WatchpostRemote access through your own hub
A vendor cloud is wired into the firmware, and you cannot point it anywhere else. Watchpost Hub goes around it: a relay on your server and a WireGuard tunnel from the site router.
- WatchpostOn your Mac or phone
- Your hubA server you control
- Site routerDials out to the hub
- Recorder and camerasNo ports opened to the internet
How a site gets connected
Run the hub
Install the relay on a server with a public address. One command sets it up and starts it on boot.
Let the app write the router config
The site wizard generates the WireGuard keys and a script for MikroTik RouterOS 7, or a WireGuard file for other routers.
Paste the script into the router
The router dials out to the hub, so the site needs no public address. It works behind CGNAT and LTE.
Open the app anywhere
On the local network Watchpost connects directly. Away from it the app goes through the hub, and it picks the route itself.
What to know before you start
- The app talks to the hub over HTTPS. On a phone it is not a VPN: only Watchpost traffic goes through it.
- The setup script is for MikroTik RouterOS 7. Other routers with WireGuard get a config file, and you set up the address mapping by hand.
- The router lets the tunnel reach only cameras and recorders, on their own ports.
- On the hub the video passes between two tunnels in the clear. Run the hub on a server you trust.
Today the hub runs as a self-hosted relay with a token per site and per person, and you can hand a site to someone without the router key. A service with accounts comes later.
Installing the hub and connecting a site are described step by step in the help. Hub installation guide