How to properly configure subnet static routing and nat offload / avoid double nat for wireless client


I have the following setup:

Goal: define static route to subnet, offload nat to/from clients in on LEDE router to dir636l gateway router.

What I managed to achieve:

  • Client can access internet.
  • Client can access but none of the other hosts on
  • Lede router on can ping client on

What I did:

  • On dir636l I created static route as follows:
# ip route
XXX via XXX dev eth2.2
XXX via XXX dev eth2.2 via dev br0  metric 1 dev br0  src
XXX/22 dev eth2.2  src XXX
default via XXX dev eth2.2
  • On dir636l I added a rule in nat table for for nat:

iptables -t nat -A POSTROUTING -j MASQ_POST -s

  • On lede router I have following lan and wan config:
config interface 'lan'
        option type 'bridge'
        option ifname 'eth1.1 eth0.1'
        option proto 'static'
        option ipaddr ''
        option gateway ''
        option dns ''
        option netmask ''
        option ip6assign '60'

config interface 'wan'
        option proto 'static'
        option ipaddr ''
        option netmask ''
        option gateway ''
  • On lede router I changed the following firewall rules (the 5ghz wlan interface is bridged to wan)
config zone
        option name             wan
        list   network          'wan'
        list   network          'wan6'
        option input            ACCEPT
        option output           ACCEPT
        option forward          ACCEPT
        option masq             0
        option mtu_fix          1
  • I can confirm that NAT is done on dir636l by looking at /proc/net/nf_conntrack:
    On lede router

ipv4 2 icmp 1 29 src= dst= type=8 code=0 id=1 packets=65 bytes=3900 src= dst= type=0 code=0 id=1 packets=65 bytes=3900 mark=0 zone=0 use=2

On dir636l

ipv4 2 icmp 1 29 src= dst= type=8 code=0 id=1 src= dst=my.public.ip type=0 code=0 id=1 mark=0 use=2

Again my issue right now is

  • cannot see other hosts on except the gateway router

I hope this also serves as a reference for people looking to do subnet static routing and NAT offload.

Thanks for your help!

I managed to get (gateway router) to ping directly by adding this in lede router firewall:

config forwarding
        option src              wan
        option dest             lan

Still, still cannot access other hosts on

Update: can ping, however still cannot ping
Checked forward table, nothing is getting dropped/reject.

Another update:

On the wireless AP, I added the following static route:

ip route add via

Now can ping and access directly. What is wrong with my setup? It seemed like when sees a packet from to itself, it accepts the packet but have no gateway information about how to send the packet back to Instead of sending it to for routing it just dropped/ignored the packet?

Without the static route on the AP the routing is asymmetric if LEDE sends packets directly to the AP but the reverse path is via 192.168 1.1. Asymmetric routing and stateful firewalls are not a good match. The result may be dropped packets. It's often better to connect a LAN to one router only and use another network for connections between routers. By not having a direct connection between LEDE and the AP you force all traffic between them to pass 192.168 1.1 and the results is symmetric routing.

1 Like

I guess I should look into some dynamic routing protocol. Any recommendations on which routing protocol may be suitable for this task to get me started?


I use babel since it supports source specific routing which is necessary when you use multiple IPv6 WAN at home. (Multiple Hurricane Electric tunnels in my case.) I have also used OSPF/OSPFv3 which are good alternatives if you don't use IPv6 or don't need source specific routing. They are more widely supported on other platforms than babel.