What Security Cams to get?

In a few months, I will have a semi-rare opportunity to redo my whole security camera set up. My current set up is a handful of inside and outside cameras, basically covering the sides of the house and the doors this was installed by the previous owner and are all coax run cameras to an (I think) outdated DVR type box.
There are many things I don't like about the current system. It doesn't connect to my network so I must go dig out a computer screen to hook up if I want to review anything (it is in a spot that I can't leave the monitor attached all the time). The storage amount leaves something to be desired and the quality is good, but not good enough if I want to zoom in for a better picture. Additionally, due to some property changes I have made, I want to add some more coverage.
So I come to you my fellow monkeys!
What brand and types of cameras can y'all suggest?
Due to the addition/remodel/subtractions I will be doing to the house, I should have access to all the places that I will need to run cable.
I was looking at maybe something that is fed by CAT cable and hopefully runs PoE for power. I imagine using one of them small all in one PC's for the DVR that I can get access to from any device on my network. I will run it on a non-internet network of-course. I would think the cameras would probably all run to a ethernet switch that hooks to the PC.
So point me in the right direction. I know there is some powerful software out there for these systems. What should I look for/Avoid in getting cameras. What are my realistic limitations. I'd like to run some lines to some of the out buildings so I can have cameras there too (buried in conduit most likely). I know enough to avoid wireless, but what other OpSec issues come to mind.

Thanks
-JW

 

Put together a Blue Iris server, install the AI to prevent false positives. Use wired PoE cameras on their own network (No wireless period) and use industry standard cameras. Run dual CAT-6 for redundancy in case one of them later goes bad. Don't use cheap CAT-6, instead buy Belden off eBay. Contractors frequently sell off unused cable after completing a job and killer prices.

To cut costs you can buy used PoE switches and adequate computers on eBay. I built mine because I wanted it to be rack mount and I wanted enough computing power to do home integration and telephony integrated to Blue Iris (telephony to get sound from doorbell cams and other areas). I also have a three disk RAID array for secure storage. If you are running a half dozen decent resolution cameras you can find an adequate computer and managed PoE switch on eBay or FB marketplace of around $500.

FOLLOW THE GUIDE on IPcamtalk - it's by far your best resource: Home

IPcamtalk is also the best place to learn about what cameras to purchase, which ones to get for the coverage you need for your property. There is even a tool where you can use an aerial view of your home/property to figure out what lens angle you need.

Blue Iris is by far the best IVR software and it's well documented. It's neither free nor is it expensive. It includes a web server so you can access it from any computer on your network. You also won't need to pay any camera manufacturer to see what's on the camera.

If your system grows you can also transfer your Blue Iris license from your old server to your new one. You also get a trial period where you can evaluate it before you buy. Download is free. BTW BI only runs on Intel systems that have graphics on the CPU. That's why it's important to read the hardware guide on IPcamtalk.

If you build a server, don't forget you can buy Windows licenses on Kinguin for $20-$30. It's basically a clearing house for contractors to sell unused OEM keys at the end of projects.

Security
Here is a map of how I set up my network. The Blue Iris server has two NIC's and is on my home network and camera network. Any TV's you want to use to view cameras you drive with any computer attached to a HDMI port. I do this anyway so I can stream whatever I want to watch on is without paying cable fees. On the Home side use wireless where necessary, but no junk like lights yuo can control with your phone. That's basically inviting the Trojan horse into your living room.

The camera network is isolated from the home network except for connecting to the Blue Iris server. The BI server is NEVER used for anything except for managing the cameras, home automation (if you go there or security systems that live on the secure camera network). No browsing, no watching movies, no nothing outside of Windows updates. It's a DMZ that should only be accessed via it's web server.

The managed PoE switch should assign IP addresses manually and use port security. This will prevent an intruder from plugging a device into a cable used by a camera and accessing your network.

EDIT: HDMI 2 in the diagram below is not used as the system is implemented. The server "lives" with the switches, router, and NAS where the TV is located in the living room and a second one in the master bedroom. This way we can monitor from our most common locations any time of the day or night.


This is going to sound over complicated, and while there is complexity there are a TON of great walk throughs like these to walk you through it:



Wireless Security
Naturally keep you wireless access point/router patched and configure for best encryption, don't broadcast network name, and use complex passcodes. If you use crap Internet connected devices (like those stupid lightbulbs) put them on a guest network that ONLY allows them Internet access (what I term idIOT).

One trick you can use if your router supports mesh configurations is to mesh a second wireless router to your ISP connected router, then plug devices into it using network cables. The wireless traffic between the two routers is encrypted and reasonably secure, and your endpoints aren't as vulnerable as they would be connected via wireless.

 

Not sure if it's wired or wireless but interesting - Kickstarter looking at a Jan 2025 release - marks intruder with a paintball or pepper spray. The top end model has pet and facial recognition.

 

I use either Hikvision or SV3C cameras and BlueIris. I have 4 facilities and my home running this set up, most with older Dell desktops with monster video cards to take some grunt work off of the CPU and allow full 30 FPS on each camera. All the servers have 500gb SSD D: drives and overwrite when full. I also run 8 port POE switches and Routerboard 1100 routers at each location. This allows me to firewall the cameras and server but still have them reachable on the network. Our network runs spanning tree so I can see the cameras from any facility in the corporation. Next, if you don't or can't firewall the outbound traffic you will want to watch the traffic from the cameras after they are installed and shut down any ports that "call home" to foreign IP addresses. The only fancy thing I used was outdoor CAT5e, plenty of bandwidth for camera RTSP IP streams.

Never assume anything not "stand alone" is secure if it is IP. Never place inside cameras where they can compromise security or dignity. Always remember the saved videos can be used as evidence, both for and against you.

 

I'm sure that most systems have low power requirements, but be sure that you can operate your system using solar power in case of power outages and SHTF situations.