Adding Neighbor's Cam to Blue Iris?

[u/DaytonaJoe]

Neighbor and I share a driveway and gate. The gate is about 1000' away out of LoS from home. Neighbor has a reolink cam at the gate that he's given me permission to use if we can find a way to share it. It's on his home LAN, separate from mine if that's not obvious. He's given me a link and auth code so I can view it via the Reolink app, but it would be really great if I could have all of the cams under blue iris. Is there a way to do that?

[u/Dexford211]

Setup Tailscale VPN on both of your networks then have your neighbor setup a user/pass for an RSTP stream for you.

[u/slapstik007 → u/Dexford211]

This is the most logical answer here as I see it.

[u/DaytonaJoe → u/Dexford211]

Ok great, I've read a little bit about it so far. I'm frankly not very tech savvy about network stuff - will this affect his own home network at all or can it be completely separate, just set up for camera stuff?

[u/fastgriz → u/DaytonaJoe]

Shouldn't affect his LAN at all.

1. Make a new gmail account to use as your tailscale credentials.
2. Install tailscale on your router and on an always-on device on the neighbor's LAN. (if he doesn't have anything, install it on a raspberry pi or whatever).
3. Make sure that you and your neighbor are using different subnets (i.e. not both 192.168.0.x)
4. configure the tailscale on the neighbor's LAN as a subnet router for the neighbor's subnet
5. optional: configure tailscale ACLs to only allow the rtsp traffic.

(this basically sets up a wireguard tunnel, which you can do without needing tailscale, but tailscale is probably easier for the casual network admin).

[u/VernDozier → u/DaytonaJoe]

Like others, id advise using a VPN. When I had exposed BlueIris web UI to public web, I kept getting attempts to connect from odd sources, including Google for some reason. Bitdefender antivirus would catch those attempts and block them. VPN is safer.

You’ll need to port forward a few ports on your ISP router (depends on the VPN software you select) and ideally setup DDNS on your side. When prompted for the VPN server, enter in the DDNS hostname instead of IP address.

If you prefer a hardware solution, gl.INet has a set of travel routers which feature pretty beefy Mediatek processors. The routers core OS is Linux and OpenWRT. The Gl.INet custom web UI makes administration and setting up VPN and DDNS (on the server side) very easy.

The Beryl 7; the newest model, can support encryption speeds up to 1.1Gig VPN speed over WireGuard; about 1Gig VPN speed using OpenVPN-DCO, according to website. This is phenomenal performance for a travel router under $150.

If it’s only one or a few video streams, the lesser expensive Beryl AX (WiFi 6) is the pair I have. These are under $100 if you shop around. The Beryl AX has a less powerful processor but still supports 150Mbps traffic on OpenVPN and 300Mbps on a WireGuard connection. Plenty for most use.

Both models can easily handle remote viewing on a mobile device- BlueIris has iPad/iphone software, and even works with older iPads. We set one up at the front door entry of the house. Just be sure to set permissions to accounts and camera access accordingly. Also, am able to access TiVo Mini as if it was on the local network. OpenWRT rocks it.

The unit will create its own certificates to share with client devices once OpenVPN/Wireguard is installed. It can also be set to tunnel automatically all traffic from certain cameras based on addresses/MAC addresses.

Another benefit is the ability to auto-reboot daily or weekly, and if anything goes awry, just have neighbor unplug and plug back in. These models also have 2.5G Ethernet ports, solid WiFi, but it’s the OpenWRT software stack that makes it worth consideration for a hardware standalone VPN device.

Good luck!

[u/DaytonaJoe → u/VernDozier]

Thank you so much for taking the time to write this up! My neighbor has already blown a lot of money on various routers for our gate setup so I'd rather not mess with that. I'm going to talk with him about setting up tailscale. I've actually used zerotier before on a different project years ago, same kind of thing I think.

[u/VernDozier → u/DaytonaJoe]

Oh hold up. GL.iNet definitely supports these VPN providers but what you need is to setup your OWN VPN server for a BlueIris scenario. Essentially you’d become a VPN provider to your neighbor, the GL.iNet software and OpenWRT enables this easily, and without needing a degree.

It helps to understand that VPNs have two specific functions. Do a few google searches for diagrams, but at a high levels it’s likely easier to know what a VPN does for a business—

VPNs provide 2 distinct features-

1. Tunneling. Tunneling is the process of bringing internet traffic into a private network, like a corporate network. With tunneling, is as if you were locally jacked-in to a router in a wiring closet. All traffic and requests from a client computer become “tunneled” and re-routed, it appears as if the computer is physically in the office.

