Accessing secondary wireless router from primary network

Question

I have two wireless routers at home, and I'm but I'm not sure what I'm doing wrong.

The first router, a D-Link DSL-6850U, is also a DSL modem, and functions as my main internet connection, for both wired and wireless clients. It's set to 192.168.0.1, and dispenses DHCP addresses between 192.168.0.2 and 192.168.0.254, with a subnet mask of 255.255.255.0. It works fine.

The second router, a TP-Link C7 Archer, has OpenWRT and OpenVPN installed on it, and creates a secondary wireless network that's connectd to the VPN. It's connected via an ethernet cable from its own Uplink/Internet port, to one of the 4 regular LAN ports on the first router. It's statically set to 192.168.1.1, has its own DHCP server in the 192.168.1.X subnet, and clients on that network also work fine, both when the VPN is up and without it, both wired and wireless.

Now, my main desktop computer is usually connected to the first router (with IP, let's say, 192.168.0.4), but I want to use it to configure the second router, so I try to access 192.168.1.1 - but I can't. No route comes through.

Running traceroute from 192.168.0.4 to 192.168.1.1, I can see that the first router is trying to route that traffic out to the internet, rather than to the second router. I don't know how to get the first router to route traffic to 192.168.1.1 (or anything in that subnet, but I only care about the router itself) via the second router.

I tried setting the first router's subnet mask to B class (255.255.0.0), but that simply meant my client tried to access 192.168.1.1 directly, which failed. I tried adding a static route to 192.168.1.1 via the LAN interface, but that also didn't quite do what I wanted - it won't let me set 192.168.1.1 as the gateway, and if I set 192.168.0.1 as the gateway, it can't reach the host:

So, is there anything I can do to allow clients in the 192.168.0.x subnet to access the router in 192.168.1.1? Is there some setting on the second router I have to set?

Solution

Static route is the main method, but you're not getting the right parameters.

• A route tells the first router that a certain subnet is reachable through the 2nd router – which means the "gateway" must be the 2nd router's IP address from the 1st router's perspective.

  So in your situation, "Gateway IP" must be 192.168.0.x address belonging to the Archer's "WAN" interface, since that's the one directly attached to D-Link.

• As for the "Destination" address, 192.168.1.1/32 isn't wrong, but it is also not very useful: it only lets you reach the 2nd router itself, but not the remainder of the 192.168.1.x subnet.

  In most cases, you would want 192.168.1.0/24 as the destination instead.

---

(Why were your attempted gateways wrong? Well, 192.168.0.1 won't work because that's the first router itself, and telling it to route something through itself would just create a tight loop.

And the 1st attempt, 192.168.1.1, won't work because the D-Link doesn't know where that address is yet – after all, you're just adding a route to it right now; it's a catch-22.)

---

Finally, even after configuring the right routes, remember to check the Archer's firewall – very likely it will be blocking inbound connections by default.

Comments

[Admin]

"So, is there anything I can do to allow clients in the 192.168.0.x subnet to access the router in 192.168.1.1? Is there some setting on the second router I have to set?" - You would have to connect your PC to the router in order to access 192.168.0.1

[Avner Shahar-Kashtan]

A-ha! Indeed, with your explanation, I could find, in the Archer's admin interface, that its WAN interface has the address 192.168.0.2 defined. I set a static route to 192.168.1.1 via 192.168.0.2, and it worked. Now I just have to get the ssh port opened, as you said, but I'm over the routing stage, at least. Thanks!

[user1686]

With routing set up, you should not need any NAT or port-forwarding between outer and inner LANs. At most, you should need to open up the Archer's firewall.

[Avner Shahar-Kashtan]

Yeah, that's what I meant by opening the port. I'm pretty sure the Archer currently blocks all incoming traffic from the WAN interface.