My router is set up with a 192.168.1.1 address scheme.

I would like to create a separate subnet on port 4 of 192.168.2.1 just for ip cameras.

The reason I want to do this is simply to keep the ip camera traffic away from the main subnet so the cameras don't slow down the network.

I would like the 2 subnets to be able to talk to one another and "see" one another, but not effect bandwidth or cause bottlenecking or any type of network slowdown.

Basically segregating the camera traffic from all other traffic.

Is this the correct way to accomplish this?

You should maybe check first where the network is choking, where is the bottleneck.

The network is not bottlnecking... I don't have the ip cameras set up yet.

I just want to do it right from the beginning so I don't have any bottlenecks.

Draw the network picture for yourself. Include the expected data volumes flow and you will see. Maybe you don't need to do anything special...

I would like to set it up regardless.

If anyone can help me out with what I am asking I would appreciate it.

just remove port 4 from the switch (master port) or bridge

then ip adresses add 192.168.2.1/24 to port 4

that is all you need to do i think

Yes, I believe that is correct.

My question remains, if I do that will it ease the traffic on subnet 192.1681.1?

For those of you that do this with ip cameras, is this how you are doing it?

Thanks.

Yes, as long as the 2 ports are not bridged or switched, they will be routed. When routing it keeps the network on separate broadcast domains. You are still limited to the capacity of the MikroTik, but for a SOHO you should be fine.

I plan on connecting the ip camera port to a poe switch which will connect to the nvr and the ip cameras. The switch will not have any other traffic.

Does this also help with easing traffix on the 192.168.1.1 subnet?

in the beginning there where hubs , then your trafic goes to all devices in the network.

since the invention of switch the trafic only goes to the devices that need the trafic ... so if you put a POE switch in between and also connect the NVR to it, than there wil be no trafic going to the main switch. unless someone is watching

Some NVR systems have 2 ethernet ports, then you can create a separate network ...

You are on the right track. For our IP cameras we just created a VLAN and assigned the VLAN to a port. Then the cameras are on their own broadcast domain. If you want the two subnets to communicate with each other just put the VLAN on the master port of your primary subnet and then the port will be able to route traffic between the two subnets.

In my opinion VLANS are the way to go, I use they to separate cameras and wifi etc.

Why not put the cameras on a lan... say you make port 3 a different subnet for the cameras, like 192.168.2.1, and connect it to a switch.

Port 2 would be 192.168.1.1, which would be normal traffic. Port 3 would be on it's own subnet for the cctv.

Wouldn't they still be able to communicate?

Why do you need a vlan if you can do it that way?

That may work just fine too. I am just a fan of VLANs since I trunk multiple VLANS traffic on a single physical port when the need arises. You would have to have a heck of a lot of traffic to bog down even a single gigabit port.... And even if I get to the point of reaching those limits I will just trunk my 10g fiber port

How many cameras are you talking about implementing?

No more than 16 cameras at max 3mp each.

I see your point about trunking. I would never need to trunk because I'm going direct to the poe switch which is connected to the NVR and ip cameras.

In theory, is my way (like I invented it!) a better solution for bandwidth and traffic separation, or does it not really matter?

With that many cameras I don't know that it matters. I just like the flexibility of VLANS I can assign them to any physical ports that I want and never have to physically move cables around. Now I am dealing with a handful of different subnets that I am trying to manage so my application is a little different. You are right thought just assigning a physical port on the router to handle a specific subnet is fine.

Now in order for them to communicate I think you will have to bridge the two physical ports. If that is the case remember that bridging is logical and eats at your processor speed.... I may be wrong about needing a bridge, I have not experimented with doing it that way before.

You are right. If I have to bridge them to make them communicate, then it's not worth it.

Does anyone know if I will have to bridge them?

If you put cameras and nvr on their own switch, the traffic will not leak outside as the switch will send the traffic to the port it belongs to. Switches learn connected mac addresses so they are not acting as dumb hub. No need to set anything. No need of separate network addresses.

Are you saying I can use the main subnet 192.168.1.1 for everything, and because I am sending the ip cameras and nvr to a poe switch there will be no effect whatsoever on the network?

If that's true, why do people put things on different subnets and vlans? You could just have each system go to a switch.

I guess the answer may be because you would run out of ip addresses.

You need separate networks if you want to secure them differently and each against the others. Or in case the cameras will broadcast instead just reply to the requests of nvr.

For me it's more a question of traffic, not security. Since that's the case, in a perfect world, what is the best solution?

different subnet on port 3?

Vlan?

same subnet for everything?

None knows how your cameras and nvr will behave. Do you? If not, you have to try it first and then solve the problem if any.

Broadcast traffic is still broadcast traffic. If your cameras, NVR or other devices on your LAN are generating a lot of broadcast traffic, every device on the subnet is going to see that regardless if it's on the same switch or not.

