diff --git a/.gitignore b/.gitignore
index 52fe9c864..4df4e49be 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,7 @@
 .idea/
 .tmp/
 
+go2rtc
 go2rtc.yaml
 go2rtc.json
 
@@ -12,3 +13,7 @@ go2rtc_win*
 0_test.go
 
 .DS_Store
+
+*.mp3
+*.wav
+*.al
diff --git a/fix_vto_codecs.sh b/fix_vto_codecs.sh
new file mode 100755
index 000000000..fd3789926
--- /dev/null
+++ b/fix_vto_codecs.sh
@@ -0,0 +1,103 @@
+#!/bin/bash
+#
+# This script fixes the VTO audio codecs before supplying the stream url to go2rtc.
+#
+# Usage: ./fix_vto_codecs.sh [--debug] [--https] <VTO stream URL>
+#
+# Examples:
+#
+#   ./fix_vto_codecs.sh rtsp://user:pass@192.168.1.40/cam/realmonitor?channel=1&subtype=0&unicast=true&proto=Onvif
+#   ./fix_vto_codecs.sh rtsp://user:pass@192.168.1.40/cam/realmonitor?channel=1&subtype=1
+#
+#   If the VTO has HTTPS enabled:
+#   ./fix_vto_codecs.sh --https rtsp://user:pass@192.168.1.40/cam/realmonitor?channel=1&subtype=0
+#
+#   With ffmpeg prefix:
+#   ./fix_vto_codecs.sh ffmpeg:rtsp://user:pass@192.168.1.40/cam/realmonitor?channel=1&subtype=0#video=copy#audio=copy
+#
+
+set -euo pipefail
+
+usage() {
+  echo "Usage: ${0} [--debug] [--https] <VTO stream URL>" >&2
+  exit "${1}"
+}
+
+debug=false
+protocol="http"
+extra_curl_args=()
+
+positional_args=()
+while [[ $# -gt 0 ]]; do
+  case $1 in
+    --debug)
+      debug=true
+      shift
+      ;;
+    --https)
+      protocol="https"
+      extra_curl_args+=("--insecure")
+      shift
+      ;;
+    -*)
+      echo "Unknown option ${1}" >&2
+      usage 1
+      ;;
+    *)
+      positional_args+=("$1")
+      shift
+      ;;
+  esac
+done
+
+set -- "${positional_args[@]}"
+unset positional_args
+
+if [[ $# -ne 1 ]]; then
+  echo "Expected 1 positional argument, got $#" >&2
+  usage 1
+fi
+
+vto_stream_url="${1}"
+
+if [[ "${vto_stream_url}" != "rtsp://"* && "${vto_stream_url}" != "ffmpeg:rtsp://"* ]]; then
+  echo "VTO stream URL does not start with rtsp:// or ffmpeg:rtsp://" >&2
+  usage 1
+fi
+
+if [[ "${debug}" == "true" ]]; then
+  set -x
+  extra_curl_args+=("--verbose")
+fi
+
+vto_host_with_creds="${vto_stream_url#"ffmpeg:"}"
+vto_host_with_creds="${vto_host_with_creds#"rtsp://"}"
+vto_host_with_creds="${vto_host_with_creds%%"/"*}"
+if [[ "${vto_host_with_creds}" =~ :[0-9]+$ ]]; then
+  vto_host_with_creds="${vto_host_with_creds%":"*}"
+fi
+
+query="action=setConfig"
+# PCMA: average audio quality, but good for WebRTC and 2-way audio
+query+="&Encode[0].MainFormat[0].Audio.Compression=G.711A"
+# 16000Hz yields better audio quality, but try 8000Hz if your VTO does not support it
+query+="&Encode[0].MainFormat[0].Audio.Frequency=8000"
+# AAC: best audio quality, good for Frigate recordings
+query+="&Encode[0].ExtraFormat[0].Audio.Compression=AAC"
+
+# PS: the current config can be retrieved with:
+#   curl -fsSL --digest --globoff \
+#     http://user:pass@192.168.1.40/cgi-bin/configManager.cgi?action=getConfig&name=Encode
+
+output=$(
+  curl --fail --silent --show-error --digest --globoff "${extra_curl_args[@]}" \
+    "${protocol}://${vto_host_with_creds}/cgi-bin/configManager.cgi?${query}"
+)
+
+if [[ "${output}" != $'OK\r' ]]; then
+  echo "Failed to set VTO codecs. Response:" >&2
+  echo "${output}" >&2
+  exit 1
+fi
+
+echo -n "${vto_stream_url}"
diff --git a/internal/dahua/init.go b/internal/dahua/init.go
new file mode 100644
index 000000000..6428b1c15
--- /dev/null
+++ b/internal/dahua/init.go
@@ -0,0 +1,13 @@
+package dahua
+
+import (
+	"github.com/AlexxIT/go2rtc/internal/streams"
+	"github.com/AlexxIT/go2rtc/pkg/core"
