IP camera solution

[akis]

I am looking for a WiFi camera that:

1) It will connect to my home network just like my WiFi/ethernet home printers
2) I will be able to connect to it and send it commands
3) It will send the video feeds to a server of my choice, in my case, inside the same network - I will have a PC running a "camera server" app.
4) I will be able to connect to this server and download videos etc
5) It will not be infested with backdoors etc, it will not try to access the internet or send messages to any remote server which I have not explicitly set up

If anyone knows whether such a camera exists I would be grateful.

[madires]

Requirement #5 could be a problem. Based on the tons of security issues with IP cams found the last few years it's better to put IP cams into a separate network. Consider them semi-compromised and don't expect that the manufacturer will provide updates. For better security and long term updates you might want to consider a professional IP cam, but it's about 5 to 10 times more expensive. Also beware of the apps of cheap cams. There are some nice open source solutions I'd use instead. And don't forget to set up a VPN for remote access.

[helius]

One way around some of the security issues is by combining a dumb, non-IP security camera with a wireless flash card (Toshiba FlashAir). The result is more fully configurable and will not come with built-in malware.

[NiHaoMike]

Build your own based on a Raspberry Pi or even an ESP32, depending on your requirements.

[stevelup]

What you are describing is basically every professional IP camera.

Suggest you look at Hikvision. If the camera is for internal use, the Ubiquiti G3 Flex is compact and attractive.

-edit- missed the WiFi requirement which effectively precludes any pro kit. But you still need to get power to any camera unless you're going to mess around with batteries. So you may as well just go wired.

[Dielectric]

I had pretty good luck using MotionEyeOS with a Pi-Zero W and the RPi camera module.  Lots of cool features, it's actually a very thoughtful creation.  The hard part is creating a good outdoor enclosure, if you need that.  I just stuck mine to the inside of the house windows instead.

[MyHeadHz]

I had pretty good luck using MotionEyeOS with a Pi-Zero W and the RPi camera module.  Lots of cool features, it's actually a very thoughtful creation.  The hard part is creating a good outdoor enclosure, if you need that.  I just stuck mine to the inside of the house windows instead.

I've used MotionEyeOS with a raspberry pi and an off-the-shelf webcam (most all of them work right out of the box with the pi) that I had around.  It meets all the requirements above and is quite stable and configurable.  The GUI is easy to use and it handled 1080P over the network flawlessly as well.  It seems perfect for this project.

edit: I used a pi 3 with built-in wifi.  Earlier models need an external wifi adapter, so keep that in mind.

[akis]

Everyone on the market should do, as long as you drop requirement 5.

How so? Amazon is full of cameras that connect to some unknown server, in some unknown country and store your photos and videos. I presume there would be a configuration file that tells the camera which server to connect to, which port etc, but asking on Amazon, even the sellers of these cameras do not think you can point them to a server of your choice.

[paulca]

I spotted this last night.  For £10 it might be worth trying.  There are youtube test/review videos, but I haven't watched them.

https://www.ebay.co.uk/itm/ESP32-CAM-WIFI-Bluetooth-Development-Board-5V-ESP32-Module-With-OV2640-Camera/352634571778?hash=item521aa88c02:g:VDoAAOSw7SRcpVhn

[akis]

Having to log in through a server is common, and necessary as many users are behind NAT. It's a matter of trust, just like I trust Linksys to fully control my WiFi router and potentially all my traffic.

Storing photos and videos to server is a stupid assumption. Storage is money. Unless you are tagged by the big brothers, no one will bother to record your life in a high bandwidth video format.

"many users" only have a mobile phone, not even a laptop, let alone be capable of hosting their own servers. But I am not "many users" and I could easily setup a local PC to record video, or setup a remote server in one of my other houses, or some similar combination.

We all have tons of data stored outside our control, and typically this is Google, Yahoo, Apple  etc - but not some guy running servers from his mother's basement ... This was my "stupid assumption"...

[soldar]

I am looking for a WiFi camera that:

A topic I have some expertise in. You should not be thinking in terms of a "camera" but in terms of designing the system as a whole.

>> 1) It will connect to my home network just like my WiFi/ethernet home printers

All IP cameras will connect to your home network but if the purpose is security then wifi is a bad choice because it is trivially easy to disrupt.

