I have a DD-WRT router that is configured for two subnets on the LAN, 192.168.254.0/24 (MAIN) and 192.168.101.0/24 (LOCAL). The two subnets have DHCP servers provided by dnsmasq. The MAIN subnet has address 192.168.254.253 as the gateway, while the LOCAL subnet has 192.168.101.0.
One of the subnets is only connected to a VLAN (ath0.2), the other is the standard net and is connected to the regular WLAN, the wired LAN and to the WAN (using NAT) on br0. I want the MAIN subnet to communicate to the WAN and LOCAL, and the LOCAL subnet to communicate to MAIN only.
When connecting devices to each of the two networks via WLAN, they receive IP addresses from the respective correct ranges. I have devices connected to both subnets, and one PC in each. Unfortunately there is no TCPDUMP available in the DD-WRT BusyBox, so I can only use wireshark on the PCs in each subnet.
On the DD-WRT router's admin page, I can see all DHCP leases and see all devices on both subnets. Communication within each of the two subnets works fine (PING, HTTP).
The issue is the communcation between subnets. Iptables is set up to allow all traffic from MAIN to LOCAL and vice versa. I can ping from any device in MAIN to the PC in LOCAL and vice versa, but not to the other devices in LOCAL, even though they properly communicate locally. Communication from the PC in the LOCAL subnet works fine to all devices in the MAIN subnet
So the communication works like this:
- PC in LOCAL -> any device in LOCAL YES
- PC in LOCAL -> any device in MAIN YES
- PC in LOCAL -> Internet NO (expected)
- Any device in MAIN -> PC in LOCAL subnet YES
- Any device in MAIN -> other device in LOCAL NO
When pinging from the MAIN network to the unreachable devices in LOCAL I get
Reply from 192.168.254.253: Destination host unreachablefrom the MAIN gateway.
ip route get 192.168.101.XXX on the gateway to both the reachable and unreachable devices results in
192.168.101.XXX dev ath0.2 src 192.168.101.0
ARP on the gateway shows the PC as the only entry from LOCAL
How can some addresses in the LOCAL subnet be accessible and some not? If the other devices on LOCAL were not communicating because they were firewalled to only accept local traffic, wouldn't the PING time out instead of be unreachable?