So currently I have one ethernet cable handle everything, Recently wanting to setup frigate with some of our security cam which is in our home network, what would be the best way to set it up so the second ethernet will only be used for the security camera. (Both should have access to internet.

review comands used in this script..

this revolves around the networking web UI and ip routes. You may need to set or create a "adhoc" networking 
and connect your second nic via  custom IP. and teh ip that the cameras see.

other advance networking and adding of additionally network to the frigate docker...
Some seen in this post:

In escense you want unraid to act as a bridge/router.

You could also install a openwrt VM pass the second nic and use that to send a separate dhcp server over the second nic for use on that side of the network...
All kinds of weird and interesting workarounds exist here...

 

To achieve network isolation between your main connection (eth0) and the camera network (eth1) while still allowing both to access the internet... Aas I don't have enoth info to fully assist. need a network layout. 

eth0 Main connection

eth1 lan connection to camera network

?eth1 vlna? switch ? same router ? etc...

So I have to assume qutie a bit!

So steps 1 set static ips... (Ideally we want to separate and make a subnet.
 

Make sure that eth0 (main connection) is connected to your primary internet network.

eth1 (camera network) should be connected to the network used by your security cameras.
(Docker network create use eth1 as parent interface...)
https://docs.docker.com/engine/network/drivers/macvlan/
 

Assign Static IPs:

For eth0 (main connection), assign a static IP address in your home network range (e.g., 192.168.1.x).

For eth1, assign a static IP in a separate subnet (e.g., 192.168.2.x), ensuring it doesn't overlap with the main network.

Configure Routing:

Ensure that both interfaces (eth0 and eth1) are properly configured with routing rules.
*Web UI Network....

Set the default gateway for the main connection (eth0) to route internet traffic.
 

Firewall Configuration (Isolation):

On eth1, apply firewall rules that restrict communication to only the devices that are part of the camera network.

Allow communication from eth1 to eth0 for internet access. This can be achieved using iptables or firewalld to create an isolated environment.

Example (using iptables):
 

# Allow traffic from eth1 to the internet (via eth0)
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

 

Frigate Configuration:

Configure Frigate to use eth1 for camera communication, ensuring all traffic related to the cameras is routed through this interface.

 

Test Network Connectivity:

After setting up the isolation rules, test that:

Devices on eth0 can access the internet.

Devices on eth1 can access the internet (through eth0) but cannot communicate with devices on the eth0 network (unless explicitly allowed).

 

Optional: VLAN Configuration (if applicable):

If you have a managed switch or router that supports VLANs, you can further isolate the camera network by assigning eth1 to a separate VLAN, which ensures strict isolation without needing firewall rules on the host itself. (Depends on network hardware and current user's setup...)

#################################################

However, as it sounds like you don't have a seperate subnet! Both your main network and camera network are on the same subnet (e.g., 192.168.1.0/24), then you can still isolate the camera traffic using virtual routing or VLANs, but you'll need to handle isolation via software. Here's an approach using a VM router or network namespaces to manage traffic:

*As Mentioned earlier...(Sometimes known or called a forbidden router... forbidden as it requires the VM to be on for base networking ....)
Approach 1: Use a Virtual Machine as a Router

Create a Virtual Machine (VM) Router (Ipfire good here...):

Set up a VM in Unraid to act as a router between your camera network and the rest of your devices.

This VM will handle routing traffic between the isolated camera network and the internet, effectively segmenting the traffic on your network.

Assign two virtual NICs to the VM
XML edit copy paste nice xml in VM then change mac and changing parent interface for eth0/eth1...

*Configure the Camera Devices/frigate to ipfires ip over dhcp or other hardware switch if isolating...

Aproach 2:
Use Network Namespaces (Linux)

*Been a while, I think unraid has netns... I have random documentation/notes on this ....

Create a Network Namespace for Cameras:

You can create a network namespace to isolate the camera network within Unraid without needing a separate VM. This can be done using ip commands or Docker if you are running Frigate in a container.

Setup Netwrok Namespace:
 

ip netns add camera_network

 

Assign a virtual network interface to this namespace and connect it to eth1 (the seconed nic...)

