any ideas ?
If I understand correctly, the NVR is connected directly to a LAN port on your ISP's device, or you have a "hub" switch between the ISP modem and your Mikrotik's WAN interface.
I also assume that the NVR's gateway is the ISP's device and not your Mikrotik....
If this is all true, then basically, you will want to do this:
1 - Add an IP address like 10.10.10.X/24 to the physical WAN interface (if your WAN is pppoe-client on ether1, for instance, then the new IP address would be on interface ether1 - or if your WAN public IP comes from dhcp-client, then whatever interace is dhcp-client, add the 10.10.10.x/24 address to the same interface)
2 - Create a NAT rule that will src-nat src-address=192.168.1.0/24 dst-address=10.10.10.5 to-addresses=10.10.10.X (the address you used in step 1). Be sure that this new rule comes before
the srcnat going towards the Internet.
3 - If you want only your PC to have access, limit this with a filter rule. chain=forward dst-address=10.10.10.5 src-address=!192.168.1.20 action=drop
This should give the access you want. If NVR is connected directly to the Mikrotik then the configuration would be different than this. It's similar to how I've granted myself DOCSYS access to my cablemodem through my router.