English
Deutsch
PolskiUniFi Protect and PoE CCTV: Twisted Pair Versus Coax and VLAN Isolation of IP Cameras
Contents
Modern video surveillance architecture has shifted decisively from legacy analog coaxial cabling to structured Power over Ethernet (PoE) networks. While older CCTV deployments relied on RG59 coaxial cables paired with separate power distribution lines, contemporary IP-based deployments utilizing twisted-pair copper cabling (Cat6 or Cat6A) provide significant technical advantages in scalability, signal integrity, and centralized power management.
1. Superiority of Twisted-Pair over Coaxial Cabling
Coaxial cables were designed primarily for analog baseband video transmission. They suffer from rapid high-frequency attenuation, ground-loop interference, and physical rigidity. By contrast, twisted-pair cabling offers standardized digital packet transmission over Ethernet protocols. The benefits include:
- Single-Cable Deployment (PoE): Power and high-bitrate video streams travel simultaneously over a single Cat6/Cat6A cable, eliminating the need for local power supplies near camera endpoints.
- Higher Bandwidth & Resolution Support: While analog coax struggles with uncompressed multi-megapixel streams without proprietary modulation, 1000BASE-T twisted-pair networks effortlessly carry multiple 4K (8MP) streams with HDR and high frame rates.
- Galvanic Isolation & Noise Immunity: Standard differential signaling on twisted pairs, especially when using shielded variants (F/UTP), protects video feeds from electromagnetic interference (EMI) often encountered in industrial or enterprise environments.
2. Security Risks of Unisolated IP Cameras
Despite their physical and operational superiority, network-connected IP cameras present an inherent cybersecurity attack surface. Embedded IoT devices frequently run proprietary firmware with unpatched vulnerabilities, hardcoded backdoors, or aggressive cloud-tethering services. Allowing surveillance cameras unconstrained access to the Internet introduces severe risks, including credential harvesting, lateral network reconnaissance, and unauthorized remote streaming.
3. Network Architecture: Dedicated CCTV VLAN & Zone-Based Isolation
To mitigate IoT-related vulnerabilities without sacrificing operational functionality, a strict network segmentation architecture must be enforced. Within a UniFi network deployment, surveillance endpoints should reside in an isolated Virtual Local Area Network (VLAN).
Firewall Policy Configuration (Zone-Based Firewall)
Since UniFi Network 9.0 the gateway groups networks into firewall zones and defines policies between those zones; the earlier interface-based rule sets (LAN IN, WAN OUT) have been superseded, and existing rules are migrated automatically once the zone-based firewall is activated under Settings → Security. Total internet isolation requires the CCTV VLAN to be assigned to its own zone, together with the following policies:
- CCTV → External – Block All: A policy from the CCTV zone to the External zone must drop all packets originating from the dedicated CCTV VLAN subnet (e.g.,
10.0.50.0/24) and destined for any external IP address. This prevents outbound telemetry, cloud home-calling, and potential data exfiltration. - CCTV → Internal – Block All: Traffic originating from the CCTV zone must be blocked from initiating connections to trusted internal zones (such as management or client networks).
- Internal → CCTV – Allow: The opposite direction requires its own explicit allow policy, ideally narrowed down to authorized administrative devices and the recorder. Because the firewall is stateful, the return traffic of these sessions is permitted automatically; a rule restricted to established and related connections covers only that return path and can never open a session toward the camera endpoints.
4. Local Video Retention on UNVR or UNAS
When external Internet access is completely blocked, video storage and processing must be handled locally within the perimeter. The recording and management software itself is UniFi Protect, which runs on the UniFi OS console — that is, on the UNVR or on a Cloud Gateway that supports the application. A UNAS cannot run Protect and serves only as an archive target for footage that has already been recorded, so a dedicated Ubiquiti Network Video Recorder (UNVR) remains the component that ensures high-capacity, on-premise retention.
Local storage architecture eliminates subscription fees, prevents bandwidth saturation on external WAN links, and ensures full compliance with strict data privacy regulations by keeping all sensitive recordings strictly inside the local infrastructure.
Beyond 100 Metres: Extenders and PoE-Powered Switches
The star topology has one hard limit: a twisted-pair Ethernet segment ends at 100 metres. A camera further away from the switch needs a device in between that terminates the segment and starts a new one. For CCTV, two kinds of device do this without a local power supply, because they draw their own power from the incoming PoE and pass the rest on.
- Inline PoE extender, for example the Axis T8129: one unit for every additional 100 metres, fed from an 802.3af or 802.3at source, no separate power supply. Its data rate is limited to 10/100 Mbit/s, and the reachable distance depends on the camera, the power source and the operating conditions, because every stage consumes part of the power that arrives.
- PoE-powered switch, for example the UniFi USW-Flex: port 1 is the PoE input (802.3af/at or 802.3bt), ports 2 to 5 supply 802.3af with at most 15.4 W per port, all at gigabit speed. The total budget depends on how the switch itself is fed: 8 W from an 802.3af source, 20 W from 802.3at, 46 W from 802.3bt or from the 60 W PoE adapter, once that power source is selected in the controller.
Two planning consequences follow from the datasheets. First, the USW-Flex outputs only 802.3af: cameras that need 802.3at, such as many PTZ models or housings with heaters, cannot be powered from it. Second, four ports at the full 15.4 W would need 61.6 W, more than the 46 W budget, so the actual draw of the connected cameras decides how many run from one switch. The operating range also depends on load: −40 to 55 °C at 46 W of PoE output, up to 65 °C at 25 W.
For the VLAN design above, the switch has an advantage: the USW-Flex is a managed switch with network and VLAN configuration per port. The cameras behind it land in the isolated CCTV VLAN just like those on the central PoE switch, and the uplink carries that VLAN back to the core.
Questions and answers
How much storage does a month of retention take for 4K cameras?
With continuous recording, more than is often assumed. Every megabit per second of sustained bitrate adds up to about 10.8 GB per day, or roughly 324 GB in a 30-day month. A 4K stream in H.265 at a reasonable quality often sits around 8 to 12 megabits per second, which means about 2.6 to 3.9 TB per camera per month, multiplied by the number of cameras.
That is precisely why detection-based recording exists, and why it is more than a compromise. Recording only on detected events, with a short pre-roll, can cut that by a large factor; how large depends on how busy the scenes are, and a driveway facing a public road behaves very differently from a garden.
Two practical notes for planning. Sizing should be based on the measured bitrate rather than the datasheet: the recorder reports what each camera actually produces, and a scene with moving foliage costs more than a static corridor. And the retention period is best decided before the capacity, not after: thirty days of events is a different question from seven days of continuous footage, and the two lead to very different capacities.
Related articles
