Blog

In my tutorial on how to block IP cameras from accessing the Internet, I used the example of wireless security cameras.

But what if you have wired IP cameras and want to achieve the same result – block PoE IP cameras from accessing the Internet? Fear not, all you need to have is any one of the following:

• [easyazon_link identifier=”B086967C9X” locale=”US” tag=”vueville.com-eaz-20″]Unifi Dream Machine Pro (UDM Pro)[/easyazon_link] which is an all-in-one device that combines a managed switch and hardware firewall, OR
• a Unifi managed switch and separate firewall, such as the [easyazon_link identifier=”B01MU3WUX1″ locale=”US” tag=”vueville.com-eaz-20″]Unifi Switch 8[/easyazon_link] & [easyazon_link identifier=”B00LV8YZLK” locale=”US” tag=”vueville.com-eaz-20″]Unifi USG firewall[/easyazon_link] combo.

Assuming you have already created a VLAN as described in Step 1 of this tutorial, here are the steps to group or assign wired Ethernet devices into a VLAN:

Step 1: Create a switch port profile

1. Log into your Unifi Controller dashboard and click on the settings button (gear icon)
2. From the settings menu, select ‘Profiles’, and then select the ‘Switch Ports’ tab
    
   
3. Click ‘Add New Port Profile’
4. Type in a profile name, I like to use the same name as the VLAN  created ‘IPCameras’.
    
   
5. Select the VLAN under the Tagged Networks section.
6. Click Save

Step 2: Plug in your Ethernet device

Into a port of your Unifi managed switch, and note the port number. Let’s assume it is a PoE device, so let’s pick port 6.

Step 3: Assign Unifi switch port to the new switch port profile

1. From your Unifi Controller dashboard and click on the Devices button from the left menu
2. Click on your Unifi Switch, this should open a slide-out menu on the right
    
   
    
   
3. Click on the Ports section
    
   
4. Click on the edit button (pencil icon) next to port 6
    
   
5. Click the dropdown called ‘Switch Port Profile’
    
   
6. Select the switch port profile you created earlier and click the apply button.
    
   

The switch will now provision the port and after a few minutes, you are in business!

How to group multiple ports into the same VLAN

Simple – just apply the port profile you created in Step 1 above to each port that you want to be in the same VLAN.

Conclusion

Liked this tutorial? Let me know in the comments below what else you would like me to cover.

It’s been quite a while since we’ve had a Reolink IP camera review here at VueVille. We already reviewed the 5MP Reolink RLC-422 dome, and today we have the bullet camera version named the RLC-511 also with optical zoom. The cameras seem to have similar sensors and share other features too.

Reolink provided us with a retail sample for this hands-on review. We are going to look at setting up the camera, video quality and how well it works with the VueVille DIY Home CCTV system and our DIY Smart Home Automation System!

Here’s a video review and if you prefer to read, just scroll down!

[text-blocks id=”earning-disclaimer”]

What’s in the box

The RLC-511 comes in a very professional-looking retail box. The camera’s main features are highlighted, as are the mobile app and the 2-year limited warranty.

Every Reolink camera I have reviewed has come very well-protected and the RLC-511 is no exception.

Box contents:

• RLC-511 Zoom IP camera
• Screws, rawl plugs and an Allen key
• Waterproof sleeve for Ethernet cable
• 1 metre blue network cable
• Software CD
• Installation guide with photos
• Mounting hole template
• Surveillance sign

Specifications

Design

The RLC-511 is a bullet-style camera and has a boxy-look reminiscent of far more expensive Hikvision bullets. Compared to the [easyazon_link identifier=”B08F568BH1″ locale=”US” tag=”vueville.com-eaz-20″]RLC-510A[/easyazon_link], this camera is a lot bigger than you might expect. That’s because its got a 4x optical zoom.

The RLC-511 has a metallic body. The fit and finish is very good and as with other Reolink cameras I have reviewed, it feels like a camera that is far more expensive than it is.

The back of the camera houses the microSD card slot, secured by two screws. The way it is located means that there’s no access to the slot after installation. And that’s exactly how you want it in a security camera – a burglar shouldn’t be able to steal the microSD card easily.

The motorized vari-focal lens on the RLC-511 goes from a focal length of 2.7 – 12 mm with auto-focus. The 1/2.7″ 5 Megapixel Progressive Scan CMOS sensor is par for the course, this is not a camera that specializes in low light performance (for that check out the [easyazon_link identifier=”B07B16DFMB” locale=”US” tag=”vueville.com-eaz-20″]Hikvision Darkfighter[/easyazon_link] series)!

There are 24 IR LEDs arranged in a ring shape around the lens. None of them are obscured or blocked in any way. A plastic shroud protects the lens from rain or snow.

The day/night sensor for the auto IR cut filter is placed right below the lens.

