CCTV VLAN Setup: How to Isolate Cameras on a Reyee Network
If you fit CCTV for UK homes, shops, schools and small commercial sites, sooner or later a customer's IT manager will ask whether the cameras are on their own network. This guide covers CCTV VLAN setup end to end for installers: what a camera VLAN actually does, which Ruijie Reyee switches can create one, how to plan VLAN IDs, how to configure access and trunk ports, and how to keep Hik-Connect and iVMS-4200 working once the cameras are isolated.
What this guide covers
- Why a dedicated CCTV VLAN reduces risk, and when a separate switch is enough on its own
- Which Reyee tiers support VLANs — unmanaged, smart, L2 managed and L2+ with static routing
- A VLAN numbering plan that works on real UK jobs
- Access ports, trunk ports and PVID, in plain installer language
- Step-by-step CCTV VLAN configuration on a Reyee managed switch via Ruijie Cloud or the web UI
- Where to put the NVR, how to route between VLANs, and how to keep remote viewing alive
- A sizing table for 8, 24 and 48-camera sites with the exact Reyee part numbers
What is a CCTV VLAN, and why put cameras on one?
A CCTV VLAN is a separate logical network on the same physical switch, so cameras and the recorder can talk to each other but cannot reach the customer's PCs, servers or tills. The switch tags traffic with an 802.1Q VLAN ID, and ports in different VLANs are isolated at Layer 2 even though they share the same box, the same power supply and the same uplink.
The reason to bother is containment. IP cameras are embedded devices that get patched late, if at all, and a camera on the office LAN is a foothold on the office LAN. The NCSC's 10 Steps to Cyber Security guidance on architecture and configuration makes the point plainly: systems that do not need to talk to each other should sit in separate network segments, so an attacker's entry point has no route to the target. Cameras need to reach the NVR. They do not need to reach payroll.
There is a second, less glamorous benefit. Broadcast and multicast chatter from 24 cameras stays inside the CCTV VLAN instead of hitting every device on site, and a mis-configured camera that floods the network takes down the cameras rather than the business.
Do I actually need a VLAN, or is a separate switch enough?
If the CCTV system is fully self-contained — cameras into a PoE switch, switch into the NVR, no remote viewing — a physically separate switch is genuinely sufficient and simpler. You need VLANs the moment the CCTV system has to share cabling, share an uplink, or reach the internet through the customer's router.
In practice, three situations force the issue on UK jobs. First, there is one structured cabling run to the comms room and no spare fibre or copper for a second network. Second, the customer's IT policy requires cameras to be segregated and auditable. Third, the site has multiple systems — CCTV, access control, Wi-Fi, EPOS — and you want each one contained. In all three, a managed switch with VLANs is cheaper and tidier than a parallel physical network.
Which Reyee switches can do VLANs — and which can't
Reyee splits into four tiers, and only the top three can create a CCTV VLAN. Buying the wrong tier is the single most common mistake on a segmented install, because an unmanaged PoE switch has no configuration interface at all.
| Tier | Example models | 802.1Q VLANs | Use it for |
|---|---|---|---|
| Unmanaged | RG-ES108GD, RG-ES118GS-P | No | Stand-alone CCTV with no shared uplink |
| Smart / cloud | RG-ES205GC, RG-ES208GC, RG-ES216GC-V2, RG-ES224GC-V2, RG-ES226GC-P | Yes, basic | Budget segmentation, small sites |
| L2 managed | RG-NBS3100-8GT2SFP-P-V2, RG-NBS3200-24GT4XS | Yes, full | The standard choice for a CCTV VLAN |
| L2+ managed | RG-NBS5200-24GT4XS, RG-NBS5500-12XS | Yes, plus static routing | Routing between VLANs on the switch |
The workhorse tier is the RG-NBS3100 and RG-NBS3200 families. The RG-NBS3200-24GT4XS is a Layer 2+ cloud-managed switch with 24 gigabit ports and four 10G SFP+ uplinks, rated at 128 Gbps switching capacity and 96 Mpps forwarding, and Ruijie specifically markets it with IP-camera recognition for CCTV networks and VLAN configuration from Ruijie Cloud (Ruijie RG-NBS3200-24GT4XS product page). For a small site the RG-NBS3100-8GT2SFP-P-V2 gives you eight PoE+ ports on a 125 W budget with 30 W maximum per port, two SFP uplinks and 6 kV surge protection in a fanless case (Ruijie RG-NBS3100-8GT2SFP-P-V2 product page). If the recorder and cameras are already powered elsewhere, the non-PoE RG-NBS3100-8GT2SFP does the same VLAN job for less. Our Reyee managed switch range guide breaks the families down port by port.
