How to Run a Local Rige Agent: Connect Budget Cameras in a Private Network Without Opening Any Ports
If you've ever tried to remotely access a security camera from outside your home network, you've probably hit the same wall: port forwarding. You dig into your router settings, open an inbound port, point it at the camera's IP address, and suddenly your home network has a permanent hole punched in it - visible to the entire internet - just so you can check your front door from your phone.
For IT professionals, this is a known and manageable risk. For everyone else, it's either a security nightmare they don't fully understand or a technical hurdle that stops their setup entirely. Most people give up and buy a cloud camera instead - handing over their footage and paying monthly fees to solve a problem that shouldn't be this hard.
The Rige Agent solves it without any of those trade-offs.
What Is the Rige Agent?
The Rige Agent is a lightweight service that runs inside your local network on a Linux machine - on a Raspberry Pi, a spare PC, a home server, or any Linux machine you already have running. Once installed, it creates a single outbound connection from your network to Rige's cloud infrastructure using a secure WebSocket (WSS) connection.
That distinction - outbound only - is what makes everything else possible. Your router never needs to accept incoming connections from the internet. No ports are opened. No firewall rules are modified. The Agent reaches out; the cloud responds. From your network's perspective, it looks exactly like any other device browsing the web.
What flows back through that connection is full remote management and live streaming access to every camera in your network, from anywhere in the world, through the Rige dashboard.
How the Rige Agent Works
When the Agent starts up, it scans your local network for cameras using ONVIF - the open protocol that most IP cameras, whether budget or professional, support out of the box. Any compatible camera it finds appears automatically in your Rige dashboard, ready to configure. If your camera uses a non-standard RTSP URL or doesn't support ONVIF auto-discovery, you can add it manually with a single line - just the stream address and credentials.
Once a camera is discovered, the Agent pulls its RTSP video stream directly over the local network and relays it securely to Rige's media servers. This happens entirely within your infrastructure on the inbound side. The raw video stream travels from your camera to the Agent over your local LAN - never exposed to the internet - and only the processed, encrypted output is forwarded outbound through the established WSS tunnel.
All configuration, recording settings, AI detection rules, and notification preferences are managed from the Rige dashboard in your browser. The Agent handles the local communication silently in the background. You never need to touch it again after the initial setup.
Setting Up the Rige Agent: A Complete Walkthrough
Getting the Agent running is a straightforward process that takes most users between 5 and 15 minutes, depending on how many cameras you're adding.
Installing the Agent
The Agent is available in three formats to suit different environments. If you're running a home server or NAS with Docker, the container image is the fastest path - one docker run command and the Agent is live. If you're on a Debian-based Linux system (Raspberry Pi OS, Ubuntu, Debian), the .deb package installs cleanly with apt and sets the Agent up as a background service that starts automatically on reboot. For other Linux environments, a standalone binary is available that runs without any dependency installation.
All three options are available from the Local Agents page in your Rige dashboard under Settings.
Registering the Agent With Your Dashboard
After installation, the Agent displays a short one-time registration code in its startup output. Open your Rige dashboard, navigate to Settings → Local Agents → Add New Agent, and enter the code. Within a few seconds, the Agent confirms registration and appears in your dashboard as an active, named node. From this point on, all further setup happens entirely in the dashboard - you don't need to interact with the Agent directly.
Discovering and Adding Cameras
Once registered, the Agent automatically runs an ONVIF scan of your local subnet. Cameras that respond appear in the dashboard within a minute or two, usually with their make, model, and stream URL already populated. For cameras that don't respond to ONVIF discovery - older units, certain budget brands, or cameras on a separate VLAN - you can add them manually by entering the RTSP URL directly in the dashboard. Either way, the camera ends up in the same unified interface with the same feature set.
Configuring Streams, Recording, and AI Features
With cameras visible in the dashboard, everything else is configured from a single interface. Stream quality, recording schedules, motion detection sensitivity, AI detection zones, notification triggers, and clip storage are all set from the same panel you'd use for any other Rige camera - including Android phones running the Rige Cam app. There's no separate admin interface for Agent-connected cameras. They're treated identically to every other camera in your system.
