7800n primary router/gateway, secondary router fails

[16CSVT]

I have problems setting up a secondary router.
I want the secondary with NAT off, to avoid setting up lots and lots of NAT/PAT on secondary.

I have a 7800n (1.06h) as a primary gateway, using EWAN port, to an existing
functioning network.
I have a different device as a secondary router. (Device running DDWRT )
I can only access internet from secondary if secondary is in gateway mode (routing with NAT on).

With secondary in Router mode (NAT off),
From primary, static route is set and checked.
It makes no difference if secondary WAN ip is by fixed host dhcp from primary, or set as static ip on secondary.
I can ping (only) from secondary client to primary (management web-server) ip.
I can http from a primary client to the secondary management webservers both on the secondary WAN ip and the secondary LAN.

I cannot connect http from secondary client to primary management webserver UNLESS in secondary gateway mode.
(I have set up all the client, secondary wan ips' in Web access control)
In routing mode (NAT off) I get http error -'The connection was reset while the page was loading'
I cannot connect http from secondary client to internet UNLESS in secondary gateway mode.
In router mode I can see the dns request appear to be satisfied, then 'connecting to (whatever server)' then nothing.

A client on the primary can always http to the internet.

I've got to the stage of sore eyes and sore brain trying to work out what I've missed in the config(s)

I have a different network of DDWRT boxes quite happily routing (no NAT) to each other and out via a cheap and nasty ADSL gateway box to the internet.
Have I missed something in 1.06h setup ???
Has anyone else observed similar??
Could this be a firewall issue?

Regards

Kevin

For those who have not got bored and clicked 'next post', some more detail.
Primary WAN (to rest of private network on EWAN port) 192.168.17.64
Primary LAN 192.168.64.0/24, dhcp 224 - 253
Primary management ip 192.168.64.1 (only :80 tested)
Secondary WAN 192.168.64.68
Secondary LAN 192.168.68.0/24, dhcp 224 - 253
Secondary management ip 192.168.68.1 :80, :8080, :23 (as required)