 

Configure Routing in the Namespace:

Set up IP forwarding and NAT to route internet traffic from the camera namespace through the main network (eth0):

ip netns exec camera_network ip route add default via <gateway_ip_of_eth0>

 

Firewall Rules/isolation:

Use iptables to create rules that restrict traffic between the camera network and the main network. Allow only necessary communication (e.g., camera feeds and Frigate)
 

iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

*May need a suer script at first array start to keep rules. 

 

Key Points:

The VM Router approach is easier to manage for larger setups or if you're unfamiliar with Linux networking, as pfSense or OpnSense have built-in tools to handle isolation and routing.

 

The Network Namespace approach is more lightweight and ideal for smaller setups where you want to avoid creating a full VM but still need to isolate traffic within your host.

 

Both approaches allow your camera network to communicate with the internet but prevent unnecessary interaction with your main network unless explicitly allowed.

 

5 hours ago, bmartino1 said:

To achieve network isolation between your main connection (eth0) and the camera network (eth1) while still allowing both to access the internet... Aas I don't have enoth info to fully assist. need a network layout. 

eth0 Main connection

eth1 lan connection to camera network

?eth1 vlna? switch ? same router ? etc...

So I have to assume qutie a bit!

So steps 1 set static ips... (Ideally we want to separate and make a subnet.
 

Make sure that eth0 (main connection) is connected to your primary internet network.

eth1 (camera network) should be connected to the network used by your security cameras.
(Docker network create use eth1 as parent interface...)
https://docs.docker.com/engine/network/drivers/macvlan/
 

Assign Static IPs:

For eth0 (main connection), assign a static IP address in your home network range (e.g., 192.168.1.x).

For eth1, assign a static IP in a separate subnet (e.g., 192.168.2.x), ensuring it doesn't overlap with the main network.

Configure Routing:

Ensure that both interfaces (eth0 and eth1) are properly configured with routing rules.
*Web UI Network....

Set the default gateway for the main connection (eth0) to route internet traffic.
 

Firewall Configuration (Isolation):

On eth1, apply firewall rules that restrict communication to only the devices that are part of the camera network.

Allow communication from eth1 to eth0 for internet access. This can be achieved using iptables or firewalld to create an isolated environment.

Example (using iptables):
 

# Allow traffic from eth1 to the internet (via eth0)
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

 

Frigate Configuration:

Configure Frigate to use eth1 for camera communication, ensuring all traffic related to the cameras is routed through this interface.

 

Test Network Connectivity:

After setting up the isolation rules, test that:

Devices on eth0 can access the internet.

Devices on eth1 can access the internet (through eth0) but cannot communicate with devices on the eth0 network (unless explicitly allowed).

 

Optional: VLAN Configuration (if applicable):

If you have a managed switch or router that supports VLANs, you can further isolate the camera network by assigning eth1 to a separate VLAN, which ensures strict isolation without needing firewall rules on the host itself. (Depends on network hardware and current user's setup...)

#################################################

However, as it sounds like you don't have a seperate subnet! Both your main network and camera network are on the same subnet (e.g., 192.168.1.0/24), then you can still isolate the camera traffic using virtual routing or VLANs, but you'll need to handle isolation via software. Here's an approach using a VM router or network namespaces to manage traffic:

*As Mentioned earlier...(Sometimes known or called a forbidden router... forbidden as it requires the VM to be on for base networking ....)
Approach 1: Use a Virtual Machine as a Router

Create a Virtual Machine (VM) Router (Ipfire good here...):

Set up a VM in Unraid to act as a router between your camera network and the rest of your devices.

This VM will handle routing traffic between the isolated camera network and the internet, effectively segmenting the traffic on your network.

Assign two virtual NICs to the VM
XML edit copy paste nice xml in VM then change mac and changing parent interface for eth0/eth1...

*Configure the Camera Devices/frigate to ipfires ip over dhcp or other hardware switch if isolating...

Aproach 2:
Use Network Namespaces (Linux)

*Been a while, I think unraid has netns... I have random documentation/notes on this ....

Create a Network Namespace for Cameras:

You can create a network namespace to isolate the camera network within Unraid without needing a separate VM. This can be done using ip commands or Docker if you are running Frigate in a container.

Setup Netwrok Namespace:
 

ip netns add camera_network

 

Assign a virtual network interface to this namespace and connect it to eth1 (the seconed nic...)

