Blog

Make Your IoT Cameras Invisible to the Internet

No open ports. No Shodan exposure. Full remote access through an encrypted tunnel.

February 2026

Your security cameras are watching your property. But who is watching your cameras? Most IP cameras ship with open ports, default passwords, and zero encryption. They are indexed by search engines like Shodan within hours of going online. With Ghost Networks, you can make them completely invisible to the public internet — while keeping full remote access for yourself.

The IoT Security Disaster

Every day, thousands of cameras, NVRs, and IoT devices are compromised because they were designed for convenience, not security. The attack surface is enormous.

Port forwarding exposes cameras directly to the internet
Default passwords: admin/admin on millions of devices
Shodan indexes your camera within hours of going online
Firmware updates are rare — known exploits stay open forever
1

Step 1: Install Ghost Connector on the Camera Gateway

Install Ghost Connector on the Linux device that sits on the same local network as your cameras. This is your gateway — the only device that needs to be on the Ghost network. Your cameras stay on the LAN, completely offline from the internet.

# Install Ghost Connector
curl -fsSL https://gh-o.net/d/connector/install.sh | bash
# Setup with your HelBind key
ghost_connector setup --cert /path/to/helbind-key.json
2

Step 2: Create a Phantom Hub for Cameras

Create a Phantom Hub containing only the gateway device and your phone. This isolates camera traffic into its own encrypted tunnel. No other device on your network can reach the cameras — and the cameras cannot reach the internet.

# Create an isolated hub for cameras
ghost-cli hubs create --name "cameras"
# Add the gateway and your phone
ghost-cli hubs add-device --hub <hub-id> \
--device <gateway-device-id>
ghost-cli hubs add-device --hub <hub-id> \
--device <my-phone-id>
3

Step 3: Access Your Cameras From Anywhere

Connect to the Ghost network on your phone and open the camera's local web UI through the gateway's Ghost IP. The traffic flows through an encrypted tunnel — never touches the public internet.

Camera web UI via gateway
http://172.16.0.10:8080
Ghost IP — not reachable from the public internet

What Attackers See

The difference between a camera exposed to the internet and one behind Ghost Networks.

Before: Exposed

Port 80 — OPEN
Port 554 (RTSP) — OPEN
Port 8080 — OPEN
Hikvision DS-2CD2xx
Firmware 5.4.x (CVE-2021-xxxxx)

Open ports, device fingerprint, known vulnerabilities. Indexed by Shodan, accessible to anyone.

After: Invisible

No open ports
No public IP
No device fingerprint
Shodan: 0 results
nmap: host down

Nothing to scan, nothing to exploit. The camera does not exist on the public internet. Only devices in the Phantom Hub can reach it.

Not Just Cameras

The same approach works for any IoT device that should never be on the public internet.

NVRs and DVRs — network video recorders with web interfaces
Smart home hubs — Home Assistant, Hubitat, SmartThings
NAS devices — Synology, QNAP, TrueNAS with admin panels
Industrial PLCs and SCADA systems — critical infrastructure that should never be online