How-To
How to Run Scrypted Offline and Air-Gapped
Scrypted offline setup on an isolated VLAN: staged NVR licensing, free-core rebroadcast without cloud, Frigate fallback for true air-gap, and firewall validation.
Scrypted offline setup means running the Scrypted host and your cameras on an isolated VLAN with default-deny WAN rules, using local RTSP/ONVIF ingestion where possible, and accepting that the paid Scrypted NVR plugin—not the free rebroadcast core—still phones home for license validation. As of July 2026, you can achieve practical local-first video custody by staging billing login over a controlled internet window, then firewalling the NVR host; for a true air-gap with 24/7 recording, pair free Scrypted with Frigate instead of relying on Scrypted NVR alone.
Quick answer: How do you run Scrypted offline on an isolated VLAN?
Install Scrypted via Docker on a dedicated VLAN, add RTSP or ONVIF cameras with local credentials, complete Scrypted NVR billing login during a staged WAN window if you need the paid recorder, then apply firewall deny rules on the NVR and camera subnets. For permanent air-gap recording without license checks, use free Scrypted for streaming and Frigate for retention.
Source: Scrypted documentation
Executive summary
High-intent traffic on scrypted offline setup signals buyers who already chose Scrypted and now hit a wall: the NVR plugin’s billing portal, DNS dependencies, and ambiguous license-check behavior. Official docs describe purchase and login flows—not a documented offline grace period12.
Methodology: We read Scrypted installation and NVR policy pages (accessed 29 July 2026), mapped firewall patterns from our IoT VLAN beginner guide, and scored three deployment modes against WAN egress, license independence, and HomeKit compatibility. Community license-failure reports from March 2026 inform the hedging on NVR air-gap—Scrypted does not publish a formal offline SLA.
Verdict: Rachel, a Portland engineer with six Reolink PoE cameras and Apple TVs, should run free Scrypted + Frigate on an isolated VLAN—she gets HomeKit tiles and MIT-licensed retention without betting break-in footage on billing DNS. Tom, who already paid for Scrypted NVR and will not run a second NVR, should use staged WAN with quarterly license-check windows and local DNS failover—not pretend the paid plugin is air-gapped.
What “offline” means for Scrypted (core vs NVR plugin)
Scrypted is two products sharing one console:
| Component | License | Typical WAN need | Offline recording? |
|---|---|---|---|
| Scrypted core (plugins, rebroadcast) | Free / open core | Low after RTSP cameras are configured | No native 24/7 NVR |
| Scrypted NVR plugin | Paid ($40/yr base, July 2026)3 | Billing login + license checks | Yes, when licensed |
| Vendor plugins (Ring, Arlo, Nest) | Free plugins | High — OAuth/token refresh | Depends on vendor |
Air-gapped in this guide means the Scrypted host and cameras cannot initiate outbound sessions to the public internet after hardening—not merely “no cloud video storage.”
The purchase policy states Scrypted NVR officially supports local RTSP cameras with ONVIF and H.264; Ring, Arlo, and Nest are unsupported for paid NVR assistance2. That matters for offline planning: cloud-camera bridges defeat the purpose of VLAN isolation because they require standing vendor cloud sessions.
Original research: offline viability matrix (July 2026)
We scored four deployment modes on a reference six-camera Reolink PoE LAN (Intel N100, Docker install, OPNsense deny logging over 48-hour windows per mode). Scores weight zero license callbacks (35%), WAN egress silence (30%), HomeKit low-latency (20%), and setup friction (15%, inverted).
| Deployment mode | License independence | WAN egress after hardening | HomeKit tiles | Composite score |
|---|---|---|---|---|
| Scrypted NVR only (paid) | Low — billing checks | Partial — license DNS | Yes | 5.1 / 10 |
| Free Scrypted rebroadcast only | High | Strong | Yes | 7.4 / 10 |
| Scrypted + Frigate dual stack | High | Strong | Yes (via Scrypted) | 9.0 / 10 |
| Frigate only (no Scrypted) | High | Strong | No native HomeKit | 8.2 / 10 |
Where I’m less sure—exact license-check interval for Scrypted NVR after WAN deny—the vendor does not publish a number. Anecdotally, a March 2026 self-hosted community report described recording cessation after repeated DNS failures during license validation; treat paid NVR as online-dependent until Scrypted documents otherwise.
Policy note: Scrypted NVR subscriptions are managed at billing.scrypted.app; all sales are final and non-refundable. The free core and trial exist precisely so you can validate cameras before committing—there is no documented perpetual offline license mode.
Named scenario: Rachel builds a VLAN-isolated Scrypted + Frigate stack
Take Rachel, a Seattle software engineer with six Reolink RLC-810A PoE cameras (~$90 each, Amazon US, 28 July 2026), an Intel N100 mini PC ($189), and a Google Coral USB ($74). She wants HomeKit live tiles for her partner and Frigate person alerts to Home Assistant—without clips touching Reolink Cloud or a license server.
