Routing to another subnet

Question

My Network...

       INTERNET
          ^
          |
.-------------------------.
|  Cable Router Gateway   |
|       4-ports+WiFi      |----  Wireless Devices
|   DHCP server 10.0.0.1  |
`-------------------------'
       |   |   |   |           .---------------------------------.
               |   `-----------| 10.0.0.9 - Linux Desktop HA01   |
               |               `---------------------------------'
.-------------------------.
|         10.0.0.4        |
|-------------------------|
|          Router         |
|       4-ports+WiFi      |---- Wireless Devices
| DHCP server 192.168.1.1 |
`-------------------------'
       |   |   |   |           .----------------------------------.
       |   |   |   `-----------| 192.168.1.3 - Linux Desktop LX00 |
       |   |   |               `----------------------------------'
       |   |   |               .----------------------------------.
       |   |   `---------------| 192.168.1._ - Linux Desktop .... |
       |   |                   `----------------------------------'
       |   |                   .----------------------------------.
       |   `-------------------| 192.168.1._ - Linux Desktop LX02 |
       |                       `----------------------------------'
       |                       .----------------------------------.
       `-----------------------| 192.168.1._ - Linux Desktop .... |
                               `----------------------------------'

(note -- The DHCP servers are enabled strictly for the wireless devices. All routers and desktops have static addresses.)

• Works: ping from LX00 (and any other 'L...' host) to HA01
• Works: ssh from LX00 (and any other 'L...' host) to HA01
• Works: http from LX00 (and any other 'L...' host) to HA01
• Fails: ping from HA01 to LX00 (or any other 'L...' host)
• Fails: ssh from HA01 to LX00 (or any other 'L...' host)

The ISP (Comcast) doesn't seem to provide a way to add routes on the "Cable Router Gateway" (or at least I haven't found it). I have complete (root/admin) control over everything else though.

There are numerous questions on Stack Exchange that are almost this scenario but either not quite or have unusable solutions for my case.

I've been working on this for several days, trying numerous routes, and have run out of ideas, so...

The Question...

What routes must I add to which devices in order to be able to ping/ssh --from-- HA01 to LX00, etc., and subsequently make HA01 a Synergy client?

ADDITIONAL INFO

[user@LX00:~] ssh -vv homeassistant@HA01
    :
debug1: Authentication succeeded (publickey).
Authenticated to ha01 ([10.0.0.9]:22).
debug1: channel 0: new [client-session]
debug2: channel 0: send open
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: exec
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug1: Remote: /home/homeassistant/.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
debug1: Remote: /home/homeassistant/.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
debug2: channel_input_open_confirmation: channel 0: callback start
debug2: fd 3 setting TCP_NODELAY
debug2: client_session2_setup: id 0
debug2: channel 0: request pty-req confirm 1
debug2: channel 0: request shell confirm 1
debug2: channel_input_open_confirmation: channel 0: callback done
debug2: channel 0: open confirm rwindow 0 rmax 32768
debug2: channel_input_status_confirm: type 99 id 0
debug2: PTY allocation request accepted on channel 0
debug2: channel 0: rcvd adjust 2097152
debug2: channel_input_status_confirm: type 99 id 0
debug2: shell request accepted on channel 0

Router Hardware

Top(gateway) router:  Arris Group TG1682 (HW rev 11) from Comcast...
  eMTA & DOCSIS Software Version:  10.1.27B.SIP.PC20.CT
  Software Image Name:  TG1682_3.6p8s1_PROD_sey
  Advanced Services:  TG1682G
  Packet Cable:  2.0

Bottom(internal) router:  DLink-615 (HW rev E3)...
  Firmware version:  5.12

Answer 1

What routes must I add to which devices in order to be able to ping/ssh --from-- HA01 to LX00, etc., and subsequently make HA01 a Synergy client?

Your "HA" side needs a route to the "LX" network. Since you cannot add routes to the gateway used by HA devices, you must add the exact same routes to each HA device directly. Yes, that means your iPhones and other 'embedded' devices are out of luck, but you can still make it work on full-featured Windows/Linux/macOS computers.

So, because your "HA01" host wants to reach the 192.168.1.x network, it needs a route like this:

• destination 192.168.1.0 / 255.255.255.0 (to LX subnet)
• gateway 10.0.0.2 (via HA-facing IP address of router 2)

Note: I had to guess all of the parameters (netmask and the 2nd router's "WAN" IP address), because you did not include them in your diagram. Each router has at least two addresses, one for each network it is in.

There is no need for a custom route from LX to HA – router 2 is directly attached to HA network so it already knows how to reach 10.0.0.x addresses.

Don't forget that the 2nd router's firewall will probably be blocking all incoming connections by default (as is standard for NAT-based "WAN/LAN" routers), so you'll need to add custom allow rules. From past experience with D-Link routers and their absolutely horrible firmware, I can't guarantee that it'll let you do that.

Answer 2

Possible scheme

       INTERNET
          ^
          |
.-------------------------.
|  TG1682 Router Gateway  |
|         NAT mode        |
|       4-ports+WiFi      |----  Wireless Devices       dynamic IP from 10.0.0.10-254/32
|  inner IP 10.0.0.1/32   |
|  DHCP server 10.0.0.1   |
|   scope 10.0.0.10-254   |
|   both wired and WiFi   |
`-------------------------'
     |   |   |   |             .--------------------.
             |   `-------------| Linux Desktop HA01 |   static IP 10.0.0.3/32
             |                 `--------------------'
.-------------------------.
|     DIR-615 Router      |
|       bridge mode       |
|       4-ports+WiFi      |----  Wireless Devices       dynamic IP from 10.0.0.10-254/32
|  inner IP 10.0.0.2/32   |
`-------------------------'
     |   |   |   |            .--------------------.
     |   |   |   `------------| Linux Desktop LX00 |   10.0.0.4/32
     |   |   |                `--------------------'
     |   |   |                .--------------------.
     |   |   `----------------| Linux Desktop .... |   10.0.0.5/32
     |   |                    `--------------------'
     |   |                    .--------------------.
     |   `--------------------| Linux Desktop LX02 |   10.0.0.6/32
     |                        `--------------------'
     |                        .--------------------.
     `------------------------| Linux Desktop .... |   10.0.0.7/32
                              `--------------------'

Single subnet 10.0.0.0/32 is used, 10.0.0.1-9/32 for static IP addressing for wired nodes (1-2 for routers, 3-7 for PCs, 8-9 reserved for devices which may be attached to unused LAN ports on TG1682), 10.0.0.10-254/32 for DHCP (Wireless devices).

To avoid wireless devices to access wired devices and back (if needed) restrict traffic from 10.0.0.2-9/32 to 10.0.0.10-254/32 and back in firewall settings on both routers.