Documentation
Remote access to IP cameras and RTSP streams
Reaching IP cameras or an NVR remotely without exposing them on the Internet: that is exactly what a mesh VPN does. VIGIL joins your cameras into an encrypted private network, carries RTSP/RTP streams as they are, lets ONVIF and mDNS discovery cross the mesh, and opens no inbound port on the site side.
The problem: never expose a camera
Opening a port to a camera or an NVR, or publishing its RTSP stream on the Internet, is a classic source of incidents: default credentials, vulnerable firmware, constant scanning. Port forwarding and DDNS make the attack surface worse. What is needed is remote access that never makes the camera publicly reachable.
The solution: join the cameras in a private network
- Zero inbound ports on the site side: a single connected node is enough to make the whole camera fleet reachable in the private network.
- RTSP/RTP streams carried as-is, encrypted end to end — the infrastructure only sees packets go by that it cannot read.
- Stable addresses and locally resolved names (MagicDNS): your VMS tools find the cameras as if on the site LAN.
ONVIF and mDNS discovery across the mesh
ONVIF discovery relies on WS-Discovery (multicast), and many devices announce themselves over mDNS. VIGIL replicates IP multicast across the mesh: your cameras discover each other as if on a LAN, between two remote sites. The multicast is encrypted and the relay replicates it without being able to read it. See /en/docs/l2-multicast.
Supervise and control
- View in the browser: the media console plays RTSP/RTP (H264/H265, WebCodecs) without a plugin.
- Drive a PTZ camera in real time: commands travel as end-to-end datagrams, with no head-of-line blocking.
- Publish a video wall or an interface without exposing the NVR: publications expose one service cleanly, without making the rest visible.