OK. With the TV decoder connected to the ISP router, you would not want to change that to bridge mode anyway so ideally, this router should be providing routing services and DHCP services to the rest of your network. I am slightly concerned with the presence of the two devolo devices on the ISP router connected devices list - presumably ethernet over power devices. Are these two devices just used to connect the TV decoder to the ISP router? If so, then that is OK and they will not be interfering with Roon operation. If, however, they are used to connect any equipment involved with Roon, then there could be an issue because that equipment will be on a different subnet to the one that the Roon is part of.
Preferred solution - eliminate double NAT on the local network
Does the Tp-Link Deco router have the option to put it in bridge (or access point) mode? If you can do this, this will disable routing and DHCP on this router and thus elliminate any double NAT that is occuring on your local network. In order to do this, you may need to change the connection from the ISP router to the Deco to use a LAN port on the Deco (presumably it is currently connected to the WAN port).
Once this is done, all of the devices in the network should have an ip address in the range 192.168.1.2 to 192.68.1.254 (you may need to reboot or otherwise force them to pick up a new ip address).
At this point, you will have uPnP and a manual port forwarding rule oitn the ISP router. As it stands, the port forwarding rule will be wrong because it will forward to 192.168.1.19 (which may or may not be associated with some device on the network now). This rule needs to be modified to forward directly to the Roon Server. Alternatively, you can remove the manual port forwarding rule and use uPnP to set it up.
You probably don’t want both uPnP enabled and a manual port forwarding rule. If you use the manual port forwarding on the ISP router, then you should probably disable uPnP. If you want to use uPnP, you should probably remove the manual port forwarding rule.
Alternate solutuion - double port forwarding to match double NAT
This is the solution that you appear to be half way towards achieving. It involves setting up a port forwarding solution on both routers.
-
On the ISP router, you will need to forward connections on port 55002 to the Deco Router - You appear to already have this port forwarding rule in place.
-
On the TpLink Deco, you will need to setup a port forwarding rule to for connections on port 55002 to your roon server (192.168.68.52). You might be able to do this by enabling uPnP on the TpLink Deco - or you may have to resort to another manual port forwarding rule.
The basic principle of all of this is that you want to forward connection attempts made to the WAN side of the ISP router to the Roon Server. With your current setup, the ISP router only knows about the TpLink Deco - so it must forward to this device. This TpLink Deco must then forward to the Roon Server.