Ip route helping

dax79 · April 11, 2026, 3:56pm

Hi, I have a fritz 7530 openwrt 24.10.5. I use it for:
-modem for ISP
-wi-fi access point
-dhcp server for subnet 192.168.1.0/24
I connect also a lan port to a mikrotik. On a mikrotik i have three subnet: 192.168.1.0/24 (fritz), 192.168.10.0/24, 192.168.20.0/24
It is possible to set a route on fritz for ping the different subnet when i'm connected to wifi (i get address class 192.168.1.0/24)?
From subnet .10 and .20 i can ping the subnet .1 (ip route on mikrotik)

cat /etc/config/firewall

config defaults
option syn_flood '1'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'

config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'

config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'

config forwarding
option src 'lan'
option dest 'wan'

config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'

cat /etc/config/dhcp

config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option localservice '1'
option ednspacket_max '1232'

config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'hybrid'
option ra 'hybrid'
list ra_flags 'managed-config'
list ra_flags 'other-config'

config dhcp 'wan'
option interface 'wan'
option ignore '1'

config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
option piofolder '/tmp/odhcpd-piofolder'

cat /etc/config/network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fdcf:f35b:f121::/48'
option packet_steering '1'

config atm-bridge 'atm'
option vpi '1'
option vci '32'
option encaps 'llc'
option payload 'bridged'
option nameprefix 'dsl'

config dsl 'dsl'
option annex 'j'
option tone 'b'
option ds_snr_offset '0'

config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option gateway '192.168.1.2'

config device
option name 'dsl0'
option macaddr '3C:A6:2F:xxxx'

config interface 'wan'
option device 'dsl0.835'
option proto 'pppoe'
option peerdns '0'
option username 'xxxx'
option password 'xxx'
option ipv6 '0'
list dns '208.67.222.222'

config rule

Thanks
Davide

psherman · April 11, 2026, 3:58pm

Is this device running OpenWrt or RouterOS?

dax79 · April 11, 2026, 5:09pm

RouterOS

Thanks

psherman · April 11, 2026, 5:14pm

Ok... so you'll need to figure out the routerOS side of things in order for this to work... what you need to do on that device is:

Disable masquerading on the upstream (wan?) connection
Allow the ingress from the upstream towards the two networks behind the 'Tik.

On the OpenWrt side...

The gateway line above should be removed. I'm guessing that the address on the uplink/wan of the 'Tik is 192.168.1.2... with that in mind, you'll create two routes on OpenWrt (and if the address of the 'Tik isn't .2, adjust accordingly):

192.168.10.0/24 via 192.168.1.2
192.168.20.0/24 via 192.168.1.2

That said, you can manage the primary routing for all 3 networks OpenWrt router instead -- you don't need to use the Mikrotik at all. Doing this all on the primary router is typically easier to manage and more efficient.

dax79 · April 12, 2026, 3:21pm

Thanks a lot, it works

config route
	option interface 'lan'
	option target '192.168.10.0/24'
	option gateway '192.168.1.2'

config route
	option interface 'lan'
	option target '192.168.20.0/24'
	option gateway '192.168.1.2'

Is it possible to consent the routing only for an ip address connected to wifi to subnet 192.168.1.0/24?

I mean the client with ip 192.168.1.15 can ping 192.168.10.1 and client with ip 192.168.1.14 cannot

_bernd · April 12, 2026, 3:28pm

You could do firewall rules based on src address but that's not an good idea
Best is to use proper subnet and firewall zone boundaries.
Second. Please do not block icmp. It's borderline stupidity that 30 year old fears still make their rounds and people blindly believe it. Yes in the 90ies it was an issue with some platforms but please show me a single attack based on icmp especially Echo reply.

dax79 · April 13, 2026, 9:16am

To be honest it’s not important and i’m not looking to do this. It’ s just for my knowledge.

If needed probably the best way it’ s to do it on mikrotik