Only use one of those switch / AP devices as a router / DHCP server, and disable DHCP on the other one. Connect the DHCP disabled one to a normal network port (not the WAN port) of the "router" just like you would a normal computer.
Everything will be in the same subnet, and you will still have two wireless access points. One of them will connect to the modem, and one of them will connect to the one connected to the modem. A daisy chain, if you will. You will NOT be using the WAN port of the access point that you disabled DHCP on.
Your problem is caused by having two subnets that are both behind firewalls. This is totally unnecessary, and you only need one subnet. It's important that only one of those access points dole out addresses, and this configuration that I described would have the "router" (the one connected to the modem) doing that.