A business router forwards traffic between networks, typically between a site’s local network and an internet connection, and it usually handles address translation, firewall rules and virtual private network tunnels. On a security network it is the boundary device, so its settings decide who can reach cameras and recorders from outside.
The router is where a camera system stops being a private installation and starts being reachable from somewhere else. That boundary deserves more attention than it usually gets.
What the router decides
It assigns or forwards addresses, translates private ranges to a public one, and filters traffic by port and application. It may also terminate a virtual private network. Each of those is a control, and a default configuration is a control set nobody chose.
Remote access done properly
Avoid forwarding camera or recorder ports directly to the internet. Prefer a virtual private network, and disable services that are not used. Change default administrator credentials, keep firmware current and log remote logins. If the router supports it, separate camera traffic from office traffic. Write down what is exposed, so the list can be reviewed when staff change.
Related:Commercial securityGlossary: VMS