internal router is wired to main router/modem from ISP.  the main router is more modern but ISP severely limits user control of it, unlike major router companies such as TP-Link, Netgear, Belkin.

why do I want to do this?  for one application for example if I need to control the router setting remotely.  some of the older security camera works only on internal router network, not when connected to main router for example and etc.  it is an excuse to dive into networking protocol which is always a headache to practice.

read quite a bit how to remotely access log in site of internal router.  quite a learning curve not only in theory but practice.

by default the internal routers have remote management disabled.  therefore need physical access to internal router at least once by connecting to it by ethernet cable or its Wi-Fi, establish connection to it, log in locally to enable remote management (which is more safely done for a single remote IP address that will be used later).

then open ISP main router website to set up Port Forwarding.  In this case set up both external and internal port to 8443.  I found this works.  no need to read more and get more headache on other port options such as 80 or 8080 etc.

use port checker site to test.  I found out 8443 port from a single selected IP address is OPEN.  This was encouraging after long period of hitting walls.  (no need to port forward on internal router now as I am not trying to access a device connected to internal router atp)

to access the router remotely, use https://WAN IP address:8443

but when try to use https://WANIPaddress:8443, on Dell desktop pc Windows 11, keep on getting error: can not establish a secure connection.  this is on MS Edge and also iPhone Safari.  I do not think modern Chrome or Firefox would work either.  in fact tried firefox on another old pc, no luck.  basically the security protocol to access the internal router is dated 2010, around the time the dual band router was released, which is simply too old to be acceptable by modern browsers.

so I am stuck.  a good open port yes but no good way to access it.  internet suggested using Internet Explorer and added the site address to insecure content allowed list.  still no luck.

finally I went to an older PC dated 2010 using original old safari from dates of High Sierra.  That works.   I can see the log in page of internal router over the internet. Fantastic solution.

Recap: must enable remote management of internal router via local connection once.  This will allow Port to be open when you use port checker to check it.  It is quite responsive like an ON OFF switch.  Port forwarding on main router alone does not open the port.  

good to use 8443 as external/internal ports of port forwarding of main router

good to use older pc older browser (2010 contemporary of router) to access the internal router remotely over the internet.  can set up to allow single IP address only access this.