Re: Routing through two DD-WRT's



aegres <aegres.30ioml@xxxxxxxxxxxxxxxxxxxxxxxx> hath wroth:

I am stuck and have been trying for a while. Perhaps I am missing
something simple.

That which is most obviously correct, beyond any need of checking, it
usually the problem.

I have 3 subnets (on 3 seperate sites 1km+ appart):

192.168.110.0/24
192.168.111.0/24
192.168.112.0/24

Why so complexicated? What are you trying to accomplish with this? If
these are 3 seperate customers that require isolation, you can
accomplish the same thing by simply putting everyone on the same Class
C subnet, and enabling "AP isolation" on the routers. AP Isolation is
a lousy term for blocking any wireless to wireless traffic. It's
kinda tricky to find the setting. See:
<http://www.informatione.gmxhome.de/DDWRT/Standard/V23final/Wireless_Advanced.html>
It's in the middle of the page. Note that this is sometimes refered
to as "client isolation" in the DD-WRT forums, which a more accurate
term.

They are connected by 4 DD-WRT v23SP2 on Linksys WRT54GL boxes.

Connected how? Wired or wireless?
Which one has the internet connection attached?

Two of the DD-WRT's are setup as routes and are located on the central
site .111. The wireless interfaces on these two talk to the other two
DD's that are accesspoints on the other two sites providing wireless
access to .110 and .112.

I can happily route packets from hosts on .111 to .110 and .112, but I
can't route packets from .110 to .112 and vice versa - which is what i
really want to achieve.

Make my life easy and kindly supply the routeing table.
Login with telnet and run:
route -e -n
on two connected routers. Once it's untangled on two routers, we can
talk about adding the others.

I have spent quite some time trying to analyse what is happening
(thinking the routing table may be incorrect). I have stripped all
rules from IP tables (ip_forwarding is on). I have added accounting
rules to the routers to see if packets are being forwarded.

Yech. IP table are for firewall rules, not for routing.

If you must route between subnets, use a static route to the remote
gateway (IP address of remote router). Something like this:
From the 192.168.110.1 router:
route add -net 192.168.111.0 netmask 255.255.255.0 gw 192.168.111.1
and on the other end:
route add -net 192.168.110.0 netmask 255.255.255.0 gw 192.168.110.1
However, these probably will not work because I have no clue where you
connect this pretzel to the internet. You will need to assign a
default gateway (default route) that points to the router that has the
internet connection.
route add default gw 192.168.110.1
or something like that.

Light reading:
<http://linux.about.com/od/commands/l/blcmdl8_route.htm>

The results:
if i try to ping a host on .110 from .112 the .111/.112 router's
accounting rules (iptables) counters increment but the .111/.110
router's accounting rules do not... I can ping the same .110 address
from the .111/.112 router though... so the route table on that router
seems to be correctly pointing at the .110 subnet. It just seems that
anything coming from the .112 doesn't come out the other side of the
router, even though the counters are incrementing in its iptables.

Is this a bug?

It's possible. However, I did have some problems with static routes
on DD-WRT v23 SP2. I went to v23 SP3 and they were fixed. I recently
moved most everything to v24 RC4 but have not retested (or had any
complaints).

Does it have something to do with the fact that one of
the interface is br0? I assume that br0 is a bridge interface to get
all four ethernet ports working - maybe the bridging module code doesn't
like this sort of stuff...

Bridging doesn't know anything about IP addresses or routing. I don't
wanna speculate, mostly because you've been tinkering with the
forwarding and IP tables.

Any thoughts or help would be greatly appreciated.

Put IP_tables back to where they belong. Concentrate on the routing
tables. Keep track of where you point your default gateways.

--
Jeff Liebermann jeffl@xxxxxxxxxx
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558
.



Relevant Pages

  • Re: Second ISP
    ... make sure that the second ISP router does not have a better default ... All of this can be done with show ip route ... Does this require a routing ... but I would recommend a routing protocol. ...
    (comp.dcom.sys.cisco)
  • Re: [Full-disclosure] Packet sniffing help needed
    ... > When you say manipulating the routing tables, ... their table, they would accept a 'more specific' 1.2.3.0/24 route, which ... now-failed router, thus making sure that outages stay limited - so that ... > for one of those machines then arp poison the router ...
    (Full-Disclosure)
  • Re: Routing Problem on OpenServer 5.0.6
    ... > I have one big problem with routing. ... > OSR506A route table: ... server to the network 129.12.130.0. ... router at 192.168.10.254 and need know nothing more about the route it takes. ...
    (comp.unix.sco.misc)
  • Re: Win2k3 LAN Routing Questions
    ... all you need to do is enable IP routing on the router. ... If there was no other network involved, you simply make the router the ... pretty straight forward as long as you can add a route to your NAT router. ... This is important because this router needs to know where your new subnet is ...
    (microsoft.public.windows.server.networking)
  • Re: Wireless Network in Public Places Options
    ... >>A WRT54G router with the correct route table does it quite well. ... >DHCP server on a wireless laptop that will deliver a creative IP ... client makes no difference at all, nor does the IP address used. ...
    (microsoft.public.win2000.networking)