NETGEAR Router Remote Management BAD

I have a vague recollection that something similar has come up before.

It turned out that the claim to be calling in from outside was no such thing. Typing in the "remote" IP address worked because the "caller" was in some way on the same network. Like I said, my recollection is hazy.

I'm not saying this is happening here, just that things can be a bit more complicated than is immediately obvious.

I have just failed in my attempts to break into my second network.

For research purposes, do your router's logs show any signs of this intrusion?

You say that you have not allowed remote management. Have you tried getting in through the conventional Remote Access route with the genie App? (See the manual for details of that.) That would show if the problem is dodgy security, or if that setting was not obeying your orders.