Those firewall settings are to help manage access by the devices that already have access on your network (ie all the other devices in your house that have network access). With them you can allow or block access to the NVR from your other household devices. I suspect one of those "allow" rules basically allows ALL devices on the local network to access the NVR. That's normally how these are set up by default and it means that unless you change it, everything on your local network can access the NVR. That isn't necessarily a bad thing either as you should generally be able to trust everything that is on your local network.
However your problem is that you have devices that are not originating from your local network somehow accessing this NVR. This is a MUCH bigger problem. Your router/firewall device should be blocking 100% of that outside traffic from even "knowing" your network exists. (Firewalls/routers don't just "block" traffic, they make it seem as if the network doesn't exist). The fact that some random person on the internet can find and attempt to access your NVR is extremely troubling. This means that person is already getting through your router/firewall and is on your network. The only security/protection you have from that person accessing everything else on your network is the "security" of your NVR's firmware. To be blunt - it sucks and can be hacked very easily by someone that knows what they are doing.
To prevent this type of outside access, you need to immediately stop forwarding ports on your router/firewall as well as turning off services like UPnP (which simply allows devices to secretly open ports to the outside world without your express permission). When you forward a port, you are bypassing all of the security that your firewall/router is suppose to provide and simply sending all traffic directly to another device/service on your network. Therefore the only "security" you have at that point is whatever is build into the device/service you are forwarding traffic to. IOT devices like this NVR are notoriously bad at providing network security.
If you need to be able to have access to the NVR and/or other devices on the local network while you are remote (ie away from the house and using the internet to access them), then you really need to set up a VPN or similar service that will allow you to securely access your network while also blocking unauthorized people from accessing your network. While traditional VPN services require a single forwarded port on your firewall to work, the VPN service requires a matching encryption key to be provided by the outside party before that traffic is allowed onto your local network. The security programmed into the VPN services is 1000 times better than any IOT device and while there is always the potential for exploits to be found (which is true of any software/device), the VPN services tend to find and patch these exploits very quickly. On the flip side, IOT device manufactures rarely patch their firmware even when known exploits have been found in them.
Long story short, you need to lock down your local network from any/all outside traffic. If you need to access the network yourself from the outside, you need to setup a VPN connection. Doing anything else is leaving the door wide open for hackers to exploit.
PS - there is no need to block the local network address on that screenshot. Your local addresses have no meaning to the rest of the world and it is not unsafe to show them. Just don't show your actual public IP address that you have been assigned by your local service provider. Blocking the local addresses is equivalent to me showing a drawing of my house and blocking out the room names like "den", "bathroom", "kitchen", "bedroom", etc. There is no security value provided by blocking them out as every house has those same rooms. What I would want to block out is the actual physical address (ie 100 Main Street, Anytown USA) of my house. The "physical address" of your network is your public IP address assigned by your provider, and you would want to block it out if there was some screen that actually showed it.