All the cabling comes out of the base and can go conveniently into a junction box or through the wall. As usual with Reolink cameras, the cabling consists of a pigtail with the following connectors:

• RJ-45 ethernet port
• 12V power input jack
• A reset push button

Just like the Reolink RLC-423 PTZ, the reset button of the RLC-511 is not on the main body of the camera. Apart from eliminating an ingress point, it means nobody can reset the camera unless they get to the hidden reset button which is probably inside the wall or the soffit! This is much better than many other cameras such as Hikvision’s which have the reset button externally on the camera body itself.

On the bottom, there is a sticker with the QR code for the mobile app setup and login details. I recommend removing this sticker before installing the camera outdoors for security purposes. Otherwise anyone will be able to load up the camera admin page, and if you haven’t changed the default admin and password shown next to it, you are in big trouble!

You can also spot the microphone hole on the underside.

Installation

Bullet cameras are the easiest type of IP cameras to install, and Reolink makes their installation process also super easy.

First I used the included Allen key to loosen the steel arm of the camera base. I did this by turning it in the direction of the unlock symbol engraved into the base.

This is required to access the three screw holes of the base one by one as you screw them in.

I then used the included screws to fix the RLC-511 to my usual test location, a wooden soffit.

After pointing the camera in the general direction of the scene, I tightened the steel arm again in the direction of the lock symbol.

Hardware setup

The RLC-511 supports Power over Ethernet (PoE) which is my recommended way of powering IP cameras. Using just a single Ethernet cable, you can send both data and power to the camera using either a PoE switch or a PoE injector.

Since this is a bullet camera with motorized varifocal lens, you cannot adjust it manually.

A typical fixed lens camera needs around 7W power, but the motorised lens of the RLC-511 means that it needs a little more power, up to a maximum of 10W. This is still within the 802.3af spec, so both my [easyazon_link identifier=”B01BW0AD1W” locale=”US” tag=”vueville.com-eaz-20″]TP-Link PoE switch[/easyazon_link] and [easyazon_link identifier=”B01DKXT4CI” locale=”US” tag=”vueville.com-eaz-20″]Unifi Switch 8[/easyazon_link] are up to the task of powering the camera over PoE.

If you want to use the included waterproofing connector, you will have to remove the RJ-45 plug on the Ethernet cable and re-crimp it once it has been passed through the waterproofing connector. My install location is sheltered from the elements, so I didn’t bother with this.

Software setup

Most manufacturers ship their cameras with static IPs by default – for example Hikvision and Dahua. In most cases the camera will not have the same network settings (like sub-domain) as your network.

This means that you cannot access the camera unless you change the camera network settings to that of your network. You are expected to do this using the manufacturer’s camera finder tool, like SADP in the case of Hikvision.

While this static IP method has a lot of security benefits, most home users would find it much easier if the camera manufacturer used DHCP as default. This way, the camera would automatically be configured to use your network settings and be ready to use.

As with all the Reolink cameras I have tested, this is exactly the case with the RLC-511:  Reolink has DHCP enabled by default.

There are quite a ways to start using the RLC-511:

1. Use the Reolink mobile app
2. Use the Reolink desktop client software
3. Use any camera monitoring software such as BlueIris
4. Use a mobile security camera app such as tinyCam Monitor Pro

The Reolink setup guide for this camera suggests the first two methods – Access the camera by smartphone and access the camera by computer.

I have tried option 1 with another Reolink before so I went with option 2 this time – setup through a computer. These are the steps I followed:

Step 1: I downloaded the Reolink Desktop Client app from the URL as the manual suggested: https://reolink.com/software-and-manual/

Step 2: Installed Reolink Desktop Client and installed it. Windows Defender identified it as a new app and asked me if I want to allow it Internet and LAN access. I allowed it to proceed.

Step 3: The app automatically identified the camera and logged in successfully, and presented me with the Live View screen.

Step 4: As I mentioned earlier, the camera has DHCP enabled by default but I like to assign my cameras static IP addresses. The main reason is that its easier to set up and access the camera form other devices without having to check each time what the IP address is.

Clicking on the setup gear icon and clicking through to Network > General allowed me to change it. This caused the Reolink app to add another camera to the list, with my new static IP address. It also then started complaining that it could not find the original camera with DHCP IP address. This was a bit tiresome so I disabled the ‘Add Camera Automatically’ option under app settings. No reboot was needed which is great.

Step 5: I then tried to access the camera from the new static IP address through Chrome. I logged in with the default login details. However since the camera admin site uses Flash and Chrome disables it by default, I just had to click on the “Get Adobe Flash player” button in the live view section and enable it in Chrome.

Step 6: I then changed the password for the admin account. I also created a new user and tried to delete the admin account for safety but like most IP cameras, the RLC-511 doesn’t support this feature.

Once you have the IP address, you can simply pop that into Chrome or Firefox to directly access the camera settings. You could also use the desktop client app to change camera settings if you don’t want to use the web-based admin panel.

You should change the password of the camera as soon as you can, especially worth noting as the camera doesn’t require you to nor remind you to do it.