VLAN numbering: a plan that works on UK sites
Use a simple, memorable numbering scheme and write it on the inside of the cabinet door, because the next engineer on site will not have your notes. VLAN 1 is the factory default on every Reyee switch and should not carry production traffic.
| VLAN ID | Purpose | Subnet example | Internet access |
|---|---|---|---|
| 1 | Default — leave unused | — | No |
| 10 | Site LAN — PCs, printers, EPOS | 192.168.10.0/24 | Yes |
| 20 | CCTV — cameras and NVR | 192.168.20.0/24 | NVR only |
| 30 | Wi-Fi and guest | 192.168.30.0/24 | Yes |
| 40 | Access control and intruder | 192.168.40.0/24 | Controller only |
| 99 | Switch and gateway management | 192.168.99.0/24 | Cloud only |
Keep the third octet the same as the VLAN ID. It sounds trivial, but on a fault call at 7 am, an IP of 192.168.20.41 instantly tells you the device is a camera on VLAN 20, and nothing else has to be looked up.
Access ports, trunk ports and PVID explained
An access port belongs to exactly one VLAN and sends untagged frames, which is what every camera and NVR needs; a trunk port carries several VLANs with 802.1Q tags and is what you use between switches or up to the gateway. The PVID is the VLAN an untagged frame is placed into when it arrives at a port.
For a CCTV install the rule of thumb is short: every camera port is an access port in VLAN 20, the NVR port is an access port in VLAN 20, the uplink to the gateway or the next switch is a trunk carrying VLANs 10, 20, 30, 40 and 99, and the native or untagged VLAN on that trunk should be left as an unused VLAN rather than VLAN 20. Set the PVID on each camera port to 20 so that an untagged camera — which is all of them, out of the box — lands in the right place.
The mistake that costs a return visit is tagging the camera ports. Cameras do not tag their own traffic. Tag the uplink, not the edge.
How to configure a CCTV VLAN on a Reyee managed switch
On a Reyee L2 managed switch you create the VLAN, assign the camera and NVR ports to it as access ports, then tag it on the uplink — three steps, from either the local web UI or Ruijie Cloud. Ruijie publishes the full procedure in the ReyeeOS configuration guide for the RG-NBS and NIS3100 series, and the sequence below is the short installer version.
- Reach the switch. Out of the box a Reyee switch answers on 10.44.77.200 or via the Reyee app. Set a static management address on VLAN 99 and change the default password before anything else.
- Create the VLANs. Under VLAN settings add VLAN 20 named CCTV, plus 10, 30, 40 and 99 as needed. Do not delete VLAN 1.
- Assign access ports. Set every camera port and the NVR port to access mode with PVID 20.
- Tag the uplink. Set the SFP or copper uplink to trunk mode and permit VLANs 10, 20, 30, 40 and 99.
- Give VLAN 20 a gateway. Either a routed interface on the switch, or a sub-interface on the Reyee gateway — see the routing section below.
- Save and adopt to cloud. Commit the configuration, then adopt the switch into Ruijie Cloud so the VLAN layout is backed up and visible remotely.
Ruijie Cloud is worth the ten minutes at commissioning: VLANs can be created and edited from the Ruijie Cloud app rather than a site visit, and the switch reports port status and PoE draw remotely. Our Reyee Cloud multi-site guide covers adopting devices across several customers under one account.
Where should the NVR sit — camera VLAN or site LAN?
Put the NVR in the CCTV VLAN, not the site LAN. The recorder needs constant, high-bandwidth Layer 2 access to every camera, and putting it in VLAN 20 keeps that traffic off the router entirely.
Client access is then handled one of two ways. On a small job, give the NVR a second network interface or a routed path so the customer's PC in VLAN 10 can reach only the NVR's web port. On a larger job, keep the NVR entirely inside VLAN 20 and let clients reach it through Hik-Connect or a VPN back to the gateway. Recorders with dual NICs make this trivial; our Hikvision NVR buyer's guide lists which ranges have two ports, and the CCTV storage guide covers drive sizing once the retention target is agreed.
