I found out incidentally the router website from ISP updates with significant latency.  sometimes the internal router address shows up as local IP 0.0.0.0 (which is in holding place) and does not update for a long time on website.  this is perhaps a known issue with network.  it simply does not update as fast as one wish.

to fix the internal router at a constant IP address with the main router using DHCP (which I can not change unless I asked the ISP to request bridge mode, something I do not want to do as there are other devices directly on ISP modem wi-fi), I found out if I let DHCP Iocal IP address start and stop at same address, basically allowing only one address. it would fix it.

the disadvantage of that is no other device can connect to main router.  

on the other hand, most of the time DHCP configures same local ip address for frequently or constantly present devices. so it is not a big problem.  while it is called dynamic, it is usually quite static.  The only time I see it dynamic is when I manually set it to allow ip address in a very narrow range, then it really tries hard to find an open address to assign to internal router for example.

Router vs. Access Point: A router acts as a dispatcher, connecting your network to the broader internet. An access point is simply an extension cord for your Wi-Fi, turning a wired internet connection into a wireless one in areas where the router's signal can't reach.

Not dhcp but remote management rule: only one remote ip

tried on another older router. Cannot reproduce success atp.

@redxps630​

1. to fix the internal router at a constant IP address with the main router using DHCP (which I can not change unless I asked the ISP to request bridge mode,

2. something I do not want to do as there are other devices directly on ISP modem wi-fi),

1. Yes, Bridge-Mode your Residential Gateway so it turns-into "Just a Modem" and then you will have full control at your own Router.

Or, just tell them you don't want a Residential Gateway (Modem and Router combo unit) and you want a "plain modem". That's what Spectrum provides to me (for free).

2. You would just put those devices on your personal router's WiFi.

One other thing as I read all this ... you should be able to access your internal gear (on safe side of router) without any additional port-forwards or pin-holes. This is all on your-side of firewall.

I used to have arris modem from isp and connect w personal router but these isp gateway modem/router combo work: I can change password remotely and monitor devices connected.  My personal router is much older than the built in router of isp gateway.

ISP router is user unfriendly: desktop and mobile version of WiFi have different features.

my new question now is how come remote access using https://WAN address:port number needs an ancient security protocol tolerant old browser while the the link itself does not say the age of equipment at all.  How do ppl remotely control modern router?  I am guessing it needs an account log in.  If that is true, the old direct link access is out of fashion and rejected by browser on modern pc and mobile phone.  I might need to use an old retired iPhone 5 of 2010 era to test remote access.  This also shows a seemingly very outdated hardware like old iMac or phone may still be handy for old fashioned communication sort of like old nuclear bunker running on analog communication in doom days when modern digital AI are wiped out

@redxps630​ ,

1. my new question now is how come remote access using https://WAN address:port number needs an ancient security protocol tolerant old browser while the the link itself does not say the age of equipment at all.  

2. How do ppl remotely control modern router?  I am guessing it needs an account log in.  If that is true, the old direct link access is out of fashion and rejected by browser on modern pc and mobile phone.  

3. I might need to use an old retired iPhone 5 of 2010 era to test remote access.  This also shows a seemingly very outdated hardware like old iMac or phone may still be handy for old fashioned communication sort of like old nuclear bunker running on analog communication in doom days when modern digital AI are wiped out

1. Unknown.

2. The usual way, but I've never remote-managed a network with 2 routers.

One thing I did once (after seeing the anonymous hammering in the router logs) was to keep remote-management turned off. If I had to, we would coordinate a TeamViewer/AnyDesk session with staff and I could admin Router from their desktop with local-IP and strong-password.

Also, it was on the other side of town, so I could just drive over there. But changing router-settings? ... hardly ever a need. Routers and Access-Points ran for years un-touched. 

Now-days, small networks can be cloud-admin like TP-Link Omada. Now there is some cool Remote Management. I figure companies like Ubiquiti have similar now. 

3. Prepping is fine, but if it gets this bad then I think you will have other priorities. 

Many people in US may not know this.  Home office with TP-Link routers have been compromised and the US government had quietly accessed those compromised routers to reset security settings and repelled the hackers.

This was done last month, code name Operation Masquerade  https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-dns-hijacking-network-controlled

Good to know this news. I have an old single band TP link router that I can’t even find a firmware update on tp website.  Definitely to remove it from service.  It would not open port using port forwarding.

if TP link was compromised I suppose other major router companies may suffer vulnerability infiltration too.