Software features

I have a number of ways of accessing my camera live feeds – typically I use the tinyCam Monitor Pro app on my Android phones. But when I want to tweak camera settings, I use the built-in web admin page of the camera.

So entering the camera’s IP address into any browser that supports the Adobe Flash player will let you login to the camera. An HTML5 interface would have been better but Flash is far better than the NPAPI plugin that Hikvision still insists on using. Use Internet Explorer or the new Microsoft Edge, Chrome doesn’t support Flash anymore.

You can choose the video stream quality you want to see at the login screen, ‘Channel 1’ is called Clear and is actually the 5 Megapixel stream (unless you have changed the camera settings). The other options are Balanced (medium quality) and Fluent (sub-stream). These can also be selected once you are logged in.

Click on the ‘Get Adobe Flash player’ button, and click ‘Allow Once’ when the browser says the content is blocked. The live view should now begin.

Reolink calls the landing page the Preview page, but I like to call it the Live View page. On the left hand side you have the live view stream, and at the bottom clicking the play button lets you select between the video quality by switching between the Clear, Balanced and Fluent streams.

On the right hand side, there are three sections – Optical Zoom, Basic settings and Advanced settings. The basic and advanced settings sections are like a quick access area that duplicates the settings on the actual configuration page – accessed by clicking on the gear button at the top right.

The Optical Zoom section adjusts to the abilities of the camera. You can change the zoom and adjust the focus manually (see the zoom test in our video review).

The Basic Settings section includes OSD settings, video stream encoding and image settings. Remember you can also change all of these settings in the configuration pages. So The OSD page is pretty standard and lets you choose whether and where to show the OSD information such as day, date and time.

The Basic Settings is where you can set the video resolution, bitrate and frames per second of each of the Primary “Clear” stream (5MP default @30fps and 6Mbps) and the Fluent stream (640×480 default @7fps). Interestingly, the ‘Balanced’ stream is missing in the stream selection drop-down.

The Image section lets you adjust the usual image settings such as brightness, contrast, saturation, sharpness and also mirroring and image rotation.

The advanced settings tab is where you will find the rest of the video settings and the ones I was most interested in – exposure, backlight and noise reduction. Setting the Exposure to ‘Low Noise’ lets you control just the range of gain, ‘Anti-smearing’ lets you control only the range of shutter speeds and manual lets you select both the gain and shutter speed ranges. The range selection method is novel – it means the camera will automatically choose the optimum settings from the range you specify.

A new addition is the LED Light option, which wasn’t available on the RLC-422 or the RLC-423.

I didn’t see an option to change the i-frame interval. This is a bit strange as it is a setting that I would have expected to find. Why is it important? The i-frame setting specifies how often the entire frame is captured and not just what has changed from the previous i-frame. So being able to control it is important for getting the right balance between network bandwidth utilisation and a high quality non-blurry video.

Now the full camera settings configuration page is accessed by clicking the gear icon at the top right of the Live View page. This lets you access video resolution, network, motion detection, email and push notifications, user control, and system maintenance settings.

Under the recording section, there are 2 tabs – encode and advanced.

While the camera support motion detection alerts, these are of the basic variety. There is no advanced motion detection such as line crossing, or intrusion detection on offer here. One of the best ways to reduce false alerts is by using these advanced motion detection methods, so bear this in mind if you are planning to use this camera not for 24/7 recording but motion triggered recording. I would use it only for 24/7 recording or to capture images and videos based on commands from my DIY home automation system.

You can adjust the motion sensitivity for the time of the day. For example, you can have a higher sensitivity during the daytime and a lower sensitivity at night to avoid false alerts. On the detection tab, you can draw motion detection regions.

The network settings section groups together port configuration, DDNS, FTP, and motion detection notifications.

There is a built-in NVR feature, so the camera can record motion detection clips to the on-board SD card, and even 24/7 a network/NAS drive.

Performance

I tested the RLC-511 at its default settings of 5MP resolution, 30fps and 6Mbps bitrate.

To optimise recording storage, I suggest setting the main stream to 5MP resolution @ 10fps, and increase the sub-stream bitrate:

Primary Stream: 5MP (2560×1920), constant 6144 Kbps @ 10 fps.
Secondary stream: 640×360, 512 Kbps @ 6 fps.

Optical Zoom Function

The optical zoom function is the standout feature of the RLC-511. I found the zoom speed to be very similar to the [easyazon_link identifier=”B09DPSB9BL” locale=”US” tag=”vueville.com-eaz-20″]Reolink RLC-422 dome[/easyazon_link] (review) and the [easyazon_link identifier=”B095H2BBWZ” locale=”US” tag=”vueville.com-eaz-20″]Reolink RLC-423[/easyazon_link] PTZ (review). The autofocus is a bit sluggish just like the RLC-423 but at such an affordable price, I shouldn’t complain.

Video quality

The RLC-511 is a 5MP camera with a 1/3″ sensor, just like the RLC-422 dome. Daytime performance should be good, but the small sensor is not suited for ultra low light situations.