 

Configure Routing in the Namespace:

Set up IP forwarding and NAT to route internet traffic from the camera namespace through the main network (eth0):

ip netns exec camera_network ip route add default via <gateway_ip_of_eth0>

 

Firewall Rules/isolation:

Use iptables to create rules that restrict traffic between the camera network and the main network. Allow only necessary communication (e.g., camera feeds and Frigate)
 

iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

*May need a suer script at first array start to keep rules. 

 

Key Points:

The VM Router approach is easier to manage for larger setups or if you're unfamiliar with Linux networking, as pfSense or OpnSense have built-in tools to handle isolation and routing.

 

The Network Namespace approach is more lightweight and ideal for smaller setups where you want to avoid creating a full VM but still need to isolate traffic within your host.

 

Both approaches allow your camera network to communicate with the internet but prevent unnecessary interaction with your main network unless explicitly allowed.

 

 

I'll read it in a bit and also here's the network layout, our ISP still Provides 7 Dynamic IP and 1 Static IP using PPPoE

 

Edited December 9, 20241 yr by LunarstarPony

Thank you for providing that layout. since you already have isolation and 2 separate routers. you may need to add a secondary docker network to assign eth1 to frigate to obtain a 192.168.137.x

I'm partial to maclvan.
Confirm and set unraid docker network settings.

*This will make the br0/bond0/eth0 network... To use the eth1 interface...

so lets make adocker network with terminal create commands:

macvlan example:

docker network create -d macvlan \
  --subnet=192.168.137.0/24 \
  --gateway=192.168.137.1 \
  -o parent=eth1 \
  mymacvlan

 

In this command:

-d macvlan specifies the driver.

--subnet defines the network range.

--gateway specifies the default gateway.

-o parent=eth1 sets eth1 as the parent interface.

 

Ipvlan example:
 

docker network create -d ipvlan \
  --subnet=192.168.137.0/24 \
  --gateway=192.168.137.1 \
  -o parent=eth1 \
  -o ipvlan_mode=l2 \
  myipvlan

-d ipvlan specifies the driver.

-o ipvlan_mode=l2 sets the mode to L2, which allows the containers to behave like they are on the same physical network segment.

Depending on if your using macvlan or ipvlan. I would recommend macvlan to get other networking required stuff such as each docker having its own unique mac address.

then you will see mymacvlan or myipvlan when you hit edit in the docker template as a drop down in the network option. this will tell frigate to use the docker network that you created (the docker network create comands survives reboots)... and when selected will use eth1 192.168.137.x for dockers networking.
 

3 minutes ago, bmartino1 said:

Thank you for providing that layout. since you already have isolation and 2 separate routers. you may need to add a secondary docker network to assign eth1 to frigate to obtain a 192.168.137.x

I'm partial to maclvan.
Confirm and set unraid docker network settings.

*This will make the br0/bond0/eth0 network... To use the eth1 interface...

so lets make adocker network with terminal create commands:

macvlan example:

docker network create -d macvlan \
  --subnet=192.168.137.0/24 \
  --gateway=192.168.137.1 \
  -o parent=eth1 \
  mymacvlan

 

In this command:

-d macvlan specifies the driver.

--subnet defines the network range.

--gateway specifies the default gateway.

-o parent=eth1 sets eth1 as the parent interface.

 

Ipvlan example:
 

docker network create -d ipvlan \
  --subnet=192.168.137.0/24 \
  --gateway=192.168.137.1 \
  -o parent=eth1 \
  -o ipvlan_mode=l2 \
  myipvlan

-d ipvlan specifies the driver.

-o ipvlan_mode=l2 sets the mode to L2, which allows the containers to behave like they are on the same physical network segment.

Depending on if your using macvlan or ipvlan. I would recommend macvlan to get other networking required stuff such as each docker having its own unique mac address.

then you will see mymacvlan or myipvlan when you hit edit in the docker template as a drop down in the network option. this will tell frigate to use the docker network that you created (the docker network create comands survives reboots)... and when selected will use eth1 192.168.137.x for dockers networking.
 

Hmmmm But the Camera Network is only needed for the Frigate to access the Camera Feed over RTSP, data will never go out that connection.

Based on your network:



Router 2 has internet access via a dynamic IP. ? do you need 2 nics attached to frigate then?

