Re: Routing through two DD-WRT's

aegres <aegres.30ioml@xxxxxxxxxxxxxxxxxxxxxxxx> hath wroth:

I am stuck and have been trying for a while. Perhaps I am missing
something simple.

That which is most obviously correct, beyond any need of checking, it
usually the problem.

I have 3 subnets (on 3 seperate sites 1km+ appart):

Why so complexicated? What are you trying to accomplish with this? If
these are 3 seperate customers that require isolation, you can
accomplish the same thing by simply putting everyone on the same Class
C subnet, and enabling "AP isolation" on the routers. AP Isolation is
a lousy term for blocking any wireless to wireless traffic. It's
kinda tricky to find the setting. See:
It's in the middle of the page. Note that this is sometimes refered
to as "client isolation" in the DD-WRT forums, which a more accurate

They are connected by 4 DD-WRT v23SP2 on Linksys WRT54GL boxes.

Connected how? Wired or wireless?
Which one has the internet connection attached?

Two of the DD-WRT's are setup as routes and are located on the central
site .111. The wireless interfaces on these two talk to the other two
DD's that are accesspoints on the other two sites providing wireless
access to .110 and .112.

I can happily route packets from hosts on .111 to .110 and .112, but I
can't route packets from .110 to .112 and vice versa - which is what i
really want to achieve.

Make my life easy and kindly supply the routeing table.
Login with telnet and run:
route -e -n
on two connected routers. Once it's untangled on two routers, we can
talk about adding the others.

I have spent quite some time trying to analyse what is happening
(thinking the routing table may be incorrect). I have stripped all
rules from IP tables (ip_forwarding is on). I have added accounting
rules to the routers to see if packets are being forwarded.

Yech. IP table are for firewall rules, not for routing.

If you must route between subnets, use a static route to the remote
gateway (IP address of remote router). Something like this:
From the router:
route add -net netmask gw
and on the other end:
route add -net netmask gw
However, these probably will not work because I have no clue where you
connect this pretzel to the internet. You will need to assign a
default gateway (default route) that points to the router that has the
internet connection.
route add default gw
or something like that.

Light reading:

The results:
if i try to ping a host on .110 from .112 the .111/.112 router's
accounting rules (iptables) counters increment but the .111/.110
router's accounting rules do not... I can ping the same .110 address
from the .111/.112 router though... so the route table on that router
seems to be correctly pointing at the .110 subnet. It just seems that
anything coming from the .112 doesn't come out the other side of the
router, even though the counters are incrementing in its iptables.

Is this a bug?

It's possible. However, I did have some problems with static routes
on DD-WRT v23 SP2. I went to v23 SP3 and they were fixed. I recently
moved most everything to v24 RC4 but have not retested (or had any

Does it have something to do with the fact that one of
the interface is br0? I assume that br0 is a bridge interface to get
all four ethernet ports working - maybe the bridging module code doesn't
like this sort of stuff...

Bridging doesn't know anything about IP addresses or routing. I don't
wanna speculate, mostly because you've been tinkering with the
forwarding and IP tables.

Any thoughts or help would be greatly appreciated.

Put IP_tables back to where they belong. Concentrate on the routing
tables. Keep track of where you point your default gateways.

Jeff Liebermann jeffl@xxxxxxxxxx
150 Felker St #D
Santa Cruz CA 95060
Skype: JeffLiebermann AE6KS 831-336-2558