From nothing to working cameras, step by step.

How it fits together

IPC Terminal connects your cameras and the people who watch them through a private server that you own. Everything is encrypted with WireGuard, and the server only passes traffic between your own devices. It never sends anything to the internet.

The four kinds of device

Every device that joins your network is a peer. It has its own key pair and gets a fixed address from a range that depends on its role:

*Inside the private network, which defaults to 10.77.0.0/24. Viewers cannot reach each other, and boxes cannot start connections to viewers.

Two ways to build a site

Before you start

Gather these first. You can follow every step below with just this list.

• A place to run the server. This can be a small PC or mini-PC with at least 1 GB of RAM, a rack server, or a hosting provider that lets you boot your own ISO image (custom ISO upload or virtual media). The server runs entirely from memory.
• A public address for it. A fixed IP or a hostname that points to it. Behind a home or office router, you must forward one UDP port (default 51820) to the server.
• A build machine running Debian 13 (Trixie) with sudo access, about 15 GB free disk space and an internet connection. A virtual machine works. This is only used to create the server image, not to run it.
• One or two USB sticks (4 GB or more) to put the image on, unless your provider boots ISO files directly. A second stick is needed if you choose the safer key-on-USB option.
• The WireGuard app on every other device. Download it from wireguard.com/install. It exists for Windows, macOS, Linux, iOS and Android.
• A list of who and what will connect: which sites (boxes), which people (viewers), and who needs admin rights.

Quick start

The whole process in eight lines. Each step has a full section below.

1. Create a key pair on every device

   On each box, viewer and admin device, using the WireGuard app. Copy down the public key of each. Details →

2. Answer the questions at build.ipcterminal.com

   Name, network, port, key delivery, allowed ports, SSH, hardening, and paste the public keys. Details →

3. Download the build script and run it on Debian 13

   It creates the server key on your machine, builds the image and prints the server public key. Details →

4. Back up the secrets folder

   Keep it offline. It is the identity of your server. Details →

5. Write the image to a USB stick and boot the server

   Open the UDP port. Details →

6. Finish each peer’s configuration

   Add the server’s public key, its address and the peer’s assigned tunnel address. Boxes → Viewers →

7. Test

   Ping the server, then the box, then open a camera. Details →

8. Keep the Peers file

   It is how you add or remove devices later. Details →

Create a key pair on every device

The server needs to know every peer’s public key when it is built. So create the keys first. If you forget one, you can always add it later by rebuilding (see Add peers & update).

On Windows, macOS, iOS or Android

1. Open the WireGuard app

   Choose Add Tunnel → Add empty tunnel… (on Windows) or the equivalent Create from scratch (mobile and Mac).

2. Give it a name

   Use something meaningful such as site-malmo or alice-laptop.

3. Copy the public key

   The app creates a key pair automatically and shows Public key, a 44-character string ending in =. Copy it and keep it with the device’s name. Do not close this window yet. You will come back and finish this tunnel in step 5 or step 6.

On Linux

umask 077
wg genkey | tee privatekey | wg pubkey > publickey
cat publickey

Keep privatekey on the device. Send only the contents of publickey.

Answer the builder

Open build.ipcterminal.com. It asks one question at a time and everything happens in your browser. Nothing is uploaded. Here is what each question means and what to answer if you are unsure.

Pasting peers

At the peers step, paste your list. The simplest format is one public key per line, with a default role chosen from the dropdown. For more control, use one line per peer in this form:

box,site-malmo,<44-character public key>
viewer,alice,<44-character public key>
admin,ops,<44-character public key>
box,site-lund,<44-character public key>,,192.168.50.0/24

• The address is optional. Leave it empty and the builder assigns the next free one for the role.
• Routes are only for Option B gateways. They are the camera LAN behind the box, for example 192.168.50.0/24. Use a semicolon to list more than one. Only private ranges between /16 and /32 are accepted, and two boxes cannot share a range.
• You can also paste a whole client config. The builder works out its public key locally and throws the private key away. You can paste the Peers file or an old build script from a previous build to carry over everything.

