Routing traffic to internet from second network segment

Hi friends,
i'm not sure whether this is OpenWrt related question, maybe not, but hopefully someone skilled will help me.

I have an internet connection via Archer C7 router running stock firmware. I use a 192.168.0.x network here.
Then I connected to it via Wifi an older TP-Link WR2543 running openwrt.
This OpenWrt is running 192.168.1.x network.

After connecting these two routers, TP-link WR2543 OpenWrt's WWAN interface was assigned 192.168.0.138 IP address by Archer C7.
In order to reach 192.168.1.x segment from 192.168.0.x devices, I created new route rule on Archer C7 and I'm able to reach devices between both networking segments.

What is not working is the Internet connection from 192.168.1.x segment (whereas from 192.168.0.x via Archer C7 all is well).
Somehow I am thinking, that since the openwrt knows that it should forward 192.168.0.x requests via WWAN, it should also forward all other requests (apart from 192.168.1.x)? Maybe that's where I'm wrong?

I thought that having a WAN rule 0.0.0.0. on Archer C7 means, that it will route internet network requests from both network segments (192.168.0.x and 192.168.1.x), but it is working only for the segment provided by Archer C7.

Any1 has any idea what's wrong?

Thank you very much in advance.

Please, post your OpenWrt configs:

uci show network; uci show firewall; uci show dhcp

https://openwrt.org/docs/guide-quick-start/sshadministration

Here it is, please note, that I replace @ with # character, since the forum rules say, that new users cannot mention more than 2 users :slight_smile:

