How to View CCTV Cameras Remotely on Your Smartphone

In Depth

In Depth

You can watch your CCTV from your phone using the official app from your recorder's manufacturer or a VPN, without opening your recorder to the internet. This guide explains how remote viewing works, how to set it up safely and how to share access properly.

How remote viewing works

Your cameras send video over cables (or Wi-Fi) to a recorder: an NVR for IP cameras, or a DVR for analogue and HD-analogue cameras. Some standalone cameras record to a memory card instead. If you are not sure what you have, CCTV cameras explained covers the basics.

Your phone has to reach that recorder across the internet. The recorder sits behind your router, which by design blocks unsolicited connections from outside, so something has to make the connection possible. There are three common ways, and they are not equally safe.

Upload speed matters more than download speed. Internet plans are sold on download speed, but remote viewing uses the site's upload. The full-quality main stream uses far more data than the sub-stream (the lower-quality second stream most recorders offer), so use the sub-stream on mobile data. Our CCTV storage calculator shows typical bitrates per camera.

The three ways to connect

1. The manufacturer's cloud or P2P service. The recorder makes an outgoing connection to the maker's service, and the app finds it by serial number or QR code. No router ports are opened. For most owners this is the simplest safe option, provided the account is well protected. The trade-off is that you rely on the manufacturer's service and its security.

2. A VPN (virtual private network). Your phone joins the site's network through an encrypted tunnel, and the app talks to the recorder as if you were in the building. The recorder is never visible to the internet. The VPN can run on a business router or firewall, or be a "mesh" VPN service that uses outgoing connections and often works where the ISP does not give you a public IP address.

3. Direct port forwarding. The router passes internet traffic straight to the recorder. It is quick, and it puts the recorder's login page in front of anyone scanning the internet. We do not recommend it.

Warning Hikvision's command-injection flaw CVE-2021-36260 let attackers send commands to the web server of affected cameras and recorders. CISA added it to its Known Exploited Vulnerabilities catalog in January 2022, meaning it was used in real attacks. A device whose web server is open to the internet can be attacked before the owner has a chance to update it.

Why exposing the recorder is risky

The UK's National Cyber Security Centre (NCSC) advises camera owners to consider turning off UPnP and port forwarding on the router, because criminals can use them to reach cameras on your network. CISA's internet exposure guidance tells organisations to remove what does not need to be reachable from the internet and to put necessary remote access behind a VPN or similar controlled gateway. In plain terms: any login page on the open internet will be found and tried, and recorders often go years without updates.

UPnP (Universal Plug and Play) lets devices open router ports by themselves, so a recorder can expose itself without anyone deciding to. Keep it off on the router and the recorder unless you have a specific need.

Manufacturer apps at a glance

Use the app named by your recorder's manufacturer, downloaded from the official App Store or Google Play listing. Look-alike apps exist, and an app from the wrong maker either will not work or asks for more access than it needs.

The details differ by app version and recorder firmware, so the app selector on this page lists each method with its official source. A few points apply to all of them:

• The verification code is not the admin password. Hik-Connect, for example, asks for a device verification code printed on the label or created when the service was enabled.
• A device can belong to only one owner account. If an installer added it to their own account, it must be unbound from that account before you can add it to yours.
• The recorder must be online with the cloud service first. If its status page says offline, the app cannot find it, however many times you scan.

Security that matters

1. Update first. Install the latest recorder and camera firmware from the manufacturer's official site or the recorder's built-in update, and keep the app updated. CISA recommends automatic updates wherever possible.
2. Use strong, unique passwords for the recorder and for the app account. CISA recommends at least 16 characters, a different password for every account and a password manager; the NCSC's three random words method is easy to remember. Our password generator can help.
3. Turn on two-step verification (2FA or MFA) on the app account where the platform offers it. CISA explains that it stops someone with a stolen password from logging in. Ubiquiti, for example, has required MFA on all UI Accounts since July 2024.
4. Turn off what you do not use: UPnP, old port-forwarding rules and unused services. Hanwha Vision's NVR hardening guide suggests disabling DDNS and UPnP if you do not need them.
5. Lock your phone with a PIN or biometric. Anyone holding an unlocked phone can open the app.

Plays from YouTube when you press play.

Share access, do not hand out the admin password

Give each person their own access instead of one shared login. In the apps, device sharing lets the owner grant another account chosen permissions: Hik-Connect lets you pick permissions such as live view and remote playback, and DMSS lets you share with other users (up to six, in Dahua's 2022 manual) and choose playback, alarm notifications or device control (live view is always included). On the recorder itself, create separate users with only the rights they need, and keep one admin account for settings.

If everyone uses "admin", you cannot tell who did what, and you cannot remove one person without changing it for everyone. Sharing can be removed in the app in seconds.

Tip Review the app's sharing list and the recorder's user list every few months. Remove anyone you do not recognise.

When a VPN is the better choice

A VPN suits you when you need the recorder's full settings remotely, have several sites or other systems (access control, alarms) to reach, or prefer not to depend on the manufacturer's cloud. If family members just need one-tap viewing and nobody can manage VPN accounts, a well-protected manufacturer account is usually the practical choice.

When it stops working

Most "device offline" messages in the app have nothing to do with the cameras. Check in this order: is the site powered (a power cut takes down both recorder and router, so put both on a UPS), does the app work on the site's Wi-Fi, is the internet up at the site, and does the recorder's cloud status say online? A new router from the ISP often leaves the recorder with an old gateway or DNS setting. If cameras themselves are dark on the recorder, see why a CCTV camera shows no video or offline.

Warning If someone suggests "just open the ports" to fix it, ask why the cloud service or VPN cannot be fixed instead.

Removing access for former staff or installers

When an employee leaves, or you change installer, do this the same day:

• Change the recorder admin password and any passwords the person knew.
• Delete their user account on the recorder and remove their device sharing in the app.
• Check who owns the app account the recorder is registered to. If it is the installer's, ask them to unbind it, then add it to an account you control.
• Revoke their VPN access.
• Check the router for port-forwarding rules or remote management you did not authorise.
• Look at the recorder's log for unexpected logins.

If you suspect someone has taken control of a device, the NCSC's smart devices guidance advises resetting it following the manufacturer's instructions.

Questions to ask your installer at handover

• Which access method did you set up: cloud/P2P, VPN or port forwarding?
• Are any router ports forwarded, and is UPnP off?
• Whose app account is the recorder registered to? Can it be mine?
• Have you handed over the admin password, and removed your own access?
• What firmware is installed, and how will updates be done?
• Is two-step verification on for the app account?
• Can I have written handover notes (users, IP addresses, access method)?

When to call Extrion

If you would like a second pair of eyes, Extrion Tech can set up or review remote viewing for your CCTV system, move it off port forwarding and clean up old installer access, as part of our security auditing and implementation service. See also CCTV installation, or get in touch and tell us what you have.

This guide is general information. Procedures, product features and firmware change, so check your own equipment's documentation before you start.