I'm attempting to wirelessly connect my neighbor's home network with mine. We each have our own internet services and subnets which we want to preserve, but still be able to access services between our subnets. To that end, I purchased two Ubiquiti NanoStation loco M2s and set them up in a test configuration as outlined in the diagram:

network diagram

I have one M2 connected to a LAN port on my ASUS wireless router. The M2 has Wireless Mode configured as "Access Point" and Network Mode configured as "Router". The lan0 interface has assigned (gateway, dns and wlan0 is assigned It has a static route, via From this point, I can successfully ping two existing hosts on my network, and

The other M2, connected to the network, has Wireless Mode configured as "Station" and Network Mode also configured as "Router". The lan0 interface has assigned (gateway, dns and wlan0 has This M2 has a static route, via

The ASUS router at is handing out DHCP and has a static route, via

The laptop in the diagram is assigned a static address of During testing, it was connected directly to the "far-side" M2. I could ping,, and immediately.

This is where it starts to get strange.

When attempting to SSH from to, the command would drag on forever, but I was eventually able to connect. I ran the command with verbose output and found that an error was occurring with GSSAPI authentication due to reverse DNS lookup failure. I added to the list of DNS resolvers on the laptop, which fixed this issue and allowed me to connect immediately.

However, I was unable to SSH to at all. I can ping it from the laptop, but unless I manually add a static route on the 5.10 host for via, it won't connect. The odd thing is that the host at does not need this static route; it connects regardless. The laptop at doesn't have any static routes and there is no change if a static route is added.

I can ping the laptop from, however the ping output includes ICMP redirects.

  1. How can it be that can be accessed without a static route, but cannot be?

  2. Shouldn't the above access be covered by the static route entry at

  3. Is there any missing configuration or incorrect configuration? I was researching DHCP options 141 and 249, would that be the correct approach to fix this issue?

  • Can you run this on 2.3: ip route get I think your config sounds correct, so I am wondering if it is a cached route. – Paul Jul 26 '16 at 3:56
  • Would you check the firewall settings on Also, please do a traceroute from to and to check if there is any difference. – Simon MC. Cheng Jul 26 '16 at 6:31
  • Did you setup the bridge like this? community.ubnt.com/t5/NanoStation-and-Loco-Devices/… – Vojtěch Dohnal Jul 26 '16 at 9:11
  • In your diagram and question you have omitted, what is IP settings on computers. – Vojtěch Dohnal Jul 26 '16 at 9:20

This sounds like a problem with reverse path filtering. Edit (as sudo) the file /etc/sysctl.conf on the Debian machine, make sure to have the two lines as follows:


save, reboot the machine, see whether you still have the problems in question. If not, then the easiest way to solve would be to add the following rule to the Asus firewall,

iptables -o ethN -j MASQUERADE

where ethN is the name of the interface to which your Centos and Debian machines are connected. This would have the advantage of saving you a configuration on each pc, but I am afraid you have the proprietary firmware on the Asus, nothing like dd-wrt, openwrt, tomato, and so on, am I right? In this case you will have to study the FM to see whether anything to this effect exists at all. Or you may check whether the Ubiquities can do that (are they running EdgeOS? If so, then you can certainly enforce the rule above).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.