>> 2) I will be able to connect to it and send it commands

Obviously, that is the purpose of having it on the network.

>> 3) It will send the video feeds to a server of my choice, in my case, inside the same network - I will have a PC running a "camera server" app.

Not really necessary or a good idea. That is the purpose and function of an NVR (Network Video Recorder) which records and manages all this. It generates the "quadrant video" etc. It is a small box, like a router, more stable than a computer, uses much less energy, etc. Also note that hard disks for NVRs are not regular computer hard disks but are optimized for continuous recording.

4) I will be able to connect to this server and download videos etc.

Yes, that is what the NVR does. In my case I have four cameras and it stores about two months of video before it starts over-writing.


5) It will not be infested with backdoors etc, it will not try to access the internet or send messages to any remote server which I have not explicitly set up

Difficult to impossible. You can set up your security cams on a LAN not connected to the Internet but then you will not have access from the Internet, only from LAN. If you want to connect from the internet the cameras need to connect and log in to servers which facilitate the connection. In other words, my client connects to the server and asks if camera with ID XXXXX is online, then the server responds with the IP and other parameters so a direct connection can be established. Given this it would be difficult to control any other leaks from the cameras.

Most cameras are full of holes and vulnerabilities. I just live with it but sometimes cameras have been infected and made BOTs. It is not an easy issue to resolve. Several workarounds can be devised but it can get complicated.

My cams are made by Xiongmai and are very definitely compromised, infected and worthless but I use them anyway. I know they have default master passwords and it is easy to log into them. There are many videos in Youtube of people hacking cameras and scaring homeowners.

My cameras are all showing the outside of the house and I don't really care if anybody can see what's going on. I guess it would be worse if they were compromised as BOTs.

https://www.pcworld.com/article/3134039/chinese-firm-admits-its-hacked-products-were-behind-fridays-massive-ddos-attack.html

Another issue is what type of camera to choose for each location. There are many different features.

I bought all my cameras, NVR, etc. from ebay and it cost me very little.

[NiHaoMike]

If you want to connect from the internet the cameras need to connect and log in to servers which facilitate the connection.

Incorrect, you just need PiVPN or some other VPN server for secure remote access. The only cloud service you need is dynamic DNS if you have a dynamic IP.

[soldar]

If you want to connect from the internet the cameras need to connect and log in to servers which facilitate the connection.

Incorrect, you just need PiVPN or some other VPN server for secure remote access. The only cloud service you need is dynamic DNS if you have a dynamic IP.

Well, yes, of course. I am talking about out-of-the-box solutions. Anyone knowledgeable can set up a VPN to the home LAN. My guess is such a person is not asking for this kind of advice here. But yes, you can VPN home and then you are local on the LAN. And you need to take extreme measures to block the cameras from the Internet. Believe me, they try very hard. They have, among other things, a long list of IPs that would need to be blocked.

[NiHaoMike]

PiVPN is about as easy to set up as VPN servers get.

[soldar]

PiVPN is about as easy to set up as VPN servers get.

I am not disputing that. The question is not if you can VPN into your LAN. The question is can you be 100% certain the cameras will not find a way out to the Internet.  Unless you are 100% certain then I would not place a camera in the bedroom. But, hey, if others want to do it I am fine with that. Maybe they will see their wives in Youtube being consoled by ... whoever replaced the milkman in these endeavors.


More things. In theory there are standards, like ONVIF which would make devices interoperable but my experience is that you often run into snags anyway.

There re many factors and features in choosing cameras: outdoor or indoor (even then I have indoor cameras placed outside, under the eaves, well protected). With/without IR illumination. Resolution, number of streams, compression (H264), auto, IR-Cut filter, auto iris. Many more if you want to get really technical.

You can also get local storage in memory card but I don't use that as it goes direct to the video recorder.

Here is a photo. You can see the Hard Disk and the tiny board. IIRC the connectors are VGA video out, USB (mouse), Ethernet and power. I seem to remember it may have eSATA for an external disk.

