As you've got Virtual Host available and enabled, you should be able to reach the cameras directly if your network gateway is told to route the packets via the NVR LAN interface IP address.
Yes, I can reach the cameras. I can access their web interface with Firefox (Linux), except for the video feed, which gives the well known missing plugin message. I started this thread because I noticed the live feed has a drop down that included VLC. I was hoping that was a key to making it work. I have also now discovered that I do not have a FF plugin for VLC. I haven't sorted that out yet, perhaps with the latest security updates to FF it is no longer available. But as Nayr pointed out, it may be possible to develop my own web page to allow VLC (and perhaps other video players?) to function. That will take some time to research, mostly because I'll have to learn Apache (I think).
Route add for net 192.168.254.0/24 via gw 192.168.1.20 (if this is your NVR LAN interface address).
Since I can already access the camera's from FF with 192.168.1.20:6500x where x is a camera number, is the above necessary? I tried to ping the private subnet and it doesn't work, of course, because there is no route. I'll play with that method and see if I get anywhere, it sounds promising. It's been awhile since I looked at the settings for my routing tables.
The NVR firmware usually sets the NVR LAN interface default gateway on the PoE connected cameras, not sure why. That breaks the ability of the camera to get out of the PoE network.
But isn't it getting out since I can access the camera web interface except video via FF? Or again, am I misunderstanding what you are advising? And isn't iVMS4200 (or is it 4500?, I forget) which I have working on a seldom used XP system showing that it is getting out? Or is that a different issue entirely.
Anyway, thanks for the great tips, both you & Nayr have given me some good info to work with.