Finish by choosing Generate build guide & script. You get three things: a build guide, the script (download it) and the Peers file (save it).

Build the server image

Do this on your Debian 13 build machine. The builder shows the exact commands with your own file names, so copy them from there. This is what they do:

1. Install the build tools

   Terminal

   sudo apt update
   sudo apt install -y live-build debootstrap squashfs-tools xorriso wireguard-tools openssh-client git curl gnupg

   For an ARM64 server built on a normal PC, the guide also adds qemu-user-static binfmt-support. That build is much slower.

2. Run the script as root

   Terminal

   chmod +x ~/Downloads/build-ipc-name.sh
   sudo ~/Downloads/build-ipc-name.sh

   The script creates a folder ~/ipc-name, makes the server key on your machine, writes every configuration file and asks Run the build now? [y/N]. Type y. A build takes 20–60 minutes.

3. Write down the server public key

   Near the end the script prints a box containing the Server public key, the listen port, the overlay network and the endpoint. Every peer needs the first and the last.

4. Back up the secrets folder

   Do this now. ~/ipc-name/secrets holds the server private key (and the SSH host key and preshared keys, if you use them). Copy it to encrypted offline storage. If you lose it, every peer has to be reconfigured. Rebuilds reuse it automatically, which is how an update keeps the same server identity.

5. Check the files

   Terminal

   cd ~/ipc-name && sha256sum -c SHA256SUMS

   Every line should say OK. The finished image is live-image-amd64.hybrid.iso (or arm64) in the same folder, and its checksum is in ISO.sha256.

Boot the server

1. Write the image to a USB stick

   Or attach the ISO as virtual media if your provider or server supports it.

   Terminal

   lsblk
   sudo dd if=~/ipc-name/live-image-amd64.hybrid.iso of=/dev/sdX bs=4M status=progress conv=fsync

   This erases the target. Replace sdX with the whole USB device you identified with lsblk, for example /dev/sdb, never a partition and never your own system disk. If you are not certain, stop and check the size and name in lsblk again.

   On Windows or macOS you can use a tool such as balenaEtcher or Rufus to write the same ISO file (use “DD image” mode in Rufus).

2. If you chose “Separate USB stick”, prepare the key stick

   Use a second stick. The label must be exactly IPCKEYS.

   Terminal

   sudo mkfs.vfat -F 32 -n IPCKEYS /dev/sdY1
   sudo mkdir -p /mnt/ipckeys && sudo mount /dev/sdY1 /mnt/ipckeys
   sudo cp -r ~/ipc-name/secrets/. /mnt/ipckeys/
   sudo umount /mnt/ipckeys

   Keep this stick offline except while the server boots. The server waits up to 15 minutes for it, copies the keys into memory and unmounts it, and then you can take it out.

3. Boot the server from the stick

   Plug the stick into the server and choose it in the boot menu (UEFI or BIOS). The system loads completely into RAM, so the server needs at least 1 GB. Leave the stick plugged in if you can: after a power cut the server will come back on its own.

   If a server refuses to boot with Secure Boot enabled, turn Secure Boot off in its firmware settings. The image is not signed for it.

4. Open the UDP port

   Allow UDP 51820 (or the port you picked) to the server, and nothing else. On a router, forward that port to the server’s address. On a hosting provider, add it to the firewall or security group.

5. Point a name at it

   Create a DNS record for your hostname, or use the fixed public IP. This is the Endpoint the peers will use, for example vpn.example.com:51820.

Connect a site (box)

Pick one of the two options. You will need three things from the earlier steps: the server public key, the endpoint and the tunnel address the Peers file gave this box.