[akis]

I am not settled on the cameras yet, still trying to decide what to buy. I have ordered two Reolinks C2 Pro, with Amazon Prime, should have been with me today, but Amazon decided to use Royal Mail (why? why? why?) and they have not arrived. I already filed a return and will not accept them if they arrive tomorrow. Have also bought a pair of significantly cheaper ieGeek 1080p home cameras, they should be here tomorrow, and if they too try to talk to China I will send them back.

Talking about security, I am not expecting anyone to hack into my wifi. I am more worried that the cameras are hardcoded to access remote servers, legitimately so, as they are trying to enable remote viewing and control for the average user. I am also worried that allowing them to communicate with some unknown remote server might also allow outsiders to hack in. Finally in terms of network usage, I am imagining that keeping the video feeds locally is better than transmitting everything to China, in order for me to have remote access.

My idea then is a bunch of cameras on the Wifi talking to a local NVR or laptop running some server, and a hole in the router to allow me to connect remotely to the laptop. The router will stop the cameras from reaching outside, as the cameras only ever need to talk to the NVR/laptop.

I m not an expert on programming the router, past opening a hole or two (port forwarding), but am sure it is possible with most home routers these days. Maybe even have a separate LAN just for the cameras / and a multihomed laptop.

In terms of NVR I have done some casual research, I was thinking of using SSDs rather than spinning disks, like the MP510 1TB. Can I leave the laptop running for a year unattended? Maybe not easy as Windows pushes updates and crashes the machine all the time, I will need to experiment with this. And I would need a means to recycle the laptop remotely or on an external timer, eg once every 4 hours.

[Red Squirrel]

If you go Wifi, you need power for it anyway.  POE makes more sense that way the power comes from a central UPS backed up area where the switch and network stuff is and you don't have to worry about using up wifi bandwidth.     I would do POE ethernet cameras, and put them on a separate vlan.  Make sure that vlan can't connect to the internet, and can only connect to the video server. In fact depending how the video server works you probably don't even need that, the video server just needs to be able to access the cameras and not the other way around.  So basically you have a camera vlan, where inbound and outbound traffic is blocked, and only the video server is allowed to connect to it.  Of course you can make other rules as you please depending on your needs.  Pfsense and a managed switch makes a pretty solid base for a home network and would allow all of this.

If you have any outdoor cameras this also protects you in case someone takes one down and tries to connect something to the port.  They WILL have access to all the other cameras, but not the rest of the network.  There may be some port security stuff you can do at the switch to mitigate that risk more.

Also be careful ordering from Amazon, there are lot of fakes.  I heard Hickvision cameras are great, but there seems to be an odd black market for fake ones so if you buy one you don't know what you're really getting, it might not be genuine and it will be filled with backdoors.  Of course the vlan and proper firewalling stuff should protect you from this anyway.

Been toying with adding some around my house myself as there's tons of theft in my city now, just not sure what to go for the recording software.  Not much for Linux.  Tried zoneminder years back but it was crappy and had lot of issues, it might be better now though.

[NiHaoMike]

I am not disputing that. The question is not if you can VPN into your LAN. The question is can you be 100% certain the cameras will not find a way out to the Internet.

Make your own cameras using Raspberry Pi or ESP32 so you can trust them.

I wonder how difficult it would be to hack the "untrustworthy" cameras to send a completely unrelated video stream to the spy servers, basically wasting their resources.

[soldar]

Been toying with adding some around my house myself as there's tons of theft in my city now, just not sure what to go for the recording software.  Not much for Linux.  Tried zoneminder years back but it was crappy and had lot of issues, it might be better now though.

Yes, I have been searching for recording software for Linux and have not found anything I really like. Another issue is that I have many different cameras and what works for one does not work for another. I am just playing around with cameras which are not in use. Some cameras will work with one software but not with another. In Linux I have found "Onvif Device Tool" works pretty well for viewing, connecting, etc. but it does not record. It even connects to my cameras without knowing the password. 

For actual CCTV surveillance I have the video recorder and it works great. It is totally independent of any computer so no problems crashing. It is self-contained and will run for months or years with no crashes and minimal consumption. Using a computer for this makes no sense unless you have very specific reason to do so. Also, the video recorder I have hidden out of the way so, even if they break into the house it will probably not be discovered. Using a computer might mean they will steal it.

