2 routers, parental control need & problems accessing subnet devices

> The issue is that subnet 1 devices can't connect to subnet 2 devices,
> even if I create the correct route on network 1 devices.

   What, exactly, are these subnets, and what, exactly is this "the
correct route on network 1 devices"?

   As usual, showing actual actions with their actual results (error
messages, LED indicators, ...) can be more helpful than vague
descriptions or interpretations.  In this case, actual IP addresses.
(They're all private addresses, so disclosure should be harmless.  Your
public IP address (WAN of IAP router) may be hidden, if you want.)

   What you need is not a "route on network 1 devices".  You need a
route on the IAP _router_.  Otherwise, it will see subnet-2 addresses as
foreign, and send messages for them out its WAN port, not to the R7000.

> [...] That's logical I guess. As far as I understand this is due to
> NAT on R7000 and could work if there has been an option to switch NAT
> off on the R7000.
>
> Is this right ?

   Nope.

   On the IAP router, you need a (static) route for subnet-2, with a
gateway address which is the WAN address of the R7000 (a subnet-1 LAN
address).  That means that the R7000 WAN address must be fixed.  It can
be a static address (configured on the R7000), or a reserved dynamic
address (or whatever the IAP router calls it, configured on the IAP
router), but it must match the gateway address in that (static) route.

   It would be easier to explain the details if we knew what the "IAP
router" was, and what the actual IP addresses are.

   Cascading two routers this way can still cause problems if you try to
run a server on subnet-2, but the basic problem is that the IAP router
doesn't know that the R7000 is where it should send things which are
addressed to subnet-2.  Defining an appropriate (static) route on the
IAP router should tell it what it needs to know.


> [...] English is not my native language.

   You use it better than many people whose native language it is.