Secure Remote Access to Blue Iris with WireGuard VPN
This guide explains how to securely access your local Blue Iris web interface from outside your network using
WireGuard VPN.
Camlocus does not require exposing Blue Iris to the public internet. However, some users also want to open the
local Blue Iris interface remotely for administration, troubleshooting, live viewing, or playback. For that use case, a
VPN is safer than direct port forwarding.
Recommended security approach
Do not expose the Blue Iris web server directly to the public internet. Use WireGuard VPN and access Blue Iris through its private LAN IP address.
When to use this setup
- You use Blue Iris locally and want remote access to the Blue Iris web interface.
- You want to avoid exposing the Blue Iris web server port directly to the internet.
- Your router supports WireGuard VPN server, for example many ASUS routers.
- You want to access Blue Iris from a phone, laptop, or tablet while away from the site.
Network example
Example layout:
Internet
->Router with WireGuard VPN server
-> Local LAN
-> Blue Iris PC / server
Example IP: 192.168.2.210
Example Blue Iris web port: 81
After the VPN connection is active, the remote device can open Blue Iris using the private LAN address, for
example:
http://192.168.2.210:81
Before you start
| Requirement | Why it matters |
| Router with WireGuard server support | The router will accept VPN connections from outside the site. |
| Public WAN IP or working DDNS | The remote device must be able to reach the router from the internet. |
| Blue Iris PC with fixed/reserved local IP | The Blue Iris address should not change after reboot. |
| WireGuard app on phone/laptop | The remote device needs a WireGuard client. |
| Blue Iris web server enabled | Blue Iris must be accessible inside the LAN before testing VPN access. |
Step 1 – Check whether your router has a public WAN IP
On your router, open the internet or WAN status page and check the WAN IP address.
If the WAN IP starts with one of the following ranges, the router is behind private NAT or CGNAT:
10.x.x.x
192.168.x.x
172.16.x.x – 172.31.x.x
100.64.x.x – 100.127.x.x
If your router is behind CGNAT, a direct WireGuard server on the router will usually not be reachable from the
public internet. In that case, use one of these options:
- Ask the ISP for a public IP address.
- Use a mesh VPN such as Tailscale or ZeroTier on the Blue Iris PC.
- Use a VPN server on a VPS and connect the site to it as a client
If the router has a public WAN IP, continue with the steps below.
Step 2 – Reserve a fixed IP address for the Blue Iris PC
Blue Iris should have a stable local IP address. The best way is a DHCP reservation on the router.
Example:
- Blue Iris PC IP: 192.168.2.210
- Router / gateway: 192.168.2.1
- Blue Iris web port: 81
On ASUS routers, the DHCP reservation is usually configured under:
LAN -> DHCP Server -> Manually Assigned IP around the DHCP list
Reserve the Blue Iris PC IP address by its MAC address. Avoid relying on a random DHCP address that can
change later.
Step 3 – Confirm Blue Iris works inside the local network
Before configuring VPN, test Blue Iris from a device already connected to the same local network.
http://192.168.2.210:81
If this does not work locally, fix the Blue Iris web server, Windows firewall, or local IP address first. VPN will not fix
a broken local Blue Iris setup.
Step 4 – Enable WireGuard VPN server on the router
On ASUS routers, open:
VPN -> VPN Server -> WireGuard VPN
Recommended basic settings:
| Setting | Recommended value |
| WireGuard VPN Server | ON |
| Access Intranet | ON |
| Tunnel IPv4 address | 10.6.0.1/32 |
| Listen Port | 51820 |
Click Apply all settings after making changes.
Step 5 – Create a WireGuard client profile
Create a separate WireGuard client profile for each phone, laptop, or tablet. Do not share one profile between
many devices.
Example client names:
Owner-iPhone
Owner-Laptop
Technician-Phone
Use the QR code option for phones. For laptops, export the WireGuard configuration file if needed.
Step 6 – Configure Allowed IPs for split tunnel
Allowed IPs is configured on the WireGuard client profile. It tells the phone or laptop which traffic should go
through the VPN tunnel.
For Blue Iris remote access, split tunnel is usually best. Only the local site network goes through the VPN. Normal
internet browsing continues to use the phone or laptop internet connection.
Example split tunnel Allowed IPs:
AllowedIPs = 192.168.2.0/24, 10.6.0.0/24
Use the actual LAN subnet of your site. If the router LAN is 192.168.1.1, use 192.168.1.0/24. If the router LAN is
192.168.50.1, use 192.168.50.0/24.
Avoid using full tunnel unless you intentionally want all remote internet traffic to go through the site router.
Full tunnel example: AllowedIPs = 0.0.0.0/0
Step 7 – Configure the endpoint
If your router has a static public IP, the WireGuard endpoint can be the public IP and port.
Endpoint = 85.206.252.89:51820
If the public IP can change, enable DDNS on the router and use a hostname instead.
Endpoint = yourname.asuscomm.com:51820
Step 8 – Test from outside the local network
Do not test from the same Wi-Fi network and assume everything is correct. Use a real outside connection.
- Turn off Wi-Fi on the phone.
- Use mobile data.
- Enable the WireGuard tunnel.
- Open the Blue Iris local web address in the browser.
http://192.168.2.210:81
If Blue Iris opens, the VPN is working correctly.
Troubleshooting
| Problem | Likely cause | Recommended value |
| WireGuard does not connect | Router not reachable from internet | Check WAN IP, CGNAT, DDNS, endpoint, UDP 51820. |
| VPN connects but Blue Iris does not open | LAN routing or firewall issue | Check Access Intranet, Blue Iris IP, Windows Firewall, Blue Iris web port. |
| Works on LAN but not over VPN | Firewall allows local subnet only | Allow Blue Iris web port from the WireGuard subnet, for example 10.6.0.0/24. |
| Blue Iris address changes after reboot | No DHCP reservation | Reserve the Blue Iris PC IP on the router. |
| Phone internet becomes slower after VPN | Full tunnel enabled | |
| DDNS hostname does not work | Hostname not updated or blocked | Test public IP directly and verify DDNS status on the router. |
Security recommendations
- Do not port-forward the Blue Iris web port to the internet.
- Use WireGuard VPN for remote access.
- Create separate VPN profiles for separate users/devices.
- Remove old VPN profiles when phones or laptops are replaced.
- Use strong Blue Iris user passwords.
- Keep router firmware and Blue Iris updated.
- Keep the Blue Iris PC on a reserved IP address.
- Use DDNS instead of manually tracking a changing public IP address.
How this works with Camlocus
Camlocus can receive streams, alerts, and video events without requiring the Blue Iris web interface to be publicly
exposed. WireGuard is only needed if the user also wants direct remote access to the local Blue Iris interface.
Recommended pattern:
Camlocus:
- cloud viewing
- alerts
- playback workflows
- multi-site access
WireGuard VPN:
- secure remote access to the local Blue Iris admin interface
- troubleshooting
- local Blue Iris web UI access