How to View Your IP Cameras Away From Home

Why there is no cloud relay

Most camera apps that work from anywhere do it by sending your video through the manufacturer's servers. It is convenient, but a live view of your home then passes through servers you don't control, tied to an account that can be breached, changed or switched off.

IP Camera Viewer works the other way. It talks to each camera directly over RTSP and ONVIF, the way a computer on your network would. There is no account to create and no app server in between, so the video goes from your camera to your phone and nowhere else.

The one thing this needs is a route to your home network. At home that route is your Wi-Fi. Away from home it is a VPN that you own and can switch off at any time. Without one, a home address such as 192.168.1.64 means nothing on mobile data, so the app shows Waiting for Home Wi-Fi instead of an error: nothing is broken, the camera is just out of reach.

Which VPN works, and which doesn't

“VPN” covers two very different things, and only one of them reaches your cameras.

• Works: a VPN that connects to your home network. Its server runs on your router or on a device at home, and your iPhone dials into it. While it is connected, your phone behaves as if it were on your home Wi-Fi, so it can reach 192.168.x.x addresses. In router menus this is called a VPN server, not a VPN client.
• Doesn't work: privacy and subscription VPN apps such as NordVPN, ExpressVPN, Surfshark or Proton VPN. They send your traffic out to the internet through their own servers to hide your location. They have no way into your home network, so your cameras stay exactly as unreachable as without them.

Don't forward camera ports instead. Opening a camera's RTSP port (554) or web ports (80, 443, 8000) on your router does make it reachable, but by everyone. Automated scanners search the internet for exposed cameras all the time and try default and leaked passwords, and camera firmware is a common target. A VPN gives you the same access through one encrypted door that only your own devices have keys to.

Your options, easiest first

1. Your router's built-in VPN server

Many home routers can run a VPN server. You switch it on, create a profile for your phone, and scan a QR code with the VPN app on your iPhone. Two things decide whether it can work:

• Your internet connection must be reachable from outside. The router needs a public IPv4 address, or IPv6. Some providers, especially mobile (4G/5G) home internet and satellite services, share one public address between many customers (carrier-grade NAT), and then no router VPN server can be reached. Your provider can tell you; if that is your situation, use Tailscale below, which doesn't need a public address.
• Your home address may change. Most routers offer a free dynamic DNS name (on a FRITZ!Box, MyFRITZ!) so the VPN profile on your phone keeps finding home.

Where to find it on common routers:

• FRITZ!Box (FRITZ!OS 7.50 or later): Internet > Permit Access > VPN (WireGuard) (German menus: Internet > Freigaben > VPN (WireGuard)), then Add WireGuard Connection and Connect a single device. Scan the QR code it shows with the WireGuard app. FRITZ! asks you to register the box with MyFRITZ! first and to move it off the default 192.168.178.x network; the second step matters, see same address range below. The 6490 Cable and 6590 Cable models don't support WireGuard. FRITZ! guide
• UniFi (UniFi gateway or Cloud Gateway): in the UniFi Network app, open the VPN settings and create a WireGuard VPN server (UDP port 51820 by default), add a client, and scan its QR code with the WireGuard app. Ubiquiti's zero-configuration alternative is Teleport: create an invitation link and open it on your iPhone with the WiFiman app (each link expires after 24 hours). WireGuard guide · Teleport guide
• ASUS (firmware later than 3.0.0.4.388): VPN > VPN Server, switch it on, choose WireGuard VPN, add a profile and scan its QR code with the WireGuard app. ASUS notes that on iPhone you may need to type a DNS server into the profile (in the WireGuard app: Edit, then DNS servers) if websites stop loading while the VPN is on. ASUS routers also offer an OpenVPN server; its default, Local network only, is all your cameras need, and the exported file opens in OpenVPN Connect. WireGuard guide · OpenVPN guide
• GL.iNet (firmware 4.x): VPN > WireGuard Server > Generate Configuration, then Profiles > Add, scan the profile's QR code with the WireGuard app, and click Start. So that the phone can reach your cameras, open Options on the same page and turn on Allow Remote Access to the LAN Subnet (on firmware 4.7 and earlier it sits under VPN Dashboard). If the GL.iNet is behind your provider's router, that router has to forward the WireGuard port to it. GL.iNet guide
• Any other router: look in its settings or app for VPN Server, WireGuard or OpenVPN. Menus differ between models and firmware versions, so follow the manual for yours. If there is no VPN server, use Tailscale.

