I did initially do it with the firewall alone. I created a “br-nvr” device, moved lan1 from br-lan to it, and used br-nvr as the device for the NVR interface and firewall zone, then selectively let my phone and the NVR app from the LAN zone access the camera ports with traffic rules.

Everything else about the interface and zone stayed the same as they are now. (That’s what’s great about the OpenWRT abstractions. )

The one major issue with that approach was that the NVR app is outside the NVR zone and I wanted it in there.

• It makes broadcasting a non-issue, (I I really don’t want to have to learn how to do cross-network broadcasts and I understand they’re fraught with problems anyway).
• Better security with less complexity. A single camera can have like 3 ports that need to be made accessible, and different cameras will have different ports. Making and maintaining traffic rules for multiple cameras would rapidly turn into a nightmare.

With the NVR app in the same isolated network as the cameras they can do whatever they want in there without needing explicit rules.

But I couldn’t put the NVR docker container into the NVR network, because it lives on a machine on the LAN network, and you can’t have the host machine on one network and a app on it in another network, with a single physical cable… unless you use tagged VLANs.

There are also some potential annoyances in the future if I ever want to move cables around the ports or make more complex setups, the VLAN abstraction makes things easier.