Data from first post. You may need to add ip route to unraids netowrk gui, enabled ipv4 / ipv6 forwarding.
 

Edited December 9, 20241 yr by bmartino1

you may need to go docker compaose to beter handle network attacehd conatiner with 2 nics....
*I would go a LXC/VM at that point for more granulat controll over the networks in the system...

Step 1: Create the Docker Networks

Step 2 use docker compose
Example:
 

version: '3.8'

services:
  frigate:
    container_name: frigate
    image: blakeblackshear/frigate:stable   # Use the latest stable version of Frigate
    restart: unless-stopped
    volumes:
      - /path/to/config:/config              # Path to Frigate config files
      - /path/to/clips:/media/frigate/clips  # Path to save clips
      - /path/to/recordings:/media/frigate/recordings  # Path for recordings
      - /etc/localtime:/etc/localtime:ro     # Sync time with the host
    devices:
      - /dev/dri/renderD128                  # For hardware acceleration (optional)
    environment:
      FRIGATE_RTSP_PASSWORD: "yourpassword"  # Example environment variable, set as needed
    networks:
      macvlan_net:
        ipv4_address: 192.168.137.100        # Static IP for Frigate
      default:                               # Connect to the default Docker bridge for Internet access

networks:
  macvlan_net:
    external:
      name: mymacvlan                        # Name of the previously created macvlan network
  default:
    driver: bridge                           # Ensures use of the default Docker bridge

Things give the docker container 2 nics, the custom macvlan at a statric ip to talk to the cameras and uses the default unraid netwrok bridge for eth0 internet access.

if you already have friagte created. make a template change. then change it back and hit apply to get the docker run line and use https://www.composerize.com/
to make a docker compose file...

as any system ctl / ipvlan or other is all termanl cams wihtin the docker when having 2 nics... But I belve this is the outcome you want.

34 minutes ago, bmartino1 said:

Based on your network:



Router 2 has internet access via a dynamic IP. ? do you need 2 nics attached to frigate then?

Data from first post. You may need to add ip route to unraids netowrk gui, enabled ipv4 / ipv6 forwarding.
 

So Pretty much I'll need Frigate able to access the camera under home network while I'll access the site via Static IP.

 

Both of them have internet access but I'd prefer internet only go out and in from the Static IP one

 

Edited December 9, 20241 yr by LunarstarPony

I would still recomend a VM instance this way you have a bit more granular contorl over a sytem and have shell access to setup and use 2 nics:

 

I think the best route in your case would be a debain os running this sh script as root.

ISO for Debian install:
https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-12.8.0-amd64-netinst.iso
https://www.debian.org/download

After reviewing and looking into a bare mental frigate application install. This LXC script looks perfect, Please overview it:
https://github.com/tteck/Proxmox/blob/main/install/frigate-install.sh

*I may work with ICH777 on a frigate lxc later for unraid. Only due to vm and hardware, pass though I think a VM would be easier in this case...

in the VM:

# Make sure you are root user.
# sudo su or su root
#once root set root password
#passwd

#move to root folder 
cd /root

#Grab promox LXC frigate install script...
wget https://raw.githubusercontent.com/tteck/Proxmox/refs/heads/main/install/frigate-install.sh

#Make script executable
chmod +x frigate-install.sh

#Run Script
.\frigate-install.sh

* Lately Debian has been removing sudo and easey access to become root. the install process sets user access and sudo is not installed.
--This a good thing for security...

*But i'm old and want sudo...
apt-get install sudo
usermod -aG %username% sudo

visudo
add entry
?%username% All:All ALL ?
^-Same as root in /etc/sudoer file to access run visudo and use vi/vim editor to make chagnes
insert/i to type in 
esc key :wq to write and save..

Other unriad - side debian install:
 

apt-get install mc unattended-upgrades openssh-server nfs-common cifs-utils -y

MC is a terminal File explorer, Unatended-Upgrades is a auto policy security update program, OpenSSH-server add ssh terminal and SFTP access, NFS-common allows terminal commands for nfs shares, cifs-utils adds samba terminal command to connect to shares.

 

There may be a virtio install for unraids passing of the folder for frigate. then its a mater of finding the frigates xml code/confi file or use the vm ip to access its web interface.

Hope this helps