Seven 4K cameras on a Mediterranean roof you do not climb. A Reolink RLN8-410 recorder in a cupboard, on the LAN, no HDMI, no mouse, no monitor. That is a network recorder. Reolink designed the product so that the day you want the cameras for yourself — RTSP, ONVIF, Frigate, your mini PC — the official path is to hang a television off the box or climb the roof and reset each camera. They are a disaster. They lock the cameras to their recorder. They left the macOS client to rot. They stripped the clients of the functions that matter. Support recites HDMI. I was not going to risk my neck. I pulled the keys out of the recorder, put one password on all seven, opened RTSP and unplugged their box.
This is a report from a specific hell: board N2MB02, firmware v3.5.1.368_25010326, model RLN8-410. If you have the same board, the dump firmware is below, and how to read it. If you have another board, do not flash it. It will brick.
1. What they sell you and what they lock
Reolink sells PoE cameras and an «easy» recorder. Auto Add. One click. The cameras appear in the app. Video arrives. For months, even years, it looks like a product. Until you want the stream for yourself.
What Auto Add actually does is this: the recorder writes onto each camera a password you did not choose and the app will not show you. In the firmware it is called special_pwd_v2. It is unique per camera. It lives inside the NVR, under /mnt/para, in a device.xml. From that moment the camera belongs to that recorder. RTSP closed. ONVIF closed. HTTP often closed. The only client that «sees» the video is theirs, speaking the Baichuan protocol on port 9000, with encryption derived from the key you do not have.
The recorder’s admin password does not open the cameras. They are different layers. The NVR keeps a per-channel copy and authenticates itself. From the outside you see seven IPs that reject everything except that hidden key. That is cameras being locked. That is a padlock. They sell it as convenience.
The official documentation for changing a camera password «via the NVR» is HDMI, mouse, maintenance menu, USB. A recorder in 2026, in a house, lives in a cupboard. LAN, full stop. Reolink has not understood that. Or they have understood it and they do not care: the padlock sells recurrence into their cloud and their app.
2. The Mac client they left to die
I work on a Mac. Reolink Client for macOS is abandoned. Old builds, a half-finished New UI, functions that still peek through on Windows and are missing here. The new client is a viewer. Watch the mosaic, rewind a little, push the camera into their cloud. What an installer needs — change an IPC password, open RTSP, open ONVIF, export a real configuration, talk to the camera without the HDMI theatre — they have stripped out.
They have removed the ability to do the work from the clients. That is not a forum rumour. It is the menu. You look for the camera password and it is gone. You look for RTSP on the IPC and it is gone. You look for a network config export and it writes an empty file. The 3.5.1 New UI is a product cut on purpose: the recorder commands, the client obeys, the owner of the cameras stays outside.
In 2026, a CCTV manufacturer that treats the Mac as a second-class citizen and cuts the Windows client until it is only good for watching is not selling an open system. It is selling a cage at 4K.
3. Support that only knows how to say HDMI
Reolink support is bad. Genuinely bad. Slow tickets. Copied answers. The mantra: connect an HDMI monitor, a mouse, go into maintenance, export, reset the camera. You explain that the recorder runs without a monitor, that it sits in a cupboard, that the seven cameras are on a roof you do not climb, and they write HDMI again.
They have no headless flow. They have no LAN recovery tool that hands you back the camera keys the NVR already knows. They have no «I forgot the IPC password, I own the recorder, prove the device and release the stream». They have HDMI. They have the reset button on each camera. They have the roof.
A LAN recorder is administered on the LAN. Mouse, HDMI and a television are a leftover from DVRs fifteen years ago. Still demanding that in 2026, with 4K PoE cameras and a proprietary protocol, is a statement: the product is their ecosystem, and you are a tenant.
4. The roof I was not going to climb
Seven cameras. Mediterranean roof, tile, pitch, height. Going up there is not «five minutes with a ladder». It is a serious risk. A slip, a tile that gives, an edge with no lifeline. I install solar. I know what a roof is. I know when a roof asks for a harness, an anchor point and a reason that weighs something. Resetting seven Reolink cameras is not that reason.