+	"github.com/AlexxIT/go2rtc/pkg/dahua"
+)
+
+func Init() {
+	streams.HandleFunc("dahua", func(source string) (core.Producer, error) {
+		return dahua.Dial(source)
+	})
+}
diff --git a/main.go b/main.go
index e85c5900f..5cf788118 100644
--- a/main.go
+++ b/main.go
@@ -6,6 +6,7 @@ import (
 	"github.com/AlexxIT/go2rtc/internal/api/ws"
 	"github.com/AlexxIT/go2rtc/internal/app"
 	"github.com/AlexxIT/go2rtc/internal/bubble"
+	"github.com/AlexxIT/go2rtc/internal/dahua"
 	"github.com/AlexxIT/go2rtc/internal/debug"
 	"github.com/AlexxIT/go2rtc/internal/doorbird"
 	"github.com/AlexxIT/go2rtc/internal/dvrip"
@@ -84,6 +85,7 @@ func main() {
 	dvrip.Init()    // dvrip source
 	tapo.Init()     // tapo source
 	isapi.Init()    // isapi source
+	dahua.Init()    // dahua source
 	mpegts.Init()   // mpegts passive source
 	roborock.Init() // roborock source
 	homekit.Init()  // homekit source
diff --git a/pkg/dahua/CGI_SDK_API.txt b/pkg/dahua/CGI_SDK_API.txt
new file mode 100644
index 000000000..9a96878d9
--- /dev/null
+++ b/pkg/dahua/CGI_SDK_API.txt
@@ -0,0 +1,154 @@
+11. Audio
+
+11.1 Audio MIME type
+
+MIME                                                                   Description
+Audio/PCM
+Audio/ADPCM
+Audio/G.711A
+Audio/G.711Mu
+Audio/G.726
+Audio/G.729
+
+                                                                  92
+Audio/MPEG2
+Audio/AMR
+Audio/AAC
+
+
+
+11.2 Post Audio
+
+URL Syntax       http://<ip>/cgi-bin/audio.cgi?action=postAudio&<paramName>=<paramValue>[&<paramName>=<paramValue>...]
+Comment          paramValue as below table.
+Response         OK or ERROR
+
+
+ParamName                                         ParamValue type                   Description
+httptype                                          string                            singlepart:HTTP content is a continuous flow of audio
+                                                                                    packets
+                                                                                    multipart:HTTP           content      type         is
+                                                                                    multipart/x-mixed-replace,and each audio packet ends
+                                                                                    with a boundary string
+channel                                           integer                           The audio channel
+
+
+
+11.2.1 Example for singlepart
+
+The RUL of transmit a singlepart、channel 1 audio stream(encoded with G.711 A-law) is:
+http: //<ip>/cgi-bin/audio.cgi?action=postAudio&httptype=singlepart&channel=1
+
+
+example:
+POST /cgi-bin/audio.cgi?action=postAudio&httptype=singlepart&channel=1 HTTP/1.1
+Content-Type: Audio/G.711A
+Content-Length:9999999
+
+
+<Audio data>
+<Audio data>
+
+
+
+11.2.2 Example for multipart
+
+The RUL of transmit a multipart、channel 1 audio stream(encoded with G.711 A-law) is:
+http: //<ip>/cgi-bin/audio.cgi?action=postAudio&httptype= multipart &channel=1
+
+
+example:
+POST /cgi-bin/audio.cgi?action=postAudio&httptype= multipart &channel=1 HTTP/1.1
+ Content-Type: multipart/x-mixed-replace; boundary=<boundary>
+--<boundary>
+Content-Type: Audio/G.711A
+
+                                                                    93
+Content-Length: 800
+
+
+<Audio data>
+--<boundary>
+
+
+
+11.3 Get Audio
+
+URL Syntax       http://<ip>/cgi-bin/audio.cgi?action=getAudio&<paramName>=<paramValue>[&<paramName>=<paramValue>...]
+Comment          paramValue as below table.
