Manuall Trade Library Run your shop on Manuall

Camera Network Layouts: Recorder Ports, Switches and the Home LAN

Reference ServiceDelivery Updated Oct 28, 2026 ยท Security Systems

Why this matters

Where the cameras plug in decides more than cable routing. It decides which network the cameras live on, who else on the property can reach them, what breaks when the customer replaces their router, and how the customer views video from their phone. Two installs with the same cameras and the same recorder can behave completely differently a year later because one put the cameras on the recorder's own ports and the other put them on a switch beside the router. The choice should be made on purpose, written down, and explained to the customer, not decided by which box had free ports on install day.

The two layouts

 A: RECORDER PoE PORTS         B: PoE SWITCH ON THE LAN
 (cameras inside the NVR)      (cameras share home LAN)

 INTERNET                      INTERNET
    |                             |
 ROUTER 192.168.1.1            ROUTER 192.168.1.1
    |   (phones, TV on            |   (phones, TV on
    |    192.168.1.x)             |    192.168.1.x)
    |                             |
 NVR LAN port                  PoE SWITCH, no address
 192.168.1.20                     |       |       |
 NVR PoE ports:                  NVR    CAM 1   CAM 2
 own subnet 10.1.1.x             .1.20  .1.31   .1.32
    |          |
 CAM 1       CAM 2             all three on
 10.1.1.11   10.1.1.12         192.168.1.x

Layout A: cameras on the recorder's built-in PoE ports. The network video recorder (NVR) has two sides. Its LAN port connects to the home router and takes an address on the home network, 192.168.1.20 in the drawing. Its PoE ports power the cameras and put them on a separate, private network the recorder runs itself, 10.1.1.x here (the actual range is the maker's default and varies). The recorder hands the cameras their addresses, finds them automatically, and records them. Nothing on the home network talks to a camera directly; it all goes through the recorder.

Layout B: cameras on a PoE switch on the home network. A PoE switch plugs into the router and powers the cameras. The cameras take addresses from the router like any other device, so the NVR, the cameras, the customer's phones and the smart TV all share one network, 192.168.1.x. The recorder finds the cameras on that network and records them over it.

How PoE delivers power and how to budget it is covered in Power over Ethernet for Cameras and Access Points; this card is about addressing and reach.

What Layout A gives you, and what it costs

Isolation. The cameras are not on the customer's network at all. A compromised laptop or a cheap smart plug on the home network cannot reach a camera's web page, and a camera that wants to contact its maker's cloud has no route out unless the recorder provides one. Cameras are a common weak point on a home network (default passwords, old firmware, services nobody asked for), and Layout A keeps that weakness behind the recorder.

Stability. The recorder owns the camera addresses. When the customer swaps their router, changes their internet provider or resets their network, the camera side does not change. Only the recorder's LAN port needs to find the new router, and if the recorder is set to take its address automatically, it will.

Simplicity. Plug in a camera, it appears. No address planning on the customer's network.

The costs. Every camera cable has to come back to the recorder, so the recorder's location sets the length of every run, and each run from port to camera must stay within the Ethernet channel limit of 100 meters (328 feet) set by the TIA-568 cabling standard. The port count caps the camera count. The recorder's total PoE budget, per the maker, caps how much the cameras can draw together, and cameras with heaters or bright infrared draw more. Some recorders let you hang a switch off a PoE port to add cameras to the internal network; whether that works, and how, is per the maker.

What Layout B gives you, and what it costs

Flexibility. A switch can sit close to a cluster of cameras (a detached garage, the far end of the house) and send one cable back. Camera count is limited by switch ports and the recorder's license or channel count, not by the recorder's PoE ports.

Shared access. Every device on the home network can reach the cameras, which is what some integrations want (a home automation hub that pulls a camera stream) and what the security of the cameras does not want.

Fragility. The router hands out the camera addresses. If the recorder added cameras by address and the router later hands a camera a different one, the recorder loses it. A router replacement can renumber everything. Layout B needs every camera's address fixed, either as a reservation on the router or as a static address outside the router's automatic range, and that has to be recorded where the next tech will find it.