I have had many break in attempts and have a lot of footage. Unfortunately the police here have no interest in resolving anything and have no interest in the video recordings.

Another thing I have learned is that if I arrive at my second home after two weeks and something happened it is almost impossible to review four weeks of video. It is easy though to place objects or "flags" in such way they would be disturbed so I can go in and check the recording at day 7, then day 10, then day 9, etc. so it is easy to narrow down the moment and see the actual video.

[soldar]

Make your own cameras using Raspberry Pi or ESP32 so you can trust them.

The OP can do that if they feel like it. Most people want to set up a system working straight out of the box, not spend countless hours designing and building their own home brew.

I wonder how difficult it would be to hack the "untrustworthy" cameras to send a completely unrelated video stream to the spy servers, basically wasting their resources.

I guess it could be possible but I don't think it is practical and does not make much sense anyway.

And the danger is not only that they may see your video but that they control the embedded system and convert it into a BOT in their BOTNET.

[Red Squirrel]

Actually a dedicated recorder box is an option too, I think some of them do handle IP cameras.  Not sure if you are stuck using only the cameras designed for it though, or if they are universal.  You also want to make sure it's easy to upgrade the drive and easy to retrieve the data.  Nothing worse than a black box you can't do anything with, like DVRs for TV.

[NiHaoMike]

The OP can do that if they feel like it. Most people want to set up a system working straight out of the box, not spend countless hours designing and building their own home brew.

The nice thing about open source is that someone who likes to tinker with stuff does most of the hard work.

Really, I think anyone who actually wants a home network they can trust should know how to configure software and other basic IT knowledge.

[soldar]

Actually a dedicated recorder box is an option too, I think some of them do handle IP cameras.

Of course they do! That is what they are designed and built for! I have had and used several in the last few years. And, again, a normal computer HDD is not optimized for video surveillance recording.

  Not sure if you are stuck using only the cameras designed for it though, or if they are universal.  You also want to make sure it's easy to upgrade the drive and easy to retrieve the data.  Nothing worse than a black box you can't do anything with, like DVRs for TV.

I have bought a lot of stuff here and there. As long as it says ONVIF they should be inter-operable. But be ready to spend a lot of time configuring everything. Not only the computer/network aspects but also camera settings. I had to do a lot of testing to get things right. The camera pointing at the street has no use for IR and just the street lighting is better. One in the back yard needs IR but the camera illuminator is not enough so I added a couple more. Angles, locations, protection from the weather... It has kept me busy for hours. Then things fail. I have just finished troubleshooting a camera that was failing intermittently. It was impossible to pinpoint the cause and this went on for weeks. It would just stop working at times. I changed the PSU, the ethernet cable... still would fail once in a while. I finally determined it was the camera's power connector. The central pin was too thin and sometimes would make bad contact. I finally resolved it by replacing the PSU barrel connector. Instead of using one with a full cylindrical inner part I used one of the type that has only two wires like a hairpin. That made better contact.

If my experience is indicative you will be spending time installing, improving and repairing your system.
 

[soldar]

I bought many more cameras than I needed so I could get a chance to play around and test them.

Besides the real working installation I have several of these that I play around with:

https://www.ebay.com/itm/192940681528
https://www.ebay.com/itm/291872810159
https://www.ebay.com/itm/271909585754
https://www.ebay.com/itm/233229176873
https://www.ebay.com/itm/312282526695
https://www.ebay.com/itm/153040848750
All support ONVIF.

And, depending on what you want to do, maybe you could use regular USB webcams.

[MyHeadHz]

If you want to connect from the internet the cameras need to connect and log in to servers which facilitate the connection.

Incorrect, you just need PiVPN or some other VPN server for secure remote access. The only cloud service you need is dynamic DNS if you have a dynamic IP.

There are several ways to set it up, and there is never any reason to use any cloud services.  In your scenario you will own the client and server so there would be no point.  Plus, the thread author specifically wouldn't want to do that anyway (#5).

Anyway, another option would be to SSH into whatever device you make, if you are comfortable with that.  That would be the most secure option.

Still, though, I think a regular USB webcam and raspberry pi would be a perfect solution for your project.  You would have the most control over the device, and you could always re-purpose it if you ever need/want to.