A picture of my network topology is included below.
I have a few servers I want exposed to the internet. These are behind a Linksys router/firewall with a public IP and a LAN address of 192.168.11.1 (Router 1 in the image). I have my home network that I want isolated from the internet, and not visible to the hosts on the 192.168.11.0/24 subnet. I'd also like the home network to be behind the Linksys firewall (not in a DMZ). I have the WAN port of a NetGear R7000 (Router 2 below) plugged into a LAN port of the Linksys router. The R7000 has a WAN address of 192.168.11.10, and a LAN address of 192.168.1.1.
The Linksys router forwards ports successfully to the servers and the R7000 router. e.g., I set up a port forward for port 8080 to 192.168.11.10. If a server is at this address it receives connections on that port. Now I put the R7000 at that address, and I have it set up to forward port 8080 through to 192.168.1.3. The problem is that the host at 192.168.1.3 never sees traffic on port 8080. To the outside world nothing appears to be listening on that port.
As I understand it, this setup should be working. I assume there's an issue with the R7000 that's preventing this (or a setting that I'm missing). Are there any routers that are known to forward ports correctly in this configuration?