In an ideal world, I segregate applications. If you are going to be using Port3 for the Camera switch uplink regardless, easiest solution is to unswitch the port in the routerboard and set up a subnet just for the cameras. That way any broadcast traffic from the cameras and NVR will be contained on their own subnet and will not impact your other network and vice versa.

Who knows if that cameras do or don't broadcast?

We don't know, however I know if there are workstations on the subnet he will see plenty of broadcast traffic.

The question was asked "what is the best solution" and IMO I would segregate the traffic. That way the camera system can have its own broadcast domain and DHCP. Down the road security needs to be improved all that needs to be done is a couple of firewall rules to control access.

I have a subnet of 192.168.4.x setup for the poe switch connected to my ip cameras.

My NVR is on the main subnet of 10.0.1.x.

Right now I cannot see any of the cameras. I don't think the camera subnet can talk to the main subnet.

I would like to keep the two subnets seperated so there is no traffic from the cameras getting on my main subnet, but I would like the two subnets to be able to see each other.

What is the best way to do this while maintaining two different subnets keeping traffic separate, but still being able to see the cameras?

Thanks.

adding a second sub won't relieve the router and/or bottlenecks. I program the DHCP IPpool for 100 and above and then use everything below 100 for static devices like cameras, NAS, servers, ect. I'm using the RB2011il and it handles over 70 devices (16 are IP cams of 1.3mp and higher) I have seen bottle necks in the wireless until I went to the AC radios.

You can even add a second IP address to the Bridge of 192.168.1.2 WITHOUT a DHCP server and you can then add static devices on that IP address range. Pretty slick!

If you want to reduce/split the traffic you can add a second router behind your primary router and then use that router for IP cams & NVR only. May not work 100% if you have a wireless system connecting all but it will reduce traffic on the primary router. I'm sure you won't need a second router BUT old school thinking still prevails today. IMO high tech routers properly programmed and managed can handle just about anything you connect to them.

I'm getting so confused. I was always told that by using different subnets traffic will not affect the other subnet. It seems like you are saying it will.

What is the advantage to using a separate subnet for the ip cameras then if I need to use 2 routers?

He is saying that even if they are on separate subnets the router still has to route all the traffic no matter what subnet(s) the traffic is on. At the end of the day for your specific setup I don't believe you will notice any performance difference no matter how you decide to set it up. You just simply don't have enough devices on the network to make a difference in my opinion.....

I have about 50 devices on the network, including 14 ip cameras.

I am using an rb750gl.

Is there a better router that will give me much better performance near the price range?

Here is what you need to do...... Setup your router along with all the devices. Put them all on the same subnet. Then start generating as much traffic as you can. While you are doing this log into your router and then click on the System->Resources tab and check your routers CPU load as well as traffic on respective ports. My guess is that you won't even be using 25% of the routers CPU.... give it a shot.

I will try that as soon as I get the cameras set up.

So in theory you think the rb750gl will be fine for my setup? I don't mind stepping up to something else, but if I don't need to then why do it. Thanks for all the help.

OP never indicated his DVR/NVR was going to sit on his LAN subnet while the cameras would go on a separate subnet. That absolutely matters and will tax the router more than necessary.

In this case, I would either move the NVR to the camera subnet or keep everything on one subnet and be done with it. The network separation doesn't benefit you if you are having to push all that recording traffic through the router and will bottleneck you worse than a single subnet.

I had a feeling that was the case.

In that case, how do you keep the nvr and ip cameras on a different subnet, and still be able to pull up the cameras while on the main subnet?

I don't think it will add that much more data that the router can handle. I'm saturating my LAN and still my router sits at 1-4% on a bad day. By bad day I mean there is a wind/snow storm and my cams are motion recording nonstop.

I've run into this "potential" concern with many network admin types and when they freak out over 16 IP cams on the LAN I always ask why? Then they tell me the LAN will be saturated. I say to them, prove it! Where do you get your info from and how do you interpet it. I can prove it and back it up.

These admin types are trying to do the best that they understand but after I show them that I know what the heck I am talking about they back off quick. Sometimes even make slight comments like "if the LAN melts it's your fault". That's when I take 100% responsibility and change passwords. After that I usually get compromise since they like to bill the client for "admin" work and if I block them out they won't and don't get paid.

The only unknown in this world is what you don't know or understand. Learn that and you'll be able to change the hearts and minds of 75% of the ones you are working with. The other 25% open their mouths and prove that they are stupid. And you can't fix stupid

My NVR assignes a separate subnet to the cameras out of the box, but the NVR is on the main subnet.

I am going to set it up and monitor the cpu usage.

Ugh this is getting crazy. If you put them on two different subnets then yes maybe not all the traffic flows through the router but that is if you have a layer two switch. But guess what...... the moment you bring up those cameras on your main LAN your router has to route the traffic! Ok screen shot time..... I have just the very base RB750. I am currently streaming 4 IP cameras, the DVR, 21 WiFi devices, and 5 wired clients and see for yourself....

I told you in the beginning that you will not need to do anything special. Strange you are still surprised.