Viewing home cameras and files remotely, safely

The safest remote access is none. The NCSC's guidance on smart security cameras says that in rare cases live feeds have been reached by unauthorised people. That is possible because cameras are set up to be viewed while you're away, and some ship with a well-known or guessable default password (the NCSC gives "admin" and "00000" as examples) that criminals can use, among other techniques. If you don't need to view a camera over the internet, it recommends turning remote viewing off, and for smart devices generally, switching off any "remote access" you don't use.

The trade-off, it says, is that this may also stop movement alerts and break links with smart assistants. So be specific about what you use:

• Alerts and the occasional clip: the maker's app is built for this; leave everything else off.
• Viewing only when you're home: if the camera can be viewed over your home network, nothing needs opening to the internet. Some can't work that way: Ring says its doorbells and cameras require an active internet connection.
• Live views, files or full control while away: pick one route deliberately, rather than letting a device open something for you.

The NCSC says the setting is usually in the app's settings, or on older cameras in a browser at the camera's IP address.

UPnP (Universal Plug and Play) is, in the NCSC's words, one of the technologies many routers use "to allow devices to find other devices within your network". Devices can also use it to have the router open ports for them (Xbox says a port needed for remote play is typically handled automatically on a UPnP router), so something can be opened without you choosing it.

The NCSC's camera guidance says UPnP and port forwarding can be exploited by criminals to reach devices such as cameras, and suggests considering switching both off. It's candid that online gaming, media servers and some smart devices may then stop working; if you rely on those, it says you'll have to decide whether to give up some security by allowing them. Gamers should read our guide to broadband for online and cloud gaming first.

Our guide to securing your home router and Wi-Fi covers UPnP with the other settings worth reviewing. Reaching your own devices is different from your provider managing the router itself; our guide on whether your provider can update your router remotely explains that.

Without CGNAT, your router is normally handed a public IP address of its own that incoming connections can be routed to. With CGNAT, your provider shares one public IPv4 address between many customers. thinkbroadband explains that this means you don't get a real IP address and that it can break some applications, such as online gaming, though it adds that these are becoming more compatible.

• Port forwarding usually can't work. toob explains that under CG-NAT your router is given a private address and traffic passes through translation equipment in the provider's network, which shares the public address. A rule on your own router can't change that equipment; as Tailscale's engineering blog puts it, "you can't reconfigure the ISP's CGNAT!" Home Assistant's advice, if you can't connect remotely, is to check whether your provider gives you a dedicated IP, adding that some, if not most, providers charge extra for one.
• Routes that don't rely on an open port are the ones to look at. Home Assistant Cloud works without opening any ports on your router (other makers' apps vary, so check). Tailscale's engineering blog says its NAT-traversal techniques largely work "fine in a CGNAT world"; the connection may stay relayed behind hard NAT, which Tailscale says affects performance, not security.

Our guide to CGNAT, static IP and IPv6 shows how to check whether you're behind CGNAT.

What about IPv6? IPv6 is the newer addressing system, which thinkbroadband describes as developed to work around IPv4 addresses running out; ISPreview says supporting it reduces the negative impact of CGNAT. Whether it lets you reach a particular camera depends on your provider, router, device and the network you connect from, so treat it as a question to ask, not a guaranteed workaround.

A static IP is a public address that's yours and doesn't change. Home Assistant Cloud works without a port opened on your router and a mesh VPN such as Tailscale is designed to work behind CGNAT, so with those you usually don't need one. A public address matters mainly when something outside must reach your home directly, and a static one also saves you relying on Dynamic DNS. toob, which uses CGNAT as standard, says you'll likely need one to set up a remote VPN, remotely access your computer and files, or host a website, game server or Plex media server, and that most homes don't need one.

A public but dynamic address may be enough. In ISPreview's 2024 altnet survey (updated 2025), Hey! Broadband said customers could ask to come off CGNAT onto a dynamic public IPv4 address, and Quickline offered a move back to native IPv4 for a valid technical reason. Those answers are dated, so ask.