One caution on Hikvision and HiLook NVRs with built-in PoE ports: those ports run their own internal 192.168.254.x network and are a separate segment already. If you use them, the cameras never touch your VLAN at all — which is fine, but it also means those cameras cannot be reached from a laptop on VLAN 20 for maintenance without going through the recorder.
Inter-VLAN routing: gateway or L2+ switch?
Traffic between two VLANs has to be routed, and you have two places to do it: on a Reyee gateway, or on an L2+ switch with static routing. Use the gateway when you want firewall rules between segments; use the switch when you want line-rate routing and the segments are broadly trusted.
For small and medium sites the gateway is the right answer. The RG-EG105G-P-V3 is a five-port cloud-managed router with four PoE+ ports on a 54 W budget and dual-WAN support, which suits a single-cabinet job (Ruijie RG-EG105G-P-V3 product page). Step up to the RG-EG210G-P-V3 for around 200 users, or the rack-mount RG-EG310GH-P-E for 300-user sites with eight PoE+ ports. Our Reyee EG gateway guide compares the whole range.
Where the CCTV VLAN is large and you want the recorder traffic to stay off the router, an L2+ switch such as the RG-NBS5200-24GT4XS or the PoE version, the RG-NBS5200-24GT4XS-P, will route between VLANs in hardware with static routes. In a multi-cabinet building the all-fibre RG-NBS5500-12XS makes a tidy 10G aggregation and routing core.
Mapping a Wi-Fi SSID to a VLAN
A Reyee access point can put each SSID into a different VLAN, so a commissioning SSID can drop your laptop straight into VLAN 20 without patching a cable. Configure the AP's uplink port as a trunk carrying the VLANs the SSIDs need, then set the VLAN ID per SSID.
In practice we set up three: a customer SSID in VLAN 30, a staff SSID in VLAN 10, and a hidden engineering SSID in VLAN 20 with a strong key that gets changed at handover. The RG-RAP2260 is the usual ceiling AP for this on smaller sites; see our Reyee Wi-Fi 7 AP guide and outdoor AP guide for larger deployments.
Locking the CCTV VLAN down: DHCP, ACLs and internet access
Segmentation only pays off if you also decide what the CCTV VLAN is allowed to reach. Cameras should have no route to the internet at all; only the NVR needs outbound access, and only for cloud connection, time sync and firmware.
The practical checklist on a Reyee gateway is short. Give VLAN 20 a DHCP scope with a reservation range so cameras keep their addresses, or use static IPs from a documented block. Enable DHCP snooping on the switch so a rogue DHCP server plugged into a camera port cannot hand out addresses. Add a gateway rule that permits VLAN 10 to reach only the NVR's web and client ports on VLAN 20, and denies everything else. Finally, deny VLAN 20 to VLAN 30 and VLAN 40 entirely — there is no reason for a camera to talk to a door controller.
Point NTP at the gateway rather than the internet, because recorded footage with the wrong timestamp is evidentially weak. Segmentation is one control among several — change every default password, keep camera and recorder firmware current, and disable UPnP on the gateway so nothing punches its own holes outbound.
Multicast, IGMP snooping and why CCTV VLANs go wrong
If live view stutters after you segment a site, the usual culprit is multicast flooding, and the fix is IGMP snooping on the CCTV VLAN. Multicast streams from cameras are otherwise treated as broadcast and copied to every port in the VLAN, which chews bandwidth on a 24-port switch.
Every Reyee managed switch in the RG-NBS3100 and RG-NBS3200 families supports IGMP snooping alongside link aggregation and VLANs. Enable it on VLAN 20 and nominate the switch as querier if there is no router inside that VLAN. The other two classic faults are a trunk that does not permit VLAN 20 somewhere along the path, and a camera port left in VLAN 1 — both show as a camera that pings from the switch but never appears in the NVR.
Remote access and Hik-Connect on a segmented network
Hik-Connect still works with the cameras isolated, because the NVR makes the outbound connection on the customer's behalf. Allow the NVR outbound HTTPS and the Hik-Connect ports from VLAN 20, keep the cameras denied, and the app behaves exactly as it does on a flat network.
Do the P2P registration and the customer handover at commissioning rather than leaving it — our Hik-Connect setup and handover guide and the iVMS-4200 installer guide walk through both, and Hikvision SADP and Batch Configuration Tool remain the quickest way to find devices once they are behind a VLAN boundary. Note that SADP works by broadcast, so you must run it from a machine inside VLAN 20 — that hidden engineering SSID earns its keep here.
