Thanks Terk - that explains it. That probably also means that the NTP client I set up on the secondary router won't work either without port forwarding, right?
It would be a lot easier to set up the VPN/DDNS on the primary router, but the NVG589 is a lousy cable company router, and it won't...