Hikvision NVR remote access without port forwarding

Port forwarding, Hikvision's own cloud, a VPN, or a box that dials out from the site, and what each means for a monitored site.

Last reviewed · Checked against portal 1.30, box software 1.8, software agent 1.7.0, local relay 1.32

You can reach a Hikvision NVR without port forwarding in two ways: through Hikvision's own apps (Hik-Connect, or Hik-Partner Pro for installers), or through something at the site that dials out, such as a VPN endpoint or a Relayant box. Port forwarding is the third way, and it needs a public address that many sites do not have.

Which one fits depends on who needs to connect. An owner on a phone is well served by Hikvision's app. A control room's monitoring software connects by address and port, and that changes the choice.

Four ways to reach a recorder

Four ways to reach a Hikvision recorder from outside the site.
WayWhat is needed at the siteHow you connectBehind CGNAT
Port forwardingA public address, and forwarding rules on the routerAny software, to the site's public address and the forwarded portsDoes not work
Hik-Connect or Hik-Partner ProThe recorder added to Hikvision's platformThrough Hikvision's app or web portalNot stated on the pages read
VPNA router or computer at the site that runs the VPNAny software, once your network is joined to the site'sWorks if the site end dials out
A Relayant boxThe box on a LAN port of the routerAny software that connects by address and port, to one address and port per deviceWorks: the box dials out

CGNAT is carrier-grade NAT: the site shares a public address with many others, so nothing can be forwarded to it. Sites on 4G, 5G and Starlink are almost always behind it, and some broadband sites are too.

Port forwarding needs a public address

Hikvision's support article lists the ports to forward for direct access by IP address. A web browser needs the HTTP port, 80 by default. The Hik-Connect app and iVMS-4200 on a PC need the server port, 8000 by default, and the RTSP port, 554 or 10554 by default. Each can be changed. The ports are forwarded to the recorder's own address, and the article leaves the forwarding to the local IT person or the internet provider (supportusa.hikvision.com, read 16 October 2026).

That works on a line with a public address. It needs access to the site's router and usually a visit, and it puts the recorder's own login page on the internet. Behind CGNAT it does not work at all: port forwarding and dynamic DNS have no public address of the site's own to use. A router WAN address from 100.64.0.0 to 100.127.255.255, or a private address, means the site is behind CGNAT. We compare port forwarding a recorder, and the alternative in more detail.

Hik-Connect and Hik-Partner Pro work through Hikvision's apps

Hik-Connect is Hikvision's app and web portal for Hikvision devices. Hikvision describes accessing and managing the devices from anywhere, and adding devices by licence with no need for servers or VPN infrastructure. An owner can give an installer or service provider limited permissions to manage one device or the whole system (hikvision.com, read 16 October 2026).

Hik-Partner Pro is Hikvision's platform for its partners. Its page describes device management, and notifications about site issues that partners can identify and resolve remotely (hikvision.com, read 16 October 2026).

Both are used through Hikvision's own app or portal, and both cover Hikvision devices. A control room whose monitoring software connects to each recorder by address and port needs something else for that connection. Our comparison with camera makers' clouds goes through the differences.

A VPN joins two networks

A VPN joins the control room's network to the site's network. Something at the site has to run it: a router that supports it, or a computer that stays on. Behind CGNAT, the site end has to dial out, because nothing can reach it from outside.

Once joined, any software can reach the recorder at its own address on the site's network. The VPN reaches as far as it is set up to, which may be the whole site network, not only the recorder. Our comparison with Tailscale and ZeroTier covers two common VPN products. Cloudflare Tunnel also connects outward from a computer at the site; see Cloudflare Tunnel for cameras, compared.

A box at the site dials out

A Relayant box plugs into a LAN port of the site's router and takes an address by DHCP. It connects out to Relayant over an encrypted WireGuard tunnel. Nothing is opened or forwarded on the site's router, so CGNAT makes no difference.

Why nothing needs to be forwarded in First, devices at a site behind carrier-grade NAT with no box: the control room's packets reach the carrier's shared address and are dropped. Then a Relayant box is added at the site beside the devices. It dials out through the same address, a tunnel opens to the cloud relay, and traffic flows in both directions. Site Carrier NAT shared public address Camera Recorder Controller Control room Controlroom Nothing gets in no box yet Cloud relay Cloudrelay Relayant box Relayantbox Tunnel opened from the site box added
Packets from outside stop at the carrier's shared address. The box at the site opens its own tunnel outward, and traffic to the devices you chose flows both ways through it.
  • It finds the recorder. The box finds the devices on the site's network and names the maker and model where it can.
  • You choose what is reached. In the portal you choose the devices your control room needs and their ports. The relay reaches only those device-and-port pairs, never the site's whole network.
  • One address per device. Each chosen device gets one address and port on Relayant. It stays the same when the recorder changes address on the site's network.
  • Only your addresses get in. Only the internet addresses you list can reach a device's address. The security page sets out how we secure each connection.
  • Your own network, if you prefer. A local relay is a PC in your control room that the site boxes dial directly. It offers the devices as local ports, so the traffic stays on your own network.

Any monitoring software that connects to a camera or recorder by address and port works this way.

Choosing the ports

When you connect a device in the portal, it asks Which ports does your software need?, with the usual ones ticked. Port not listed? Add it adds another, and Check it tests it.

Choose the ports your monitoring software uses for the recorder. For Hikvision's own client software, Hikvision's article lists the server port and the RTSP port; a browser needs the HTTP port. If a recorder's ports were changed from the defaults, use the ones it is set to.

We hold no device logins and do not sign in to the recorder. Your software signs in as it does today. Between the relay and your software, the recorder's own protocol is used, which may not be encrypted; only your allowed addresses can connect. The box's health check of a vendor port such as 8000 only tests that the port is open.

Hik-Connect and the box side by side

The two do different jobs. Hik-Connect gives the owner and the installer Hikvision's app. The box gives the control room an address and port per device, and checks every minute that each device answers.

The box changes nothing on the router and does not sign in to the recorder, so it leaves the recorder's own settings, Hik-Connect included, as they are. A site can use both.

Product names belong to their owners.

Sign in Talk to us

Something in this guide is wrong or missing? Tell us: hello@relayant.net.