root#OpenWrt:~# uci show network; uci show firewall; uci show dhcp
network.loopback=interface
network.loopback.ifname='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='fd58:04d0:348b::/48'
network.lan=interface
network.lan.proto='static'
network.lan.ipaddr='192.168.1.1'
network.lan.netmask='255.255.255.0'
network.lan.ip6assign='60'
network.lan.ifname='eth0.1'
network.lan.type='bridge'
network.wan=interface
network.wan.ifname='eth0.2'
network.wan.proto='dhcp'
network.wan6=interface
network.wan6.ifname='eth0.2'
network.wan6.proto='dhcpv6'
network.#switch[0]=switch
network.#switch[0].name='switch0'
network.#switch[0].reset='1'
network.#switch[0].enable_vlan='1'
network.#switch_vlan[0]=switch_vlan
network.#switch_vlan[0].device='switch0'
network.#switch_vlan[0].vlan='1'
network.#switch_vlan[0].ports='1 2 3 4 9t'
network.#switch_vlan[1]=switch_vlan
network.#switch_vlan[1].device='switch0'
network.#switch_vlan[1].vlan='2'
network.#switch_vlan[1].ports='0 9t'
network.wwan=interface
network.wwan.proto='dhcp'
firewall.#defaults[0]=defaults
firewall.#defaults[0].syn_flood='1'
firewall.#defaults[0].input='ACCEPT'
firewall.#defaults[0].output='ACCEPT'
firewall.#defaults[0].forward='REJECT'
firewall.#zone[0]=zone
firewall.#zone[0].name='lan'
firewall.#zone[0].input='ACCEPT'
firewall.#zone[0].output='ACCEPT'
firewall.#zone[0].forward='ACCEPT'
firewall.#zone[0].network='lan'
firewall.#zone[1]=zone
firewall.#zone[1].name='wan'
firewall.#zone[1].output='ACCEPT'
firewall.#zone[1].mtu_fix='1'
firewall.#zone[1].input='ACCEPT'
firewall.#zone[1].forward='ACCEPT'
firewall.#zone[1].network='wan wan6 wwan'
firewall.#forwarding[0]=forwarding
firewall.#forwarding[0].src='lan'
firewall.#forwarding[0].dest='wan'
firewall.#rule[0]=rule
firewall.#rule[0].name='Allow-DHCP-Renew'
firewall.#rule[0].src='wan'
firewall.#rule[0].proto='udp'
firewall.#rule[0].dest_port='68'
firewall.#rule[0].target='ACCEPT'
firewall.#rule[0].family='ipv4'
firewall.#rule[1]=rule
firewall.#rule[1].name='Allow-Ping'
firewall.#rule[1].src='wan'
firewall.#rule[1].proto='icmp'
firewall.#rule[1].icmp_type='echo-request'
firewall.#rule[1].family='ipv4'
firewall.#rule[1].target='ACCEPT'
firewall.#rule[2]=rule
firewall.#rule[2].name='Allow-IGMP'
firewall.#rule[2].src='wan'
firewall.#rule[2].proto='igmp'
firewall.#rule[2].family='ipv4'
firewall.#rule[2].target='ACCEPT'
firewall.#rule[3]=rule
firewall.#rule[3].name='Allow-DHCPv6'
firewall.#rule[3].src='wan'
firewall.#rule[3].proto='udp'
firewall.#rule[3].src_ip='fc00::/6'
firewall.#rule[3].dest_ip='fc00::/6'
firewall.#rule[3].dest_port='546'
firewall.#rule[3].family='ipv6'
firewall.#rule[3].target='ACCEPT'
firewall.#rule[4]=rule
firewall.#rule[4].name='Allow-MLD'
firewall.#rule[4].src='wan'
firewall.#rule[4].proto='icmp'
firewall.#rule[4].src_ip='fe80::/10'
firewall.#rule[4].icmp_type='130/0' '131/0' '132/0' '143/0'
firewall.#rule[4].family='ipv6'
firewall.#rule[4].target='ACCEPT'
firewall.#rule[5]=rule
firewall.#rule[5].name='Allow-ICMPv6-Input'
firewall.#rule[5].src='wan'
firewall.#rule[5].proto='icmp'
firewall.#rule[5].icmp_type='echo-request' 'echo-reply' 'destination-unreachable                                                                     ' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type' 'router-so                                                                     licitation' 'neighbour-solicitation' 'router-advertisement' 'neighbour-advertise                                                                     ment'
firewall.#rule[5].limit='1000/sec'
firewall.#rule[5].family='ipv6'
firewall.#rule[5].target='ACCEPT'
firewall.#rule[6]=rule
firewall.#rule[6].name='Allow-ICMPv6-Forward'
firewall.#rule[6].src='wan'
firewall.#rule[6].dest='*'
firewall.#rule[6].proto='icmp'
firewall.#rule[6].icmp_type='echo-request' 'echo-reply' 'destination-unreachable                                                                     ' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type'
firewall.#rule[6].limit='1000/sec'
firewall.#rule[6].family='ipv6'
firewall.#rule[6].target='ACCEPT'
firewall.#rule[7]=rule
firewall.#rule[7].name='Allow-IPSec-ESP'
firewall.#rule[7].src='wan'
firewall.#rule[7].dest='lan'
firewall.#rule[7].proto='esp'
firewall.#rule[7].target='ACCEPT'
firewall.#rule[8]=rule
firewall.#rule[8].name='Allow-ISAKMP'
firewall.#rule[8].src='wan'
firewall.#rule[8].dest='lan'
firewall.#rule[8].dest_port='500'
firewall.#rule[8].proto='udp'
firewall.#rule[8].target='ACCEPT'
firewall.#include[0]=include
firewall.#include[0].path='/etc/firewall.user'
firewall.#forwarding[1]=forwarding
firewall.#forwarding[1].dest='lan'
firewall.#forwarding[1].src='wan'
dhcp.#dnsmasq[0]=dnsmasq
dhcp.#dnsmasq[0].domainneeded='1'
dhcp.#dnsmasq[0].localise_queries='1'
dhcp.#dnsmasq[0].rebind_protection='1'
dhcp.#dnsmasq[0].rebind_localhost='1'
dhcp.#dnsmasq[0].local='/lan/'
dhcp.#dnsmasq[0].domain='lan'
dhcp.#dnsmasq[0].expandhosts='1'
dhcp.#dnsmasq[0].authoritative='1'
dhcp.#dnsmasq[0].readethers='1'
dhcp.#dnsmasq[0].leasefile='/tmp/dhcp.leases'
dhcp.#dnsmasq[0].resolvfile='/tmp/resolv.conf.auto'
dhcp.#dnsmasq[0].localservice='1'
dhcp.lan=dhcp
dhcp.lan.interface='lan'
dhcp.lan.start='100'
dhcp.lan.leasetime='12h'
dhcp.lan.dhcpv6='server'
dhcp.lan.ra='server'
dhcp.lan.ra_management='1'
dhcp.lan.limit='250'
dhcp.wan=dhcp
dhcp.wan.interface='wan'
dhcp.wan.ignore='1'
dhcp.odhcpd=odhcpd
dhcp.odhcpd.maindhcp='0'
dhcp.odhcpd.leasefile='/tmp/hosts/odhcpd'
dhcp.odhcpd.leasetrigger='/usr/sbin/odhcpd-update'
dhcp.odhcpd.loglevel='4'
dhcp.#host[0]=host
dhcp.#host[0].mac='5A:58:8E:F5:46:BA'
dhcp.#host[0].name='KameraZahony'
dhcp.#host[0].dns='1'
dhcp.#host[0].ip='192.168.1.114'
dhcp.#host[1]=host
dhcp.#host[1].mac='CC:50:E3:56:F1:96'
dhcp.#host[1].name='Cerpadlo'
dhcp.#host[1].dns='1'
dhcp.#host[1].ip='192.168.1.50'
dhcp.#host[2]=host
dhcp.#host[2].mac='DC:4F:22:56:E2:E8'
dhcp.#host[2].name='ReleKvapka'
dhcp.#host[2].dns='1'
dhcp.#host[2].ip='192.168.1.55'
dhcp.#host[3]=host
dhcp.#host[3].mac='DC:4F:22:56:E2:E9'
dhcp.#host[3].name='ReleTravnik'
dhcp.#host[3].dns='1'
dhcp.#host[3].ip='192.168.1.54'
root#OpenWrt:~#

