How to Isolate IP Cameras with VLAN for Video Surveillance

Separate Cameras and the User Network with a Dedicated VLAN

IP camera isolation through VLAN works as follows: cameras are connected to a separate logical network segment, switch ports for cameras are assigned to this VLAN, and routing between VLANs is allowed only through firewall or router rules. This approach reduces the attack surface: surveillance devices are not located in the same broadcast domain as employee computers and other clients.

Before configuration, define the addressing scheme and access requirements. For example:

VLAN 10 — workstations;
VLAN 20 — IP cameras;
VLAN 30 — video recorder or storage server;
only required connections are allowed between segments.

Exact menu names and commands depend on the switch, router, and video surveillance system manufacturer. Before changing the configuration, check the documentation for your specific equipment model.

Prepare Equipment and Connection Scheme

VLAN-capable equipment is required for this setup:

managed switch with IEEE 802.1Q support;
router or firewall for communication between VLANs;
IP cameras with network settings matching your addressing scheme;
video recorder or server that will be allowed to access the cameras.

A typical connection scheme looks like this:

IP cameras
    |
    | access ports VLAN 20
    |
Managed switch
    |
    | trunk 802.1Q
    |
Router / Firewall
    |
    +-- VLAN 10 Users
    +-- VLAN 20 Cameras
    +-- VLAN 30 Video recorder

The port where a camera is connected should normally be an untagged access port. The link between switches or between a switch and a router is usually configured as a trunk with VLAN tagging.

Create a Dedicated VLAN for Cameras

First, create a VLAN on the managed switch. The VLAN name and identifier can be selected independently, but the number must match on all devices where this segment is transmitted.

Example configuration logic:

VLAN ID: 20
Name: CAMERAS
Subnet: 192.168.20.0/24
Gateway: 192.168.20.1

If multiple switches are used, VLAN 20 must be created on each of them or propagated using configuration management tools provided by the manufacturer.

Configure IP Camera Ports

Assign ports connected to cameras to the surveillance VLAN. These ports should not be used simultaneously for regular user devices.

After configuration, verify:

the camera receives an address from the camera VLAN subnet;
the camera does not receive an address from the user network;
a user computer cannot directly access the camera without allowed routing rules.

VLAN alone is not a complete security measure. It separates network segments, but access between them must be controlled by router or firewall rules.

Configure Routing Only for Required Services

After creating VLANs, decide who is allowed to access the cameras. The most secure approach is to block all inter-segment traffic and add only required exceptions.

For example:

the video recorder can connect to cameras;
operators can connect to the video recorder;
regular workstations do not get direct access to cameras;
cameras do not have access to the user network.

The set of allowed ports depends on the camera and recorder manufacturer. Do not open services simply because they are available by default. Check the documentation for the specific device and leave only required protocols enabled.

Restrict Camera Access with Network Rules

Firewall rules are usually built according to the principle “deny everything, allow what is required”.

Example rule logic:

Allow:
VLAN_30_NVR → VLAN_20_CAMERAS
Allow:
ADMIN_PC → VLAN_20_CAMERAS
Deny:
VLAN_10_USERS → VLAN_20_CAMERAS

The actual implementation depends on the security device being used. Names of objects, zones, policies, and rule processing order may differ between manufacturers.

Configure Camera IP Addressing

For surveillance systems, predictable addressing is more convenient. Cameras should be located in a separate subnet, for example:

Camera network: 192.168.20.0/24
Camera 1: 192.168.20.101
Camera 2: 192.168.20.102
Recorder: 192.168.30.10
Camera VLAN gateway: 192.168.20.1

The address assignment method depends on the camera model:

static configuration through the device web interface;
DHCP address reservation on the DHCP server;
automatic configuration through manufacturer-specific tools.

After changing addresses, update recorder settings so it uses the new camera addresses.

Verify VLAN Isolation

Perform verification from different network segments.

Connect a test computer to the user VLAN.
Verify that it cannot directly access cameras without an allowed rule.
Connect to the administrator VLAN or recorder and verify camera access.
Verify that video recording continues after enabling filtering rules.
Check firewall logs for blocked or incorrectly allowed connections.

Standard operating system tools can be used to diagnose network availability, but results depend on device settings and security policies.

ping 192.168.20.101
tracert 192.168.20.101

No ping response does not always mean there is no network access: many cameras and network devices can ignore ICMP requests. Check the required surveillance service itself.

Additional Security Measures

Change default passwords for cameras and network equipment.
Disable unused network services if supported by the manufacturer.
Do not place cameras in the same subnet as user computers.
Restrict remote access to the surveillance system using separate security rules.
Regularly install firmware updates only from official manufacturer sources.

Common VLAN Configuration Errors for Cameras

Error	Consequence	Fix
Cameras and computers are in the same VLAN	No network separation	Create a separate VLAN for surveillance devices
Trunk is configured incorrectly	VLAN does not pass between equipment	Check allowed VLANs on all connection points
Firewall rules are too broad	Cameras are accessible to unnecessary users	Allow only required access paths
Recorder cannot access cameras	Recording stops	Check routing and allow rules

Final Checklist

A separate VLAN for cameras has been created.
Camera ports are configured as access ports in this VLAN.
Communication between VLANs goes through a router or firewall.
Inter-segment access is restricted by security rules.
The recorder has access only to required devices.
Video recording has been verified after enabling isolation.
Default device credentials have been changed.

Sources

IEEE 802.1Q Standard for Local and Metropolitan Area Networks — https://standards.ieee.org/standard/802_1Q-2022.html
Cisco VLAN Configuration Guide — https://www.cisco.com/c/en/us/support/docs/lan-switching/vlan/index.html
Fortinet Firewall Policy Documentation — https://docs.fortinet.com/document/fortigate/latest/administration-guide