@Ronnie79 What's the model of the second router ? If it's NX200 you could connect it as satellite device in Easymesh to the first one and avoid the double NAT. If it's a common wireless router then...

@Burroughs70 For a local SSH access you can use the original TCP port 22. If you use TCP port 552 for external access the port-forwarding rule would look like: If you insist to move the defualt SSH...

@Burroughs70 For a local SSH connection to the RPi wouldn't it be: Macandy:~ alutri$ ssh -p22 192.168.0.x and just for an external SSH connection to be Macandy:~ alutri$ ssh -p552 192.168.0.x

@Ronnie79 How come that you have a double NAT in your network, describe your topology and devices. In general when you want to avoid a double NAT, it's better to take this approach.

@manjtb350 You don't have to change anything if topo3 works as you expected. To experience security featres you have to switch AX53 to router mode - these feature are not applicable in AP mode...

@BerNet Here's an example for configuring 802.1Q VLAN on TP-Link Easy Smart switches. It may help you to understand how to configure your switch.