Load on the home network. Eight cameras at 4 Mbps each is 32 Mbps flowing to the recorder around the clock. A gigabit switch handles that easily if the cameras and the recorder sit on the same switch. If camera traffic crosses a cheap switch, a mesh Wi-Fi backhaul or the router itself to reach the recorder, it competes with everything else.

Remote viewing in each layout

The app should connect to the recorder, not the cameras, in either layout. Most recorders offer the maker's relay service (the recorder makes an outbound connection, and the phone app reaches it through the maker's server) or work with a VPN the customer runs. Either way the recorder is the only thing reached from outside.

Never forward a port on the customer's router to a camera's or a recorder's web page. That puts a login page on the open internet for anyone scanning for one.

In Layout A this falls out naturally: the cameras cannot be reached from outside because they cannot be reached from inside either. In Layout B the cameras sit on the home network with their own cloud features often switched on by default. Turn off each camera's own cloud, peer-to-peer and automatic port-opening (UPnP) features so that the recorder is the single path, and confirm it from the router's device list.

Worked example: seven cameras and a detached garage

The site. A two-story house with the recorder planned for a basement utility room. Five cameras on the house: front door, driveway, two back corners, side gate. Two on a detached garage 180 ft (about 55 m) from the utility room. The garage has its own 120 V circuit. The recorder in the quote has 8 PoE ports and, per its sheet, a total PoE budget of 80 W; the cameras' sheet lists a maximum of 7 W each with infrared on.

House cameras: Layout A. Five runs from the utility room, the longest about 140 ft (about 43 m), all well inside 100 m. Power: 5 cameras x 7 W = 35 W worst case, under the 80 W budget with 45 W to spare. The five cameras land on recorder ports 1 to 5 and appear on its internal network.

Garage cameras: two ways to do it.

  • Option 1, extend Layout A. One Cat6 run from recorder port 6 to the garage, 55 m, into a small switch powered by its own adapter on the garage circuit, which powers the two garage cameras. This recorder's documentation says cameras behind a switch on a PoE port join its internal network and get addresses from it; with a recorder that does not support that, this option is off the table. The port supplies no power to the switch because the switch is not a powered device; the PoE port simply carries data to it.
  • Option 2, Layout B for the garage. Connect the garage switch to the home network instead, give the two garage cameras reserved addresses on the router, and add them to the recorder over the LAN.

The call. Option 1 keeps all seven cameras off the home network and survives a router change without anyone touching the garage. Option 2 exposes two cameras to the home network for no benefit the customer asked for. The tech chooses Option 1, and the job notes record the internal address range, which port feeds the garage, and the garage switch's location and power source.

Remote viewing. The recorder's LAN port takes an automatic address from the router, and remote access goes through the maker's relay. If the recorder resists joining the customer's network, the usual causes and fixes are in Getting a Stubborn Device onto the Customer Network. The tech tests the app from a phone on cellular data with Wi-Fi off; a test from the home Wi-Fi proves only that the phone and recorder share a network.

Verify the layout did what it was for. From the customer's laptop on the home network, the tech tries to open a camera's internal address and confirms it does not answer, then confirms the router's device list shows the recorder and none of the seven cameras.

What changes the choice

  • More cameras than the recorder has ports, spread far apart: Layout B, or a recorder that supports switches on its PoE ports.
  • An integration that needs direct camera streams, such as a home automation hub. Layout B, or a managed switch with the cameras on their own segment, which is network design work worth quoting as such rather than improvising.
  • A business or a property with an IT provider. The camera network is their decision too; get it in writing before you plug anything into their switch.

References

  • Power over Ethernet for Cameras and Access Points
  • Getting a Stubborn Device onto the Customer Network
  • TIA-568, structured cabling standard (the 100 m Ethernet channel limit)
  • See related: How to Set Up a Network Video Recorder and Confirm Retention
  • See related: How to Run Cat6 for Cameras Through a Finished House

Related articles