This guide is written for IT, network, and security teams preparing a site for Genea Video. It covers how the system connects, what needs to be allowed through your firewall, and what to confirm before installation day.
The short version: one outbound allowlist, no inbound firewall rules, and no change to your inbound security posture.
đĄ This article covers deployments using a Genea edge gateway.
Cam2Cloud cameras connect directly from the camera itself and have different requirements.
How Genea Video connects
The edge gateway is an appliance installed on your local network. It does three things:
Pulls video from your IP cameras over the local network
Processes video analytics on the device itself
Sends only what is needed outbound to Genea cloud services
How video reaches a viewer
Live video can travel by three different paths. Genea picks the best available one automatically.
Path | When it is used | How it travels |
Local | Viewer is on the same network as the gateway | Direct on the LAN, never leaves your site |
Direct peer to peer | Viewer is remote and a direct path can be established | WebRTC over UDP, using a STUN service to find the direct path |
Cloud relay | Viewer is remote and no direct path is available | Through Genea's media relay in the cloud |
Recorded playback and search always come from cloud storage over HTTPS on TCP 443.
The core principle: outbound only
Every connection is initiated by the gateway, outbound to the internet. You do not need to open any inbound ports, create any inbound firewall rules, or expose the gateway to the public internet.
This is the single most important point for your security review. Nothing on the internet reaches in. The gateway reaches out.
Required outbound allowlist
All entries below are outbound from the gateway's IP or MAC address to the internet.
Destination | Port | Protocol | Purpose |
| 443, 8443, 80 | TCP, HTTPS | Media upload and device management |
| 443, 80 | TCP, UDP, HTTPS, WSS | Genea API and signaling |
| 19302 | UDP | STUN, used to discover a direct path |
WebRTC media | ~10000 to 20000 | UDP, RTP | Live video, direct and relayed |
DNS resolution over UDP and TCP port 53 must also be permitted for all destinations above.
Use FQDN allowlisting where you can
Genea recommends allowlisting by domain name rather than by IP address. Cloud provider IP ranges change over time, so IP based allowlists need ongoing maintenance and tend to break quietly.
If your security policy requires IP based allowlisting, use AWS's published ip-ranges.json file, filtered to the relevant service and region, and refresh it periodically.
A note on the STUN endpoint
The STUN server endpoint is subject to change. Any change will be communicated in advance so your allowlist can be updated before it takes effect.
LAN side traffic
These rules apply inside your local network only. They are not internet facing.
Connection | Ports | Protocol | Purpose |
Gateway to camera | ~554 | TCP, RTSP | Video stream |
Gateway to camera | 80, 554, 8080 | TCP | Camera discovery scanning |
The tilde indicates the port a service typically operates on. It can be changed by the installer if your environment uses something different.
If your cameras are on a separate VLAN
Many sites isolate cameras on a dedicated VLAN or camera network. That is fine, and Genea recommends it. Your network team simply needs to allow the gateway's IP address to reach that camera VLAN on the ports listed above.
Network placement
For best performance, install the gateway on a network segment that has:
Internet access
Access to the IP cameras it will manage
Stable DNS resolution
A consistent outbound path through the firewall
Encryption
Where | Protection |
HTTPS, WSS, and MQTT connections | TLS 1.2 |
WebRTC media, direct or relayed | DTLS SRTP |
Recorded video in cloud storage | Encrypted at rest |
Device data (camera status, configuration, and software updates) travels over MQTT with TLS 1.2 on TCP 8883 or 443.
Configurations that can cause problems
Three common network configurations interfere with gateway operation. Worth checking before installation rather than after.
SSL and TLS deep packet inspection
Avoid applying TLS inspection to gateway traffic. Intercepting TLS causes certificate trust failures and will disrupt communication with Genea cloud services. Add the gateway to your inspection bypass list.
Proxy servers
If outbound internet traffic from the gateway must pass through a proxy, confirm compatibility with Genea before deployment. Proxy configurations vary and some affect gateway behaviour.
Restricted UDP traffic
Live video uses UDP for both the direct peer to peer path and the relayed path. If your network restricts UDP, live view behaviour should be validated during installation. Genea also recommends using a restricted UDP port range for peer to peer traffic where your equipment supports it.
Pre installation checklist
Confirm all of the following with your IT and network team before installation day.
Item |
The gateway has internet access |
The gateway can resolve DNS |
All outbound cloud endpoints in this guide are allowed |
The gateway can reach the camera VLAN or subnet on the required ports |
No inbound internet firewall rules are being created for the gateway |
SSL and TLS inspection is disabled or bypassed for gateway traffic |
Any proxy requirement has been reviewed with Genea |
Live view and WebRTC behaviour has been validated if UDP traffic is restricted |
Troubleshooting
Symptom | What to check |
Gateway will not come online | Confirm internet access, DNS resolution, and that |
Gateway online but cameras not found | Confirm the gateway can reach the camera VLAN on ports 80, 554, and 8080 |
Cameras found but no video | Check RTSP on port 554 between the gateway and cameras, and verify camera credentials |
Recorded playback works but live view does not | Almost always UDP. Confirm the WebRTC range and STUN on UDP 19302 are allowed outbound |
Live view works locally but not remotely | Direct peer to peer is failing. Confirm STUN access, then verify the cloud relay path over TCP 443 |
Connection drops intermittently | Check whether TLS inspection is being applied to gateway traffic, and confirm the outbound path through the firewall is consistent |
Everything worked, then stopped | If you use IP based allowlisting, cloud IP ranges have likely changed. Refresh from AWS |
If you have any questions about this feature or have any other requests, please reach out to acsupport@getgenea.com.