In my testing I found the daytime video to be similar to the RLC-422 dome. Crisp and much sharper than my 4MP Hikvision DS-2CD2542FWS-IWS as well as the 4MP Reolink RLC-423 PTZ. However it couldn’t compare with the 8MP Hikvision camera.

If the camera has one weakness, it is the speed of the autofocus. While the accuracy of the autofocus is pretty good, it does take a few seconds to re-focus after zooming in or out.

The real test of an IP camera is when the sun’s gone down and the lights are off. In my opinion, the night-time video quality is great with just a slight hint of noise. The RLC-511 uses 24 conventional IR LEDs arranged in a ring around the lens. While these are powerful, the ring arrangement does cause a noticeable flash-lighting effect when you are pointing the camera at a nearby wall or floor.

Mobile app

The Reolink mobile app is one of the best original manufacturer apps I have seen. Hands down it beats Hikvision’s rather poor efforts and runs circles around other brands’ apps.

I was able to quickly add the RLC-511 to the Reolink app on my phone, adjust the zoom level, and use the built-in NVR feature to access the recorded clips on the on-board SD card.

The RLC-511 works great with my favourite mobile CCTV app, tinyCAM monitor Pro.

Compatibility with QNAP QVR Pro

Adding the RLC-511 to QVR Pro was a breeze. It works well because QNAP officially supports this and other Reolink models. I created a motion detection trigger and event to test the reliability of the trigger and the pre-record and post-record features.

For this I also logged into the camera admin page and set up the motion detection zone – you can’t do this from the QVR Pro interface.

Motion detection was reliable and worked as expected. The QVR Pro client even allows you to control the optical zoom of the RLC-511.

You can also set up event recording of the main stream at the same time as 24/7 continuous recording of either the main or sub stream. This is great for getting those pretty pink markers on the timeline that you can jump to quickly.

Verdict

The RLC-511 is the best budget 5MP camera on the market with optical zoom. It has great video quality in the day and night, and is also capable of stand-alone operation with the microSD card slot and built-in NVR feature.

While the 5MP resolution is very good for a budget IP camera, other brands such as Amcrest are moving to 8MP cameras which have 4K resolution. I am looking forward to an 8MP version of the RLC-511.

What’s missing with all the Reolink cameras are advanced motion detection methods, and audio & alarm connections. The slow zoom and auto-focus is also a bit frustrating.

For those who need a 24/7 recording bullet camera with optical zoom, the ONVIF and RTSP support makes the camera very easy to integrate with compatible NVRs or a DIY NAS NVR. BlueIris users, note the lack of an iframe setting – this makes it tricky to get the camera to work as desired in BlueIris.

[review]

Where to buy

[easyazon_link identifier=”B08QV8T3D9″ locale=”US” tag=”vueville.com-eaz-20″]Check Price on your local Amazon site[/easyazon_link]

I started my DIY CCTV system with Hikvision cameras many years ago, but over time I’ve added quite a few Reolink IP cameras to my DIY CCTV system.

Hikvision has been probably the most popular non-retail brand whereas Reolink is a very popular budget-friendly yet brand. They are pretty much at opposite ends of the spectrum.

While enthusiasts might balk at budget brands like Reolink and Amcrest, I am a big fan of only spending as much money as needed on this hobby. You don’t need the most powerful IP camera everywhere in your home. So there’s a place and application for all types of IP cameras.

Having owned and used many cameras from both brands extensively, here’s my detailed take at Hikvision vs Reolink IP cameras and which one may be right for you.

A quick note: This article may contain affiliate links. If you click on one of these links and then purchase something, we may receive a fee. This does not cost you anything extra. Also note that Hikvision and Dahua do not consider certain platforms including Amazon as an authorized seller platform. So if you need warranty support please purchase from authorized resellers of Hikvision and Dahua products in your country.

Hikvision vs. Reolink – the Stories behind the Brands

Hikvision

Unlike Reolink, Hikvision is not a retail brand. They are an OEM and primarily cater to professional installers. They are not really interested in retailing to the general public. But their affordable DIY IP cameras with powerful motion detection features and great build quality attracted DIY-ers like crazy. That’s also the reason I bought my first IP camera, the Hikvision DS-2CD2032-I back in 2015.

A couple of years ago, they launched their retail brand EZVIZ. Confusingly, EZVIZ used to be the name of their cloud app as well. Anyway the EZVIZ models are dumbed down versions of the Hikvision cameras and are not worth spending any money on. What about HiLook? Same story. That’s why I am focusing on the main Hikvision brand.

The biggest concern I have with Hikvision is not so much about their cameras, but who owns the company. The Chinese government owns at least a partial stake in Hikvision. This creates a few ethical and moral quandaries that I won’t go into here – you know what I’m talking about.

If you live in the USA, there’s one more reason to avoid Hikvision cameras – the US government has recently banned the sale and import of new Hikvision products into the USA unless certain conditions are met. They are still being sold by their authorized retail seller BH Photo though. Of course, you can always get them from AliExpress as most of us have always done.

