How to set up CCTV remote viewing safely and reliably

For many customers, the phone app is the system. They rarely look at the recorder's monitor, but they will open the app whenever an alarm sounds or a staff member calls. If it is slow or stops working, they will call you and assume that the whole installation has failed.

Remote access is also where many systems become vulnerable. A quick port forward can get a customer online in minutes, and expose their recorder to the whole internet for years. This guide explains how to set up remote viewing that's both reliable and safe.

The main ways to connect

Manufacturer's cloud or P2P service

Most recorders offer a peer-to-peer or cloud relay service. You register the device, typically with a QR code, and the app connects through the manufacturer's servers.

Pros: Simple. Doesn't require changes to the router, and works with most connections, including those behind carrier-grade NAT.

Cons: Depends on the vendor's security and service. Remote streaming may be limited. Some sites and customers won't allow it for policy reasons, or may be subject to rules about specific vendors.

This is often a reasonable option for small sites, if it's set up with strong passwords and two-factor authentication where available.

VPN

A VPN puts the phone or laptop securely on the site's network. Cameras and recorders are never exposed to the internet.

Pros: Strong security when done properly. Works with any camera system. Good for technicians who support several devices.

Cons: Needs a suitable router or VPN device, some setup, and some care with user management. It can be harder for non-technical users.

This is usually the preferred choice for business customers with higher security needs.

Port forwarding

Port forwarding opens a path through the router, so that the recorder can be reached from anywhere on the internet.

Avoid this method. Automated scans find exposed devices quickly, and any unpatched vulnerability or weak password can be exploited. A long history of attacks on internet-exposed video devices shows the risk is real. If you inherit a system using it, plan to replace it with something safer and explain why to the customer.

Also turn off UPnP on the recorder and router, so that devices can't open ports by themselves.

Managed cloud platforms

Some systems manage remote access as a core part of the platform, with central user management. See our guide on NVR vs cloud CCTV for more on this choice.

Check the site's internet first

Remote viewing depends on the site's upload speed, not download. Many connections have much lower upload capacity than the headline number suggests. Test it at the site with a reliable speed test, at a busy time of day.

Add headroom for other traffic on the connection, and these are just illustrative. Check real rates in your system.

Connection problems that catch people out

• Carrier-grade NAT: Many ISPs share one public IP address among many customers, which stops inbound connections. P2P or an outbound VPN often still works.
• Mobile routers: A 4G or 5G connection may use data caps and have variable upload. Remote streaming could quickly use up the customer's allowance.
• Double NAT: The customer's own router behind an ISP modem can cause issues if you're relying on inbound connections.
• Changing IP addresses: Dynamic public addresses complicate VPNs. A dynamic DNS service or a fixed IP can help.

Configure streams properly

Most cameras produce two or more streams: a high-quality main stream for recording, and a lower-quality sub stream for grids and phones.

• Set the sub stream to a modest resolution and bitrate, enough for a phone screen.
• Make sure the app uses the sub stream by default.
• Set an H.264 sub stream if the customer's devices struggle with H.265.
• Test the picture on the customer's real phone.
• Show the customer how to switch to high quality for a closer look at a single camera.

Good sub stream settings do more for perceived speed than almost any other change. A grid of 16 full-resolution streams will overwhelm a phone and the connection.

Set up user accounts

Don't hand out a single admin login.

• Owner or administrator: Full control, used sparingly.
• Manager: View and playback, with export if needed.
• Staff or guards: Live view only, or limited cameras.
• Installer: A named account, agreed with the customer, and removed when no longer needed.

Limit each user to the cameras they need. A shop manager may not need the view of the owner's office. Turn on two-factor authentication wherever it's available.

Install the app on the customer's own device using their own account. If the app account is tied to your company's email address, the customer may lose access if you part ways. Make clear who owns what.

Set sensible notifications

Default motion alerts can send hundreds of notifications a day, and the customer soon ignores them or turns them off altogether.

• Enable only the alerts that matter, such as a line crossing after closing time.
• Schedule alerts for times when the premises should be empty.
• Use person or vehicle detection if the camera supports it, instead of pure motion.
• Exclude moving trees, roads and flags.
• Send to the people who need them.

Also consider system alerts, such as disk failure or video loss. Those are arguably more valuable than motion alerts, because they tell someone the system has a problem before an incident occurs.

Test before leaving

Always test on mobile data, not site Wi-Fi. A connection over the local network tells you nothing about what happens away from the site.

• Live view opens within a reasonable time on mobile data
• Each required camera can be viewed
• Playback works, for a specific camera and time
• Clips can be exported or saved, as agreed
• The notification test works
• Each user can log in with the correct access
• The system reconnects after the router restarts
• The recorder's date and time are right
• No unexpected ports are open from outside

Add these to your handover checklist.

Common faults and how to fix them

Our CCTV troubleshooting guide covers more faults.

Multi-site customers

If a customer has several locations, try to avoid a separate login for each site.

• A central video management system or a cloud platform can bring them all together.
• A site-to-site VPN connects branches to head office.
• Consistent naming, such as "BLR-Store12-Entrance", makes it easy to navigate.
• Use consistent user roles across all sites.

Check head office's upload and download capacity if they plan on viewing many sites at once.

Supporting customers remotely

Remote access can reduce your service visits, but it needs clear rules.

• Agree in writing that you'll have access, and when you can use it.
• Use named accounts rather than shared logins.
• Log each access against a service call.
• Never look at footage beyond what you need.
• Remove access when the contract ends.
• Keep credentials in a secure company password manager.

Your own company's security is part of your customer's security, as described in our cyber security guide.

What to tell customers

Set expectations honestly at handover.

• Remote viewing depends on the site's internet, and the phone's connection.
• Viewing may be slower when others are using the connection.
• If the internet fails, the phone app won't show live pictures, but the recorder should keep recording.
• App updates may change how things look.
• Only give access to people you trust, and tell us when someone leaves.
• Don't share your login or forward footage carelessly.

A short, honest conversation here prevents a lot of support calls. When the app behaves as you said it would, the customer stays confident in the whole system.