How to configure local network isolation rules for Eufy basestation local area networks

Bottom line: Isolate the Eufy HomeBase by blocking its outbound RTSP cloud-upload and UDP hole-punching attempts at Layer 4, while keeping local RTSP streams open to your NVR. This stops the cloud leak without breaking local Home Assistant integration. Eufy cameras recently faced scrutiny over unencrypted RTSP stream cloud bypass leaks, where data intended to remain local was discovered accessible via cloud portals. Blocking Eufy cloud access while maintaining local Home Assistant integration is essential for proper OPSEC on a residential network, and the same containment pattern applies to other hardware-isolation targets like Ring cameras and Tuya smart plugs.

Isolating the Basestation

You can configure EdgeDefenseAI to completely sandbox the Eufy HomeBase. Our localized machine learning appliance identifies outbound UDP hole-punching attempts and RTSP cloud uploads, terminating the session at Layer 4 while allowing local RTSP streams to hit your Frigate or Home Assistant NVR natively.

Hardware & Software Prerequisites

To achieve full local video management without Eufy cloud leaks, ensure you have:

• Local NVR Host: Frigate NVR, Shinobi, or AgentDVR running on local x86 or ARM hardware.
• HomeBase Static IP: Assign a static DHCP reservation for your Eufy HomeBase (e.g. 192.168.1.150).
• WebRTC / RTSP Add-on: eufy-security-ws or go2rtc service running locally in Docker.

Step-by-Step Eufy Containment & Local Stream Capture

1. Enable Local NAS / RTSP Streaming: Inside the Eufy app, enable NAS (RTSP) streaming under Storage Settings and set authentication credentials for local stream consumption.
2. Block Cloud Ingest & UDP Hole Punching: Set up egress firewall rules blocking destination domain security-app.eufylife.com, subnets 34.202.0.0/15, and UDP ports 32100-32150.
3. Incorporate into Frigate / Home Assistant: Direct your local NVR to consume rtsp://192.168.1.150/live0, verifying local recording while WAN egress remains completely severed.

Troubleshooting & Frequently Asked Questions

Q: Why does Eufy attempt UDP hole punching on port 32100?
A: Eufy HomeBases use P2P UDP hole-punching to initiate remote video streams through NAT firewalls without requiring port forwarding. Blocking port 32100 forces all streams to stay strictly within the local LAN subnet.

Q: Will continuous local RTSP streaming drain battery-powered Eufy cameras?
A: Continuous RTSP streaming will drain battery models quickly. For battery devices, configure PIR-triggered local wake events via Home Assistant automation rather than continuous recording.

For the underlying architecture behind this kind of containment, see our local inference engine deep dive, or explore our full range of IoT security solutions.