From a technical standpoint, you should treat any security camera the same way – with maximum suspicion that they may be ‘dialing home’ to their manufacturer’s own servers and leaking your data. So lock them down using Virtual LANs (VLAN) and strict firewall rules like I have in my DIY home security camera system.

Reolink

Reolink is the brand name of IP cameras manufactured by Reolink Innovation Limited (earlier known as Shenzhen Baichuan Security Technology Co., Ltd.). A few years ago, they launched the Reolink brand and seriously upped their marketing game. This push paid off handsomely with Reolink pulling off an upset in the budget IP camera market.

Apart from solid build quality, super affordable pricing, and totally offline operation, what I really like about Reolink is the quality of their apps and PC software.

8MP 4K IP Camera Duel – Hikvision DS-2CD2085G1-I vs. Reolink RLC-810A

In 2025, everybody’s selling 8MP IP cameras. 4K resolution is the buzzword and 8MP is what you need to get 4K video. So lets pitch an 8MP camera from each brand against each other.

Until 2021 Reolink didn’t have an 8MP model that was ONVIF compatible. But now almost all Reolink models support ONVIF and RTSP. So lets pick a camera from Reolink’s current lineup that represents the most common form factor of IP camera, a bullet camera with a fixed lens. Specifically the RLC-810A. The 8 in the model number represents its 8 Megapixel sensor.

Hikvision constantly refreshes their model lineup. The Hikvision model that’s widely available online and that is comparable to the RLC-810A in price is the DS-2CD2085G1-I (sourced from AliExpress).

Hardware features – Hikvision vs. Reolink

The size of the sensor has a huge bearing on the low light ability of a camera, whether it be a camcorder or a security camera. The larger the sensor, the greater its ability to gather light and so do well in low light conditions. So a larger sensor is the key to great low light performance.

But as you cram in more and more pixels into the same size sensor, they get smaller and smaller, which adds noise. Noise is the bane of low light video and reduces the detail that you can get out of your video.

The Hikvision model has the term ‘Darkfighter’ in its marketing material and that’s a hint at its strong low light performance. This is really due to the 1/2″ sized CMOS sensor whereas the Reolink has a 1/2.5″ CMOS sensor. Don’t get me wrong, the RLC-810A is a fine low light performer but the Hikvision definitely has the edge here.

Both cameras support Power over Ethernet (PoE). Both also have on-board storage in the form of a microSD card slot that can take cards of up to 128 GB capacity.

The cameras bodies are both made from metal but differing levels of ingress protection (IP67 for Hikvision and IP66 for Reolink). I am happy to see Hikvision have embraced IP67, they have always gone for IP66 for their outdoor IP cameras.

Neither have vandal protection (IK10), more expensive Hikvision bullets do have it these days.

The Reolink does have a built-in microphone, but Hikvision doesn’t.

Winner: Hikvision

Software features – Hikvision vs. Reolink

The three most important software features that I look for are ONVIF support, the built-in NVR feature, and the advanced motion detection features that help reduce false alerts. Why because if an IP camera has ONVIF and RTSP features, you can use it as a standalone IP camera or easily integrate it into a Pro-DIY type DIY NVR system like mine.

While Hikvision has always supported ONVIF and RTSP on all their IP cameras, Reolink supports it on most of their models (the battery powered ones and B model cameras don’t).

ONVIF ensures that your camera will work with standards-compliant gear from other manufacturers. This is why you can add a Hikvision or Reolink camera to your ONVIF-compatible NVR or DIY NAS NVR and integrate it into my smart home automation system.

RTSP allows even non-ONVIF equipment (such as software) to access the security camera’s video stream. Examples are video players like the popular VLC player or [easyazon_link identifier=”B004VD3YIM” locale=”US” tag=”vueville.com-eaz-20″]tinyCAM Monitor Pro[/easyazon_link] on Android.

The Hikvision has true 120dB Wide Dynamic Range (WDR) to help improve video quality in high glare situations. The Reolink has only digital WDR. This can make a difference if your scene has bright and dark areas, like a lamp that casts long shadows.

Hikvision cameras now support H.265+ which is a very efficient codec for encoding video streams. Reolink has moved on from H.264 and now supports H.265 but there’s still no H.265+ support. The difference you will see is in the file size at the same bitrate. You can benefit from H.265+ by increasing the Hikvision’s bitrate to the max 16Mbps and still enjoy bandwidth and storage requirements comparable to the Reolink at its max 8Mbps bitrate.

Motion Detection ability

The Reolink doesn’t have the wide array of advanced motion detection alerts that Hikvision has, such as line crossing, intrusion detection etc. which are all great for reducing false motion detection alerts.

On the other hand Reolink does have person, vehicle and even pet detection (beta for now). These are equally effective at reducing false alerts.

The Hikvision camera I have selected doesn’t have the AcuSense feature which reduces false alarms by ignoring birds, animals, lights and movement of trees.

