0

My Network...

       INTERNET
          ^
          |
.-------------------------.
|  Cable Router Gateway   |
|       4-ports+WiFi      |----  Wireless Devices
|   DHCP server 10.0.0.1  |
`-------------------------'
       |   |   |   |           .---------------------------------.
               |   `-----------| 10.0.0.9 - Linux Desktop HA01   |
               |               `---------------------------------'
.-------------------------.
|         10.0.0.4        |
|-------------------------|
|          Router         |
|       4-ports+WiFi      |---- Wireless Devices
| DHCP server 192.168.1.1 |
`-------------------------'
       |   |   |   |           .----------------------------------.
       |   |   |   `-----------| 192.168.1.3 - Linux Desktop LX00 |
       |   |   |               `----------------------------------'
       |   |   |               .----------------------------------.
       |   |   `---------------| 192.168.1._ - Linux Desktop .... |
       |   |                   `----------------------------------'
       |   |                   .----------------------------------.
       |   `-------------------| 192.168.1._ - Linux Desktop LX02 |
       |                       `----------------------------------'
       |                       .----------------------------------.
       `-----------------------| 192.168.1._ - Linux Desktop .... |
                               `----------------------------------'

(note -- The DHCP servers are enabled strictly for the wireless devices. All routers and desktops have static addresses.)

  • Works: ping from LX00 (and any other 'L...' host) to HA01
  • Works: ssh from LX00 (and any other 'L...' host) to HA01
  • Works: http from LX00 (and any other 'L...' host) to HA01
  • Fails: ping from HA01 to LX00 (or any other 'L...' host)
  • Fails: ssh from HA01 to LX00 (or any other 'L...' host)

The ISP (Comcast) doesn't seem to provide a way to add routes on the "Cable Router Gateway" (or at least I haven't found it). I have complete (root/admin) control over everything else though.

There are numerous questions on Stack Exchange that are almost this scenario but either not quite or have unusable solutions for my case.

I've been working on this for several days, trying numerous routes, and have run out of ideas, so...

The Question...

What routes must I add to which devices in order to be able to ping/ssh --from-- HA01 to LX00, etc., and subsequently make HA01 a Synergy client?

ADDITIONAL INFO

[user@LX00:~] ssh -vv homeassistant@HA01
    :
debug1: Authentication succeeded (publickey).
Authenticated to ha01 ([10.0.0.9]:22).
debug1: channel 0: new [client-session]
debug2: channel 0: send open
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: exec
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug1: Remote: /home/homeassistant/.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
debug1: Remote: /home/homeassistant/.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
debug2: channel_input_open_confirmation: channel 0: callback start
debug2: fd 3 setting TCP_NODELAY
debug2: client_session2_setup: id 0
debug2: channel 0: request pty-req confirm 1
debug2: channel 0: request shell confirm 1
debug2: channel_input_open_confirmation: channel 0: callback done
debug2: channel 0: open confirm rwindow 0 rmax 32768
debug2: channel_input_status_confirm: type 99 id 0
debug2: PTY allocation request accepted on channel 0
debug2: channel 0: rcvd adjust 2097152
debug2: channel_input_status_confirm: type 99 id 0
debug2: shell request accepted on channel 0

Router Hardware

Top(gateway) router:  Arris Group TG1682 (HW rev 11) from Comcast...
  eMTA & DOCSIS Software Version:  10.1.27B.SIP.PC20.CT
  Software Image Name:  TG1682_3.6p8s1_PROD_sey
  Advanced Services:  TG1682G
  Packet Cable:  2.0

Bottom(internal) router:  DLink-615 (HW rev E3)...
  Firmware version:  5.12
Improve this question
11
  • What routes must I add to which devices in order to be able to ping/ssh --from-- HA01 to LX00, etc., and subsequently make HA01 a Synergy client? None routes will help. You cannot access any LXnn from HAxx because LXnn are behind the NAT. And I doubt that this router can act in a regime when LAN is bridged to WAN whereas WiFi uses NAT.
    – Akina
    Dec 6 '19 at 5:41
  • I'd recommend to set your D-Link to bridge mode and disable its DHCP (all WiFi clients will obtain the address from TG1682, or set D-Link's DHCP to 10.0.0.0/xx without overlapping with TG1682 scope range and statically assigned addresses for routers and wired network nodes if D-Link can act by such way).
    – Akina
    Dec 6 '19 at 5:44
  • @Akina: Since the source is directly on the same subnet as the NAT gateway, that actually allows it to go inwards through the NAT. (Of course, it's very likely that router 2 has a built-in firewall rule blocking packets going from "WAN" to "LAN" – but that is not done by the NAT itself.)
    – user1686
    Dec 6 '19 at 6:25
  • @grawity I cannot find such possibility in DIR-615 user manual... of course it must be tested if the route to 192.168.1.0/24 via 10.0.0.x (DIR-615 WAN) on HA01 will help while set DIR-615 firewall rule to route from 10.0.0.2-10.x.x.x to 192.168.1.x directly, without NAT.
    – Akina
    Dec 6 '19 at 6:32
  • Wouldn't the solution be to just add forwarding rules on both routers for each LAN subnet, allowing forwarding to the other? i.e. HA01's router allows passing of forwarded traffic from LX00's router's LAN subnet and LX00's router allows passing of forwarded traffic from HA01's router's LAN subnet?
    – JW0914
    Dec 6 '19 at 8:16
2

