How camera traffic flows through the relay
The camera or NVR sits behind NAT/CGNAT without a public IP, while you need to watch from a phone on any network. The solution is a persistent outbound tunnel to an edge node and stream delivery through a relay node.
Four links in one chain
Device on site
A camera or NVR serves the stream over RTSP/ONVIF. A small agent on site makes an outbound connection — no inbound ports are opened.
Edge node (Minsk)
Accepts the encrypted connection, verifies the device key and keeps the session. Edge stores no video — it only routes the stream.
Relay node (Amsterdam)
Egress node for clients: joins the device and client sessions with minimal latency.
Client
Phone, tablet or desktop connects to the same relay and receives the stream. The archive stays on your recorder.
Why it looks like ordinary HTTPS
The tunnel runs over TLS 1.3 (and QUIC where available) on standard port 443. For both the site network and the client network it looks like a normal secure connection — the same as opening any website. That is why no port forwarding, static IP or router changes are needed.
| Parameter | Value | Why |
|---|---|---|
| Transport | TLS 1.3 / QUIC | Encryption and compatibility with HTTPS-only networks |
| Port | 443/tcp, 443/udp | Standard web port, rarely blocked |
| Direction | outbound from site | No public IP required |
| Keys | per device | Access can be revoked per site |
| Video storage | on site only | The relay does not store or analyse video |
What happens when the network fails
- Site link drops. The agent reconnects automatically; recording on the NVR continues.
- ISP changes the IP. No effect: the connection is always outbound.
- Weak mobile link. The stream adapts its bitrate.
- Non-standard ports blocked. We use 443, which is almost always open.
Tell us about your site — we will propose a scheme
Describe your equipment and task: we will suggest how to connect cameras to the relay.