The long version, for the person who has to approve it. First the problem, then the mechanism one stage at a time, where the relay runs, and what we leave out.
The problem
The cameras are usually fine. What is missing is a way in, and each of the three causes is a plain fact about the connection.
Sites on 4G, 5G and Starlink are almost always behind CGNAT. CGNAT is carrier-grade NAT: the site shares one public address with many others, so nothing can be forwarded to it. Port forwarding and dynamic DNS do not work there.
When a site fails over from Starlink to 4G, its public address changes. A forwarded port points at the old address. The box's tunnel follows the new address by itself.
Port forwarding needs a public address, the router password and a site visit. It also puts the device's own login on the internet. At most sites, at least one of those is not available.
The mechanism
Seven stages, in the order they happen at a new site.
The Relayant box plugs into a LAN port of the site's router and takes an address by DHCP. It then connects out to our servers over an encrypted WireGuard tunnel. WireGuard is a modern VPN protocol; everything between the box and our servers is encrypted.
The connection is outbound only, so it works on fibre, DSL, 4G, 5G and Starlink. The site needs nothing but outbound internet.
Because the box dials out, the site's router is left exactly as it was. No port is forwarded, no rule is added, no password is needed. The router sees one more device on its LAN making an ordinary outbound connection.
Nothing at the site listens for the internet. There is no way in for anyone, including us, except through the tunnel the box itself opened.
Once connected, the box searches the site's network and lists what it finds. Cameras, recorders, door controllers, routers, printers, UPSes, switches, NAS, inverters and building controllers. It names the maker and model where it can.
Finding a device is not reaching it. Nothing is connected to your control room until you say so in the next stage.
In the portal you pick the devices your control room needs and, for each, its ports. A camera's video port; a recorder's web port. Everything you do not pick stays unreachable.
The relay reaches only the device-and-port pairs you chose, never the site's whole network. A printer you did not pick is as unreachable as it was before.
Every chosen device gets its own address and port on our relay. Enter it in your monitoring software once. Software that connects to a camera or recorder by address and port can use it.
The address stays the same when the device changes address on the site's network. The box follows the device by its hardware address, so the control room never re-enters anything.
A device's address answers only the internet addresses you list: your control room's, and nothing else. Anyone else who tries that address and port is refused before they reach the site.
You can choose to allow any address for a device, and the portal warns you what that means. Whoever gets through reaches that one device and port, never anything beside it.
When the internet drops, the power is cut, or Relayant itself is unreachable, the box keeps trying. When internet, power and Relayant are all back, it connects again. Nobody visits the site.
While a site cannot reach Relayant, the portal shows it offline and, on the Relay + Alerts plan, alerts go out. A box that has just been plugged in shows Online once it has connected.
Where the relay runs
The relay is the piece that carries the connection between your control room and the site. It can run in two places, and the box, the portal and the addresses work the same way with either.
What is absent
These are the things the product is built not to do.
The portal
The portal is where sites are set up and watched.
Every site you look after, with its box shown Online or Offline. A new box shows Online once it has connected. A site that cannot reach Relayant shows offline, and alerts go out.
What the box found at each site, with maker and model where it can tell. For every monitored device: its state, response time, when it went offline, and seven days of availability by hour.
Each chosen device's address and port, and the addresses allowed to reach it. With local relays, whether each site reaches each relay, naming any address that fails, and what to forward on your router.
Every alert, the message it sent and when, kept with the site. Who acknowledged it, or which channel did, is recorded beside it.
A monthly PDF report for each site, produced on the first of the month for the month before, and available on demand. Its cover gives the period and an overall status; inside are the figures, every device and every incident.
Every box you own, whether in stock, at a site, lost or retired, with its history. Every change anyone made, recorded in the audit log: who, what, when, for every site.
If they have a question it does not answer, send it to us and we reply by email. Tell us how many sites you look after, how they connect and what monitoring software you use.