Sooner or later everyone wants to reach something at home or at the office from somewhere else: the camera recorder, a file server, the automation system, a computer on the desk. There are two ways to make that possible. One of them is how it was done for years and is the source of a large share of the break-ins we read about. The other is how it should be done.
A quick model of the problem
Every device on the internet has an address, and every service on that device listens on a port, the way an office building has a street address and each tenant has a suite number. Your router presents one public address to the world and, by default, refuses all incoming connections to anything behind it. That refusal is the single most important security feature a home or small office has.
Option 1: port forwarding
Port forwarding tells the router to accept incoming connections on a particular port and send them to a particular device inside: the camera recorder, say. Now that recorder is reachable from anywhere, which is the goal, but it is reachable by everyone, which is the problem. Automated scanners sweep the whole internet continuously looking for exactly these openings, and the device on the other side is now protected only by its own login page and its own software. Camera recorders and consumer network gear have a poor history on both counts. A forwarded port is a door with a lock on it, propped open on a busy street.
It is also fragile: the public address changes, the rule breaks, and it tends to accumulate. We regularly find routers with a dozen forgotten forwards to devices that were replaced years ago.
Option 2: a VPN
A virtual private network creates an encrypted tunnel from your phone or laptop to the router, after which the device behaves as if it were sitting inside the network. Nothing on the inside is exposed to the internet; the only thing listening is the VPN itself, which is designed to be listened to and authenticates you before letting anything through. Modern protocols such as WireGuard are fast enough to be left on permanently, and the better routers we install support them directly.
Option 3, which most people already use
Most professionally installed systems no longer need either. Control4, Crestron Home, Lutron, and the major camera platforms connect outward to the manufacturer's cloud service, and your app talks to that service. Nothing is opened on the router, the connection is encrypted and authenticated by the vendor, and it survives an address change. For the things these apps cover, this is the right answer, and it is why we can support a client's system remotely without ever opening a port.
Our recommendations
- No port forwarding, with very rare exceptions that are documented and reviewed.
- Use the manufacturer's cloud service for the systems that provide one, with strong passwords and multi-factor authentication on those accounts.
- For everything else, a VPN on a business-class router.
- Keep cameras and other connected devices on their own network segment, so even a compromised device reaches nothing important. Our camera guide covers that setup.
- Keep firmware current on the router and on every exposed device, and retire equipment the manufacturer no longer updates.
If a previous installer left forwards on your router, or you are not sure how your cameras are reached from outside, it is worth a look. Our networking page describes the networks we build, and we can review yours.