I was just connected with my smartphone to the openwrt (that 192.168.1.x segment) and noticed, that 192.168.0.x traffic is not being relayd to that Archer C7 network.. now I'm totally lost.

I tried to switch off and switch on wireless and tried to connect to openwrt, and sometimes, it relays traffic 192.168.0.x correctly, sometimes it doesn't, i'm getting very confused :confused:

Some routers do not permit LAN to WAN forwarding if the source does not match their local subnet.

You can enable selective masquerading to workaround the issue:

uci set firewall.zone[1].masq="1"
uci set firewall.zone[1].masq_dest="!192.168.0.0/23"
uci commit firewall
/etc/init.d/firewall restart

https://openwrt.org/docs/guide-user/firewall/firewall_configuration#zones

I made another test.
My main router's segment is 192.168.0.x (router is 192.168.0.1).
I connect to this network from OpenWRT via WWAN interface, it gets 192.168.0.4 address (outside of DHCP range).
I set this IP also as a static IP of the OpenWRT itself, also I disabled DHCP on OpenWRT in order to get DHCP from main 192.168.0.1 router.
THen I tried to connect laptop to LAN ports of OpenWRT - but sadly, no IP is given (so I'm not sure if DHCP requests from OpenWRT's network are passed into 192.168.0.1..
Moreove, If I set static ip to laptop 192.168.0.5 - i cannot even ping 192.168.0.4
But interestingly, from OpenWRT I'm able to ping anything in 192.168.0.1 router's segment..

This is how it looks:

