Access Cameras Anywhere,
Without Opening Your Network

🔓 What Most People Do (WRONG)

You install a camera at home. You want to see it from work or while traveling. The internet says: "Just set up port forwarding on your router!" You open port 8080, point it at your camera's IP, and now you can see your camera from anywhere at http://your-public-ip:8080.

The problem? You just punched a hole in your firewall. That hole is visible to EVERY hacker, bot, and scanner on the internet — all 4+ billion IP addresses. Shodan.io (a search engine for internet-connected devices) indexes millions of exposed cameras within hours. Your camera — and potentially your entire home network — is now accessible to anyone who finds that open port.

🔒 Tailscale = A Private Network That Works Everywhere

Tailscale is a mesh VPN built on WireGuard (the fastest, most secure VPN protocol, built into the Linux kernel). It creates a private, encrypted network between all your devices — your phone, laptop, home server, and Raspberry Pi — no matter where they are in the world.

Unlike traditional VPNs (which route all traffic through one server), Tailscale creates direct, peer-to-peer connections between your devices. Your phone in a coffee shop connects directly to your home Raspberry Pi — encrypted, fast, and with zero configuration on your router.

📐 The Complete Setup — What Goes Where

Here's the architecture for securely accessing home cameras from anywhere:

Key insight: The cameras NEVER touch the internet. They sit on your local network. The Raspberry Pi (with Tailscale) is the ONLY device that bridges your private Tailscale network to your local camera network. Your router's firewall stays completely closed.

🧠 Why Frigate + Tailscale is the Dream Setup

Frigate (frigate.video) is an open-source NVR (Network Video Recorder) with AI object detection. It runs on a Raspberry Pi or any Linux PC and:

• Records video from all your cameras 24/7
• Uses AI to detect people, cars, animals (locally — no cloud!)
• Sends alerts only when it detects something interesting (not every tree branch)
• Stores recordings on a local hard drive
• Beautiful web dashboard to view all cameras

Combined with Tailscale, you get: AI-powered cameras + secure remote access + zero cloud dependency + zero subscription fees. No Ring subscription. No Google Nest fees. No corporate access to your video.

🔓 Headscale = Self-Hosted Tailscale Control Server

Tailscale's client is open source, but their coordination server is proprietary. If you want zero dependency on Tailscale's company, use Headscale — a fully open-source, self-hosted implementation of Tailscale's control server.

Tailscale client + Headscale server = 100% open source mesh VPN. No company involved. No data sent to anyone. Complete sovereignty.

🔑 1. ALWAYS Change Default Camera Passwords

Factory passwords (admin/admin, admin/12345) are the #1 reason cameras get hacked. Even behind Tailscale, change EVERY camera's default password to something strong (12+ characters). This is defense in depth — multiple layers of security.

🔄 2. Update Camera Firmware

Camera manufacturers release firmware updates that fix security vulnerabilities. Check for updates every 3–6 months. Hikvision, Reolink, Dahua, and others have had critical vulnerabilities patched in updates. An unpatched camera is a liability.

🌐 3. Create a Separate Camera VLAN (Advanced)

For maximum isolation: put cameras on a separate network (VLAN) that has NO internet access. Cameras only need to talk to your NVR (Frigate), not to the internet. This way, even if a camera is compromised, it can't reach the internet or your other devices.

🔐 4. Use Tailscale ACLs (Access Control Lists)

In the Tailscale admin panel, set up ACLs to control which devices can access which services. Example: your phone can access cameras, but your work laptop cannot. Your spouse can view cameras but not SSH into the server.

🚫 5. Block Camera Cloud Features

Many cameras try to "phone home" — sending data to manufacturer servers (China, US, wherever). If you're using Frigate as your NVR, you don't need the camera's cloud features. Block all outbound internet access for cameras in your router/firewall. Cameras should talk to your Pi only.

💾 6. Encrypt Camera Storage

If recordings are stored on an external drive, encrypt it (LUKS on Linux). If someone steals the Pi or the hard drive, they can't access your recordings without the encryption password.