Open up a vlan ip to the outside

[rashadmahmood]

I should have been clearer. It's a PC running Windows 10 with AXIS Camera Station 5 software. The cameras are AXIS dome IP cameras, which are powered via a PoE switch. I believe I need to create VLANs to segment the network.

@johnpoz said in Open up a vlan ip to the outside:

More than happy to help you through segmenting your cameras onto their own network

Thanks that would help, for sure.

[rashadmahmood]

@johnpoz I would love to hear your thoughts.

[johnpoz]

@rashadmahmood how many interfaces does your router have - you don't have to create vlans to segment networks, unless you need to run more than 1 network over the same physical interface.

And your prob going to want to have multiple interfaces on this PC being used as your nvr, or all the camera traffic will be using the same interface it uses to talk to the network for other stuff.

A vlan still uses the bandwidth on that physical interface.. You more than likely are going to the camera to nvr completely different network interfaces.

Might not be an issue, but how many cameras - what resolution? Are they recording constant or just on events?

[rashadmahmood]

@johnpoz

I have the Netgate 4100 which has 2 WAN and 4 LAN ports.

I can install install another NIC in the windows 10 machine (NVR)

I will have 4 camera's all doing 1080P, they can be set to record on events to save disk usage.

My network will consist of the following:

1 x Netgate 4100 router
1 x Freepbx server (intel NUC)
1 x AXIS Camera Station 5 running in a Lenovo ThinkCentre M720q (windows 10)
4 x IP camera with 1080P
3 x voip Polycom telephones
1 x Netgear POE switch
2 x WIFI Zyxel access points

In the future I would like to add in a NAS drive

[johnpoz]

@rashadmahmood so your not currently using all your lan ports on the 4100?

I mean you could do it with vlans - but if you have the physical interfaces prob best to keep that video traffic off your normal network, and wouldn't be running it over your wifi, etc.

Can your poe switch do vlans? If not do you use it for your other traffic?

I mean 4 1080P cameras prob not all that much traffic - but why mix it with normal traffic if you don't have to.. What about if/when you add more cameras, etc.

[rashadmahmood]

@johnpoz

The router is only using the 1 LAN which the connects to the POE switch, the switch supports vlans.

[johnpoz]

@rashadmahmood How many ports do you have free on your poe switch, you can use another port on the poe and pfsense for your other segmented network without having to vlan them.

I do this - I have some networks just native, and then some networks that are vlans over the same physical wire. The networks that are vlans are just wifi networks, and don't actually talk to each other so no hairpin traffic over the same physical interface.

For remote access I would setup a vpn.. So you don't have to expose cameras or the nvr to the public internet at all.

[rashadmahmood]

@johnpoz

The POE switch will have 3-4 ports free.

so I should segment the access points, using the two lans on pfsense? - and set up firewall rules so they can speak to the other network in the house (some pcs will be connected to the physical lan)

Do I still need two NICS in the NVR?

[johnpoz]

@rashadmahmood do your AP support vlans? You can for sure segment out your wifi ssids to different networks if you desire. But your cameras are not over wifi are they? You really wouldn't need a wifi segment for your cameras if they are wired.

And again - your cameras are not going to be saturating the wire or anything, not with 4 of them.. But I would keep traffic between the cameras and the nvr on a completely different network than your normal network traffic. If your wanting to segment it out, might as well keep it from riding over the same wires as your normal network if possible.

For example - lets say your cameras are doing 40mbps per second.. If that rides over the same wire as your normal traffic to your router as all your other traffic for other networks, or even over the same wire to say your nvr machine. That is 40mbps that is used that your devices can't use.. Or if you saturate that link with other traffic, maybe your cameras have issues with recording..

It is best if possible to put this sort of traffic on its own wires so that it doesn't compete or interfere with your normal day to day network traffic.

its not the end of the world if you can't, and it might never be problem - but if your going to take the time to set it up on its own network anyway, might as well keep this traffic off your normal day to day connections.

[rashadmahmood]

@johnpoz

yep the access points can do vlans.

@johnpoz said in Open up a vlan ip to the outside:

It is best if possible to put this sort of traffic on its own wires so that it doesn't compete or interfere with your normal day to day network traffic.

absolutely agree, I will do this, thanks so much for your help and advice!

[JKnott]

@rashadmahmood said in Open up a vlan ip to the outside:

What is the best way to deal with this? My understanding is that you want to segment the CCTV LAN; otherwise, the whole network would be broadcasting all over the place. With a VLAN, I can confine this to the CCTV LAN.

Does your NVR have 2 ports? If so, you use one to access the NVR from elsewhere and one for an isolated LAN for your cameras.

[rashadmahmood]

@JKnott

thanks, yes I will separate the camera network from the NVR.

[johnpoz]

@rashadmahmood keep in mind if your going to multihome this box your using as your nvr. The interface you add to the cam network you create wouldn't have a gateway set, nor dns on this interface.

I would just have an IP with proper mask for the network your attaching it too.

[rashadmahmood]

@johnpoz

You mean such as 192/168.0.1/24 (proper subnet mask?) and omit the gateway?

[johnpoz]

@rashadmahmood yeah your just going to use this interface to talk to cameras on this same network - you would not want your pc being used as nvr to use it for any other connections to other networks - so there would be no gateway set on it.

[rashadmahmood]

@johnpoz

Many thanks

[johnpoz]

@rashadmahmood example - my main pc connection to my nas at 2.5ge.. That I use only to move files back and forth from my pc and nas.

This network 192.168.10/24 isn't use for anything else.. Kind of like the network your pc/nvr will user to talk to the cameras..

if I want to talk to the nas for say admin of the nas, then I talk to it on its 192.168.9 IP address.

[rashadmahmood]

@johnpoz perfect, thanks!

[JKnott]

@johnpoz said in Open up a vlan ip to the outside:

so there would be no gateway set on it

Unless the device needs a gateway set. Then just use the NVR or a dummy address.

[johnpoz]

@JKnott said in Open up a vlan ip to the outside:

Unless the device needs a gateway set.

Why would the windows PC with a 2nd nic added it to it need a gateway on the interface?

This not the cameras - this is the PC he is using as his NVR.

"It's a PC running Windows 10 with AXIS Camera Station 5 software"