Blue Iris is a powerful video surveillance platform, but remote access should be configured carefully. One of the most common mistakes is opening the Blue Iris web server directly to the public internet using port forwarding.
Port forwarding may look like the quickest way to access Blue Iris remotely, but it also exposes your local video system to internet-wide scanning, password attacks, misconfiguration risk, and future software vulnerabilities. A safer approach is to keep Blue Iris private on your local network and access it through a VPN such as WireGuard.
The problem with Blue Iris port forwarding
When you port-forward Blue Iris, the router sends traffic from a public internet port directly to the Blue Iris PC. That means anyone on the internet can potentially reach the login page or service endpoint.
Even if the Blue Iris password is strong, direct exposure increases the attack surface. For security camera systems, this is unnecessary risk. A video surveillance system should not be casually exposed to the internet unless there is a very specific reason and strong security controls are in place.
A better pattern: Blue Iris behind WireGuard VPN
WireGuard creates an encrypted tunnel between your remote device and your local network. Instead of opening the Blue Iris web server to the internet, you expose only the VPN port on the router. After connecting to the VPN, your phone or laptop can access Blue Iris using its private LAN address.
Without VPN:
Internet -> public router port -> Blue Iris web server
With WireGuard:
Internet -> WireGuard VPN -> private LAN -> Blue Iris web server
This keeps Blue Iris private and gives you controlled remote access when you need it.
Example setup
A typical setup looks like this:
Router with WireGuard server
-> Local network
-> Blue Iris PC
IP: 192.168.2.210
Web port: 81
From outside the site, connect your phone or laptop to WireGuard and then open:
http://192.168.2.210:81
For a detail setup guide, please click here
Why this is useful for Camlocus users
Camlocus can work together with Blue Iris for cloud-based viewing, alert workflows, and remote video access. However, some users still want direct access to the local Blue Iris interface for administration or troubleshooting.
In that case, WireGuard is a strong companion setup: Camlocus handles the cloud workflow, while WireGuard gives secure access to the local Blue Iris admin interface without exposing Blue Iris publicly.
Recommended Blue Iris remote access approach
- Keep the Blue Iris PC on a fixed or reserved local IP address.
- Enable WireGuard VPN server on the router.
- Create a separate WireGuard client profile for every remote device.
- Use split tunnel Allowed IPs so only the local camera network goes through VPN.
- Do not port-forward the Blue Iris web server directly to the internet.
- Use DDNS if the public IP address can change.
What if your ISP uses CGNAT?
Some mobile and residential internet connections use CGNAT, which means the router does not have a directly reachable public IP address. If your router WAN IP starts with 10.x.x.x, 192.168.x.x, 172.16-31.x.x, or 100.64.x.x, a direct VPN server may not be reachable from the internet.
In that case, ask the ISP for a public IP, use a mesh VPN such as Tailscale or ZeroTier on the Blue Iris PC, or use a VPS-based VPN design.
WireGuard vs direct Blue Iris port forwarding
| Approach | Pros | Cons |
|---|---|---|
|
Blue Iris port forwarding |
Simple to understand |
Exposes Blue Iris to the internet;
higher security risk. |
|
WireGuard VPN |
Private, encrypted, better access
control |
Requires VPN setup on router and
client device. |
|
Tailscale / ZeroTier |
Works well behind CGNAT |
Requires software agent and third-
party coordination layer. |
Conclusion
For most users, the safest Blue Iris remote access setup is simple: do not expose Blue Iris directly to the internet. Keep it private on the local network and use WireGuard VPN when you need direct remote access.
If you use Camlocus together with Blue Iris, this approach gives you a cleaner security model: Camlocus for cloud workflows and WireGuard for secure local Blue Iris administration.
Need the exact setup steps?
Read our full documentation guide:
Secure Remote Access to Blue Iris with WireGuard VPN