This question is out of academic interest. I know how to work around the limitation. I use this setup to control access from one subnet to the other on IP level which works great so I don't need any 'solution' or alternative setup - just as implied by the questions: no need for any guessing about my intentions :)
My LAN consists of two cascaded consumer routers with NAT enabled each. I set up a static route in router 1 (which is connected to the internet) so that packets from subnet 1 targeting the subnet of router 2's LAN will use the latter as a gateway. The routing seems to work so far. However when router 2 receives a packet for its LAN subnet on its WAN port it drops the packet immediately.
Is this because of the nature/specification of NAT so that the router won't accept any packets not addressed to its WAN IP? Do the NAT specs imply this?
Or does the firewall inside the router blocks everything which is not port-forwarded to a specific LAN IP?
Are consumer routers (also) designed to not route private IP addresses on their WAN port even if it has a private address assigned?
Any other mechanism involved?