UniFi Protect NVR direct connection from separate Network

I have googled this issue over and over again until I stumble upon this page. Thanks to rickatnight11 who did a great job at finding a solution and sharing his knowledge. Following this discovery, I decided to create a quick tutorial with a few printscreen hoping to complement this post and help others like me who have been struggling with this issues for years. I already have implemented this solution on my network and it works like a charm so lets get started!

The first step is to install and configure a plugins called "os-udpbroadcastrelay", once that's done, you will need to configure it to broadcast the packages from the UniFi NVR network to your desired network (or LAN) as shown below: 

The port use by UniFi Discovery is 10001, then select the 2 networks you want the broadcast to be relayed, add an instance ID and enter a quick description. After you saved your configuration, you should end up with a "green" highlighted instance which means your settings are correct.

The next step is to create a firewall rule on your UniFi Protect (NVR) interface. The rule should read as follow:

Action: Pass
Interface: CAM (the Interface where your NVR resides)
Direction: In
TCP-IP Version: IPv4
Protocol: UDP
Source: Your NVR IP Address
Source port range: any
Destination: LAN net (Network where your devices loading the Protect App are located)
Destination port range: any (Protect will reply on a random high port)

Your rule should look like this one below:

Then we need to create another rule but this time under your LAN interface. The rule should read as follow: 

Action: Pass
Interface: LAN (the Interface where your devices running the Protect App reside)
Direction: In
TCP-IP Version: IPv4
Protocol: UDP
Source: LAN net (it should be the same interface as above, LAN)
Source port range: 10001 (I am using an alias ui_discovery)
Destination: Here you have 2 choices, either enter 255.255.255.255 or any (this allow the UDP Broadcast Relay service to pick up the packets)
Destination port range: any

Your rule should look like this one below:

Lastly, you need a rule to allow your devices on the LAN running the Protect App to reach and connect to the NVR on the other network. The rule should read as follow:

Destination port range: 443, 7443 (you will have to use an alias for this one)

Your rule should look like this one below:

You should now be all set! What we just did can be explained as follow:

• Protect App on a device on the LAN network starts up and sends a discovery broadcast packet to the local network on 255.255.255.255:10001;
  
  
• OPNSense firewall allows that packet on its LAN interface;
  
  
• The UDP Broadcast Relay service on OPNSense is listening on that network for that port, hears the packet, and relays it to the CAM network (with the original source IP);
  
  
• Protect service running on the NVR on the CAM network is listening for broadcasts on that port, hears the forwarded packet, extracts the original source IP from it, and sends a reply to it from its own source IP and a random high port;
  
  
• OPNSense firewall allows the reply packet on its CAM interface and routes it out the LAN interface;
  
  
• Protect App hears the reply, now knows the IP of a "local" Protect service, and connects to it over TCP on ports 443 and 7443;
  
  
• OPNSense firewall allows that traffic coming in its LAN interface and routes it out the CAM interface;
  
  
• Since the traffic is TCP, OPNSense automatically tracks the connection and allows the response traffic without a static rule.
  

That sums it, once again I wanted to thank rickatnight11 for this great post!

Let me know if it works for you in the comments below.

Enjoy!