IPCamera setup on simple network

[pasta514]

I am creating a simple, limited access network with multiple access points. Think of a coffee shop or something like that. What do I need to do to permit IPCamera images or video onto my website?

Here is a diagram:

IPCameras----+---Managed Switch POE----Router------CableModemRouter-----Internet-----Mywebsite(wants iFrame code for embedding)
WiFi APs------+
OC200_SDN--+

All this hardware is new within that last year and all works fine. The network equipment is all TP-Link Omada SDN. The Cable modem is rented from the ISP and it's a new Arris DG2460A. Cameras are Dahua IPC-HFW5442-ZE.
There are no servers nor storage on the network, the network is only to allow customer access to the internet through the WiFi, point of sale transactions to stripe and a few other IoT devices.
I just want to stream either snapshots or live video to my website from 2 cameras.
I also want the WiFi to be secure for my customers (and my PoS).

Where do I start? I'd prefer not to deal with a 3rd party IPCamera MediaServer Cloud provider. This is not security video and it doesn't need to be saved.
I think I want to put the cameras on a VLAN then make that VLAN open to the internet? or VPN? or Opening Ports?

 

[dosborne]

Where do you start? ENSURE YOUR POS AND OTHER SYSTEMS ARE NOT ACCESSIBLE TO YOU CLIENTS.

Ensure your customers are on a separate vlan or guest network. Similarly separating the cameras may not be a bad idea, but not as critical.

I'm not familiar with you cameras or the features they have, but with mine, before I went in a different direction, I coded my website to use embedded frames essentially captured or provided from the web server built into the camera. Another option would be to use ftp or similar to upload still images to your web site. It has been a while since I've done these things, they did work, but there may be more elegant solutions these days.

As cameras can be an easy entry point for malicious activity, I would go with embedded code on your site accessing specific services on your internal network either in the background on the internal lan, or by opening only the ports required to get the information rather than exposing your cams to the internet directly.

 

[pasta514]

As cameras can be an easy entry point for malicious activity, I would go with embedded code on your site accessing specific services on your internal network either in the background on the internal lan, or by opening only the ports required to get the information rather than exposing your cams to the internet directly.

Right, so the website/server is hosted in the cloud and the cameras are behind two NAT/firewall/routers. I need help getting through the routers. How do I do that without compromising the rest of the network?