The physical reset of a Reolink IPC is the button. The button is on the camera. The camera is outside, often under the eave, often four or five metres up, often over tile. The official procedure, the one support recites, is: climb, press, come down, first-time setup, repeat seven times. Each cycle is a trip to the edge of the roof. Each trip is a real chance of getting hurt.
That is the hell. Not the XML. XML you can read. The hell is a manufacturer that puts the exit button in a place where a man can break his legs, and then pretends that is «support».
There was another path: leave the cameras chained to their NVR forever, and let Frigate suck the mosaic off the recorder. That is still paying the padlock. The day the NVR dies, or Reolink changes the client again, you are blind. I wanted the seven cameras with a password of mine, RTSP open, and their recorder in a drawer.
5. Official firmware does not let you out
We tried the «clean» path. Export the configuration over the network. On this 3.5.1 the command exists. The USB comes out empty. The file that should be the tar of /mnt/para does not carry the keys. HDMI, again, as if the emptiness were your fault for not hanging a television off the NVR.
Firmware v3.5.1.368 on N2MB02 does not run an autoexec.sh from USB. The tricks from older recorders do not apply. At boot it mounts the FAT, looks for /mnt/usb/upgrade/*.pak and, if there is one, it flashes. Full stop. No documented service door. No «IPC key recovery mode» in the client. Nothing.
The recorder, meanwhile, does see picture. Of course it sees picture: it has the keys. Frigate, against the camera IPs, does not. The contrast is obscene. The box they sold you as a «network NVR» is the only party authorised to talk to the hardware you paid for.
6. How we got the keys with no monitor
Reverse engineering of the stock PAK, board N2MB02, Novatek NT98312 SoC. Only the filesystem is touched. At boot, S90StartSuvr, after mounting /mnt/para, waits for a FAT32 USB, copies that whole directory to para-dump/, writes a para-dump.tar and a DONE.txt, and renames upgrade/ to upgrade.done so the same PAK does not reflash in a loop.
You can flash by USB (folder upgrade/, stick plugged in, reboot) or over the LAN, Baichuan protocol, upgrade command, if you can still log into the recorder with the NVR admin. Here we flashed over the LAN and the dump landed on the USB on the next boot. No HDMI. No mouse. No climbing.
Inside device.xml each camera is a node dev_0, dev_1… The pwd attribute is a 24-character Base64 string. If the node has no pwd_ver, that string is the administrator password of that camera, in the clear. The NVR firmware, when pwd_ver is missing, does a strncpy and uses it as-is. That is why the recorder had video and we did not: it already had the text. We did not.
The usr_v2 file is something else: the recorder’s own users, AES-256-CBC. Not the cameras. Mixing the two layers is the mistake that leaves you locked out and, if you smash SetUser at the NVR, you can wreck the box admin. Do not. The IPC keys are in device.xml.
With those 24 characters, log into each camera. HTTPS CGI where ports 80/443 are open; Baichuan TCP 9000 where Reolink left HTTP closed. Then ModifyUser with oldPassword and newPassword. The password field is rejected (parameter error). SetUser on these IPCs is not supported. One unique key, the same on all seven. RTSP, ONVIF, HTTP, HTTPS, RTMP, open. Frigate talks to each IP. The NVR can go in a drawer.
7. Dump firmware for the N2MB02 board
If you have the same board, the PAK is here. Read this whole section before you touch it.
- RLN8-410 / board
N2MB02/ stockv3.5.1.368only. Any other board, model or SoC: brick. N3MB01, 16-channel recorders, other kits: stop. - This is not Reolink firmware. It is stock
368_25010326with the filesystem patched. Destination version368_25111499, so the NVR does not reject it as «same version». - Brick risk. Power cut mid-flash, a badly formatted USB, a board that is not N2MB02: dead box. Use it on your recorder, knowing what you are doing.
