Most home cameras are sold as a pair: the camera and the manufacturer's app, with clips stored in the vendor's cloud. That works until the subscription price goes up, the service shuts down or someone finds a hole in it. In October 2026 CERT-UA warned that attackers were reaching Dahua cameras through the Easy4IP cloud feature by guessing serial numbers, without any open port on the victim's router (we covered it in the news section).

The alternative is to treat the camera as a plain video source on your network and do the recording, viewing and motion detection on hardware you control. Two standards make that possible: RTSP and ONVIF. Below is what each one does, how to check a camera before you buy it, how to get a working stream and how to keep the whole setup closed to the outside world.

RTSP and ONVIF are not the same thing

RTSP (Real-Time Streaming Protocol) is how you get the video itself. A camera that supports it exposes one or more stream addresses, usually on port 554, and any compatible player or recorder can pull the picture from them. VLC can play it, an NVR can record it, Frigate can analyse it. RTSP does not discover cameras or change their settings. You need to know the address.

ONVIF is an industry standard for talking to the camera as a device: finding it on the network, reading its stream addresses, controlling pan and tilt, receiving motion events and, on some models, managing recordings. ONVIF groups features into profiles:

  • Profile S: basic video streaming and configuration, plus PTZ, audio and relay outputs where the device has them.
  • Profile T: advanced streaming with H.264 and H.265, imaging settings, motion and tampering events, metadata and two-way audio.
  • Profile G: recording on the device (for example on its SD card) and searching and retrieving those recordings.
  • Profile M: analytics metadata and events, such as detected objects, and optionally events sent over MQTT.

In practice, a recorder often uses ONVIF to find the camera and read its settings, then pulls the video over RTSP. Tapo's own help pages put it the same way: RTSP gives a direct video stream, while ONVIF adds management features such as PTZ control.

Profile S is on its way out

ONVIF announced on 9 October 2025 that it is ending support for Profile S. After 31 March 2027, manufacturers can no longer submit new products or new firmware versions for Profile S conformance. The reason is security: Profile S requires "username token" authentication, which ONVIF now describes as too weak to protect against unauthorised access. Profile T, introduced in 2018, contains virtually all of Profile S plus digest authentication and optional HTTPS media transport.

Cameras you already own keep working. ONVIF says deployed Profile S systems are not affected, although individual vendors may remove username token support in future firmware. For new purchases, look for Profile T in the specification. If a box only says "ONVIF" without a profile, check the product on the ONVIF conformant products list or ask the seller.

Check before you buy

Support for these protocols varies more than the marketing suggests, even within one brand. Reolink is a good example because it publishes a clear table:

  • PoE and mains-powered Wi-Fi cameras, such as the RLC and Duo series, support RTSP and ONVIF on their own.
  • Battery-powered Wi-Fi cameras (the Argus and Altas series, the battery doorbell) support them only through a Reolink Home Hub or NVR.
  • 4G LTE cameras do not support them at all.

Tapo says its wired cameras support RTSP and ONVIF Profile S. The pattern is common: battery cameras sleep most of the time to save power, so they rarely offer a stream that a recorder can pull around the clock. If you want continuous recording, choose a wired camera, preferably PoE, which also gives you power and network over a single cable.

A short checklist for the product page or manual:

  1. RTSP support, with the stream URL documented.
  2. ONVIF, ideally with Profile T.
  3. A main stream and at least one sub stream, so you can record in high resolution and view or analyse a lighter stream.
  4. H.264 as an option. H.265 saves space, but browser support is limited. Frigate's documentation says H.264 with AAC audio gives the best compatibility.
  5. A way to use the camera without a cloud account, or at least to turn off remote access.

Getting the stream URL

Every manufacturer builds the RTSP address differently, so check the documentation. Two examples:

Tapo. First create a separate camera account in the app: tap the camera, open the settings (gear icon), then Advanced Settings > Camera Account. This is not your Tapo login. Username and password must be 6-32 characters. The streams are then:

rtsp://user:[email protected]:554/stream1   (high quality)
rtsp://user:[email protected]:554/stream2   (lower quality)

ONVIF on Tapo cameras uses port 2020.