+Response         OK or ERROR
+
+
+
+
+ParamName                                           ParamValue type                    Description
+httptype                                            string                             singlepart:HTTP content is a continuous flow of audio
+                                                                                       packets
+                                                                                       multipart:HTTP           content        type         is
+                                                                                       multipart/x-mixed-replace,and each audio packet ends
+                                                                                       with a boundary string
+channel                                             integer                            The audio channel
+
+
+
+
+11.3.1 Example for singlepart
+
+The RUL of Request a singlepart、channel 1 audio stream(encoded with G.711 A-law) is:
+http: //<ip>/cgi-bin/audio.cgi?action=getAudio&httptype=singlepart&channel=1
+
+
+If the request was successful, the server returns a continuous flow of audio packets.The content type is only set at the beginning of the
+connection.
+Return:
+HTTP Code: 200 OK
+Content-Type: Audio/G.711A
+Body:
+<Audio data>
+<Audio data>
+
+
+
+11.3.2 Example for multipart
+
+The RUL of Request a multipart、channel 1 audio stream(encoded with G.711 A-law) is:
+http: //<ip>/cgi-bin/audio.cgi?action=getAudio&httptype=multipart&channel=1
+
+
+If the request was successful, the server returns a continuous flow of audio packets. The content type is “multipart/x-mixed-replace” and each
+audio packet ends with a boundary string.
+                                                                      94
+Return:
+HTTP Code: 200 OK
+Content-Type: multipart/x-mixed-replace; boundary=<boundary>
+--<boundary>
+Content-Type: Audio/G.711A
+Content-Length: 800
+
+
+<Audio data>
+--<boundary>
+
+
+
+
+11.4 Audio Input
+
+11.4.1 getCollect
+
+URL Syntax            http://<ip>/cgi-bin/devAudioInput.cgi?action=getCollect
+Comment               Get Audio input channel number.
+                      Below response means there are 2 audio input channels.
+Response              result=2
+
+
+
+
+11.5 Audio Output
+
+11.5.1 getCollect
+
+URL Syntax            http://<ip>/cgi-bin/devAudioOutput.cgi?action=getCollect
+Comment               Get Audio output channel number.
+                      Below response means there are 2 audio output channels.
+Response              result=2
diff --git a/pkg/dahua/backchannel.go b/pkg/dahua/backchannel.go
new file mode 100644
index 000000000..12434f364
--- /dev/null
+++ b/pkg/dahua/backchannel.go
@@ -0,0 +1,147 @@
+package dahua
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+
+	"github.com/AlexxIT/go2rtc/internal/app"
+	"github.com/AlexxIT/go2rtc/pkg/core"
+	"github.com/pion/rtp"
+)
+
+func (c *Client) GetMedias() []*core.Media {
+	return c.medias
+}
+
+func (c *Client) GetTrack(media *core.Media, codec *core.Codec) (*core.Receiver, error) {
+	return nil, core.ErrCantGetTrack
+}
+
+func (c *Client) AddTrack(media *core.Media, _ *core.Codec, track *core.Receiver) error {
+	log := app.GetLogger("dahua")
+	log.Debug().
+		Str("media_kind", string(media.Kind)).
+		Str("codec", track.Codec.Name).
+		Msg("[dahua] adding track")
+
+	if c.sender == nil {
+		c.sender = core.NewSender(media, track.Codec)
+
+		// Set up the audio handler
+		c.sender.Handler = func(packet *rtp.Packet) {
+			// Get connection in a thread-safe way
+			conn := c.getConnection()
+			if conn == nil {
+				return
+			}
+
+			// For G.711, we should send raw audio data without RTP headers
+			// The Dahua camera expects pure G.711 audio samples
+			audioData := packet.Payload
+
+			// Skip empty packets
+			if len(audioData) == 0 {
+				return
+			}
+
+			// Send multipart boundary with payload
+			boundary := "\r\n--go2rtc-audio-boundary\r\n"
+
+			// Determine content type based on codec
+			var contentType string
+			switch track.Codec.Name {
+			case core.CodecPCMA:
+				contentType = "Audio/G.711A"
+			case core.CodecPCMU:
+				contentType = "Audio/G.711Mu"
+			default:
+				contentType = "Audio/G.711A"
+			}
+
+			boundary += "Content-Type: " + contentType + "\r\n"
+			boundary += fmt.Sprintf("Content-Length: %d\r\n\r\n", len(audioData))
+
+			// Write boundary and audio data in one operation to reduce fragmentation
+			fullData := append([]byte(boundary), audioData...)
+
+			// Use thread-safe connection writing
+			c.connMu.Lock()
+			n, err := conn.Write(fullData)
+			c.connMu.Unlock()
+
+			if err != nil {
+				log.Debug().Err(err).Msg("[dahua] failed to write audio data")
+				return
+			}
+
+			c.send += n
+		}
+
+		log.Debug().