Which Reyee kit for 8, 24 or 48 cameras?
Size the switch on PoE budget first and port count second, then check the uplink is fast enough for the aggregate camera bitrate. A 24-camera 4 MP site at 8 Mbps per main stream is around 200 Mbps, which a gigabit uplink handles, but a 48-camera 8 MP site is not the place for a single gigabit trunk.
| Site | Switch | Gateway | Notes |
|---|---|---|---|
| Up to 8 cameras | RG-NBS3100-8GT2SFP-P-V2 | RG-EG105G-P-V3 | 125 W PoE, fanless, 2×SFP uplink |
| Up to 8, existing PoE | RG-NBS3100-8GT2SFP-P or non-PoE RG-NBS3100-8GT2SFP | RG-EG105G-P-V3 | Same VLAN feature set, lower cost |
| Up to 24 cameras | RG-NBS3100-24GT4SFP-P-V2 or RG-NBS3200-24GT4XS-P | RG-EG210G-P-V3 | 370 W PoE; the 3200 adds 10G uplinks |
| 24 cameras, PoE elsewhere | RG-NBS3200-24GT4XS | RG-EG210G-P-V3 | 4×10G SFP+ for the recorder ring |
| Up to 48 cameras | RG-NBS3100-48GT4SFP-P-V2 or RG-NBS3200-48GT4XS | RG-EG310GH-P-E | Check total PoE draw against the 370 W budget |
| Multi-cabinet / routing core | RG-NBS5200-24GT4XS-P + RG-NBS5500-12XS | RG-EG310GH-P-E | Static routing between VLANs on the switch |
Both 24-port and 48-port PoE variants in the RG-NBS3100 and RG-NBS3200 families share a 370 W PoE budget with a 30 W maximum per port (Ruijie RG-NBS3200 series specifications), so a 48-camera site with 15 W cameras is already at the limit before you add a heater or a PTZ. The 48-port RG-NBS3200-48GT4XS carries the same four 10G SFP+ uplinks as its 24-port sibling (Ruijie RG-NBS3200-48GT4XS product page), which is what you want when 48 cameras share one trunk. For unheated plant rooms and gatehouses, the DIN-rail industrial range in our RG-NIS industrial switch guide runs the same VLAN feature set in a hardened case, and if you are mixing brands, our Hikvision PoE switch guide covers the equivalent Hikvision models.
Frequently asked questions
Do IP cameras need to be on a separate VLAN?
Not always, but it is best practice on any site where the cameras share cabling or an internet connection with business systems. A VLAN stops a compromised camera from reaching PCs and servers while still letting it talk to the NVR.
Can I create a CCTV VLAN on an unmanaged switch?
No. Unmanaged switches such as the RG-ES108GD have no configuration interface. You need at least a smart switch like the RG-ES208GC, or preferably an L2 managed model such as the RG-NBS3100-8GT2SFP-P-V2.
Should the camera ports be tagged or untagged?
Untagged. Cameras and NVRs do not tag their own traffic, so each camera port is an access port with the PVID set to the CCTV VLAN. Only inter-switch and gateway uplinks are tagged trunks.
Will Hik-Connect still work if the cameras are on their own VLAN?
Yes. The NVR makes the outbound cloud connection, so allow the recorder outbound access from the CCTV VLAN and keep the cameras denied. Remote live view and playback are unaffected.
How do I find cameras with SADP once they are behind a VLAN?
SADP relies on broadcast, so run it from a laptop inside the CCTV VLAN — either on a spare access port or via an engineering SSID mapped to that VLAN on a Reyee access point.
Do I need Layer 3 switching, or is the gateway enough?
A gateway such as the RG-EG210G-P-V3 handles inter-VLAN routing on most CCTV sites. Move routing to an L2+ switch like the RG-NBS5200-24GT4XS when the volume of cross-VLAN traffic would otherwise bottleneck the router.
Order Reyee managed switches from Netview
Netview is a Ruijie Reyee authorised UK wholesaler based in Leicester. We hold the RG-NBS managed switch, RG-ES smart switch and RG-EG gateway ranges in stock for same-day dispatch, and can pre-configure VLANs before shipping. Browse the full Reyee networking range or see all the brands we stock at netviewcctv.co.uk.
Related guides
About the Author
