ONVIF Over the Internet: Can You Use ONVIF Cameras Remotely?

If you have a set of ONVIF-compliant IP cameras and want to watch them from outside your home or office network, you have probably run into a wall. ONVIF Device Manager finds your cameras instantly on the LAN, but the moment you try to use the same approach from the internet — nothing. No devices discovered. Just silence.

This article explains exactly why that happens, what ONVIF actually is (and is not), and the practical steps to get your ONVIF cameras accessible from anywhere in the world.

What ONVIF Actually Is

ONVIF (Open Network Video Interface Forum) is an open industry standard that defines a common protocol for IP-based physical security products. It is not a streaming protocol. ONVIF is a device management and interoperability layer — it gives software tools a standardised way to talk to cameras from different manufacturers.

Through ONVIF you can:

• Discover cameras on your local network (WS-Discovery)
• Query device information: model, firmware version, capabilities
• Retrieve the RTSP stream URL for the camera's video output
• Configure video encoding parameters (resolution, bitrate, codec)
• Send PTZ (Pan-Tilt-Zoom) control commands
• Manage users, time, and network settings
• Subscribe to event notifications (motion detection, tampering, etc.)

The actual video data is not carried by ONVIF. Once ONVIF tells you the camera's RTSP URL, RTSP takes over for the live stream. ONVIF is the handshake; RTSP is the pipeline.

Why WS-Discovery Only Works on a LAN

ONVIF camera discovery is built on WS-Discovery (Web Services Dynamic Discovery), a protocol that uses UDP multicast to announce and find devices. When ONVIF Device Manager launches a discovery probe, it sends a multicast UDP datagram to the well-known SSDP/WS-Discovery address 239.255.255.250 on port 3702.

Multicast datagrams have a Time-To-Live (TTL) of 1 by default, which means they are discarded at the first router hop. They never leave the local subnet. This is by design — multicast discovery is a broadcast mechanism intended for devices physically on the same network segment.

This means ONVIF WS-Discovery:

• Works perfectly on a LAN where the PC and cameras share the same subnet
• Will not work across VLANs unless multicast routing is enabled
• Will never work directly over the internet — no exceptions

ONVIF Profile S and RTSP Streaming

ONVIF defines several Profiles that describe which features a device must support to be compliant:

• Profile S — live video and audio streaming (RTSP), video encoder configuration, PTZ
• Profile G — on-device recording and storage
• Profile T — advanced video streaming including H.265 and metadata
• Profile M — metadata and analytics

Most consumer and prosumer IP cameras are Profile S compliant. Profile S requires the camera to expose an RTSP URL that a client can connect to in order to receive the live video stream. That RTSP URL typically looks like:

rtsp://192.168.1.64:554/stream1
rtsp://admin:password@192.168.1.64:554/Streaming/Channels/101
rtsp://192.168.1.64:554/h264/ch01/main/av_stream

The exact path varies by manufacturer (Hikvision, Dahua, Reolink, Axis, etc.). ONVIF Profile S provides a standardised way to ask the camera for its RTSP URL without you having to look it up in a manual.

The Common Misconception

Many users think "ONVIF" means everything about their camera is standardised and accessible remotely. The confusion stems from the fact that ONVIF Device Manager is often the first tool that works to connect to an IP camera — so people associate ONVIF with "the thing that streams video."

The reality is:

• ONVIF = management, discovery, configuration (local LAN only for discovery)
• RTSP = the actual video stream transport (TCP, can in principle go over internet)
• The internet problem is a network access problem, not an ONVIF limitation per se

If you directly exposed your camera's RTSP port (554) to the internet via port forwarding, the RTSP stream would work remotely — but you would be opening an unauthenticated port on your router, which is a serious security risk. The correct solution is to relay the stream through a secure intermediary.

Step 1: Get Your Camera's RTSP URL Using ONVIF

Before you can relay a stream, you need the camera's RTSP URL. The easiest way is to use ONVIF Device Manager (ODM) — a free Windows application — from a machine on the same LAN as the camera.

