SMSMC Blog
Data & Architecture GovernanceOctober 2026 · 6 min read

Cameras without the risk: putting UniFi cameras on their own network

Cameras and recorders on the same network as your office PCs give an attacker a path in. How to put UniFi Protect on its own network with firewall rules that keep it there.

By Jim Venuto

The camera is a computer on your network

Every IP camera is a small computer with an operating system, a network connection and software that needs updates. In most small offices it is plugged into the same switch, on the same network, as the bookkeeper’s PC and the file server. Anything that can reach one can reach the others.

That matters because camera systems and the consoles that run them are real targets. On June 23, 2026, CISA added three UniFi OS flaws (CVE-2026-34908, CVE-2026-34909 and CVE-2026-34910) to its Known Exploited Vulnerabilities catalog, the list of flaws it has evidence attackers are using. CISA’s descriptions all begin the same way: a malicious actor with access to the network could change the system, read files on it, or run commands (CISA KEV catalog). Ubiquiti published fixes in its Security Advisory Bulletin 064, which CISA links.

Patching closes those particular holes; a separate post covers keeping the console itself secure. Network design decides who has “access to the network” in the first place.

Why flat networks happen

A camera installer’s job is to get pictures on a screen. The quickest way is to plug everything into the existing network and move on. Nothing breaks, so nobody revisits it. The result is a flat network where a phished laptop, a guest’s infected phone or a compromised smart TV sits one hop away from the cameras and the recorder, and the reverse is also true.

The design: a camera network with walls

SMC’s preferred design puts UniFi Protect on its own network (a VLAN), and uses the UniFi gateway’s firewall to decide exactly what may cross. Where a business already runs another camera platform that works, the same principles apply to that system.

1. Give cameras their own network, and put the recorder in it

Create a dedicated camera network in UniFi Network and assign the switch ports that feed cameras to it. Ubiquiti’s guidance matters here: if Protect runs on a recorder (an NVR) or a CloudKey and you have multiple VLANs, the cameras must be on the same VLAN as that recorder (Getting Started with UniFi Protect). So the recorder moves into the camera network too. That is good: the device holding your footage is no longer sitting among office PCs.

2. Block traffic between networks by default

UniFi’s Zone-Based Firewall (UniFi Network 9.0 and later, on a UniFi gateway) groups networks into zones and sets policies between them. Built-in zones include External, Internal, Gateway, VPN, Hotspot and DMZ, and you can create your own (Zone-Based Firewalls in UniFi).

The simple version: put the camera network in its own zone and block it from reaching the office network. For a one-click start, UniFi’s Network Isolation setting blocks a network from all other networks; Device Isolation (ACL) on switches can also stop devices on the same network from talking to each other (Implementing Network and Client Isolation).

Then allow only what is needed, and write each exception down:

  • Staff who watch cameras use the Protect app or Site Manager. Allow those viewing devices, not the whole office network, to reach the recorder.
  • Cameras need to reach the recorder and get updates through it. They do not need to browse the internet on their own.

3. Don’t open ports to the internet

Remote viewing should go through Ubiquiti’s Site Manager, which sets up an end-to-end encrypted connection between your phone or browser and the console; Ubiquiti says it cannot view your video (How UniFi Protect Protects Your Data). Port forwards to cameras or recorders, often left by installers “so the app works”, should be removed.

4. Encrypt the video on the wire

Protect can encrypt streams between cameras and the console. Ubiquiti lists support on G4, G5 and AI Series cameras with Protect 5.2.42 or later, turned on under Settings > System > Advanced > Stream Encryption (How UniFi Protect Protects Your Data).

5. Treat third-party cameras as less trusted

Protect can adopt ONVIF cameras from other makers, which is a sensible way to phase out an old system. Ubiquiti’s steps include replacing default credentials and updating the camera’s firmware before adoption, and only basic features carry over (Third-Party Cameras in UniFi Protect). Keep them on the camera network, and plan their replacement.

What it looks like

flowchart LR
  Internet((Internet)) --- GW[UniFi gateway<br/>zone-based firewall]
  GW --- Office[Office network<br/>PCs, file server]
  GW --- Cam[Camera network<br/>cameras + recorder]
  GW --- Guest[Guest Wi-Fi<br/>isolated]
  Office -. "viewing devices only" .-> Cam
  Cam -- "blocked by default" --x Office

Illustration: if a front-desk PC is compromised through a phishing email, the attacker finds the office network, but the recorder, the cameras and their console are behind a firewall rule that only lets the owner’s viewing laptop through. That doesn’t make the system invulnerable; it shrinks the number of devices that can reach it from dozens to one or two.

Checklist

  • Camera network (VLAN) created; camera switch ports assigned to it
  • Recorder moved onto the camera network, per Ubiquiti’s guidance
  • Camera network isolated from the office network by default
  • Each allowed path written down: which device, to what, why
  • No port forwards to cameras or the recorder; remote viewing through Site Manager
  • Stream encryption on for supported cameras
  • Third-party cameras re-credentialed, updated and scheduled for replacement

When to get help

SMC assesses the site, designs the UniFi network and camera system, and writes the specification, including the firewall rules. A licensed installer you contract with does the installation; SMC reviews the bid and checks the finished system against the specification. SMC doesn’t sell equipment or take commissions. UniFi is our preferred platform; if your existing system fits your business, we design around it.

Start with the free security assessment at https://www.securitymedic.com/assessment. Physical security questions are covered there and on a free 30-minute call. You get a gap report to keep and a free results review.

Sources

Tags#physical-security#smb#ubiquiti#playbook