0

I have a DD-WRT router that is configured for two subnets on the LAN, 192.168.254.0/24 (MAIN) and 192.168.101.0/24 (LOCAL). The two subnets have DHCP servers provided by dnsmasq. The MAIN subnet has address 192.168.254.253 as the gateway, while the LOCAL subnet has 192.168.101.0.
One of the subnets is only connected to a VLAN (ath0.2), the other is the standard net and is connected to the regular WLAN, the wired LAN and to the WAN (using NAT) on br0. I want the MAIN subnet to communicate to the WAN and LOCAL, and the LOCAL subnet to communicate to MAIN only.
When connecting devices to each of the two networks via WLAN, they receive IP addresses from the respective correct ranges. I have devices connected to both subnets, and one PC in each. Unfortunately there is no TCPDUMP available in the DD-WRT BusyBox, so I can only use wireshark on the PCs in each subnet.
On the DD-WRT router's admin page, I can see all DHCP leases and see all devices on both subnets. Communication within each of the two subnets works fine (PING, HTTP).
The issue is the communcation between subnets. Iptables is set up to allow all traffic from MAIN to LOCAL and vice versa. I can ping from any device in MAIN to the PC in LOCAL and vice versa, but not to the other devices in LOCAL, even though they properly communicate locally. Communication from the PC in the LOCAL subnet works fine to all devices in the MAIN subnet

So the communication works like this:

  • PC in LOCAL -> any device in LOCAL YES
  • PC in LOCAL -> any device in MAIN YES
  • PC in LOCAL -> Internet NO (expected)
  • Any device in MAIN -> PC in LOCAL subnet YES
  • Any device in MAIN -> other device in LOCAL NO

When pinging from the MAIN network to the unreachable devices in LOCAL I get Reply from 192.168.254.253: Destination host unreachablefrom the MAIN gateway.
Runnning ip route get 192.168.101.XXX on the gateway to both the reachable and unreachable devices results in 192.168.101.XXX dev ath0.2 src 192.168.101.0
ARP on the gateway shows the PC as the only entry from LOCAL

How can some addresses in the LOCAL subnet be accessible and some not? If the other devices on LOCAL were not communicating because they were firewalled to only accept local traffic, wouldn't the PING time out instead of be unreachable?

Improve this question
1
  • If your network is 192.168.101.0/24, then your gateway cannot be 192.168.101.0... That is the network address. It can be any address from .1-.254 but not .0 or .255 so I would suspect your devices don't know now to handle this incorrect configuration.
    – acejavelin
    Aug 22, 2020 at 15:43

2 Answers 2

Reset to default
0

Found the problem. The other devices were too smart by half, and refused to accept the gateway address of 192.168.101.0. thus no responses were ever forwarded to the MAIN net.

Improve this answer
1
  • 1
    You have a 192.168.101.0/24 subnet mask and use a gateway address of 192.168.101.0 on the connected host machines? That seems a bit weird to me with that subnet mask. I've never done that before but I have left gateway undefined entirely before to do something similar.
    – Vomit IT - Chunky Mess Style
    Aug 22, 2020 at 14:18
0

You receive the information from your default gateway (192.168.254.253) that the targeted machine is unreachable. This is a perfectly normal behavior an can be indeed a result of your ICMP request being blocked on the target machine. Therefore no answer will be send back to the gateway and hence it replies back to you a Destination Unreachable. There is no timeout like you imagine in ICMP.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .