The quick answer for double NATing is the first router is a RB750GL (not wireless) and router 2 is a RB951G-2HnD (wireless). Years ago I purchased the first router thinking (actually not thinking ahead or lack of planning) that I wasn't going to need a wireless router. Didn't have a wireless camera at the time nor any other wireless device at the time. Now that I'm thinking through this setup, I wonder if I should just remove router 1 and connect everything to router 2. Although I would like to get this working with both routers.
RB951G-2HnD is more powerful than RB750GL and it can be easily used as a main (edge) router at your home. You can use both, but I would suggest to set up RB951 as a main one, and RB750 as a simple switch. Of course, I assume, that there is no difference where your AP is located. If it makes difference, you can use RB750GL as a edge router and RB951 as a switch with AP. However, RB750 has less RAM, slower CPU, etc. Here you can compare both.
RB951G -
https://mikrotik.com/product/RB951G-2HnD
RB750GL -
https://mikrotik.com/product/RB750GL
The quick answer for double NATing is the first router is a RB750GL (not wireless) and router 2 is a RB951G-2HnD (wireless). Years ago I purchased the first router thinking (actually not thinking ahead or lack of planning) that I wasn't going to need a wireless router. Didn't have a wireless camera at the time nor any other wireless device at the time. Now that I'm thinking through this setup, I wonder if I should just remove router 1 and connect everything to router 2. Although I would like to get this working with both routers.
i ran your command and I still can't get to the camera from router 1. Is there an issue with the firewall rule on router 2?
Here is my export from router 2 for the firewall rules and NAT
# dec/28/2017 13:24:57 by RouterOS 6.41
# model = 951G-2HnD
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" out-interface=ether1-gateway
add action=dst-nat chain=dstnat disabled=yes dst-port=9003 in-interface=ether1-gateway protocol=tcp to-addresses=192.168.99.120 to-ports=9003
/ip firewall filter
add action=accept chain=input comment="default configuration" protocol=icmp
add action=accept chain=input comment="default configuration" connection-state=established,related
add action=accept chain=forward comment="default configuration" connection-state=established,related
add action=drop chain=forward comment="default configuration" connection-state=invalid
add action=drop chain=forward comment="default configuration" connection-nat-state=!dstnat connection-state=new in-interface=ether1-gateway
You don't need firewall on that device at all. Just reset with no config, log in via MAC address using WinBox, bridge all ports (ether1,2,3,4,5,wlan1- if you are going to use RB951 as a switch). Then set up DHCP client on that bridge: IP > DHCP Client > click + > choose bridge as interface > click Apply. On the main router you can set up static IP address that will be alwats assigned to that device.
Make sure, that all devices have DHCP clients on. Otherwise, if they are static, make sure they are in the same subnet and their addresses are not colliding with those assigned bythe main router.