Issue with Inter-VLAN Communication on ASUS RT-AX88U Pro

[copperhead]

I’m encountering an issue with inter-VLAN communication on my ASUS RT-AX88U Pro router. Here's the setup:

• Router's main IP: 192.168.1.1
• Target device: 192.168.2.45 (on Guest Network 1, configured via YazFi)
• Goal: I want to run a script on the router (192.168.1.1) that occasionally needs to send data to 192.168.2.45 on port 999.

Observations:

• Ping from 192.168.1.1 to 192.168.2.45 works fine.
• Ping from other devices on 192.168.1.0/24 (like 192.168.1.2) to 192.168.2.45 also works.
• However, a TCP connection attempt from 192.168.1.1 to 192.168.2.45:999 fails, whereas the same connection from 192.168.1.2 succeeds.
• A TCP connection attempt from 192.168.1.1 to any address on the other subnet fails.

Steps already taken:

1. Verified iptables rules on the router. No apparent DROP rules blocking the connection.
2. Verified that the Guest Network has internet access. YazFi is set for 1-way guest access with client isolation, and I’ve also tried with 2-way guest and no client isolation, but neither made a difference.

Given that the issue is specific to traffic originating from the router's IP (192.168.1.1), I’m suspecting it might be a routing or firewall rule that applies only to the router itself, however, iptables shows nothing relevant.

FTR, I do have Skynet and YazFi scripts installed but i didnt see anything relevant within their configuration which could be causing the above.

Any help would be appreciated!

 

[dave14305]

You also need to check ebtables.

ebtables -L
ebtables -t broute -L

 

[bennor]

@copperhead, if you haven't done so already, have you looked at using custom YazFi firewall rules to accomplish what you seek?

GitHub - jackyaz/YazFi: Feature expansion of guest WiFi networks on AsusWRT-Merlin, including SSID -> VPN, separate subnets per guest network, pinhole access to LAN resources (e.g. DNS) and more!

Feature expansion of guest WiFi networks on AsusWRT-Merlin, including SSID -> VPN, separate subnets per guest network, pinhole access to LAN resources (e.g. DNS) and more! - jackyaz/YazFi

github.com

And see my post at the following link, if you haven't done so already, about custom firewall rules scripting with YazFi to facilitate communication between main LAN clients and YazFi clients:
https://www.snbforums.com/threads/allowing-access-to-selected-network-devices.80405/#post-784521