But as a temporary solution:

To make media server serve video streams for clients who are outside of network which the server is in, it is sufficient to override a response of an endpoint I mentioned earler (POST /api/v1/vms/<vms_id>/sites/<site_id>/relay/requestStream), so it contains your external IP or a domain name instead of an intranet IP.

To achieve this, I ran an NGINX reverse proxy that proxies all traffic to the VMS Web Server (with default port changed to 10801), except the path of this one endpoint, which it redirects to my own small HTTP server written in Python (with Flask):

import requests
from flask import Flask, request

app = Flask(__name__)

@app.post("/api/v1/vms/<path:vms_id>/sites/<path:site_id>/relay/requestStream")
def request_stream(vms_id, site_id):
    requests.post(
        f"https://127.0.0.1:<VMS_WEB_SERVER_PORT>{request.path}", # TODO
        verify=False,
        headers=request.headers,
        json=request.get_json(),
    )
    return {
        "errorCode": 0,
        "message": "success.",
        "result": {
            "relayUrl": "<YOUR_EXTERNAL_IP_OR_DOMAIN>", # TODO
            "relayPort": 10556,
            "relaysPort": 10556,
        },
    }

Also here's my nginx.conf

server {
    listen       8081 ssl;

    ssl_certificate      <YOUR_SSL_CERTIFICATE>.cer; # TODO
    ssl_certificate_key  <YOUR_SSL_CERT_PRIVATE_KEY>.pem; # TODO

    location / {
        location ~ (.*)/relay/requestStream$ {
            proxy_pass   http://127.0.0.1:<FLASK_SERVER_PORT>; # TODO
        }
        proxy_pass   https://127.0.0.1:<VMS_WEB_SERVER_PORT>; # TODO
    }

}

Notice that you'll have to generate a self-signed SSL certificate for Nginx.

TP-Link hire me