Option A: the recorder PC is the box (Windows)

1. Open the tunnel you created in step 1

   In the WireGuard app select the tunnel and choose Edit. Leave the PrivateKey line exactly as the app made it, and add the rest:

   WireGuard config

   [Interface]
   PrivateKey = (leave the line the app generated)
   Address = 10.77.0.2/32
   MTU = 1420
   
   [Peer]
   PublicKey = <SERVER public key from the build>
   Endpoint = vpn.example.com:51820
   AllowedIPs = 10.77.0.0/24
   PersistentKeepalive = 25

   Keep AllowedIPs to the tunnel network only. Never use 0.0.0.0/0. It would try to send all your internet traffic into the tunnel. The server would drop it anyway, but the PC would lose its internet.

2. Save and activate

   Click Save, then Activate. After a few seconds the status should show a latest handshake.

3. Allow the recorder software through Windows Firewall

   Windows treats the tunnel as a public network, so rules written only for “Private” networks will not apply. Create an inbound rule that allows your recorder’s ports (for example TCP 80, 443, 554, 8000 and, if you use admin Remote Desktop, 3389) and limit it to the remote address range 10.77.0.0/24.

   Remote Desktop can only be hosted on Windows Pro or higher, not Windows Home.

4. Make it start by itself

   For a recorder that must reconnect after every reboot, install the tunnel as a Windows service. Run this in an administrator Command Prompt, using the full path to a saved copy of the config file:

   Command Prompt (admin)

   "C:\Program Files\WireGuard\wireguard.exe" /installtunnelservice "C:\path\to\site-malmo.conf"

   Delete the loose .conf copy afterwards, because it contains the private key.

Option B: a gateway on the camera network (Linux)

Use a mini-PC or Raspberry Pi running Debian or Ubuntu, connected to the same LAN as the cameras. In this setup the box needs a route: when you pasted its peer in the builder, you added the camera LAN, for example 192.168.50.0/24.

1. Install WireGuard and create the keys

   Terminal

   sudo apt install -y wireguard iptables
   umask 077
   wg genkey | sudo tee /etc/wireguard/privatekey | wg pubkey

2. Create /etc/wireguard/wg0.conf

   Replace eth0 with the box’s network interface name (see ip -br link) and use your own addresses and keys.

   /etc/wireguard/wg0.conf

   [Interface]
   PrivateKey = <contents of /etc/wireguard/privatekey>
   Address = 10.77.0.3/32
   MTU = 1420
   PostUp = sysctl -w net.ipv4.ip_forward=1; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
   PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
   
   [Peer]
   PublicKey = <SERVER public key from the build>
   Endpoint = vpn.example.com:51820
   AllowedIPs = 10.77.0.0/24
   PersistentKeepalive = 25

   The two extra lines let the box pass tunnel traffic on to the cameras and make the cameras see it as coming from the box itself, so the cameras do not need any special route back.

3. Start it and keep it running

   Terminal

   sudo systemctl enable --now wg-quick@wg0
   sudo wg show

   wg show should list the server with a latest handshake of a few seconds ago.

Connect viewers and admins

A viewer is configured in the same way as a box. The differences are the address range and AllowedIPs.

1. Open the tunnel you created in step 1 and edit it

   WireGuard config

   [Interface]
   PrivateKey = (leave the line the app generated)
   Address = 10.77.0.100/32
   MTU = 1420
   
   [Peer]
   PublicKey = <SERVER public key from the build>
   Endpoint = vpn.example.com:51820
   AllowedIPs = 10.77.0.0/24, 192.168.50.0/24
   PersistentKeepalive = 25

   • Address: the address from the Peers file. Viewers use .100–.199, admins .200–.254.
   • AllowedIPs: the tunnel network, plus the camera LAN of every Option B gateway you want to reach (here 192.168.50.0/24). If you only use Option A boxes, the tunnel network alone is enough.

2. Save and activate

   Turn the tunnel on when you want to view cameras and off when you are done. Everything else on the computer keeps using the normal internet connection.

3. Open your viewing software

   Add the device by IP address, using the box’s tunnel address (Option A) or the camera’s own LAN address (Option B).