Depending on what your specific needs are, you may find either camera suitable.

Hikvision gets the slight edge here if you are not interested in smart detection like vehicle/pet, and need the advanced methods such as line crossing/intrusion detection. Remember it can still do face detection as well.

Reolink gets the edge if you only care about person/vehicle/pet detection.

As part of a DIY NAS NVR system that uses Blue Iris or Home Assistant, both Hikvision and Reolink may fit the bill. Hey maybe get the best of both worlds and get 1 of each covering the same scene!

Winner: Tie!

Mobile app

There’s no contest here, the Reolink mobile app is miles ahead of the IVMS suite of Hikvision mobile apps.

Winner: Reolink

Warranty – Hikvision vs. Reolink

Hikvision products come with a limited 3-Year Warranty at B&H Photo. Please note that warranty will be honoured only if you buy from an authorised retailer like B&H Photo. If you buy from AliExpress or other such marketplaces, you may not get an official warranty.

If you live in the parts of the US or other countries where Hikvision products are banned, getting a warranty is not an option though.

Reolink has upped their warranty to 2 years recently & of course this is available everywhere Reolink cameras are officially sold.

Detailed Comparison Table

Here’s a summary of the full review in a nice and easy table:

Verdict – Hikvision vs. Reolink

In summary, the Hikvision has better low light capability, WDR capability and advanced motion detection methods. Reolink has smart motion detection methods, a microphone for audio recording, and a much better mobile app (if that matters to you) but their biggest advantage is the super attractive price points.

So I will have to call this a tie – which brand and camera is better for you will depend on your specific needs. You can’t go wrong with either.

Also check out my recommendations on our best outdoor IP cameras list for more interesting cameras reviewed from a DIY perspective.

Where to buy

• Hikvision DS-2CD2085G1-I at BH Photo (authorized retailer).
• Reolink RLC-810A at [easyazon_link identifier=”B07K74GWX5″ locale=”US” tag=”vueville.com-eaz-20″]local Amazon website.[/easyazon_link]

Related Comparisons

• Hikvision vs. Dahua
• Hikvision vs. Amcrest
• Hikvision vs. Lorex
• Amcrest vs. Lorex
• Lorex vs. Swann
• Reolink vs. Lorex
• Reolink vs. Arlo

One of the most common questions I have been getting about our DIY Home Security system is this: How to setup a VLAN and firewall rules to block IP cameras from accessing the Internet?

Wondering why you would want to do that? Here are a few good reasons:

• Most security cameras like to phone home to their manufacturer’s servers. There’s no need to, it’s not good for your privacy or your network’s security.
• Most security cameras have poor security and can be easily hacked, and none of us want someone spying on our indoor security cameras!
• Moreover, security cameras are at risk of being hacked to join botnets, which then attack other devices on your network or the Internet.

For the longest time, I was put off by my perception that firewalls and VLANs are too complex for me. Looking at most networking gear, I would be right.

The beauty of the Ubiquiti Unifi system I now use is that you don’t need to be a networking wizard to secure your security cameras and your home network. Using the excellent Unifi Controller GUI, I was able to block my security cameras from the Internet without getting a university degree in networking.

So in this tutorial, I am going to show you how to:

1. Create a Virtual LAN (VLAN) for your wireless security cameras
2. Create a dedicated Wi-Fi network for your wireless security cameras and assign this network to the VLAN
3. Create 3 firewall rules to prevent the cameras accessing the Internet (but allow other devices on your network to access them locally or just for pulling the RTSP video streams)

NOTE 1: I use the example of wireless cameras in this how-to guide, see this guide for grouping wired cameras in a VLAN and blocking them from accessing the Internet.

NOTE 2: This tutorial is for those who only access their IP cameras via the local IP (such as 192.168.X.X). So for remote access, you would VPN into your home network and then access your cameras using their local IP address. If you require your cameras to be exposed to the Internet using P2P or DDNS, this tutorial is not for you! Most camera apps that have a plug ‘n play setup option use remote P2P servers! Blocking internet access to these cameras will cause them to fail.

Okay, so if you are accessing your IP cameras through the local IP address (from home or remotely via a VPN such as OpenVPN), let’s continue!

What you will need

You will need the [easyazon_link identifier=”B086967C9X” locale=”US” tag=”vueville.com-eaz-20″]Unifi UDM Pro[/easyazon_link] which is a very versatile networking device along with at least one other Unifi Wi-Fi Access Point (WAP) such as the [easyazon_link identifier=”B08QG92M83″ locale=”US” tag=”vueville.com-eaz-20″]Unifi AP 6 Lite[/easyazon_link].

Preparation: Planning your home network

To make sense of this topic, we need a basic understanding of how network connections and firewalls work. I am assuming your security camera has an RTSP video stream and that’s what we are trying to view.

The relevant networking terminology is:

• WAN (Wide Area Network) refers to the Internet.
• LAN is your local home network.

