I am looking for a step by step tutorial on securing Red5 from intrusion. This seems to be a question that comes up alot in a google search, but is never really answered i
You cannot secure the backend from the client side, OflaDemo is a demo app, not a production one. By default, Red5 disallows global connections, so if you only run your own application, you can implement whatever kind of security you wish.
No, it is actually not needed (and not useful) to try to manage security only on firewall level. The API permits restricting user access to the various kinds of usage of red5.