CCTV Remote Access

You want to view CCTV or NVR footage remotely without exposing the NVR's web interface to the public internet.

The problem

Most NVRs and CCTV systems offer a “remote viewing” feature that works by forwarding a port on the site’s router directly to the NVR. It is one of the most common ways CCTV systems end up compromised – NVR web interfaces have a long history of vulnerabilities, and a forwarded port puts that interface directly on the public internet for anyone scanning for it.

The architecture

The same pattern as remote Home Assistant access: a small VPS acts as a WireGuard relay between the site and whoever needs to view the footage. The NVR is never reachable from the public internet – only from inside the VPN.

• VPS: WireGuard relay, nothing else exposed publicly
• Site network: a router or small device holding the outbound tunnel – a Teltonika RUTX-series router is a common fit here
• Viewer: WireGuard client on a phone or laptop, connecting through the VPS to reach the NVR’s normal local interface

For sites already running a Teltonika router, the VPN tunnel can run directly on the router itself rather than needing a separate device on site.

Where this scales further

For a business running CCTV across several sites, the same VPS can hold a tunnel to every site, giving one central point to reach any of them.

Security considerations

Change the NVR’s default credentials regardless of the VPN – the tunnel stops the internet reaching it, not anyone who gets onto the local network another way. Restrict each WireGuard peer to only the NVR’s specific IP and port rather than the whole site subnet.

Backup considerations

Back up the WireGuard configuration from the VPS and each site router. Footage backup is a separate question entirely – this architecture solves remote access, not footage retention – so plan NVR storage and any offsite footage copy separately.