This does seem like a layer 2 (switching, vlan) problem. I don't think anything is necessarily wrong with routing, per se. Based on your diagram, the NAS should be able to ping the IP Camera.
Also, I assume you have the entire LAN on /24? I recommend assigning a different IP range to different VLANs. You could go with a /25 or /26 to divide it up.
A real test would be to wire the two TP-Link SG108E together (shown with the Netgate between them). Could the PC ping everything then? If so, add the NetGate back and look closer at the LAN/vLAN config. You'll definitely need 802.1q enabled. If not, then the answer lies with one of the switches.
Worse case, don't use VLANs, and instead use the OPT1 interface (and a different subnet) for the IP Camera network segment.