+			Str("codec", track.Codec.Name).
+			Uint32("clock_rate", track.Codec.ClockRate).
+			Msg("[dahua] audio sender created")
+	}
+
+	c.sender.WithParent(track).Start()
+	return nil
+}
+
+// getConnection returns the current connection in a thread-safe way
+func (c *Client) getConnection() io.WriteCloser {
+	c.connMu.RLock()
+	defer c.connMu.RUnlock()
+	return c.conn
+}
+
+func (c *Client) Start() (err error) {
+	log := app.GetLogger("dahua")
+	log.Debug().Msg("[dahua] starting client")
+
+	if err = c.open(); err != nil {
+		log.Error().Err(err).Msg("[dahua] failed to open connection")
+		return
+	}
+
+	log.Debug().Msg("[dahua] client started successfully")
+	return
+}
+
+func (c *Client) Stop() (err error) {
+	log := app.GetLogger("dahua")
+	log.Debug().Msg("[dahua] stopping client")
+
+	if c.sender != nil {
+		c.sender.Close()
+		log.Debug().Msg("[dahua] sender closed")
+	}
+
+	if c.conn != nil {
+		err = c.close()
+		if err != nil {
+			log.Error().Err(err).Msg("[dahua] error during close")
+		}
+		log.Debug().Msg("[dahua] connection closed")
+	}
+
+	log.Debug().Msg("[dahua] client stopped")
+	return nil
+}
+
+func (c *Client) MarshalJSON() ([]byte, error) {
+	info := &core.Connection{
+		ID:         core.NewID(),
+		FormatName: "dahua",
+		Protocol:   "http",
+		Medias:     c.medias,
+		Send:       c.send,
+	}
+	if c.conn != nil {
+		info.RemoteAddr = c.url // Use URL instead of RemoteAddr since we don't have a net.Conn
+	}
+	if c.sender != nil {
+		info.Senders = []*core.Sender{c.sender}
+	}
+	return json.Marshal(info)
+}
diff --git a/pkg/dahua/client.go b/pkg/dahua/client.go
new file mode 100644
index 000000000..a4c94ed2a
--- /dev/null
+++ b/pkg/dahua/client.go
@@ -0,0 +1,226 @@
+package dahua
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"sync"
+
+	"github.com/AlexxIT/go2rtc/internal/app"
+	"github.com/AlexxIT/go2rtc/pkg/core"
+	"github.com/AlexxIT/go2rtc/pkg/tcp"
+)
+
+// Client implements Dahua CGI HTTP API for 2-way audio
+type Client struct {
+	core.Listener
+
+	url      string
+	username string
+	password string
+	channel  string
+	conn     io.WriteCloser
+	connMu   sync.RWMutex
+
+	medias []*core.Media
+	sender *core.Sender
+	send   int
+}
+
+// Dial creates a new Dahua CGI client
+func Dial(rawURL string) (*Client, error) {
+	log := app.GetLogger("dahua")
+	log.Debug().Str("url", rawURL).Msg("[dahua] creating new client")
+
+	// Parse URL
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		log.Error().Err(err).Str("url", rawURL).Msg("[dahua] failed to parse URL")
+		return nil, err
+	}
+
+	// Extract credentials
+	username := u.User.Username()
+	password, _ := u.User.Password()
+
+	// Build base URL
+	u.User = nil
+	u.Scheme = "http"
+	u.Path = ""
+	u.RawQuery = ""
+	u.Fragment = ""
+
+	client := &Client{
+		url:      u.String(),
+		username: username,
+		password: password,
+		channel:  "1", // Default channel
+	}
+
+	log.Debug().
+		Str("url", client.url).
+		Str("username", username).
+		Str("channel", client.channel).
+		Msg("[dahua] client configuration")
+
+	if err = client.dial(); err != nil {
+		log.Error().Err(err).Msg("[dahua] failed to dial")
+		return nil, err
+	}
+
+	return client, nil
+}
+
+// dial establishes connection for audio output only (postAudio)
+func (c *Client) dial() error {
+	log := app.GetLogger("dahua")
+	log.Debug().Msg("[dahua] starting dial process")
+
+	// Create media descriptor for audio output (send-only from go2rtc perspective)
+	// We support both G.711 A-law and μ-law for postAudio functionality
+	media := &core.Media{
+		Kind:      core.KindAudio,
+		Direction: core.DirectionSendonly,
+		Codecs: []*core.Codec{
+			{Name: core.CodecPCMA, ClockRate: 8000}, // G.711 A-law
+			{Name: core.CodecPCMU, ClockRate: 8000}, // G.711 μ-law
+		},
+	}
+	c.medias = append(c.medias, media)
+
+	log.Debug().
