Unable to ping device on network

[Dixit]

I have two houses and we have them connected via a PTP (Mikrotik) wireless network. Here is a good idea of how the network looks like.

You can disregard some of the devices at the bottom, recently changed my APs to eero's (setup as bridge mode only). But gives you an idea of how its setup.

Issue I got is from the 2744 side (left side above) I cannot seem to ping a Windows10 box which has an IP of 192.168.0.10 (sitting on the 1750 side). Even on the 2nd Nic it has an IP of 192.168.0.87, still cant ping it. Devices on the 1750 side can ping that device no issue. Even turned off the firewall on the Windows10 box, still no go.

I had this firewall script put in awhile ago that helped fix this issue in the past, it was not allowing certain devices to flow through the firewall. So someone suggested putting this script in. Here is it (sitting on both sides):
#!/bin/sh
#
InsLoc1=`iptables -nvL FORWARD --lin | grep -i "INVALID" | tail -n 1 | awk '{ print $1 }'`
if [ "x$InsLoc1" == "x" ]
then
echo "Rule INVALID not found"
# Add rule to Drop unexpected traffic from Internet interface only
iptables -I FORWARD 1 -i eth0 -m state --state INVALID -j DROP
InsLoc1=1
else
echo "rule INVALID replaced at $InsLoc1"
# Replace rule with one changed to drop unexpected traffic from Internet interface only
iptables -D FORWARD $InsLoc1
iptables -I FORWARD $InsLoc1 -i eth0 -m state --state INVALID -j DROP
fi
#

Any idea on what is causing this? Trying to access files on that machine via UNC path like \\servername\share but it cant even ping it so that was step one to figure this out.

Dixit

 

[Dixit]

Okay I may have been mistaken, I turned off firewall on the Windows10 box again and this time I could ping and get to the file share. I cant seem to figure out what on the Windows10 box (what rule it is) that is preventing this even though its on the same routed network. Its definitely the private firewall affecting this, turning that off alone fixes it, the public one isn't preventing this. Guess I will analyze this a bit more to understand whats causing this.

Dixit

 

[Dixit]

I believe I have figured this out, after doing a lot of trial and error, turns out there is a specific "scope" setting under the following rule "File and Printer Sharing (Echo Request - ICMPv4-In)"

Here is what it was set to:

You can see bottom part shows local subnet, that's why it refused the 2744 side because its not part of the local subnet, I just moved that to the right subnet scope (or one can do any IP as well).

Now working on finally windows allowing \\servername\share, just need to find that rule now and make the same change.

So basically nothing to do with Asus Firewall at all.

Dixit

 

[Dixit]

And finally found the last one, it was the "File and Printer Sharing (SMB-In)" rule. Once I changed the scope of the IP range from local subnet to extend the range slightly, that fixed it. Guess Windows 2012, 2012R2, even Windows 2016 server didn't have this rigid of a firewall rule set. Interesting to see Windows10 Pro had this rigid of a firewall rule set by default, not a bad thing personally.

Dixit