In case anyone else is having the same problem, I’ll post my solution (more like a workaround) here.
It turns out that IP passthrough wasn’t enough. I also had to enable the option “DMZ host enabled” using the setting “Automatic” under the Security tab.
Once this was done, the ES450 seems to pass almost* all external traffic to the router behind it.
- Almost, as if I try to connect to the external IP address on the telnet port, the ES450 login prompt shows up. I found no way to disable this. I find this a very weird design choice for a device supposed to work as a transparent bridge.