+		Str("kind", string(media.Kind)).
+		Str("direction", string(media.Direction)).
+		Int("codecs", len(media.Codecs)).
+		Msg("[dahua] media configuration created for postAudio")
+
+	return nil
+}
+
+// open establishes the audio streaming connection
+func (c *Client) open() error {
+	log := app.GetLogger("dahua")
+	log.Debug().Msg("[dahua] opening audio connection")
+
+	// Determine content type based on codec
+	var contentType string
+	if c.sender != nil && c.sender.Codec != nil {
+		switch c.sender.Codec.Name {
+		case core.CodecPCMA:
+			contentType = "Audio/G.711A"
+		case core.CodecPCMU:
+			contentType = "Audio/G.711Mu"
+		default:
+			contentType = "Audio/G.711A" // Default to A-law
+		}
+	} else {
+		contentType = "Audio/G.711A" // Default to A-law
+	}
+
+	log.Debug().
+		Str("content_type", contentType).
+		Str("channel", c.channel).
+		Msg("[dahua] opening multipart audio stream")
+
+	// Use multipart POST for audio streaming
+	link := fmt.Sprintf("%s/cgi-bin/audio.cgi?action=postAudio&httptype=multipart&channel=%s", c.url, c.channel)
+
+	// Create request with a pipe for streaming body
+	pipeReader, pipeWriter := io.Pipe()
+	req, err := http.NewRequest("POST", link, pipeReader)
+	if err != nil {
+		return err
+	}
+
+	// Set credentials in URL for digest auth support
+	req.URL.User = url.UserPassword(c.username, c.password)
+	req.Header.Set("Content-Type", "multipart/x-mixed-replace; boundary=go2rtc-audio-boundary")
+	req.Header.Set("Transfer-Encoding", "chunked")
+
+	log.Debug().Str("url", link).Msg("[dahua] sending audio stream request")
+
+	// Start the HTTP request in a goroutine
+	go func() {
+		defer pipeWriter.Close()
+
+		res, err := tcp.Do(req)
+		if err != nil {
+			log.Error().Err(err).Msg("[dahua] failed to start audio stream")
+			return
+		}
+		defer tcp.Close(res)
+
+		// Log detailed response information
+		log.Debug().
+			Int("status", res.StatusCode).
+			Str("status_text", res.Status).
+			Str("content_type", res.Header.Get("Content-Type")).
+			Str("content_length", res.Header.Get("Content-Length")).
+			Str("connection", res.Header.Get("Connection")).
+			Str("transfer_encoding", res.Header.Get("Transfer-Encoding")).
+			Msg("[dahua] HTTP response details")
+
+		if res.StatusCode != http.StatusOK {
+			log.Error().
+				Int("status", res.StatusCode).
+				Str("status_text", res.Status).
+				Msg("[dahua] audio stream request failed")
+			return
+		}
+
+		log.Debug().Msg("[dahua] audio connection established successfully")
+
+		// Read any response data
+		buf := make([]byte, 1024)
+		for {
+			_, err := res.Body.Read(buf)
+			if err != nil {
+				if err != io.EOF {
+					log.Debug().Err(err).Msg("[dahua] connection read error")
+				}
+				break
+			}
+		}
+	}()
+
+	// Store the pipe writer as our connection
+	c.connMu.Lock()
+	c.conn = pipeWriter
+	c.connMu.Unlock()
+
+	// Send initial multipart boundary
+	boundary := "\r\n--go2rtc-audio-boundary\r\n"
+	boundary += fmt.Sprintf("Content-Type: %s\r\n", contentType)
+	boundary += "Content-Length: 0\r\n\r\n"
+
+	if _, err := c.conn.Write([]byte(boundary)); err != nil {
+		log.Error().Err(err).Msg("[dahua] failed to send initial boundary")
+		return err
+	}
+
+	log.Debug().Msg("[dahua] initial boundary sent successfully")
+
+	return nil
+}
+
+// close closes the audio connection
+func (c *Client) close() error {
+	log := app.GetLogger("dahua")
+	log.Debug().Msg("[dahua] closing audio connection")
+
+	c.connMu.Lock()
+	defer c.connMu.Unlock()
+
+	if c.conn != nil {
+		err := c.conn.Close()
+		c.conn = nil
+		if err != nil {
+			log.Error().Err(err).Msg("[dahua] error closing connection")
+			return err
+		}
+	}
+
+	log.Debug().Msg("[dahua] audio connection closed")
+	return nil
+}