Firewall – How to define static routes between two subnets in OpenWRT / LEDE

firewallopenwrtroutingsubnetwifi

Migrated question here according to this.
This is for hotel wireless coverage.

What I need is explained here for DD-WRT, but I am using OpenWRT and LEDE. I need to make routes (gateways) to between subnetworks, but I am stuck at this step. The OpenWRT guide says to do this: https://wiki.openwrt.org/doc/recipes/routedclient

After fixing the WAN address, a static route must be added to the Access Point with the following information:

IP address: 192.168.2.1 (IP address of our LAN interface)

Destination LAN NET (required in DD-WRT): 192.168.2.0 (our LAN interface subnet)

Netmask: 255.255.255.0 (Netmask of our LAN interface)

Gateway: 192.168.1.30 (IP address of our WAN interface)

It does not say how to do this. I know there are usually two ways: one temporary and one persistent. How can I achieve this? (I understand what needs to happen, I just don't know how to implement it) If anyone would like to know what I have tried, I'd be happy to add more info.

As an attempt, I tried adding a route to router 1 (/etc/config/network):

# Route to router 3 subnet
config route
  option interface lan
  # remote subnet that route is for (called destination on dd-wrt i think)
  option target     10.0.1.0
  # net mask of subnet on router 3)
  option netmask    255.255.255.0
  # ip address of next hop to destination subnet, router 3 wan
  option gateway    10.0.3.1

If that is correct, should I be able to ping 10.0.1.1 from router 3?

Typology

My network topology is very similar to this one except that I have 3 routers. I constructed my subnets with a logical, easy-to-remember scheme:

enter image description here

Private (one subnet per router; 10.0 for the private nets)

  1. 10.0.1.0/24 private subnetwork 1 with router at 10.0.1.1/24 (this is also an internet provider over pppeo)
  2. 10.0.2.0/24 private subnetwork 2 with router at 10.0.2.1/24 (routed client)
  3. 10.0.3.0/24 private subnetwork 3 with router at 10.0.3.1/24 (routed client)

Guest (one subnet per router; 10.1 for the guest nets)

  1. 10.1.1.0/24 guest subnetwork 1 with router at 10.1.1.1/24
  2. 10.1.2.0/24 guest subnetwork 2 with router at 10.1.2.1/24 (routed client)
  3. 10.1.3.0/24 guest subnetwork 3 with router at 10.1.3.1/24 (routed client)

All the routers are connected wireless over a backend wireless network just like in the diagram–each with a static ip address on their wan. In my case, the main network is 10.0.1.0/24 (which represents 192.168.1.0/24 in the diagram).

enter image description here

Notes

I want the routed way (as opposed to WDS or masquerading) for the flexibility of adding layers of security (e.g. join guest subnets across multiple access points, join private subnets across multiple access points, isolate guests from private network, provide everybody access to the internet). I just wish I log on to router 2 or 3 and run ping 10.0.1.1 and get an answer! I only get "pingto: sendto: Network is unreachable".

Using OpenWRT on a Icidu (rebranded TL-wr1043ND, hacked) and LEDE on a Linksys WRT1900WC.

Best Answer

The router on the 192.168.1.0/24 should have a route for 192.168.2.0.24 via 192.168.1.30. You could add this to individual devices on this network.

The wireless router should be routing all traffic to 192.168.1.0/24 to the router with the address 192.168.1.1. However it may be Masquerading (NATing) traffic. Disable masquerading for traffic to 192.168.1.1/24 if you want devices on 192.168.1.0/24 to be able to connect to devices on 192.168.2.0/24.

Add the route in the control panel of the router on 192.168.1.1, save and apply. This should make it persistent. Adding the route by executing a routing command will not be persistent. However, if you can add commands to run on reboot, that would also be persistent.

Related Topic