The issue you will have here has to do with L2 and L3 boundaries, and how MAC addresses are exposed.
When a L2 packet is handled by a L3 gateway, especially one which applies NAT to it, this will cause the packet to be re-transmitted by the l3 gateway rather than forwarded as is. This means that to the public world IE your remote location you will see the ASUS router as the sources and destination of the conversation, and the remote endpoint will not know what is behind the ASUS router. This is contrary to a L2 only network in which the logic is much simpler, the MAC address is compared with an ARP table, or list of ports and the MAC addresses associated with that port. The ARP table is populated by the conversations a network client makes when interrogating the network when first connected. The switches then effectively replicate the data packet and forward it to the destination port until it arrives.
The best you can do is restrict it to a remote IP, or you could layer on some security higher in the network stack, like in the session, or the application itself.
The problem with MAC addresses, is that they are readily forged. It's just security through obscurity because guessing which MAC to use wouldn't be trivial. Typically people use SSL keys or other harder to impersonate unique identifying mechanisms to ensure good security. For example, you could have a VPN which only allowed members to connect if they had a correct SSL private key which was authorized.
On a semi-related note - I highly recommend getting a Dropcam for watching a baby at home. It handles the security issue well and gives great HD quality.