Watchpost Hub

Camera vendors keep the address of their cloud in the firmware, and you cannot change it. Watchpost Hub is the way around: a small relay on a server you control, and a WireGuard tunnel that each site’s router opens toward it.

SiteCamerasand recorder

LAN

SiteRouterdials out by itself

WireGuard

Your serverHubrelay and WireGuard

HTTPS

Your deviceWatchpostthe app

The router dials out, so the site needs no public address. A site behind a mobile modem or a carrier’s CGNAT works the same as one with a static IP. On the site’s own network the app connects directly and never touches the hub. Away from it, the app sends its requests to the hub over HTTPS, and the hub passes them into that site’s tunnel. The app picks the route itself.

What the hub gives you

Many sites on one server

Every site gets its own network on the hub (10.77.N.0/24), so two sites that both use 192.168.1.0/24 do not collide.

No VPN on the phone

The app talks to the hub over HTTPS, and only its own traffic goes that way. Nothing else on the phone changes.

Setup from the app

The app makes the router keys and the script, and adds the site to the hub. You paste one script into the router.

Protection built in

Each site and each person has an access token of its own. The relay opens only that site’s network, and only device ports. It also caps connections per device and pauses clients that guess tokens. Details are in Limits and refusals. What is kept where is on the page Where things are kept.

One command to install

Install the hub on any Linux server with systemd.

Know before you start

The hub sees the video. Between the two tunnels the stream passes through the relay in the clear. Keep the hub on a server you trust.

Video crosses the server twice. The main stream of a 2560×1440 camera takes 3–4 Mbit/s, once in and once out, for every viewer. Check the traffic quota of your hosting plan.

Routers. The script is for MikroTik RouterOS 7. Keenetic, ASUS on recent firmware and OpenWrt get a WireGuard config file, and you set up the address mapping by hand. For a router without WireGuard, put a small box behind it: a GL.iNet or a Raspberry Pi.

Some carriers block WireGuard, most often on traffic to servers abroad. Test the tunnel from the site before you rely on it.

In testing

The hub works on real sites. We have checked live view and playback from Xiongmai recorders through it, and a 2560×1440 main stream with sound at 4.2 Mbit/s with no decoding errors in a 20 second run. Still being checked: Hikvision devices, archive export, streams of several hours, and iPhone on a mobile network. Each site has an access token, and each person you hand a site to gets one of their own. Builds with Watchpost accounts also offer invitations and access management on Mac; see People and invitations.

Next

1. Install the hubThe script, the ports and how to check it runs.

2. Connect a siteThe wizard in the app and the script for the router.

3. Limits and refusalsWhat the relay limits and what each refusal means.

RoadmapWhat works today, what we are verifying, what comes next.

See Manage hubs to edit saved hubs and inspect server sites, Site connection paths to choose a route, and People and invitations to share access on Mac.