UniFi Protect and PoE CCTV: Twisted Pair Versus Coax and VLAN Isolation of IP Cameras

An IP camera needs a data connection, power and a recording destination. Power over Ethernet (PoE) can carry data and power over one network cable. A separate camera network limits permitted connections; the cable itself does not provide that security policy.

1. Compare twisted pair and coax by use case

Twisted pair means paired, twisted conductors. Suitable Cat5e supports many gigabit installations; Cat6 or Cat6A may form part of a design with additional headroom. Camera, switch, PoE class and cable-run requirements determine suitability.

Coax is not restricted to legacy analog video. Ethernet-over-coax adapters such as AXIS T8640 can reuse existing coax for data and PoE. Adapter requirements and cable, distance and power limits belong in the comparison. Coax cannot simply be ruled out for high-resolution IP cameras.

Bandwidth depends on codec, frame rate, scene and quality settings. Several compressed 4K streams can share a properly sized uplink; resolution alone does not establish spare capacity. Shielding and grounding must suit the installation. Twisted conductors do not replace correct bonding or surge protection.

2. A VLAN limits connections, not firmware defects

A compromised camera should have access to as few other systems as possible. A dedicated CCTV VLAN, maintained firmware and restricted credentials complement each other. Segmentation does not repair a device vulnerability.

In this example, cameras and a dedicated recorder share the CCTV VLAN. Traffic inside that VLAN normally passes directly through the switch, bypassing the gateway firewall. Additional port isolation therefore needs a separate design that preserves recorder connectivity.

3. Plan firewall exceptions first

Current UniFi zone-based firewalling supports policies between CCTV, Internal, External and Gateway. Menu locations depend on Network version. A testable communication list is needed before broad blocking:

• Administration: Only designated admin devices and required services may reach CCTV.
• Recorder: A recorder in another network requires explicit exceptions for camera connections. Ubiquiti lists TCP 7444, 7550, 7442 and UDP 10001 among Protect adoption requirements; operation and device model may require more. Recorder-to-camera permission alone does not replace this check.
• Basic services: DHCP, DNS and an actually available local time service need targeted access. Router-hosted services belong to the Gateway zone.
• Remaining traffic: Unnecessary new CCTV connections to other networks and Internet destinations are blocked. IPv4, IPv6 and additional zones such as VPN need coverage.

Replies need an effective return rule, for example through Auto Allow Return Traffic. A higher-priority block can discard replies too. Rule order, new connections and existing sessions require testing after changes.

4. Local recording and external access are separate

UniFi Protect records on a supported console, such as a UNVR or compatible Cloud Gateway. A UNAS is a file or archive destination, not a replacement for that Protect recorder. NAS archiving is a separate export path.

Local storage does not automatically prevent remote viewing or cloud exports from the recorder. Blocking camera Internet access initially covers only the cameras. Fully local operation also requires appropriate console, remote-access and archive settings.

Storage location alone does not establish data-protection compliance. Purpose, camera coverage, access rights, information for affected people and necessary deletion periods still need definition. A larger drive does not justify longer retention.

5. Cable length and PoE budget

Common 100/1000BASE-T installations use a maximum 100-metre channel including patch cables. Additional active segments, fibre or suitable extenders can cover longer distances. AXIS T8129 operates at 10/100 Mbit/s; extra reach depends on power-source capability and camera demand because each stage consumes power.

USW-Flex: conflicting manufacturer documents. The current technical page lists four PoE+ outputs at up to 25 W per port. The older linked PDF instead lists 802.3af and 15.4 W. “Only 802.3af, therefore no PoE+ camera” is consequently not a reliable current purchasing rule. The actual hardware and software must match the applicable specification.

Total output remains limited: current specifications list 8 W with PoE input, 20 W with PoE+ and 46 W with PoE++ or the suitable 60 W adapter. Four simultaneous 25 W loads exceed that budget. Startup peaks, infrared lighting and heaters belong in the calculation; permitted ambient temperature also depends on load.

6. Verify operation after isolation

Acceptance testing covers adoption, live view, recording, playback, restart, timekeeping and firmware maintenance. Unauthorized connections from CCTV must also fail. A reachable web interface alone proves neither recording nor complete network isolation.