For simplicity, let’s assume your mobile phone is connected to your general Unifi Wi-Fi network. In the Unifi world, your phone is therefore in the LAN group. By default, devices in the LAN group can access any part of the local network and the Internet.

When you use your mobile phone IP camera app (like tinyCAM Monitor Pro) to view the stream of your wireless IP camera, the phone sends an RTSP connection request to your IP camera. The camera accepts it and sends the stream back out to your phone.

Now, the idea here is to segment your home network into different groups, based on what type of access control you want to impose on those devices. In networking parlance, you would create a Virtual LAN or VLAN to group these devices together.

When you create a VLAN in the Unifi Controller software and assign a device to it, the router will tag each data packet of that device with a VLAN ID.

How do VLANs work in practice? How do I assign a device to a VLAN?

For wired devices, you can assign each port of a managed switch to a specific VLAN. Then all devices connected to that network will be in the same VLAN. That’s what happens with a Unifi Switch. So if you connect your wired PoE IP cameras to a port that’s assigned to VLAN 25, all those IP cameras are now in VLAN 25.

For wireless devices, you create separate Wi-Fi networks for different groups of devices and then assign a VLAN ID to each Wi-Fi SSID you create. So you would create a Wi-Fi network called ‘IP Cameras’, assign that Wi-FI SSID to VLAN 35, and connect all your wireless cameras to that network. All those wireless cameras are now in VLAN 35.

Then you can create firewall rules for each VLAN to control data flow in very granular detail (if you choose to!).

In summary, segmenting your home network into different VLANs allows you to precisely control how and where data is allowed to go.

Further reading: Unifi Guide to VLANs

What are some good ways to group devices?

For example, you may want your media boxes to reach the Internet to access Netflix, Amazon Prime, Hulu etc. But you may not want them to access the rest of your network. Why? Because your cable provider’s cheap no-name box probably has weak security and may be the easiest way for hackers to get inside your home network. So that’s one VLAN for your media boxes.

If you are using wired PoE cameras outside your home, anybody can access your entire home network through that network cable! So you should put wired cameras also into their own VLAN and isolate it from the rest of your network.

Its also a very good idea to make all your security cameras fully local by blocking them from the Internet. Many of them phone home regularly and are also easy targets for botnets and the like.

I have created separate VLANs for my PoE cameras and Wi-Fi cameras. I also have separate VLANs for my home automation system and the default VLAN Unifi created for the guest Wi-Fi network. Please note that I have an older Unifi setup that involves a USG and switch combo, which you can simply replace with a single [easyazon_link identifier=”B086967C9X” locale=”US” tag=”vueville.com-eaz-20″]Unifi UDM Pro[/easyazon_link] device!

What’s in scope of this tutorial

To keep this tutorial easy to follow and understand, I am not going to show how to replicate my entire network setup. That would be a 10,000 word post at least and this tutorial is already long enough as it is!

You will learn the core ideas here and then you can create more VLANs and more firewall rules to suit your specific needs. Just ask me in the comments section if you have any questions.

If you want your camera to send ONVIF motion detection notifications to your NVR, you need to create additional firewall rules to allow outgoing connections from the camera’s ONVIF port (usually port 80, some Reolink cameras use port 8000). Consult your IP camera manual to see which ports are used for these features.

Step 1. Create a VLAN for your security cameras

For simplicity, I will take the example of creating a VLAN and Wi-Fi SSID for wireless cameras.

In the Unifi world, a VLAN is the same as a ‘network’. So you have to create a ‘network’ with a VLAN ID of your choice.

• Log into your Unifi controller and navigate to Settings > Networks. I am using the classic settings view.
• Click on ‘ + Create New Network’
• Enter a name, I chose ‘IPCameras’
• Leave all the settings at defaults except the following
  • VLAN: Select a number, I used 5 as per my home network plan. For convenience, it’s a good idea to keep the VLAN ID same as the subnet you choose in the next step.
  • Gateway/Subnet: My main network is 192.168.1.X, so I chose a subnet of 192.168.5.X for this VLAN. So enter your desired subnet followed by ‘/24’. So I entered: 192.168.5.1/24
  • DHCP Range: 192.168.5.2 – 192.168.5.254 (replace 5 with your selected subnet number)
  • DHCP Name Server: Choose manual and enter 192.168.5.1 (replace 5 with your selected subnet number)
  • DHCP lease time: 14400 sec
• Hit Save

Step 2. Create a dedicated Wi-Fi network for your security cameras

Next let’s create a Wi-Fi SSID for your wireless cameras to connect to, and assign this SSID to the ‘network’ created earlier.

