How to Access RTSP Cameras Without Opening Ports or Port Forwarding

You have IP cameras on your local network. You want to access their RTSP streams from the internet — from a remote office, a cloud server running OpenCV, or an AI application. But every guide you find tells you to open port 554 on your router and forward it to your camera.

That works — but it's a terrible idea for anything beyond a home lab. Port forwarding exposes your camera directly to the internet, and IP cameras are notoriously poorly secured. There's a better way.

This guide covers 4 methods to access RTSP cameras remotely without opening ports, with honest pros, cons, and real setup instructions for each.

Why Not Just Port Forward RTSP?

Port forwarding RTSP (port 554) seems like the obvious solution. You log into your router, create a rule mapping external port 554 to your camera's internal IP, and you're done. So why avoid it?

• Security: Your camera is now reachable by anyone on the internet. Hikvision, Dahua, and many other camera brands have had severe CVEs — remote code execution, authentication bypasses, and credential leaks. Shodan regularly indexes thousands of exposed cameras.
• ISP restrictions: Many ISPs block port 554 inbound. Business ISPs often block all non-standard ports. You may not even be able to get this working.
• Dynamic IPs: Your public IP changes, breaking any integration that relies on a fixed endpoint.
• Multiple cameras: Each camera needs a different external port (554, 555, 556...), making management complex and fragile.
• Corporate/apartment networks: You may not have access to the router at all.

In short: port forwarding works for a quick test, but it's not a solution you'd put into production. Here are the real alternatives.

Method 1: Cloud Relay Agent

How to Set It Up (TheRelay)

1. Create account Sign up at app.therelay.net — free to start.
2. Install the Agent on your LAN Download the agent for Windows (.exe) or Linux (.sh installer). Run it on any machine that can reach your cameras on the same network.
3. Add your cameras Paste your RTSP URLs in the dashboard. The format is typically:

   rtsp://username:password@192.168.1.100:554/Streaming/Channels/101

   The agent reads the stream locally — credentials never leave your network.
4. Create an access token Generate a token to control who can access the stream. Scope it to a specific camera or your entire account.
5. Access from anywhere Use the cloud endpoint in any player or integration:

   # VLC
   vlc rtsp://therelay.net:554/camera/{id}?token={token}
   
   # ffmpeg
   ffmpeg -i "rtsp://therelay.net:554/camera/{id}?token={token}" ...
   
   # OpenCV (Python)
   cap = cv2.VideoCapture("rtsp://therelay.net:554/camera/{id}?token={token}")

Method 2: VPN Mesh Network

Setup with Tailscale (Easiest VPN Option)

1. Install Tailscale on the machine next to your cameras: curl -fsSL https://tailscale.com/install.sh | sh
2. Run tailscale up and log in
3. Install Tailscale on your remote machine and log in with the same account
4. Find the Tailscale IP of the local machine: tailscale ip
5. Access RTSP using the Tailscale IP: rtsp://user:pass@100.x.x.x:554/stream

Method 3: Reverse Proxy over SSH Tunnel

Basic Setup

# On your LAN machine — open reverse tunnel to your VPS
# This forwards VPS port 8554 to camera at 192.168.1.100:554
ssh -R 8554:192.168.1.100:554 user@your-vps-ip -N

# Keep it persistent with autossh
autossh -M 0 -R 8554:192.168.1.100:554 user@your-vps-ip -N

# On the VPS — access the stream via the tunnel
ffplay rtsp://localhost:8554/stream

Method 4: Dynamic DNS + UPnP

Side-by-Side Comparison

Frequently Asked Questions

Can I access an RTSP camera without port forwarding?

Yes. Using a cloud relay agent like TheRelay, your camera's RTSP stream is tunneled from your LAN to the cloud via an outbound-only encrypted connection. No port forwarding, no VPN, no firewall changes are needed. The agent on your LAN initiates an outbound SRT connection to the cloud server — the same way your browser opens HTTPS connections, requiring no inbound firewall rules.

Why can't I access my RTSP camera from outside my network?

RTSP cameras sit on a private LAN behind NAT (Network Address Translation). Your router blocks all inbound connections by default — this is actually a security feature. To reach an RTSP camera from the internet without port forwarding, you need a technique that works from the inside out, like a cloud relay or VPN.

Is it safe to port forward RTSP (port 554)?

It works but it's not recommended for production. Port 554 exposes your camera's authentication interface directly to the internet. Hikvision, Dahua, and many other camera brands have had well-documented CVEs including unauthenticated access, remote code execution, and credential exposure. Using a cloud relay with encrypted transport and token-based access control is significantly safer.

Does RTSP work over the internet without port forwarding?

Standard RTSP cannot traverse NAT without port forwarding or a tunnel — it's a stateful protocol that requires inbound connections. However, cloud relay services like TheRelay accept the RTSP stream from your LAN agent and re-expose it as an internet-accessible endpoint. You still consume RTSP (or WebRTC, HLS, SRT) at the cloud end, without any port forwarding requirement on your LAN side.

What RTSP URL format should I use for Hikvision cameras?

Hikvision cameras use this RTSP URL format:

# Main stream (high quality)
rtsp://username:password@192.168.1.100:554/Streaming/Channels/101

# Sub stream (lower bandwidth)
rtsp://username:password@192.168.1.100:554/Streaming/Channels/102

See the full Adding Cameras guide for Dahua, Axis, and generic RTSP URL formats.

Can I use OpenCV with cloud RTSP endpoints?

Yes. Once your camera is published through TheRelay, the cloud RTSP endpoint works with any standard RTSP client:

import cv2

cap = cv2.VideoCapture("rtsp://therelay.net:554/camera/{camera_id}?token={token}")
while True:
    ret, frame = cap.read()
    if not ret:
        break
    cv2.imshow("Camera", frame)
    if cv2.waitKey(1) & 0xFF == ord('q'):
        break

cap.release()