Routing troubles

[Yusaku]

I have problem in router mode.

Desired final configuration:


Network_1 Network_2
[computer_1]--------------[asus]--------------------[computer_2]
eth0 ^ br0 (LAN) eth0
10.38.25.78/28 | 10.38.25.193/28 10.38.25.200/28
vlan1 (WAN)
10.38.25.77/28

Goal is to get from computer_1 to computer_2 and vice versa, i.e. normal static routing.

Hardware: 500gx, firmware 1.9.2.7-6b

In gateway mode with NAT enabled, with Network_2 configured to 192.168.1.X/24 (default after restoring factory defaults) I can ping computer_1 from computer_2.

Gateway mode with NAT, Network_2 configured as above, computer_2 sees WAN interface of router, but not computer_1

Router mode, Network_2 configured as above, computer_2 sees WAN interface of router, but not computer_1.

/proc/sys/net/ipv4/ip_forward is 1, router can ping all computers in all networks without problem... it just doesn't act as a router

I am quite sure it will be just a simple newbie problem - but I've spent some 6 hours on this already and still have no idea where is the problem.

BTW: Oleg, thanks for the ifconfig -a tip for vlans... Stupid newbies :D

[Oleg]

You have to adjust firewall rules to allow WAN to LAN traffic.

[Yusaku]

firewall (in webinterface) is turned off

[Yusaku]

I still seem to be missing something. I tried clearing iptables completely (iptables -F, iptables -X, iptables -F -t nat, iptables -X -t nat) both interactively and in post-firewall, but the box still refuses to route.

The weirdest thing is, that with the NAT up, pinging IP on WAN works. But after doing iptables -F -t nat, iptables-restore /tmp/nat-rules (i.e. returning to exactly the same configuration, right?), the pings no longer make it through.

[Oleg]

There should not be nat in the Router operation mode.

[Yusaku]

this was in a gateway mode (because NAT is the only thing working), just an attempt in despair :). Plus, I managed to get the pings through, so ignore that , please.

Anyway - in router mode, with iptables chains completely cleared (both filter and nat), the box still does not route.

When I take WAN port down (ifconfig vlan1 down), the pings from LAN report "destination network unreachable", otherwhise the usual "request timed out"; i.e. it seems it is partly working, but some firewall is still set up (how?)

Here are the steps I took so far:
1) reset asus to factory defaults
2) put to router mode, configure both WAN and LAN with static addresses
3) write in /usr/local/sbin/post-firewall :
#!/bin/sh
iptables -F
iptables -X
iptables -F -t nat
iptables -X -t nat

It seems I am still missing something. Everything seems to be configured correctly... it just doesn't route :confused:

[Oleg]

Havr you added a route on the computer #1 to reach computer #2?
You should use Router mode for sure.

[Yusaku]

Of course. I am pretty sure that it is working, because when I switch to NAT mode I can ping WAN from LAN (i.e. normal operation for most users). But router mode doesn't.

I tried connecting network_1 to vlan2 instead, but it is exactly the same situation - from asus everything works perfectly, but it doesn't route, same between vlan1 and vlan2

It just seems that the list of three things above is not enough. According to iptables config it seems to me that the wl500gx should route between two networks in router mode out-of-the-box with default config, but it does not for me

[Yusaku]

well... I installed OpenWRT and everything works out-of-the box as expected (i.e. it starts to route immediately after I clear iptables; I'll need to set those up later).

Oh well... I wanted the ease of use of custom firmware, but it seems I'll have to go the hard route.