• Navigate to Settings > Wireless Networks. I am using the classic settings view.
• Click ‘+ Create New Wireless Network’
• Under the ‘Create New Wireless Network’ section
  • Enter the SSID name you want, I chose ‘WirelessIPCameras’
  • Choose WPA Personal security and enter a security key (password for this Wi-Fi network)
  • Don’t apply guest policies
• Expand the ‘Advanced Options’ section to reveal it
  • Select VLAN and enter the VLAN ID you have chosen. I entered 5.
  • Hide SSID – select this for better privacy
  • If you have created a user group, you can assign one here. Useful for bandwidth rate limiting etc but not relevant in our case.
  • Combine Name/SSID: Select this. If your camera supports the 5 GHz band, it will be used instead of the slower 2GHz band. Most security cameras do not.
  • Leave all other settings at default
• Hit Save

Wait a few minutes for the Unifi controller to provision the new wireless network.

Note: If you are looking to use only wired cameras, the concept remains the same but in this step 2 you will tag specific Unifi switch ports with the VLAN ID from step 1. Here’s a tutorial on grouping wired PoE cameras into a VLAN.

Step 3: Create 3 Firewall rules to block camera access to the Internet

We will create 3 firewall rules for our security camera VLAN and those rules will apply to all the cameras in this VLAN.

The logic behind our firewall rules

We will be editing the WAN OUT (connections going out to the Internet), and LAN OUT (connections going from inside a VLAN to the rest of your local network or Internet). We will use the default rules for LAN IN (connections coming into a VLAN from the rest of your local network or the Internet):

• We do not want our cameras to accept connections from the Internet. We want to allow only connections from the local network. You can achieve both of this through a single firewall rule, but we don’t need to create it manually. The Unifi USG firewall by default ‘drops’ or ignores all unsolicited incoming connections from the Internet. Any good firewall will do this by default. You can find this default rule under then WAN IN section of the firewall rules.
• We also do not want the cameras to initiate connections to the Internet (WAN). In other words, we do not want them to ‘phone home’ to the manufacturer’s servers. So we will define a WAN OUT rule blocking all outgoing connections initiated by this VLAN. That’s Rule 1.
• To further tighten up things, even when a connection request is received by this VLAN from anywhere else in the local network, I want the firewall to allow the cameras only outgoing RTSP connections. That’s another LAN OUT rule and rule no.2 for today.
• We also don’t want the cameras to initiate any other connection to the rest of the local network (LAN). So we will define a LAN OUT rule blocking all outgoing connections initiated by this VLAN. That’s Rule 3.

Whom this tutorial/approach is not for

Do you want to use your camera manufacturer’s P2P-based mobile app (Dahua P2P, Reolink P2P etc.)? Then this tutorial will not help you – blocking Internet access for the cameras will kill the P2P feature also.

This tutorial is only for those who only want to use the RTSP video stream of their cameras (use all 3 rules below) OR want to use a mobile app set up using a local IP address (use only rule 1 below).

Creating the rules

Right, let’s do it.

• Navigate to Settings > Routing & Firewall. I am using the classic settings view.
• Select the Firewall tab and then Rules IPv4
• Rule 1 – Block access to the Internet (WAN)
  • Select the WAN OUT tab, and click ‘+ Create New Rule’
  • Name this rule ‘Block IPCameras going out’
  • Under Advanced, enable logging and select all the states
  • Under Source, select Network and pick the VLAN network you created earlier (IPCameras in the step 1 above). Ensure IPv4 subnet is selected in the dropdown next to it.
  • Leave everything else at defaults
  • Hit Save
• Create a port group for rule 2
  • Navigate to Firewall > Groups
  • Click on ‘+Create New Group’
  • Name it ‘RTSP’ and enter port as 554 (or whichever port your camera uses for RTSP)
  • Hit Save
• Rule 2 – Allow only RTSP outgoing connections in response to incoming requests from the LAN
  • Select the LAN OUT tab, and click ‘+ Create New Rule’
  • Name this rule ‘Allow only RTSP port 554 out established’
  • Select state ‘Established’
  • Select Source type ‘Address/Port Group’
  • Under port group, select the RTSP port group you created earlier
  • Leave everything else at defaults
  • Hit Save
• Rule 3 – Block access to the rest of your home network (LAN)
  • Select the LAN OUT tab, and click ‘+ Create New Rule’
  • Name this rule ‘Drop all outgoing’
  • Under Advanced, select all the states
  • Under Source, select Network and pick the VLAN network you created earlier (IPCameras in the step 1 above). Ensure IPv4 subnet is selected in the dropdown next to it.
  • Leave everything else at defaults
  • Hit Save

The order of these rules is very important – after creating the rules above, make sure that under the ‘LAN OUT’ section rule 2 is on the top of the list and rule 3 should be after it. Because that’s the order in which the firewall will process the rules.

Now let’s test the rules to see whether they are working as intended. Temporarily connect a laptop or mobile phone to the Wi-Fi SSID you created. You should not be able to reach the Internet or access any other local network resource such as the Unifi controller dashboard. If all is well, disconnect from the Wi-Fi network.

Now simply connect your wireless cameras to the Wi-Fi SSID. Re-connect your mobile phone or laptop to your regular Wi-Fi network. Now try to access the RTSP stream of your cameras – you should get a video stream.

Congratulations! You have now secured your security cameras and your network is a whole lot safer.