root##OpenWrt:~# uci show network; uci show firewall; uci show dhcp
network.loopback=interface
network.loopback.ifname='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='fd58:04d0:348b::/48'
network.lan=interface
network.lan.proto='static'
network.lan.ip6assign='60'
network.lan.ifname='eth0.1'
network.lan.type='bridge'
network.lan.ipaddr='192.168.0.4'
network.lan.broadcast='192.168.0.255'
network.wan=interface
network.wan.ifname='eth0.2'
network.wan.proto='dhcp'
network.wan6=interface
network.wan6.ifname='eth0.2'
network.wan6.proto='dhcpv6'
network.##switch[0]=switch
network.##switch[0].name='switch0'
network.##switch[0].reset='1'
network.##switch[0].enable_vlan='1'
network.##switch_vlan[0]=switch_vlan
network.##switch_vlan[0].device='switch0'
network.##switch_vlan[0].vlan='1'
network.##switch_vlan[0].ports='1 2 3 4 9t'
network.##switch_vlan[1]=switch_vlan
network.##switch_vlan[1].device='switch0'
network.##switch_vlan[1].vlan='2'
network.##switch_vlan[1].ports='0 9t'
network.wwan=interface
network.wwan.proto='dhcp'
firewall.##defaults[0]=defaults
firewall.##defaults[0].syn_flood='1'
firewall.##defaults[0].input='ACCEPT'
firewall.##defaults[0].output='ACCEPT'
firewall.##defaults[0].forward='ACCEPT'
firewall.##zone[0]=zone
firewall.##zone[0].name='lan'
firewall.##zone[0].input='ACCEPT'
firewall.##zone[0].output='ACCEPT'
firewall.##zone[0].forward='ACCEPT'
firewall.##zone[0].network='lan'
firewall.##zone[1]=zone
firewall.##zone[1].name='wan'
firewall.##zone[1].output='ACCEPT'
firewall.##zone[1].mtu_fix='1'
firewall.##zone[1].input='ACCEPT'
firewall.##zone[1].forward='ACCEPT'
firewall.##zone[1].network='wan wan6 wwan'
firewall.##forwarding[0]=forwarding
firewall.##forwarding[0].src='lan'
firewall.##forwarding[0].dest='wan'
firewall.##rule[0]=rule
firewall.##rule[0].name='Allow-DHCP-Renew'
firewall.##rule[0].src='wan'
firewall.##rule[0].proto='udp'
firewall.##rule[0].dest_port='68'
firewall.##rule[0].target='ACCEPT'
firewall.##rule[0].family='ipv4'
firewall.##rule[1]=rule
firewall.##rule[1].name='Allow-Ping'
firewall.##rule[1].src='wan'
firewall.##rule[1].proto='icmp'
firewall.##rule[1].icmp_type='echo-request'
firewall.##rule[1].family='ipv4'
firewall.##rule[1].target='ACCEPT'
firewall.##rule[2]=rule
firewall.##rule[2].name='Allow-IGMP'
firewall.##rule[2].src='wan'
firewall.##rule[2].proto='igmp'
firewall.##rule[2].family='ipv4'
firewall.##rule[2].target='ACCEPT'
firewall.##rule[3]=rule
firewall.##rule[3].name='Allow-DHCPv6'
firewall.##rule[3].src='wan'
firewall.##rule[3].proto='udp'
firewall.##rule[3].src_ip='fc00::/6'
firewall.##rule[3].dest_ip='fc00::/6'
firewall.##rule[3].dest_port='546'
firewall.##rule[3].family='ipv6'
firewall.##rule[3].target='ACCEPT'
firewall.##rule[4]=rule
firewall.##rule[4].name='Allow-MLD'
firewall.##rule[4].src='wan'
firewall.##rule[4].proto='icmp'
firewall.##rule[4].src_ip='fe80::/10'
firewall.##rule[4].icmp_type='130/0' '131/0' '132/0' '143/0'
firewall.##rule[4].family='ipv6'
firewall.##rule[4].target='ACCEPT'
firewall.##rule[5]=rule
firewall.##rule[5].name='Allow-ICMPv6-Input'
firewall.##rule[5].src='wan'
firewall.##rule[5].proto='icmp'
firewall.##rule[5].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type' 'router-solicitation' 'neighbour-solicitation' 'router-advertisement' 'neighbour-advertisement'
firewall.##rule[5].limit='1000/sec'
firewall.##rule[5].family='ipv6'
firewall.##rule[5].target='ACCEPT'
firewall.##rule[6]=rule
firewall.##rule[6].name='Allow-ICMPv6-Forward'
firewall.##rule[6].src='wan'
firewall.##rule[6].dest='*'
firewall.##rule[6].proto='icmp'
firewall.##rule[6].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type'
firewall.##rule[6].limit='1000/sec'
firewall.##rule[6].family='ipv6'
firewall.##rule[6].target='ACCEPT'
firewall.##rule[7]=rule
firewall.##rule[7].name='Allow-IPSec-ESP'
firewall.##rule[7].src='wan'
firewall.##rule[7].dest='lan'
firewall.##rule[7].proto='esp'
firewall.##rule[7].target='ACCEPT'
firewall.##rule[8]=rule
firewall.##rule[8].name='Allow-ISAKMP'
firewall.##rule[8].src='wan'
firewall.##rule[8].dest='lan'
firewall.##rule[8].dest_port='500'
firewall.##rule[8].proto='udp'
firewall.##rule[8].target='ACCEPT'
firewall.##include[0]=include
firewall.##include[0].path='/etc/firewall.user'
firewall.##forwarding[1]=forwarding
firewall.##forwarding[1].dest='lan'
firewall.##forwarding[1].src='wan'
dhcp.##dnsmasq[0]=dnsmasq
dhcp.##dnsmasq[0].domainneeded='1'
dhcp.##dnsmasq[0].localise_queries='1'
dhcp.##dnsmasq[0].rebind_protection='1'
dhcp.##dnsmasq[0].rebind_localhost='1'
dhcp.##dnsmasq[0].local='/lan/'
dhcp.##dnsmasq[0].domain='lan'
dhcp.##dnsmasq[0].expandhosts='1'
dhcp.##dnsmasq[0].readethers='1'
dhcp.##dnsmasq[0].leasefile='/tmp/dhcp.leases'
dhcp.##dnsmasq[0].resolvfile='/tmp/resolv.conf.auto'
dhcp.##dnsmasq[0].localservice='1'
dhcp.lan=dhcp
dhcp.lan.interface='lan'
dhcp.lan.ignore='1'
dhcp.wan=dhcp
dhcp.wan.interface='wan'
dhcp.wan.ignore='1'
dhcp.odhcpd=odhcpd
dhcp.odhcpd.maindhcp='0'
dhcp.odhcpd.leasefile='/tmp/hosts/odhcpd'
dhcp.odhcpd.leasetrigger='/usr/sbin/odhcpd-update'
dhcp.odhcpd.loglevel='4'

Basically, what I'm trying to accomplish is, that OpenWRT router becomes switch, that is connected to main network via WWAN.

One of these should help: