I have a LAN1 in 192.168.0.0/24
and other LAN2 in 192.168.1.0/24

In LAN2 I have Debian server (e2guardian) with two NICs
eth0 = 192.168.1.20 DHCP Assign by LAN1/LAN2 Firewall Appliance
eth1 = 192.168.0.100 DHCP Assign by LAN2 Cable Modem

Cable Modem - Static IP 192.168.0.1
Firewall Appliance - WAN/LAN1 IP 192.168.0.3, LAN2 IP 192.168.1.1

In LAN1 I have DVR Device with Static IP 192.168.0.99

Need to make routing rules to allow the LAN2 computers to connect to the DVR passing around the Firewall. (Firewall seems to be incompatible with the DVR)

Trying to make e2guardian a router added the eth1 interface and made some routing rules. I think I damage the routing table.

ip route output:

default via 192.168.1.1 dev eth0
192.168.0.0/24 via 192.168.1.1 dev eth0
192.168.0.99 via 192.168.0.100 dev eth1
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.20

First I need to make sure the e2guardian routing table is OK.
1. pings the DVR using the eth1 interface.
2. pings the Cable Modem (192.168.0.1) and LAN1 except DVR using eth0 through the default Gateway
3. pings the Internet using eth0 through the default Gateway

Then I think I need to enable forwarding in the e2guardian to the DVR only.

Finally I have to add some rules in the Firewall to send the LAN2 Computers to the DVR through the e2guardian server. This part I think I know how to do it.

It looks like you are doing a double-nat and that can get difficult with multimedia anything.

I went at your issue little more simply.

Set your dhcp server to issue a /23 netmask instead of the /24 (255.255.254.0) Let's say 192.168.5.0/23
Set your Debian server address to something like 192.168.4.11/23. Use the firewall (iptables) on the Debian host to control access to the LAN.

I know it's not perfect, but you get nice, clear distinction between your dmz host without double-nating as many consumer firewalls (cable router) just don't handle anything beyond the normal firewall NAT.

You are making my eyes pop out. I did not understand anything.

The Cable Modem is natting the Internet to the LAN1 where the DVR and the Firewall WAN are
The Firewall is natting the LAN1 to the LAN2

I though that there is no need to do NAT for the LAN2 to see some IP in LAN1, that plain routing was enough.

Yeah, the problem with routing is not all protocols easily route.

That's why if you set your dhcp server LAN address to something like 192.168.5.1 255.255.254.0 you can then assign your DMZ machine a 192.168.4.xx 255.255.254.0. There's no need to route or fiddle with double-nat that your cable modem likely can't handle. Then your DMZ machine has iptables rules to restrict traffic into the LAN as you please.

The DVR is not a full OS, or at least I can not customize iptables or routing tables.