   What	Use
   Hikvision iVMS-4200 / NVR	Add the IP, SDK port 8000, and the device’s user and password
   Dahua SmartPSS / NVR	Add the IP, port 37777 (add it as an extra port in the builder), user and password
   VLC or any RTSP player (Hikvision)	rtsp://user:pass@IP:554/Streaming/Channels/101
   VLC or any RTSP player (Dahua)	rtsp://user:pass@IP:554/cam/realmonitor?channel=1&subtype=0
   Camera web page	http://IP or https://IP
   Remote control of the recorder PC (admin)	Remote Desktop to the box’s tunnel address, when RDP is enabled in the builder

   Automatic device search tools (such as Hikvision SADP) only find devices on the same local network, so they will not see devices through the tunnel. Always add them by IP address.

Test it

Test in small steps, so that if something fails you know which part. Start from a viewer with its tunnel turned on.

1. Ping the server

   Terminal

   ping 10.77.0.1

   A reply proves the tunnel itself works. No reply? See no handshake.

2. Ping the box

   Terminal

   ping 10.77.0.2

   Windows blocks ping by default. If the recorder PC does not answer but the tunnel shows a handshake, go on to the next step and test the real port instead.

3. Open a camera or the recorder

   Use the software from step 6, or open http://<box or camera address> in a browser.

4. Check the isolation (optional, recommended)

   With the tunnel on, check that your public IP address is unchanged by visiting any “what is my IP” page. It must still show your own connection. This confirms that no internet traffic goes through the server.

5. Check from the server (only if you enabled SSH)

   Terminal (admin peer, tunnel on)

   ssh ipcadmin@10.77.0.1
   sudo wg show
   sudo nft list ruleset

   You should see a recent latest handshake for each connected peer and a forward chain that only accepts traffic from wg0 to wg0.

Add peers and update the server

The server never changes while it is running, which is what makes it secure. To add or remove a device, change a port, or update the system, you build a fresh image with the same identity and boot it.

1. Collect the new public keys

   Create the key pair on the new device as in step 1.

2. Open the builder and paste your old peers

   At the peers step paste your saved Peers file (or the previous build script). All existing peers come back automatically. Add the new public keys, or remove peers with the × button.

3. Generate and run the new script on the same build machine

   It reuses secrets/, so the server key does not change and no peer needs updating. If you build somewhere else, copy the secrets folder there first.

4. Write the new image and reboot the server

   Peers reconnect by themselves, typically within a minute. Save the new Peers file for next time.

5. Finish the new peer

   Give the new device the server public key, the endpoint and its tunnel address, as in steps 5 and 6.

Lost or compromised device

Remove its public key at the peers step, rebuild and reboot. From then on it can no longer connect. If a device is stolen, also change the passwords on cameras and recorders that it could reach.

Lost secrets folder

The server can still be rebuilt, but it gets a new key. Every peer must then be given the new server public key. Keeping an offline backup avoids this.

Camera-side tips

The tunnel protects the path between sites and viewers. These settings make the cameras themselves safer:

• Remove the camera’s route to the internet. On an isolated camera LAN, leave the camera’s default gateway empty so it cannot reach vendor servers.
• Turn off cloud and P2P features (for example Hik-Connect, EZVIZ or Dahua P2P) on cameras and recorders. They are not needed with IPC Terminal.
• Change default passwords and use a different strong password per device.
• Prefer RTSP over TCP. It travels cleanly inside the tunnel. Only enable “RTP over UDP” in the builder if you have a specific need, because it weakens isolation.
• Keep firmware up to date by downloading it on a separate machine and uploading it locally.

Troubleshooting

Find the symptom, then work down the list. Start with the first one that matches what you see.

FAQ

Asking for help

The fastest way to a solution is to send the facts. Please include:

• What you were doing and the exact step that failed.
• The exact error message, copied as text.
• The role of the device that fails (box, viewer, admin) and whether it is Option A or B.
• The output of wg show on the Linux device, or a screenshot of the Windows tunnel status, with the latest handshake visible.
• On the server (SSH enabled): sudo wg show.
• Your Peers file. It holds public keys only and is safe to share.

Find the maker and project updates on the project homepage.