Second wifi network behind the first one

Hi, I'm trying since days to set up a particular configuration, but with no luck.

The problem :
I have a bunch of wifi-camera that I don't trust so much, I mean, I don't want them to stream to the producer cloud, but I want to use them just to stream locally over my lan with rstp protocol.
Sometimes I need them to go the internet just to download update.

Boundaries :
No, I can't change my ISP router.
Also : the router has few options, no second network, firewall it's just a switch (on-off)
I can't set rules specifically for the ip cameras group.
I can't replace the isp router with an openwrt one.
Actually, on the only wifi available cameras will always have the isp router gw, so no way to manage them, even putting a fw in the network

The goals:
Cameras usually shouldn't have internet access. I will activate it sometimes just to update the firmware. Cameras need to talk to the client network to stream the local rspt stream

The idea :
Create a second wifi network on openwrt tour, with another addressing.
Open Wrt router will also be a client on the isp-router network.
Cameras will be hooked to the open-wrt wifi , and since their gw will be the open-wrt router , I will be able to set firewall roules to block internet.

I tryied so hard since now , but with no luck. I'm able to create ap (second wifi) , and make sure that openwrt is a isp-router-wifi client, but I'm not able to make the first network communicate with the second one, and also giving spot internet access to camera group is a trouble.

Forum, could you please explain me how to do that on LUCI?

(in 19.07)
Network -> Wireless -> Scan -> Join
put the interface in the WAN zone

that should be enough, as long as you make sure the openwrt router's LAN subnet isn't the same as subnet used by the IPSs device.

if you want to allow regular LAN's IPs, to connect to the cameras behind the openwrt router, you'll need to open some ports in the openwrt firewall.

so Home-Wifi as WAN , right?
It is enough also to let subnet talk with ?


I assume you mean 192.168.3 and 192.168.1 ?

access from 192.168.3 to 192.168.1 and internet, is by default unrestricted, it's the access from 192.168.1 to 192.168.3 that needs changes in the firewall, to be allowed.

sure, sorry for th typos

ok, I'll give it a try