By the SightShield team · · 3 min read
Cameras are computers
An IP camera is a small computer running an operating system, connected to your network. So are NVRs, biometric attendance machines, video door phones, smart TVs and home automation hubs. They are rarely updated as often as laptops, and many have had serious security flaws over the years. Botnets that scan the internet for exposed recorders and cameras are well documented, including Mirai variants targeting DVRs as recently as 2025.
If those devices share a flat network with your laptops and accounts PC, one weak camera becomes a way in to everything else. Keeping them on a separate network limits the damage.
What a VLAN is
A VLAN (virtual LAN, IEEE 802.1Q) splits one physical network into several logical networks. Devices on the CCTV VLAN can talk to each other and to the NVR, but not to the office VLAN unless a firewall rule allows it. All of this runs on the same cables and managed switches — no second set of cabling is needed.
A typical plan
| Network | Devices | Allowed to reach |
|---|---|---|
| Staff / family | Laptops, phones, desktops | Internet, printers, NVR viewing |
| CCTV | IP cameras, NVR | NVR only; NVR to the brand’s app service if remote viewing is used |
| Devices / IoT | Biometrics, door phones, smart TVs, automation hubs | Their own cloud services, attendance server |
| Guests | Visitors’ phones and laptops | Internet only |
Even simpler: let the NVR isolate the cameras
Many NVRs have built-in PoE ports that put cameras on a private network behind the NVR. The cameras never touch your main network at all; only the NVR does. For homes and small shops with up to 8 or 16 cameras, this is an effective and inexpensive form of separation. Larger systems use external PoE switches, where VLANs do the same job.
Remote viewing without opening holes
Avoid port forwarding on the router to reach the NVR from outside. It exposes the recorder’s login page to the whole internet. Use the manufacturer’s app service, which connects outward from the NVR, or a VPN on the firewall. Turn off UPnP on the router so devices cannot open ports by themselves.
CCTV Remote Viewing Not Working? →What it takes in equipment
| Site | Simplest good setup |
|---|---|
| Home with up to 8 cameras | NVR with built-in PoE ports; NVR on the home network; no port forwarding |
| Shop or small office | NVR PoE ports or a small managed PoE switch; guest Wi-Fi separate |
| Office or apartment | Managed PoE switches with a CCTV VLAN; business firewall |
| Factory or campus | Managed switches, fibre backbone, VLANs per system, firewall rules |
Checklist
- Cameras on the NVR’s own PoE ports or a dedicated CCTV VLAN.
- Firewall rules: cameras cannot reach the internet or the office network.
- No port forwarding; UPnP off.
- Unique strong passwords on every camera and the NVR, not the default.
- Firmware updated at installation and checked during AMC visits.
- A guest network that reaches the internet only.
Quick answers
Does a separate CCTV network need separate cables?+
No. VLANs separate traffic on the same cables and managed switches.
Will VLANs stop me viewing cameras on my phone?+
No. The NVR is allowed to reach the brand’s app service, or you connect through a VPN. Viewing works as before, more safely.
Do I need a managed switch?+
For VLANs, yes. Unmanaged switches cannot separate traffic. Small systems can rely on the NVR’s built-in PoE ports instead.
Should biometric machines be on the CCTV network?+
Put them on a separate devices network that can reach only the attendance server or cloud service they need.
Can VLANs be added to an existing network?+
Yes, if the switches are managed. Unmanaged switches may need replacing.
Does separating the network slow down cameras?+
No. It usually improves performance by keeping camera traffic away from office devices.