Port forwarding: getting your camera onto the internet
Our server connects to your camera over the internet, so the camera or recorder must be reachable from outside. That takes a public IP address and one forwarded port on the router — the RTSP port, nothing else.
Public and private addresses
Every device in your office or home has a private address: 192.168.x.x, 10.x.x.x or 172.16–31.x.x. These work only on the internal network — nobody on the internet can reach them. To the outside world the whole network appears as one public IP, held by the router.
Port forwarding is an instruction to the router: "whoever arrives on this port, pass them to the camera". That way our server reaches the camera through your public IP and one specific port, while the rest of the network stays closed.
Step 1. Check whether your IP is public
- Find the WAN (internet) address in your router's web interface.
- From the same network, open any "what is my IP" website and compare.
- If they match, you have a public IP. If they differ, or the WAN address starts with
100.64–100.127,10.or192.168., you are behind CGNAT.
CGNAT means your provider shares one public address among many customers. A forward on your own router then changes nothing — the connection stops at the provider. Mobile (4G/5G) internet is almost always like this.
Step 2. Ask for a public, ideally static, IP
Contact your internet provider and ask for a public static IP address. In Georgia, Magti, Silknet and other providers commonly offer this as a paid add-on; confirm the terms and price with your provider. A static IP never changes, so the camera is always at the same address.
A dynamic public IP can work with DDNS (a router or camera service that keeps a name pointed at the current address), but each time the address changes the live stream drops until the camera is checked again at its new address. DDNS doesn't work at all behind CGNAT. For a live camera, a static IP is the reliable option.
Step 3. Fix the camera's local address
A forward points at one specific local address. If the router hands the camera a different address after a reboot, the rule points at nothing. So either set a static address on the camera itself or create a DHCP reservation on the router that ties the camera's MAC address to a fixed IP (on TP-Link: Advanced → Network → DHCP Server → Address Reservation).
Step 4. Forward only the RTSP port
Find the Port Forwarding, Virtual Server or NAT section in your router (on TP-Link: Advanced → NAT Forwarding → Virtual Servers) and create one rule:
| Field | Value |
|---|---|
| External port | 5541 |
| Internal IP | The camera's address, e.g. 192.168.1.64 |
| Internal port | 554 |
| Protocol | TCP |
A non-standard external port (5541) is better: bots knock on 554 across the internet all day. That is not protection by itself, but it cuts the noise. In our dashboard, enter your public IP as the host and 5541 as the RTSP port. For several cameras, give each its own external port (5541, 5542…) or forward only the recorder's RTSP port. On MikroTik the same rule looks like this (replace ether1 with your WAN interface):
/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=5541 action=dst-nat to-addresses=192.168.1.64 to-ports=554Our system pulls RTSP over TCP by default, so one TCP port is enough — there is no need to open UDP ports. Why is explained in What is RTSP.
Step 5. Test from outside
- Turn off Wi-Fi on your phone, open VLC on mobile data and enter
rtsp://PUBLIC-IP:5541/Streaming/Channels/101(with your camera's path). - Testing your own public IP from inside the network often fails — many routers don't support that loop-back. It isn't an error; just test from outside.
- The final check is the connection test in our dashboard: the server connects to the camera from the internet, exactly as it will during the live stream.
If the test says "unreachable" or "timeout", recheck CGNAT, the forwarding rule and the camera's local IP. If it says "auth error", the network already works and the problem is the username or password: see How to find your RTSP URL.
Sounds complicated? We'll come on site
NEWTECH sells and installs cameras. If talking to the provider, the router or the camera settings is too much, call +995 577 79 53 77 or write to info@videocamera.ge — we'll come and set it up. Don't send passwords over chat: a technician enters them himself, on site or during a phone call.
Can I connect a camera without a public IP?
Not at the moment: the server connects to the camera over the internet. The way forward is a public or static IP from your provider plus a port forward. If that isn't possible, call us and we'll sort it out on site.
Will it work on a 4G router?
Mobile internet is almost always behind CGNAT, so a port forward won't work. Ask your operator whether they can give your SIM a public IP.
Is opening a port dangerous?
Opening the web admin port is. Forwarding only the RTSP port, with a separate view-only user, a strong password and current firmware, reduces the risk a lot.
I can't change settings on the provider's router. What now?
Ask the provider to add the forwarding rule for you, or to switch the router to bridge mode so you can forward on your own router.
How many ports do I need for several cameras?
One external TCP port per camera, or a single port for the recorder — through a recorder every camera is reached by channel number. See NVR and DVR.