Ways to block camera traffic
BombeCam's option keeps allowed controls working under destination and rate limits. Encrypted traffic may still contain image data. It needs a router you control. If you don't have one, or want something different, these are the other ways to limit what the cameras send to the cloud, with the pros and cons of each. This page is information only; nothing here changes your setup.
| Method | Osaio app controls | BombeCam local streaming | Video and images to the cloud | What you need |
|---|---|---|---|---|
| BombeCam router block | Keep working | Keeps working | Destination and rate limits | GL.iNet or OpenWrt router |
| Small travel router for the cameras | Keep working | Keeps working | Destination and rate limits | An extra GL.iNet router |
| Full internet block | Stop | New streams can't start | Blocked | Almost any router |
| Guest network without internet | Stop | May not reach the cameras | Blocked | Router with a guest network |
| Your own firewall rules | Keep working | Keeps working | Blocked if set up right | pfSense, OPNsense, UniFi, MikroTik… |
| Linux box as the cameras' router | Keep working | Keeps working | Destination and rate limits | Linux computer or Raspberry Pi |
| DNS blocking (Pi-hole etc.) | Keep working | Keeps working | Not blocked | A DNS filter |
| Cloud features off in the app | Keep working | Keeps working | Up to the camera | Nothing |
BombeCam router block
Rules on the router your cameras connect to let each blocked camera reach only Osaio's control server, the short stream-setup handshake, DNS and time sync, normally under a 4 KB/s cap and 8 KB burst per camera (some fw3 routers use a packet-rate fallback). Other internet destinations are dropped. These rules cannot inspect encrypted content or guarantee that no image data escapes. You connect the router once in BombeCam's Firewall tab, then switch each camera on or off.
Pros
- The Osaio app can still switch the light, pan/tilt and change night vision.
- BombeCam can start local streams at any time.
- Set per camera, and easy to undo.
- Only allows, drops and rate-limits. Nothing is redirected, and the camera isn't modified.
Cons
- Needs a GL.iNet router on firmware 4.x or OpenWrt 21.02+, in Router mode.
- Osaio still sees that the camera is online, your IP address, and which commands are sent.
- Small images, fragments or low-rate video can fit within allowed encrypted traffic.
Small travel router for the cameras
If your main router comes from your internet provider, plug a small GL.iNet travel router into it and put the cameras (and ideally the PC running BombeCam) on the travel router's Wi-Fi. The travel router then runs BombeCam's router block.
Pros
- Brings BombeCam's router block to any internet provider's router.
- Keeps the cameras on their own network, apart from your other devices.
Cons
- One more device to buy and power.
- Must run in Router mode. Access point, extender and WDS modes pass traffic straight through, where the rules can't see it.
- The cameras have to join its Wi-Fi, usually through the Osaio app.
Full internet block
Most routers and internet-provider apps can pause a device or block it with parental controls. The camera then can't reach the internet at all.
Pros
- Works with almost any router, with no extra hardware.
- Nothing reaches Osaio, not even whether the camera is online.
Cons
- The Osaio app can't control the camera.
- Every stream starts with Osaio's handshake, so BombeCam can't start a new one while the block is on (after the camera or the PC restarts, for example). A stream that is already running may keep going.
Guest or IoT network without internet
Some routers can create a separate Wi-Fi network with internet access turned off, for smart-home devices.
Pros
- Keeps the cameras apart from your computers and phones.
- Same protection as a full block.
Cons
- Same limits as a full block.
- Guest networks often keep devices from reaching each other or your main network, so BombeCam on your PC may not reach the cameras at all.
Your own firewall rules
On a firewall you run yourself (pfSense, OPNsense, UniFi, MikroTik and similar) you can write the same rules BombeCam uses: for the camera, allow mqtts02-us.osaio.net TCP 8883 and wss-us.osaio.net TCP 443, DNS (port 53) and time sync (UDP 123), then block everything else, IPv4 and IPv6.
Pros
- Works with gear you already trust and manage.
- App controls and local streaming keep working, as with BombeCam's block.
Cons
- Set up and maintained by hand; BombeCam can't apply or check it.
- Rules based on host names depend on the firewall resolving the same addresses the camera gets, and those addresses change.
- Not every firewall can cap one device's bandwidth, and without the cap the allowed connections are wider than BombeCam's.
Linux box as the cameras' router
A Linux computer or Raspberry Pi that routes the cameras' network can run bombecam-net block-cloud-video yes, which applies the same rules as the router block.
Pros
- The same protection as BombeCam's router block, on hardware you choose.
Cons
- The box has to be the cameras' router (for example a Wi-Fi access point that routes), which takes technical setup.
- Command line only; the Firewall tab doesn't manage it.
DNS blocking (Pi-hole, AdGuard Home, NextDNS)
A DNS filter refuses to look up the names of cloud storage and relay servers.
Pros
- Easy if you already run one.
Cons
- On its own it doesn't work for these cameras: they ask Google's DNS (8.8.8.8) directly, so a filter on your network never sees the lookups unless your router forces all DNS through it.
- A camera that already knows a server's address isn't stopped.
Cloud features off in the Osaio app
Turn off cloud recording, motion clips and similar options in the camera's settings.
Pros
- No hardware and no setup.
Cons
- Nothing on your network enforces it: you rely on the camera and the app doing what the setting says.
- Remote live view through Osaio's relay servers stays available.