What routes must I add to which devices in order to be able to ping/ssh --from-- HA01 to LX00, etc., and subsequently make HA01 a Synergy client?

Your "HA" side needs a route to the "LX" network. Since you cannot add routes to the gateway used by HA devices, you must add the exact same routes to each HA device directly. Yes, that means your iPhones and other 'embedded' devices are out of luck, but you can still make it work on full-featured Windows/Linux/macOS computers.

So, because your "HA01" host wants to reach the 192.168.1.x network, it needs a route like this:

  • destination 192.168.1.0 / 255.255.255.0 (to LX subnet)
  • gateway 10.0.0.2 (via HA-facing IP address of router 2)

Note: I had to guess all of the parameters (netmask and the 2nd router's "WAN" IP address), because you did not include them in your diagram. Each router has at least two addresses, one for each network it is in.

There is no need for a custom route from LX to HA – router 2 is directly attached to HA network so it already knows how to reach 10.0.0.x addresses.

Don't forget that the 2nd router's firewall will probably be blocking all incoming connections by default (as is standard for NAT-based "WAN/LAN" routers), so you'll need to add custom allow rules. From past experience with D-Link routers and their absolutely horrible firmware, I can't guarantee that it'll let you do that.

Improve this answer
5
  • I tried root@HA01:~# route add -net 192.168.1.0/24 gw 10.0.0.4 but got SIOCADDRT: Network is unreachable.
    – DocSalvager
    Dec 6 '19 at 15:13
  • What do you get from ip route add 192.168.1.0/24 via 10.0.0.4 instead? As well as ip route get 10.0.0.4. What netmask is this network using?
    – user1686
    Dec 6 '19 at 15:17
  • root@HA01:~# ip route add 192.168.1.0/24 via 10.0.0.4 results in RTNETLINK answers: Network is unreachable
    – DocSalvager
    Dec 6 '19 at 15:19
  • route -n returns only 1 route... `0.0.0.0 10.0.0.1 0.0.0.0 UG 0 0 0 eth1'
    – DocSalvager
    Dec 6 '19 at 15:20
  • Sorry @user1686. Misunderstood second question. ip route get 10.0.0.4 returns 10.0.0.4 dev eth1 src 10.0.0.9\n cache
    – DocSalvager
    Dec 23 '19 at 7:28
1

Possible scheme 

       INTERNET
          ^
          |
.-------------------------.
|  TG1682 Router Gateway  |
|         NAT mode        |
|       4-ports+WiFi      |----  Wireless Devices       dynamic IP from 10.0.0.10-254/32
|  inner IP 10.0.0.1/32   |
|  DHCP server 10.0.0.1   |
|   scope 10.0.0.10-254   |
|   both wired and WiFi   |
`-------------------------'
     |   |   |   |             .--------------------.
             |   `-------------| Linux Desktop HA01 |   static IP 10.0.0.3/32
             |                 `--------------------'
.-------------------------.
|     DIR-615 Router      |
|       bridge mode       |
|       4-ports+WiFi      |----  Wireless Devices       dynamic IP from 10.0.0.10-254/32
|  inner IP 10.0.0.2/32   |
`-------------------------'
     |   |   |   |            .--------------------.
     |   |   |   `------------| Linux Desktop LX00 |   10.0.0.4/32
     |   |   |                `--------------------'
     |   |   |                .--------------------.
     |   |   `----------------| Linux Desktop .... |   10.0.0.5/32
     |   |                    `--------------------'
     |   |                    .--------------------.
     |   `--------------------| Linux Desktop LX02 |   10.0.0.6/32
     |                        `--------------------'
     |                        .--------------------.
     `------------------------| Linux Desktop .... |   10.0.0.7/32
                              `--------------------'

Single subnet 10.0.0.0/32 is used, 10.0.0.1-9/32 for static IP addressing for wired nodes (1-2 for routers, 3-7 for PCs, 8-9 reserved for devices which may be attached to unused LAN ports on TG1682), 10.0.0.10-254/32 for DHCP (Wireless devices).

To avoid wireless devices to access wired devices and back (if needed) restrict traffic from 10.0.0.2-9/32 to 10.0.0.10-254/32 and back in firewall settings on both routers.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.