Connect a site

A site is one place with cameras: a house, a shop, a warehouse. The app does most of the work. You paste one script into the router.

To create the site in your registry and assign its devices, see Organize devices into sites.

Before you start

• The hub is installed and you have its hub code with the admin token.
• The site is in the app, with its devices added and reachable on the local network.
• The site’s router runs WireGuard. The script is for MikroTik RouterOS 7. For other routers, see Other routers.

Steps

1. Add the hub to the app. Open Hubs…, choose New Hub… and paste the hub code. The app fills in the address, the port and the admin token.

2. Open the site’s Site Connection… and choose Set Up on a Hub…. The app makes the router’s keys and script and adds the site to the hub. The hub gives the site its network, and the app shows it.

3. Open Router Setup…, copy the script and run it in the router’s terminal. Until the router connects, the sheet shows “The router has not connected yet”.

4. Wait for the state to change from “The router has not connected yet” to “The router is connected”.

5. With Automatically selected in Site Connection, leave the site’s network and open live view. Watchpost uses the hub when the direct path no longer answers.

What the script does on the router

Everything it creates carries the comment watchpost. It starts by deleting its own earlier version, so running it twice is safe.

• It creates the WireGuard interface wg-watchpost and a peer toward the hub. The router dials out and sends a keepalive every 25 seconds, which costs about 1 MB a day on a mobile plan.
• It maps each of the site’s networks onto its own 10.77.N.0/24, where N is a number the hub gave that network.
• It lets the tunnel reach only the devices on its list, and only their service ports.

The hub reaches only the listed devices. After you add a device to the site, make the script again.

How the app picks a route

With Automatically selected, Watchpost prefers a reachable direct path, then the first reachable route in the saved list. A fixed choice does not fall back to another path on failure. See Site connection paths for checks, manual hub/VPN routes, Save and local route removal.

A site with several networks

Cameras on one /24 network and a recorder on another is common. The app looks at the addresses of the site’s devices and asks the hub for a number for each /24 network they sit in, up to eight. The router gets its tunnel address from the first number, and the script maps every network onto its own 10.77.N.0/24.

Added a device from a new network? Open Router Setup… again and paste the script. The numbers the site already has stay where they are. An export file with such a site opens only in apps that know several networks. Older apps refuse it instead of sending every device into the first network.

Limits

• A hub holds numbers 1 to 253. Every network of every site takes one.
• A site has up to 8 networks.
• The numbering gives every network its own range, so sites with the same LAN do not clash.

Other routers

Any router with WireGuard can be the tunnel’s end. The app gives you a WireGuard config file, and you set up the address mapping and the firewall by hand. Keenetic, ASUS on recent firmware and OpenWrt qualify. MikroTik needs RouterOS 7.

No WireGuard on the router? Put a small box behind it, a GL.iNet or a Raspberry Pi.

Add a site without the admin token

A hub code from watchpost-relay info has no admin token, so the app cannot add the site itself. It shows a command with the values filled in. Run it on the hub:

watchpost-relay site add -name home -key <router public key> \
  -address 10.77.0.2 -network 10.77.1.0/24 -token-sha256 <hash>

A site with several networks repeats -network for each one.

The command carries no secrets. The relay keeps only the hash of the site’s token.

Give someone access

On Mac, use People and Invitations on the hub screen to invite a person, wait for acceptance and send their protected device package. See People and invitations for device passwords, access terms and revocation. Acceptance alone does not add cameras.

File transfer with For another person remains a separate way to share devices. Review the passwords included and the personal tokens for the selected routes. Removing your local devices or routes does not revoke the other person’s access.

Remove a site

Open the hub screen or Hub Sites… from a saved route. Removing a server site closes its router tunnel and access through that site for everyone. Its local route stays in Site Connection until you remove it separately. See Manage hubs for server removal, local route removal and removing a saved hub.

Tunnels added to the hub’s WireGuard by hand show up in the same list, and you can remove them there.