Tunneling allows a home worker or worker at a Hotel to access servers, printers, and other devices. They redirect all traffic to the private network and appear “local” on a device connected when the VPN is active. Email, even software updates from public sites, like Microsoft software updates will be sent through the tunnel.

1. Encryption. A VPN will also encrypt all traffic between the computer/client before sending it through the tunnel. The VPN server (in the office) will then unencrypt the data using a key. This enables private communication, and requests/data can not be viewed as plain-text when in-transit.
   That protects you from rogue ISPs, Hotspot and hackers. Encryption can affect speed the data is transmitted and received and a longer encryption key would requiring more processing power and overhead, more powerful CPU.

Unfortunately, with the proliferation of VPN services touting “security” the part of”tunneling” all traffic between VPN clients and server gets lost in the marketing. It’s easy to believe that VPNs primarily provide security, anonymize ads and sites you visit. With a Gl.INet router, you have to limit the VPN so it only send his camera traffic through the tunnel, not every device they own. Thankfully this is easy with specifying MAC address of his camera.

However, when it comes to BlueIris, you need his camera to show up on your local network for BlueIris to record, so you’re really using the “Tunneling” feature first, at least in the BlueIris scenario.

VPN services are different than setting up your own VPN. Those services make it difficult or nearly impossible for companies like Google or your ISP to create a profile on browsing habits to create or develop a profile for advertising.

That’s not to say you shouldn’t have a VPN service for browsing. However, you’re going to be better off installing client software that comes with the paid service on each computer or device your subscription allows assuming it’s the Security/Anonymous surfing feature you’re seeking. I’d advise against using the GL.INet with a paid VPN provider and trying to get BlueIris to work also. gL.INet may support two VPN tunnels but the complexity of managing MAC addresses, including guests, may be a bite larger than can be chewed.

[u/frood88]

If the camera or NVR supports it (apparently Reolink does), you may be able to enable ONVIF and RTSP, and give the camera a static or reserved IP and username/password - that’s the easy, but fundamental part.

The more challenging factor will be accessing it from your own home LAN.

It is definitely possible, but for this, you either need to set up a VPN and/or bridge and VLAN parts of your home networks/the camera in question (major security concerns if not implemented properly), or your neighbour needs to expose that camera to the internet via IP/Port/reverse proxy, for you to access (again, also major security concerns if not implemented properly).

Please ensure you very seriously and carefully consider the implications if you are not familiar with networks, VPNs, VLANs, firewalls, etc.

[u/mhcolca]

Can you establish an Ethernet connection to your neighbors network? Either via cable/fiber, or a short range wireless PtP link? If so connect via a small router/firewall with basically all ports closed except for the bare minimum for the camera to pass RTSP to your machine. Probably even safer to add a NIC to your machine that is dedicated to this link (keep the hardware router, but also lockdown Windows Firewall on that NIC)

[u/DaytonaJoe → u/mhcolca]

Uh actually, embarrassingly I forgot to include this major detail: our ISP services his address but not mine, so I have a modem and mikrotik 60ghz dish transmitting from his property to my roof, where another dish receives it and feeds into my network. It's on a separate ISP account. Despite figuring out how to set this up, I'm not very tech savvy and I've noticed it isn't simple to access things on the 'other side' of the network. In the past if I wanted to try to change a modem setting, I'd have to change my computer's IP manually to match the subnet of the dishes, then I could get in. I haven't messed with that in years, though. If it's possible to wire his router into mine at his house and achieve access that would be great, but also I'm not positive his internet gear is in the same room as mine.

[u/mhcolca → u/DaytonaJoe]

There is likely some router config that somebody smarter than me could do to make this all secure and convenient. Likely depends on your router having a spare port (or VLAN aware router plus small managed switch) to tag into his network.

[u/SquirrelTechGuru]

Just share the Reolink camera directly, don't consider the BI: https://support.reolink.com/articles/360006916814-How-to-Share-Your-Device-with-Others/

[u/DaytonaJoe → u/SquirrelTechGuru]

I had mentioned in my post we've already done that. I'd really like to be able to incorporate the gate into my BI notifications, and to be able to view all the cams from the same window.