Per your above, the port forwarding 80 from the ER4 to the pcWRT did the trick, but only after I allowed ICMP traffic through. And I did get to the pcWRT subnet (from the ER4) when I adjusted the ‘next hop’ address of the static route to the ‘WAN’ IP of the pcWRT, not the native subnet gateway. That might explain why it didn’t matter if I have the firewall turned off.