@Nert 

 

Hi, you can take a look:

 

If the 68LAN need to access the 20 server, you need to through the double NAT, you can set the port forwarding rule on the ASUS router for ER605 V1 WAN IP, set the port forwarding on green ER605 for ER605 V2 WAN IP, and set the port forwarding on the blue ER605 for 192.168.20.65.

  @Nert 

 

Nope, the ER605 is a NAT device and you can not disable the NAT on it.

Or you can try to create a site-site IPsec VPN between the ASUS router and blue ER605, and keep green ER605 connected to the ASUS router but disconnect to blue ER605.

Just a thought.

  @Nert 

 

I’m not sure what you need that ER605v1 for. You should be able to connect the RT-AC66U and ER605v2 directly.

Anyways, you can try the following configuration.

 

ER605v1

 

LAN68:

192.168.68.44/24

vlan68

Port ?, Untagged in vlan68, PVID=68

LAN20:

192.168.20.44/24

vlan20

Port ?, Untagged in vlan20, PVID=20

 

RT-AC66U

 

Static route:

192.168.20.0   255.255.255.0   192.168.68.44   LAN

 

ER605v2

Is 192.168.20.10 in LAN or LAN20? Let’s say it is in LAN.

 

LAN:

192.168.20.10/24

vlan1:

Port ?, Untagged in vlan1, PVID=1

Static route:

192.168.68.0   255.255.255.0   192.168.20.44   LAN

 

I assume you use the 255.255.255.0 subnet mask.