If you've left both your routers routing, then that's behaving as we would expect. The firewall in the VR will be protecting devices connected to it from being probed by anything on the Internet.
The firewall in your ASUS will permit devices connected to the ASUS initiating sessions with devices connected to the VR. But session initiation "the other way around" will be blocked by the ASUS firewall unless you get into setting up a load of "port forward" rules.
You may have partitioned your LAN into two subnets - the tell tale will be that the IP addresses of devices attached to both will be in different ranges. For example, if both are running 192.168.X.Y address ranges, the "X" will be different - if everything has the same "X", then it's still functioning as a single subnet. Same deal if one or other is using a 172.[16-31].X.Y or a 10.A.B.C - that indicates they are different subnets and you've partitioned you LAN into two.
If so, and at risk of sounding like a stuck record, by splitting your LAN in two, I fear we're making this needlessly complicated for no good reason. It would be much simpler, both to set up and to use, if you have a single flat network all on the same subnet, which can be achieved by turning your ASUS into an AP/switch combo (or run it in "bridge mode" if it has one) and leave the VR to do everything else except Wi-Fi (if you don't want it.) If you want to use all the bells and whistles of your ASUS, then you need something upstream if it that either is, or functions as, a modem - and your VR is not it. We cannot turn a SOHO router into a modem just by "saying so" - it needs to have a "modem mode" and not all do.