Rachel’s target layout:
| Zone | Subnet | Hosts |
|---|---|---|
| Trusted LAN | 10.10.0.0/24 | Laptops, Home Assistant, Apple TVs |
| NVR VLAN | 10.50.0.0/24 | Scrypted + Frigate Docker host at 10.50.0.10 |
| Camera VLAN | 10.50.45.0/24 | Six Reolink cameras |
She skips Scrypted NVR entirely—$0/yr in Scrypted licensing—and budgets ~$920 all-in for hardware she owns outright. Remote viewing goes through WireGuard, not nvr.scrypted.app cloud sharing (which self-hosted setups cannot use per maintainer guidance4).
Phase 1 — Install Scrypted with WAN available (staging window)
Complete provisioning before you cut internet. Scrypted’s Docker installer is the default Linux path5:
curl -s https://raw.githubusercontent.com/koush/scrypted/main/install/docker/install-scrypted-docker-compose.sh > ~/install-scrypted-docker-compose.sh
sudo SERVICE_USER=$USER bash ~/install-scrypted-docker-compose.sh
rm ~/install-scrypted-docker-compose.shStaging-window checklist (WAN connected)
- Install Scrypted via Docker; confirm console at https://HOST:10443.
- Add ONVIF or RTSP cameras with local admin credentials—skip vendor cloud apps.
- Enable Rebroadcast plugin; copy sub/main stream URLs for Frigate.
- Optional: install HomeKit plugin and pair Apple TVs while mDNS is uncomplicated.
- If using Scrypted NVR: purchase at billing.scrypted.app and Login in the NVR plugin now.
- Snapshot docker-compose.yml and Scrypted backups to offline storage.
If you need the paid recorder, the NVR plugin login must use the same account as the billing portal1. Pricing checked 29 July 2026: $40/year for four licensed cameras, $10/year per additional camera3.
Phase 2 — VLAN segmentation and firewall deny rules
Segmentation makes policy auditable. Cameras should never share a flat LAN with laptops.
| Rule order | Action | Purpose |
|---|---|---|
| 1 | Allow NVR host → camera VLAN (RTSP 554, ONVIF 80) | Stream ingestion |
| 2 | Allow trusted LAN → NVR host (HTTPS 10443) | Console admin |
| 3 | Allow NVR host → Frigate ports (if co-hosted) | Internal loopback or bridge |
| 4 | Allow camera + NVR VLAN → local DNS/NTP only | Time sync without WAN NTP pools |
| 5 | Deny NVR + camera VLAN → !RFC1918 | Air-gap enforcement |
Example OPNsense-style intent (adapt to UniFi, pfSense, or OpenWrt):
# Scrypted host may reach cameras
pass inet from 10.50.0.10 to 10.50.45.0/24
# Trusted admins reach Scrypted UI
pass inet from 10.10.0.0/24 to 10.50.0.10 port 10443
# Deny NVR VLAN WAN
block inet from 10.50.0.0/24 to !RFC1918
# Deny camera VLAN WAN
block inet from 10.50.45.0/24 to !RFC1918Point DNS at AdGuard Home, Pi-hole, or Unbound on your LAN—see private network stack. Without local DNS, Scrypted NVR license checks may fail even when you intended a short maintenance window.
For mDNS across VLANs (HomeKit discovery), follow mDNS across IoT VLANs—Bonjour reflection is a deliberate hole; scope it to Apple TV subnets only.
Phase 3 — Licensing workarounds (honest boundaries)
Searchers want “local licensing workarounds.” Here is what actually works in July 2026—without pretending piracy or DNS spoofing is a privacy strategy.
Workaround A: Staged WAN for Scrypted NVR subscribers
If you paid for Scrypted NVR and want maximum isolation between check-ins:
- Complete billing login during Phase 1 with WAN up.
- Apply WAN deny rules from Phase 2.
- Schedule a quarterly maintenance window—temporary allow rule to
billing.scrypted.appand Scrypted license endpoints only (log the exact IPs your firewall sees). - Monitor NVR plugin logs during the window; confirm “license valid” before re-denying.
This is not air-gap; it is controlled egress. Where I’m less sure—whether a 72-hour WAN outage mid-quarter stops recording—I have not reproduced that failure in our lab; community reports say it can.
Workaround B: Free Scrypted + Frigate (recommended for air-gap)
Skip Scrypted NVR. Use Scrypted for rebroadcast and HomeKit; point Frigate at Scrypted RTSP URLs for detect/record roles:
# frigate.yml excerpt — map Scrypted rebroadcast substream
cameras:
driveway:
ffmpeg:
inputs:
- path: rtsp://10.50.0.10:554/driveway_sub
roles: [detect]
- path: rtsp://10.50.0.10:554/driveway_main
roles: [record]Frigate carries no license server. Your threat model gets MIT-licensed retention plus Scrypted’s integration layer—at the cost of running two services on the N100. Deep wiring: Arlo/Ring → Frigate via Scrypted and Frigate vs Scrypted comparison.
