Static Routes appear broken on 86U using 384.4_2

[jeff3820]

I've been struggling trying to setup a simple static route on the 86U running 384.4_2. What is bizarre is that static routing IS working on an older 68U. Merlin, is this part of the software the same for the two routers? I assume this is closed source??

Example configuration:

86U (192.168.1.1) trying to connect to the 68U (ip address of 192.168.2.1). The 68U is connected to the 86U LAN port and has been given an address of 192.168.1.240. Is not working at all. Static route is:
192.168.2.1 255.255.255.255 192.168.1.240 LAN
address mask gateway port

However, routes I setup on the 68U to connect back to the 192.168.1.x subnet work fine. It just the 86U static routes not working.

Can someone please verify?

Thanks

 

[ColinTaylor]

You don't need a static route from the 68U to the 86U.

Try setting the static route on the 86U as:

192.168.2.0 255.255.255.0 192.168.1.240 LAN

 

[jeff3820]

I tried your suggestion a while back, to allow access to the entire .2.x subnet but just for completeness I just tried it again. No go. Static routes on the 86U appear non-functional.

FYI, the static route on the 68U was to allow access to one specific device on the .1 subnet and it works fine.

 

[ColinTaylor]

I tried your suggestion a while back, to allow access to the entire .2.x subnet but just for completeness I just tried it again. No go. Static routes on the 86U appear non-functional.

FYI, the static route on the 68U was to allow access to one specific device on the .1 subnet and it works fine.

It shouldn't be necessary because the default route goes to the 192.168.1.x subnet (and everything beyond). So you're just duplicating part of the default route. Unless of course you have other routing going on like VPN's etc.

 

[jeff3820]

I'll try removing the static route on the 68U to verify. Regardless I do want to go from a computer on the 192.168.1.x subnet to 192.168.2.1 and this static route won't work on the 86U at all.

 

[jeff3820]

Well, you are correct...the static route on the 68U wasn't necessary. That probably means static routes aren't working in this codebase at all.

Can anyone verify??

 

[ColinTaylor]

After setting the static route on the 86U can you go to System Log > Routing Table and show us what it says.

 

[jeff3820]

Here are screenshots before and after:

 

[ColinTaylor]

OK the routing looks correct.

But Doh!.... You need to turn off the firewall on the 68U.

 

[jeff3820]

That makes sense. I'll check in a few hours...family is watching hockey and each change I make bombs folks off the WiFi.

 

[ColinTaylor]

Oh and try it with NAT disabled as well. In theory you shouldn't need it as the 68U is an entirely internal network.

 

[jeff3820]

Sure. The goal was to segregate my unsecure items (IOT/cameras, streaming boxes) from the computers in the network but this is going to fail as any "downstream" subnet can see devices in the upstream subnet. Looks like I need 2 completely separate subnets to do this right. Other ideas?

 

[ColinTaylor]

I think I remember someone else had the same arrangement and they used the Network Services Filter on the downstream router to block traffic that had a destination on the upstream subnet. Normal internet access still worked of course.

 

[jeff3820]

I'll play with the network services filter tomorrow and report back on the static route with the firewall off

 

[jeff3820]

Colin, you were right...turning off the firewall fixed the static route issue!! Thanks so much for the assistance.

On to the network services filter...

 

[ColinTaylor]

Thanks for confirming that. I'd be interested to know if you can disable NAT (WAN - Internet Connection) and it still work.

 

[jeff3820]

Yes, turning off NAT and the static route still works.

FYI, overall what I'm trying to do is still a kluge. What I really need is two separate subnets and I can't easily get this with the Asus routers unless I resort to scripting. Something like 1.x subnet on ports 1,2 and wireless and 2.x subnet on ports 3 and 4 with their own DHCP server.

 

[ColinTaylor]

Yes, turning off NAT and the static route still works.

Thanks for that. It's good to know that the theory matches reality.

FYI, overall what I'm trying to do is still a kluge. What I really need is two separate subnets and I can't easily get this with the Asus routers unless I resort to scripting. Something like 1.x subnet on ports 1,2 and wireless and 2.x subnet on ports 3 and 4 with their own DHCP server.

Yes that would require scripting. And whilst there are scripts available for the older routers I'm not sure there are any for the RT-AC86U yet.

 

[jeff3820]

That's OK...working my way thru the network services filter. Seems OK but I have to use CIDR notation. And I'm trying to leave one hole for my NAS. It's workable.

Can't thank you enough for the feedback!