Examples checked in October 2026 (no prices; see each provider's add-ons page):

"Static" isn't a lifetime promise. ISPreview reported on 30 June 2026 that Zen was changing the IPv4 addresses of under 2% of customers between 1 May and 30 August 2026, with 30 days' notice, and on 4 September 2026 that some former Cuckoo customers with static IPs had been put on CGNAT after moving to Onestream, which blamed a "product update" affecting 88 customers and said it expected normal service back soon. If remote access matters, keep a fallback such as an app or VPN. And a static IP doesn't make port forwarding safe: YouFibre notes that it lets others find your devices or servers easily, and with a forwarded port, "others" means anyone on the internet.

Choosing a package with this in mind? Compare deals at your postcode or browse fibre broadband deals, then ask the provider in writing about CGNAT and static IPs before you order, since the deal listings come from our partner and don't show IP policies. Our broadband providers hub covers each provider.

Sometimes port forwarding is the only option a device offers. BT's help pages show how it works on a BT Smart Hub or Ultrafast Smart Hub:

1. Connect a device to the Hub and go to 192.168.1.254 in a web browser to open Hub Manager.
2. Click Advanced Settings, then Firewall, and enter the admin password (the default is on the Hub settings card on the back).
3. Click Create a new port forwarding rule, name it, select the device and click Set.
4. Enter the external and internal port range, select the protocol, click Set, then click +. Repeat for other ports.
5. Click Save. BT says changes aren't kept until you do.

BT also points out:

• Get the correct port numbers from the maker of the hardware or software, or your IT support.
• The BT Mini Hub doesn't support port forwarding.
• Older BT Hubs (Hub 3, 4 and 5) use Settings, Advanced Settings, Continue to Advanced Settings, then Port Forwarding.
• Most VPN clients, such as one for homeworking, should work without port forwarding.

Our own suggestion on top (general good practice, not BT's): forward only the ports the maker lists, only to the device that needs them, and delete the rule when you stop using that device; a forgotten rule pointing at an old camera is an easy door to leave open. On other routers the menus differ; as Xbox's support pages note, the process varies by router, so check its documentation. See BT broadband deals for BT's current packages.

Whichever route you choose, the device at the end must be secure. The NCSC's advice for cameras and other smart devices:

• Change any default password. It gives "admin" and "00000" as examples of default camera passwords and suggests a strong replacement such as three random words.
• Turn on 2-step verification for the device or its app account if it's offered.
• Keep the software updated, with automatic updates on if available.
• Know the support end date. Treat it like a "use by" date and avoid devices that are out of support or nearly so.

Since 29 April 2024 the UK's Product Security and Telecommunications Infrastructure (PSTI) rules have banned universal default passwords on smart products and made makers publish a security-update end date (see the FAQ below). Check that date before buying a camera or NAS you'll reach from outside. Our router security guide covers the router every remote connection passes through.

When you watch a camera from outside, the video travels from your home to you, so it relies on your upload speed rather than download. Ring, for example, says each of its doorbells and cameras needs at least 1Mbps of upload, more for higher resolutions, and adjusts video quality to the speed available.

As an example using only Ring's minimum, four Ring cameras would need at least 4Mbps of upload between them, before anyone at home joins a video call; other makers publish their own figures. Our guide to download versus upload speed explains the difference, and our broadband speed test shows what your line delivers now. When you compare packages, look at the upload figure too.

Remote access makes footage easier to reach, so handling it properly matters. GOV.UK's domestic CCTV guidance says that if your cameras capture people outside the boundary of your property, UK GDPR and the Data Protection Act 2018 apply, enforced by the Information Commissioner's Office (ICO).

You must then keep recordings secure with access kept to a minimum; GOV.UK also says you should not keep images longer than needed to protect your property and should use them only for the purpose the system was installed for, so not, for example, on social media. That's another reason to limit who has logins to the camera app and not to expose cameras through a forwarded port.