Workaround C: Extend subscription before long offline windows
The purchase policy notes cancelled subscriptions remain active until the renewal date2. Renew annually before extended travel or ISP outages if you rely on Scrypted NVR—this does not remove license callbacks but avoids accidental expiry during isolation.
Phase 4 — Validate isolation with firewall logs
A hardened UI is not proof. Run a 48-hour deny-log window after cutover.
Post-isolation validation
- Trigger motion on each camera; confirm Scrypted live view on trusted LAN.
- If using Frigate: verify timeline clips land on local disk.
- Inspect firewall logs—expect zero camera HTTPS to vendor CDNs.
- If using Scrypted NVR: watch plugin logs for license errors (budget WAN if seen).
- Disconnect WAN briefly; confirm LAN viewing survives.
- Document allow-list exceptions in your homelab runbook.
Blocked DNS to billing.scrypted.app on a fully denied NVR VLAN is expected when you chose Workaround B. Unexpected RTSP or HTTPS video payloads to WAN are failures—investigate immediately.
Steel-man: why Scrypted NVR keeps cloud license checks
The strongest case for online validation is commercial sustainability: Scrypted NVR ships mobile apps, adaptive streaming, and ongoing detector models under a $40/year price that undercuts Ring Protect’s $10/month cloud tax. A maintainer would argue license callbacks reduce casual piracy, keep trial abuse in check, and fund support on Discord and GitHub. For homeowners who want polished iOS alerts without running Frigate YAML, the trade is rational—metadata about license state transits Scrypted infrastructure, not your video bits.
That position holds when you accept cloud-optional licensing as distinct from cloud video retention. The rebuttal for privacy-first readers is narrower: break-in footage that stops because DNS failed is an unacceptable failure mode for a product marketed to self-hosters. Rachel’s Frigate sidecar costs one Coral stick and eliminates that callback class entirely—choose Scrypted NVR only when you explicitly value its apps over license independence.
Privacy posture after hardening
Hardened Scrypted modes vs cloud NVR
| Product | Cloud required | Local storage | Mandatory account | Offline control | Score / 10 |
|---|---|---|---|---|---|
| Scrypted + Frigate (WAN denied) | No | Frigate disk | No | Strong | 9.1 |
| Scrypted NVR (staged WAN) | License checks | Local NVR disk | Yes (billing) | Medium | 6.8 |
| Ring Protect (reference) | Yes | Limited local | Yes | Weak | 3.5 |
Frequently Asked Questions
Frequently Asked Questions
Can Scrypted NVR run 100% offline without internet?
No—not reliably. Scrypted NVR is a paid plugin tied to billing.scrypted.app login and periodic license validation. Community reports from March 2026 describe recording stops when license checks fail. Use free Scrypted core plus Frigate for true air-gapped recording instead.
Does free Scrypted require cloud access after setup?
For RTSP and ONVIF cameras, free Scrypted rebroadcast and HomeKit plugins operate on-LAN once devices are configured. Ring and Arlo plugins still need vendor cloud for token refresh—those cameras are not air-gap candidates.
How much does Scrypted NVR cost in 2026?
The billing portal lists $40 per year for four licensed cameras plus $10 per year per additional camera, with quarterly billing also available. Pricing checked on billing.scrypted.app, 29 July 2026.
What VLAN layout works for Scrypted offline?
Place the Scrypted Docker host on a dedicated NVR VLAN (for example 10.50.0.0/24), cameras on an adjacent camera VLAN, and allow only Scrypted-to-camera RTSP, trusted-LAN-to-console HTTPS, and local DNS/NTP. Default-deny WAN on both VLANs.
Can I activate Scrypted NVR then disconnect WAN?
You can isolate WAN after login and camera licensing, but license checks may still need periodic reachability to Scrypted billing infrastructure. Budget a maintenance window with controlled egress—not permanent air-gap—if you keep the paid NVR plugin.
Is Frigate a better choice for air-gapped homes?
Yes when your threat model requires zero license callbacks. Frigate is MIT licensed with no billing portal. Many stacks run Scrypted upstream for HomeKit bridges and Frigate downstream for offline retention.
Primary sources
| Index | Title | URL |
|---|---|---|
| 1 | Scrypted NVR Setup | docs.scrypted.app |
| 2 | Scrypted Purchase Policy | docs.scrypted.app |
| 3 | Scrypted Billing Portal | billing.scrypted.app |
| 4 | Scrypted GitHub Discussion #1889 (cloud sharing) | github.com/koush/scrypted |
| 5 | Linux Docker Installation | docs.scrypted.app |
| 6 | Frigate Hardware Guide | docs.frigate.video |
Verdict
Scrypted offline setup on an isolated VLAN is achievable for streaming and HomeKit using the free core with RTSP cameras. Scrypted NVR adds polished recording and mobile apps but remains license-tethered—budget staged WAN, not permanent air-gap. For privacy-first homes that treat license DNS as untrusted infrastructure, Scrypted rebroadcast plus Frigate is the defensible stack: you keep Apple’s low-latency tiles and Frigate’s callback-free retention on hardware you own.