The firewall has a 1 to 1 NAT feature. It maps an external ip to an internal one. I had no firewall policies set. Rookie mistake, I've blocked all outgoing access and only allow port 80 and the video port incoming.

I wouldn't even allow port 80 incoming from the internet. Even if the web interface appears to have authentication on it, there may be vulnerable CGIs. They left a telnet interface wide open--do you trust them to write a secure website?

I'd suggest blocking all incoming traffic except a VPN. It's not that hard to set up a VPN.

Even better if the high-risk devices like cameras are on a separate VLAN from critical stuff.

Blocking outgoing traffic is generally a mistake. It prevents the device from retrieving updates, assuming there are any. And if there are no updates then there had better also be no undiscovered or unpatched vulnerabilities, which isn't likely.

I read it as he gave the DVRs external IP adresses without NATing them to internal addresses.