What Cameras Work With the Rige Agent?
The Agent is designed to work with the full range of hardware people actually use, not just expensive professional equipment.
Budget ONVIF cameras - the kind that cost $20-$50 on Amazon with no-name branding - work reliably as long as they support ONVIF Profile S or expose an RTSP stream. The vast majority do. If a camera has ever appeared in any ONVIF-compatible NVR software, it will work with the Rige Agent.
Old Android phones running the Rige Cam app connect through the same Agent infrastructure, giving you the same unified dashboard and AI features discussed in earlier posts. A repurposed Samsung Galaxy and a professional Hikvision PTZ camera can sit side by side in the same feed, managed with the same tools.
Professional ONVIF cameras - Hikvision, Dahua, Reolink, Axis, and most other major brands - work with full feature support including two-way audio where the hardware supports it.
The Security Architecture: Why "No Open Ports" Is More Than a Marketing Line
Traditional DIY camera setups require inbound ports because the client (your phone, your browser) initiates the connection. The camera or your home NVR needs to be reachable from the internet, which means your router has to forward traffic to it. That exposed port is a permanent, publicly visible entry point into your home network - and it's directly responsible for a well-documented category of security camera compromise.
The Rige Agent flips the model. Your network never accepts unsolicited inbound connections. The Agent initiates contact; Rige responds. This isn't just a firewall configuration difference - it's a fundamentally different trust model that eliminates the attack surface entirely.
On top of that, all traffic between the Agent and Rige's infrastructure is end-to-end encrypted. The relay that carries your video stream can't be intercepted in transit. Dashboard access is protected by standard account authentication with fine-grained permission controls, so you can give a family member view-only access to one camera without exposing your full setup or your network credentials.
Advanced Capabilities for More Demanding Setups
For users running the Agent on hardware with sufficient processing power - a recent Raspberry Pi 4, a mini PC, or any machine with a capable CPU - the Agent can run local AI inference directly, rather than relying on the cloud for motion classification. This means person detection, vehicle detection, and custom zone analysis all happen on your own hardware, with zero video ever leaving your network for AI processing. The latency is lower, the privacy guarantees are stronger, and the bandwidth cost is essentially zero.
The Agent also handles stream optimization and transcoding automatically. If a camera outputs a stream that's too high-bitrate for your upstream connection, the Agent can transcode it locally before relay - keeping remote viewing smooth without degrading local recording quality. This matters most for users on asymmetric internet connections where upload bandwidth is limited.
Reliability is handled at the Agent level as well. If a camera drops its RTSP connection - common with budget hardware during reboots or power fluctuations - the Agent detects the disconnect and reconnects automatically, typically within a few seconds. If the outbound connection to Rige's infrastructure drops due to a temporary internet outage, the Agent queues state and re-establishes the tunnel once connectivity returns. Monitoring continues without manual intervention.
The Right Way to Run Local Cameras Remotely
Port forwarding persists because it's simple to understand, even if it's risky and technically frustrating. The assumption has always been that local network privacy and remote access are an either/or trade-off - you can have one, but not both, without expensive professional networking equipment.
The Rige Agent breaks that assumption. You get full remote management and live access from anywhere, a unified dashboard that treats budget cameras and professional hardware equally, AI-powered detection running locally when your hardware allows, and a network architecture that never requires an inbound port.
If you have ONVIF or RTSP cameras in a location where cloud cameras aren't practical - or you simply don't want to pay ongoing subscription fees or hand your footage to a third-party cloud - the Agent is the setup that was missing.
Download the Rige Agent from your dashboard under Settings → Local Agents, or visit rige.io to create a free account and start from scratch. Two cameras are included on the free tier with no credit card required.
Running cameras in a more complex setup - multiple VLANs, remote office locations, or hardware you're not sure is compatible? Drop your setup details in the comments and we'll help you figure out the right configuration.