I would like to learn about using a dedicated Network Card / Adapter to isolate my IP Cameras from talking directly to the internet.

Is anyone here doing this, willing to explain how they set it up?

I think folks now use virtual networks using modern routers to isolate subnets but I am not 100% sure. Maybe research virtual nets.

But then I would need to buy another router. I have an ASUS RT- AC68U flashed with Merlin, but there is no way to create a VLAN with this router. It is a good router and I have OpenVPN setup on it for remote viewing.

There should be a way to setup a dedicated Network Adapter for just my IP Cams. But I'm not super network savvy. I could do it if I had instructions or a video tutorial.

This may not help if you are set on a 2nd network card but it lets you what other options there are.

I'm using a Ubiquiti system here and its very easy to deny internet access to any individual client or group of clients by creating a 'rule'.

If you want a separate physical network, you'd need a separate router to do the routing on that second network, wouldn't you? Really not sure, just asking.

I used to use Network Services Filter on my old ASUS (non-Merlin) to block internet access from my cameras.
I don't know if Merlin supports the same or not.

HeneryH wrote: ↑Sun Jan 19, 2020 11:50 pm If you want a separate physical network, you'd need a separate router to do the routing on that second network, wouldn't you? Really not sure, just asking.

That's what I did because I have 1 wireless camera, as well as several wired cameras. I have the router use DHCP on the 2nd nic for that subnet. Worked well. It isolated my 'camera network' from the internet, and, from my normal use network.

BI could see cameras on both networks.

oceanslider wrote: ↑Sat Jan 18, 2020 10:02 pm I would like to learn about using a dedicated Network Card / Adapter to isolate my IP Cameras from talking directly to the internet.

Is anyone here doing this, willing to explain how they set it up?

Create a rule in your router's firewall to deny access to the internet for each camera. Setup is different for every router, but if your router allows you to create firewall rules, this is by far the simplest way to do what you want to do.

But then I would need to buy another router. I have an ASUS RT- AC68U flashed with Merlin, but there is no way to create a VLAN with this router. It is a good router and I have OpenVPN setup on it for remote viewing.

There should be a way to setup a dedicated Network Adapter for just my IP Cams. But I'm not super network savvy. I could do it if I had instructions or a video tutorial.

I know it's an old thread, and you have probably sorted this by now, but:

1. I have an Asus RT-AC86U router running Merlin firmware.
2. I have a second NIC on the BI5 pc just for my cams.
3. I have a PoE ethernet switch plugged into the second NIC, and the IP cams are plugged in to that.
4. I do NOT have a second router connected between the cams and the second NIC.
5. The NIC and the cams all have static IP's.
6. I have OpenVPN running on the RT-AC86U for remote server access and BI viewing.

Simples

Yes so this definitely all comes down to design choice, budget (though trust me, I don't like spending a dime!), and what functionality you'd like.

You can certainly add a second NIC to your BI server. Give that interface a static IP address (different subnet than your "regular" network) and make sure NOT to give it a default gateway. That interface should then go to either your one camera directly or to a network switch that isn't connected to your regular network**. You can configure your BI system to do dhcp or some other complicated setup but as TimG noted, it's easiest (and in my opinion preferred) to just also give your camera(s) static IPs, again no default gateway - because there isn't one! At that point, your secondary BI NIC and the cameras are all on the same subnet, can talk directly with absolute minimal latency (no layer 3 hops), and no default gateway to be able to talk to another network - including the Internet. The catch is that you won't be able to directly access the cameras from a system other than your BI server. This may be fine but a consideration if you need to do firmware updates, etc. Also, IF your cameras need to use NTP (network time protocol) to ensure current overlay timestamps, that wouldn't work.

If you have a router/firewall that can do any sort of rules, you should be able to keep a single flat network and just block outbound traffic from the cameras. Again consider if you want to block ALL outbound traffic or still allow NTP (udp/53) for time (you likely also need to permit DNS (udp/53) so that it can resolve the name of an NTP server). From a paranoid security perspective, this does technically still leave you vulnerable to lateral movement though which is why having an isolated, completely cut off vlan for just cameras is most ideal. I have done packet captures on my cameras and can say you absolutely do not want them to have wide open outbound access!! In fact, for my cameras I configure my firewall to be the DNS server of the cameras and then while I cannot force the cameras to use my NTP server, I translate their traffic to redirect to my firewall for NTP - the result being they never do go to the Internet.

Sorry for what could be overload. Happy to break that down more if anyone cares or followed what I said . I lay in bed awake at night thinking about changes I can make to my environment!

**Technically it could be a switch on multiple networks and it SHOULD isolate subnets ok but you could be setting yourself up for some headaches plus if you're isolating anyway, why not actually isolate.