Using ONVIF Device Manager

1. Download ONVIF Device Manager from sourceforge.net/projects/onvifdm
2. Launch it on a Windows PC connected to the same network as your cameras
3. Click Refresh — your cameras should appear in the left panel via WS-Discovery
4. Select a camera, enter its credentials if prompted
5. Navigate to the Live Video or Media tab
6. The RTSP URL is displayed — copy it

The URL will be something like:

rtsp://192.168.1.64:554/Streaming/Channels/101

Using Python (onvif-zeep library)

If you want to retrieve RTSP URLs programmatically from the LAN:

from onvif import ONVIFCamera

cam = ONVIFCamera('192.168.1.64', 80, 'admin', 'password123')
media = cam.create_media_service()
profiles = media.GetProfiles()

for profile in profiles:
    req = media.create_type('GetStreamUri')
    req.ProfileToken = profile.token
    req.StreamSetup = {
        'Stream': 'RTP-Unicast',
        'Transport': {'Protocol': 'RTSP'}
    }
    uri = media.GetStreamUri(req)
    print(f"Profile: {profile.Name}  RTSP: {uri.Uri}")

Once you have the RTSP URL (with credentials embedded or passed separately), you are ready for step 2.

Step 2: Relay the RTSP Stream via TheRelay

Now that you have the camera's local RTSP URL, the goal is to make it accessible from the internet — securely, without opening firewall ports. This is exactly what TheRelay is built for.

TheRelay runs a lightweight agent on your LAN. The agent connects outbound to TheRelay's cloud infrastructure and maintains a persistent tunnel. Your cameras never need inbound firewall rules.

How to add an ONVIF camera to TheRelay

1. Install the TheRelay agent on any machine on the same LAN as your cameras (Linux, Windows, or Docker)
2. In the TheRelay dashboard, click Add Camera
3. Enter the RTSP URL you retrieved from ONVIF Device Manager
4. TheRelay will assign cloud endpoints for the stream

TheRelay also supports ONVIF auto-discovery directly in the agent — it runs WS-Discovery on your LAN and populates the camera list automatically, so you often do not need to manually copy RTSP URLs at all.

Once added, your camera is accessible via cloud endpoints:

• WebRTC — browser playback, no plugin needed
• RTSP — rtsp://stream.therelay.net/your-stream-token for NVR or VLC
• HLS — for web players and mobile apps
• RTMP — for streaming software like OBS
• SRT — low-latency broadcast use cases

Pricing is $2 per stream per month — a straightforward flat rate with no bandwidth caps.

Local ONVIF vs Remote RTSP Relay — Comparison

Frequently Asked Questions

Does ONVIF work over the internet remotely?

Not for discovery. ONVIF WS-Discovery uses UDP multicast, which does not traverse routers or the internet. The RTSP stream that ONVIF Profile S cameras expose can technically work over the internet, but only if you have a secure way to reach the camera's network — such as a VPN or a cloud relay service like TheRelay.

What is ONVIF Profile S?

ONVIF Profile S is the specification that defines how IP cameras expose live video and audio streams via RTSP. A Profile S-compliant camera must support streaming configuration, RTSP-based media delivery, and optionally PTZ control. It is the most widely implemented ONVIF profile and supported by virtually all modern IP cameras.

How do I find my camera's RTSP URL using ONVIF?

The simplest method is to use the free ONVIF Device Manager application on a Windows PC that is on the same LAN as the camera. It will auto-discover cameras via WS-Discovery and show their RTSP URLs. Alternatively you can use the onvif-zeep Python library to query the camera's media service programmatically. TheRelay's agent also performs ONVIF discovery automatically, so you may not need a separate tool.

Can I control PTZ remotely without ONVIF?

PTZ control commands in ONVIF are sent as SOAP HTTP requests directly to the camera's local IP address. This means PTZ control inherently requires IP-level access to the camera — either by being on the LAN, or through a VPN/tunnel that routes traffic to the camera's private IP. TheRelay relays the video stream but does not proxy ONVIF PTZ command traffic. For remote PTZ, a VPN that extends your LAN access is the appropriate tool alongside a stream relay for the video.

Does TheRelay support ONVIF camera discovery?

Yes. The TheRelay agent runs on your LAN and can perform ONVIF WS-Discovery to automatically detect cameras on your network. This means you can add cameras to TheRelay without manually looking up each camera's RTSP URL — the agent does the discovery for you locally and registers the streams with the cloud infrastructure.