- I am not publishing my dump. No UIDs, no IPs, no
device.xmlfrom this house. The PAK only lets your recorder write your/mnt/parato your USB.
Download the dump PAK (39 MB) · SHA256 · README
SHA256 fa66d5d7669ce2f17ef123b086da64ef13a610131602676019277392040f3d8f
file reolink-rln8-410-n2mb02-para-dump-368_25111499.pak
board N2MB02 model RLN8-410 dest_ver 368_25111499USB, the short path:
- Confirm on the label and in GetDevInfo that it is RLN8-410 / N2MB02 / v3.5.1.368. If it does not match, stop.
- USB stick, MBR, FAT32, one partition. Folder
upgrade/with this.pakinside. Nothing else in that folder. - Leave it plugged in. Reboot the recorder. Stock firmware looks for
/mnt/usb/upgrade/*.pakand flashes on its own. - Wait for the upgrade and the reboot into
368_25111499. The stick stays plugged in. On that boot,S90StartSuvrcopies/mnt/paraand renamesupgradetoupgrade.done. - If you flashed over LAN, plug the USB and reboot once more. The dump is the already-patched boot, not the flash.
- On the stick you want
para-dump/DONE.txt,para-dump.tarand the tree from/mnt/para.
Afterwards you can go back to official firmware from Reolink’s download centre. This PAK is for getting the keys out. You do not need to leave it as daily driver.
8. What to do with the dump: one key, RTSP, Frigate
Open para-dump/device.xml. Each dev_N is a camera. 24-character pwd, no pwd_ver: that is the current admin password on that IPC. Log into the camera IP, not the recorder IP.
Password change, CGI:
{"cmd":"ModifyUser","param":{"User":{
"userName":"admin",
"oldPassword":"the_one_from_device.xml",
"newPassword":"your_new_key"
}}}oldPassword and newPassword. With password + newPassword this generation returns a parameter error. If 80/443 are closed, Baichuan on TCP 9000 still answers; from there you open HTTP and RTSP (set_port_enabled / SetNetPort). Leave the NVRHOLDER user alone: that is the recorder’s, not yours.
RTSP on these IPCs:
rtsp://admin:KEY@IP:554/h264Preview_01_main
rtsp://admin:KEY@IP:554/h264Preview_01_subMain, on mine, is HEVC 3840×2160 at 25 fps. Sub is H264 640×360 at 10 fps. Frigate records main and detects on sub. go2rtc against each IP. NVR out of the path. When all seven answer, the Reolink plug can come out.
This is recovery of hardware you already own, so you can speak RTSP and ONVIF to it, the protocols a 2026 NVR should have left open. It is not an attack on anyone else’s network. Do not publish your device.xml. Do not spray passwords at the cameras: they lock themselves.
9. Reolink are a disaster
I will say it plainly, because the euphemism has lasted too long. Reolink are a disaster. They lock the cameras to their recorder and call it «Auto Add». They leave the macOS client as a lame viewer. They cut the client until you cannot change a password or open a port. They have support that answers HDMI to a box that was born to live without HDMI. They put the emergency exit on a roof.
A LAN recorder in 2026 is administered on the LAN. Real ONVIF. Real RTSP. Passwords the owner can see. A config export that contains what the box already knows. A Mac that is not a second-class citizen. Support that understands there are houses with no television hanging off the NVR, and roofs you do not climb for a reset button.
What Reolink built is the opposite. A 4K padlock. An app. An HDMI religion. Seven cameras of mine, paid for, installed, cabled, that the day I wanted the stream for Frigate turned into seven bricks with an IP. The hell was not the PAK. The hell was discovering the manufacturer had designed the product so that the only clean door was risking your neck.
The cameras speak RTSP now. Frigate records them. The Reolink box can be powered off. If you have the same board and you are in the same alley, the PAK is above. If you are buying CCTV today: look at something else. Reolink, in 2026, is hell with a nice brochure.