Tutorials · Security
How to Segment IoT and CCTV Devices From Your Main Network
Put cameras, smart TVs, sensors and building systems in their own VLANs so one compromised device cannot reach your business systems.
Before you start
- Managed switches and a Layer 3 switch or firewall
- An inventory of IoT devices
Step by step
Inventory devices
List cameras, NVRs, access control, TVs, printers, HVAC and sensors, with what each needs to talk to.
Create segments
For example VLAN 30 for cameras, VLAN 31 for NVR and VMS, VLAN 50 for building systems and VLAN 60 for TVs and signage.
Write allow-list rules
Cameras → NVR only; NVR → VMS clients; building systems → their controller. Deny everything else by default.
Block Internet where not needed
Most cameras and sensors never need direct Internet access. Allow only NTP and firmware servers if required.
Use secure remote access
Reach cameras through a VPN, never through port forwarding (see the CCTV remote-access tutorial).
Monitor
Alert on unexpected traffic from IoT VLANs, for example a camera talking to the Internet.
Pro tips
- Change default passwords on every camera and NVR.
- Keep IoT firmware updated on a schedule.
FAQ
Frequently asked questions
Why are cameras a security risk?
Many cameras run old firmware and default passwords. Botnets scan for them constantly. Segmentation limits the damage.
Keep learning
Related guides
IoT and camera botnets
Read more →Network segmentation (blog)
Read more →How to Enable 802.1X Port Authentication on Switches
Stop unknown devices from using your network ports: configure 802.1X with RADIUS and MAC-authentication bypass for printers and cameras.
Read more →How to Secure the Management of Switches, Routers and Access Points
A hardening checklist for every network device: strong credentials, SSH only, a management VLAN, access lists and logging.
Read more →How to Write Firewall Rules That Actually Protect You
Default-deny, least privilege and clean rule bases: practical rules for any firewall or gateway.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.