2. Tailscale, with a subnet router at home

If your router has no VPN server, or your connection has no public address, Tailscale is the easiest route. It links your own devices into a private network without opening any ports on your router. One device at home that stays switched on acts as a subnet router: it lets your iPhone reach the rest of your home network, cameras included.

1. Install Tailscale on an always-on device at home and sign in: a Mac, a Windows PC, a Linux computer or Raspberry Pi, a Synology NAS (Synology guide), or an Apple TV with tvOS 17 or later that is set up as your home hub, so it stays connected while asleep (Apple TV guide).
2. Share your home network from it. On an Apple TV, open Tailscale and choose Subnet Router > Advertise New Route, then enter your range, for example 192.168.1.0/24. On a computer, Tailscale's guide gives the command, tailscale set --advertise-routes=192.168.1.0/24; Linux and Windows also need IP forwarding switched on.
3. In the Tailscale admin console, open Machines, find the device with the Subnets badge, choose Edit subnet routes and approve the route.
4. Install Tailscale on your iPhone and sign in with the same account. iPhones pick up approved routes automatically.

Tailscale's servers help your devices find each other. When a direct connection isn't possible they relay the traffic, but it stays end-to-end encrypted with keys that never leave your devices, so the relay can't see your video. Tailscale: subnet routers

The app on your iPhone

Use the official, free app that matches your VPN: WireGuard (FRITZ!Box, UniFi WireGuard, ASUS, GL.iNet), OpenVPN Connect (OpenVPN servers), Tailscale, or WiFiman for UniFi Teleport. All are on the App Store, and the same apps are on Google Play for Android, where IP Camera Viewer works the same way.

Not sure what your home range is? Look at a camera's address in the app. If it is 192.168.1.64, your range is 192.168.1.0/24, which means every address from 192.168.1.0 to 192.168.1.255.

Using it with IP Camera Viewer

1. Add your cameras at home on Wi-Fi first, so each one is saved with its home address, such as 192.168.1.64.
2. Away from home, turn the VPN on in the WireGuard, OpenVPN Connect, Tailscale or WiFiman app. Wait until the VPN app shows it as connected.
3. Open IP Camera Viewer. On mobile data the app first checks that the camera answers through the VPN, then plays it just as at home, in single view and in groups.
4. If a camera shows Waiting for Home Wi-Fi, the VPN isn't reaching your home network yet. Work through the checks below, then tap I'm on VPN - Try Anyway.

Nothing in the app needs to change. Keep the cameras saved with their home addresses; don't swap them for your public IP address or a dynamic DNS name, because through the VPN the home address is the right one. On mobile data, use a camera's sub-stream where it has one: a 4K main stream can use several gigabytes an hour, a sub-stream a fraction of that.

VPN on, but cameras don't load

• Test it at home first. Turn Wi-Fi off on your iPhone, turn the VPN on over mobile data, and open a camera. If it plays, it will play anywhere; if not, you can fix it while you are next to the router.
• The VPN has to carry your home range. In the WireGuard app, tap the tunnel, then Edit, and check Allowed IPs under Peer: it must include your home range, such as 192.168.1.0/24, or be 0.0.0.0/0, which sends everything. In Tailscale, the subnet route must be approved in the admin console. On GL.iNet, Allow Remote Access to the LAN Subnet must be on.
• The Wi-Fi you are on uses the same addresses as home. If a hotel, a friend's house or a holiday flat uses the same range as your home network, your iPhone looks for the camera on that Wi-Fi and never sends the request through the VPN. This is very common with two FRITZ!Boxes, which both use 192.168.178.x out of the box, and with 192.168.0.x and 192.168.1.x. Switch to mobile data for the moment. For good, change your home router to a less common range such as 192.168.10.x, as FRITZ! recommends. Your cameras then get new addresses: reserve them in the router and update each camera in the app with Edit Camera, or add them again with a scan.
• Full tunnel or split tunnel. A full tunnel (0.0.0.0/0, the FRITZ!Box default) sends all of your phone's traffic home. That keeps you private on public Wi-Fi, but your browsing then runs at your home upload speed. A split tunnel sends only your home range through the VPN and leaves everything else on the local connection. Both work for cameras, as long as the home range is included.
• The VPN won't connect at all. Check that your connection has a public address (see above), that the dynamic DNS name in the profile is current, and, if your router sits behind your provider's router, that the provider's router forwards the VPN port to it (UDP 51820 is the usual WireGuard port). Tailscale avoids all three.
• It plays, but stutters. Video leaving your home is limited by your home upload speed, and then by your mobile signal. Switch to the sub-stream, or open one camera at a time instead of a group.