Reolink. On models that have port switches, enable RTSP and ONVIF first (in the Reolink Client: Device Settings > Network > Advanced > Server Settings). Reolink lists these addresses:

rtsp://user:[email protected]:554/Preview_01_main
rtsp://user:[email protected]:554/Preview_01_sub

Older firmware uses h264Preview_01_main or h265Preview_01_main. The default ONVIF port is 8000.

Test the address before you configure any recorder. In VLC, open Media > Open Network Stream and paste the URL. On a Linux machine with FFmpeg installed, ffprobe shows the codec, resolution and frame rate:

ffprobe -rtsp_transport tcp "rtsp://user:[email protected]:554/stream1"

If VLC shows a picture but your recorder does not, the problem is in the recorder configuration, not the camera.

Where to record

You have several options, from closed boxes to open software:

  • A standalone NVR. A dedicated recorder with disks, often from the camera manufacturer. Simple, but its own firmware and remote access need the same care as the cameras.
  • A NAS. Synology Surveillance Station, for example, can add cameras by ONVIF or by a manually entered RTSP URL. Reolink and Tapo both document this route.
  • Agent DVR, Blue Iris and similar software on a home computer or server. Tapo's guide uses Agent DVR as its ONVIF example.
  • Frigate. Open-source NVR with object detection, running in Docker. It works standalone and integrates with Home Assistant if you use it.

Whatever you choose, the camera settings matter as much as the software. Frigate's camera setup guide is useful even if you never install Frigate. It suggests three separate roles:

  • Recording: the main stream, at full resolution, around 15 fps.
  • Detection: the sub stream at a moderate resolution, 5 fps. Frigate notes that 5 fps is right for almost every camera, and that higher detection resolution does not improve accuracy unless objects are very small in the frame.
  • Live viewing: a stream light enough to load reliably on a phone.

Set resolution and frame rate in the camera rather than reducing them in software. Frigate points out that dropping frames on the server wastes CPU, because it has to decode the frames it then throws away. It also recommends the same aspect ratio for both streams: if the main stream is 3840x2160, use 640x360 for the sub stream, not 640x480.

One camera, several viewers

Cheap cameras may struggle when several clients pull the same stream at once. go2rtc solves this by connecting to the camera once and restreaming the video to everyone else over RTSP, WebRTC and other formats. The simplest configuration is a single entry:

streams:
  driveway: rtsp://user:[email protected]:554/Preview_01_main

Mind the defaults: go2rtc opens its web interface on port 1984, RTSP on 8554 and WebRTC on 8555, all reachable from the local network, and the documentation states plainly that anyone on that network can watch the cameras without authorisation. Set a username and password in its configuration, or keep it on a network that only you control.

Keep the cameras off the internet

Local recording only helps if the camera cannot still talk to the vendor's cloud in the background. A few rules:

  • Do not forward ports. Reolink's documentation explains that RTSP works over the internet if you set up port forwarding. Do not. Use a VPN such as WireGuard or Tailscale to reach your recorder from outside.
  • Turn off P2P and UID remote access in the camera settings if you do not use the app. That is the feature abused in the Dahua case.
  • Block internet access at the router. Put the cameras on a separate VLAN or Wi-Fi network and allow traffic only to the recorder. The VLAN article shows how to plan the rules. Expect the vendor app to stop working remotely, which is the point.
  • Treat RTSP credentials as passwords. They travel inside the URL and end up in configuration files. Tapo advises using RTSP and ONVIF only on trusted local networks with encrypted Wi-Fi, and using a camera account password that differs from your cloud account.
  • Update the firmware. With the cloud blocked, the vendor app may no longer offer updates, so check the manufacturer's site from time to time and install them manually.

Common problems

  1. The stream works in VLC but not in the browser. Browsers do not play RTSP. You need a recorder or a restreamer such as go2rtc that converts it, for example to WebRTC.
  2. The picture freezes or smears. Try forcing TCP transport (-rtsp_transport tcp in FFmpeg tools, a similar option in most recorders). Over Wi-Fi, also check signal strength.
  3. H.265 does not play. Switch the stream that you view to H.264. Keep H.265 for recording only if the recorder handles it.
  4. The recorder cannot find the camera through ONVIF. Check the ONVIF port (2020 on Tapo, 8000 by default on Reolink) and whether ONVIF is enabled at all. Discovery may not cross VLANs, so add the camera by IP address.
  5. Special characters in the password break the URL. Characters such as @, : or / must be URL-encoded, or simply avoided in the camera account password.