← RETURN TO HOME
Ring telemetry kill
DOCS // HARDWARE ISOLATION

How to block Ring camera from calling home without breaking application notifications

• • BY ARUN DASS

Bottom line: Block outbound traffic from the Ring camera's IP address on ports 80, 443, and 8883 (MQTT) to stop it from streaming to Amazon's cloud, while keeping it reachable on your local network. Ring cameras are notorious for communicating extensively with Amazon's cloud infrastructure. If you want to use the hardware locally, or integrate it directly into Home Assistant without relying on the cloud, you need to isolate it, the same approach we use for Eufy cameras and Tuya smart plugs.

Isolating the Hardware

To stop a Ring camera from streaming video data to external cloud servers, you must block outbound traffic on ports 80, 443, and 8883 (MQTT) specifically for the device's IP address.

If you are using EdgeDefenseAI, this process is automated. The appliance will detect the device signature and you can apply a one-click "Local Only" policy which severs the WAN connection while preserving local LAN routing for your smart home hubs.

Hardware Prerequisites & Network Configuration

Successfully isolating a Ring device without rendering local push notifications useless requires specific router capabilities:

  • Router/Firewall: PfSense, OPNsense, UniFi Dream Machine, or OpenWrt router with support for per-device firewall rule groups.
  • Local SIP/RTSP Bridge: Home Assistant with Scrypted or Ring-MQTT installed locally to handle local stream re-broadcasting.
  • Dedicated IoT Subnet/VLAN: Isolate all Ring doorbells and cameras on a segregated VLAN (e.g. VLAN 20 - 192.168.20.0/24).

Step-by-Step Manual Isolation Setup

  1. Reserve IP Assignment: Open your router DHCP server settings and set a static reservation for the Ring camera MAC address.
  2. Block AWS Metrics & Ingestion Endpoints: Create egress firewall rules blocking destination hostnames device-metrics-us.amazon.com and subnets 52.21.14.0/24 & 54.192.0.0/16.
  3. Enable Local Home Assistant Relay: Route the camera's RTSP/WebRTC stream locally through a local NVR or Scrypted hub, preventing WAN data usage while keeping local motion alerts instant.

Troubleshooting & Frequently Asked Questions

Q: Will my Ring app on iOS/Android still receive motion alerts?
A: When WAN egress is completely dropped, cloud-based Ring push notifications will pause unless routed through a local Home Assistant bridge (via Homekit or WebRTC local proxy). Local chimes and Home Assistant alerts will function continuously.

Q: Why does Ring use port 8883 (MQTT)?
A: Port 8883 carries encrypted MQTT heartbeat signals back to AWS servers. Blocking port 8883 prevents Amazon from remotely altering camera settings while local streaming remains active.

For the architecture behind this containment approach, see our local inference engine deep dive, or explore our full range of IoT security solutions.