The camera needs cloud server contact for ONVIF authorization/functionality, so just opening up the firewall without actively re-initiating server contact afterward would still leave it relatively lifeless.
And I know this is an old post, but I'm wondering if your efforts ever established...