@Rico619 You need to ensure that the WAN IPs of the two ER605s are able to communicate with each other. This requires you to open the port for the WAN IP of the ER605 on the front NAT device and also...

@packergeek Check this: How to create multi networks and manage network behavior with ACL on Omada Gateway In this scenario, you don't need a switch.

@words If you use the ER605 as OpenVPN server, unfortunately, it doesn't support full tunnel yet. But you can set it as L2TP/PPTP server, then it support proxy access Internet.

@Jacket73 You can consider to use the policy routing function, hope this can help you: How to configure Policy Routing

@mikahe You can try to disable SSH to test, check this: https://community.tp-link.com/en/business/forum/topic/583776

@wisem2540 Are you managing this with a controller? How exactly is it set up? Can you provide a screenshot to show this? Normally, if you set it correctly, one WAN should be offline.