

The NVR doesnt have to live in the same VLAN if you give it explicit firewall rules to traverse to the tainted camera VLAN for the explicit purpose of fetching the rtsp stream from the cursed cameras. Its how I setup my network. The cameras are islanded, I setup Frigate to be allowed to go in and open that port over TCP. The cameras try to phone home and pull DNS but are ignored, only traffic they’re allowed to product is rtsp to Frigate.



My budget is under 100w for 3 servers with a combined 18tb of ssd and 28tb of spinning rust that stays spun down unless I need to so a cold backup.