Connecting Sites and Remote Support Safely: VPNs, Not Open Ports

SSMS brings cameras from many sites into one console. To do that, video has to travel across your network. How you build those links decides how safe your cameras are. This guide is for IT admins. It explains the safe way to connect sites and to give Skyline remote access for support.

How sites reach the SSMS server

Every site needs a network path to the SSMS server. Skyline checks this during the site survey. There are two common paths:

• WAN: the private network that links your sites, often supplied by a telecom provider.
• Site-to-site VPN: an encrypted tunnel over the internet between two sites. Encrypted means the data is scrambled, so outsiders cannot read it.

Both paths keep camera video inside your own network. Neither one needs your cameras to be visible on the public internet.

Never open ports to cameras, NVRs or the SSMS server

Port forwarding means opening a port on your router, so anyone on the internet can reach a device inside your network. It is a common shortcut for viewing cameras from home. It is also one of the most common ways cameras get attacked.

• Do not forward ports to cameras or NVRs.
• Do not forward ports to the SSMS server.
• Check every site's router for old forwarding rules left by a past installer. Remove them.
• Switch off UPnP on routers if your IT policy allows it. UPnP is a router feature that lets devices open ports by themselves.

Keep cameras on their own network

Put cameras and NVRs on a separate network segment, such as a VLAN. A VLAN is a separate virtual network that runs on the same switches. It keeps camera traffic away from office computers and guest Wi-Fi.

Then use firewall rules to control what can talk to what. A firewall is a device or program that allows or blocks network traffic by rules. A typical starting point looks like this:

Your Skyline engineer and your IT team agree the exact rules during deployment. Tell Skyline before you change firewall rules or IP addresses that SSMS relies on.

Remote access for the Skyline engineer

Skyline's deployment support is remote. So during setup, the engineer needs remote access to your server. Give that access in a controlled way:

1. Use the remote access method your IT team approves.
2. Create a separate login for the engineer. Do not share an admin password.
3. Make the access temporary. Set an end date, or switch it on only for the session.
4. Make sure IT knows when each session starts and ends.
5. Remove or disable the access when setup is finished.
6. For later support, switch it on again only for that support session.

Keep routers and devices up to date

• Change the default passwords on routers, firewalls, NVRs and cameras.
• Keep firmware up to date. Firmware is the software inside a device. Test an update on one device first.
• Review your forwarding rules and remote access accounts every few months.

Watching from outside the office

Watching video from home or on a phone is not among SSMS's confirmed capabilities. If staff need this, ask Skyline to confirm in writing what your deployment supports. If it is supported, connect through a VPN, never through open ports.

Where to go next

• Keeping SSMS secure: passwords, workstations and camera logins
• Watching branches and remote sites from one console
• Estimating storage and bandwidth
• Getting help: what to send Skyline support

Quick checklist

• Every site reaches the SSMS server over a WAN or a site-to-site VPN.
• No router forwards ports to cameras, NVRs or the SSMS server.
• Cameras and NVRs sit on their own network segment.
• Firewall rules block cameras from the internet and from office networks.
• The engineer's remote access is separate, temporary and switched off after use.
• Default passwords are changed and firmware is current.