SSH via WiFi blocked by firewall

Route command output in these cases plz . and dest ip that you ssh upon ? what was that

I do ssh from 192.168.2.148 to [carambola8_with_OpenWRT] (which is in the same subnet).

Route command output (dhcp config):

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.2.1     0.0.0.0         UG    0      0        0 wlan0
192.168.2.0     *               255.255.255.0   U     0      0        0 br-lan
192.168.2.0     *               255.255.255.0   U     0      0        0 wlan0

Route command output (static config):

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.2.1     0.0.0.0         UG    0      0        0 wlan0
192.168.0.0     *               255.255.252.0   U     0      0        0 br-lan
192.168.0.0     *               255.255.252.0   U     0      0        0 wlan0

On static config, I can (from my OpenWrt device) ping 8.8.8.8, no matter it is wifi or ethernet connection.
But working only on wifi, I can't ping devices from my local network 192.168.2.*
When I disable WiFi, ethernet connection works fine. I can ping 8.8.8.8 and devices from my local network 192.168.2.*

DHCP config works for all interfaces, static config works fine for eth interface, but on wifi connection I cannot ping devices from my local network.

Sorry for delay , in 30 mins I ll be home and solve your problems for sure

@pawel_ub . verify the diagram . i ll explain queries after dinner ( 15 mins )

When the Link is configured for DHCP ( either wired or wireless) configuration that link get is
192.168.2.x
255.255.255.0
192.168.2.1

on static implementation you are pushing manually below settings
192.168.2.x
255.255.252.0
192.168.2.1

there are multiple things to discuss , let me know when you can be here

Your picture shows a wired and wireless link between the 2 routers. Please verify these links do not connect the same networks on both devices, respectively.

No they are uplink , only one is active at a time either wired or wireless

there are multiple issues with this configuration according to me

hi @lleachii this topic of @pawel_ub is very nice and covering a lot of concepts that i think will be useful for this community.

As in this post, multiple config changes happened so its difficuilt to point out and discuss the impact

what do you guys suggest ? continue with this post or new one ?

If you are referring to the Original Poster's topic, then here.


But...If you're serious about other threads...I would suggest an announcement about a software that can manage routers of multiple software vendors:

https://forum.openwrt.org/c/community-builds-projects-packages

I think you didn't interpret that post correctly ,
Let me reframe that

Suppose you have 10 access points of different vendors and 5 Cisco , 3 ruckus ,2 unifi .
I just found a way in which an openwrt router will come in picture to manage all the clients accross diff vendor AP and under simple hotspot solution like coova chilli

That is a hotspot of hydrid hardware consisting of openwrt compatible as well as non compatible routers

This can merged into an ipk kind of package and a optional feature with toggle state

Hi @arjuniet
I've changed option netmask to 255.255.255.0 in my static config interface wlan as you pointed out.
After that change I can ping devices from my local network, while connected via wifi.
However option netmask in my static config interface lan is still 255.255.252.0, beacouse if I change it to 255.255.255.0, I cannot ping devices in my local network while connected via wifi.
There are any next steps, or this config is finally good?

While connect via wlan your lan Ethernet link must be idle or not connected ? Isn't ?

When wlan connection is active, ethernet is not connected.

so why are you bothered by this interface ??
when you are connected via wifi

(in dhcp mode )```
when connected via wlan how are you getting dhcp ip on lan ??

Lets clarify.
I would like to have 2 different configs, and they are not going to be used in the same time of course.
First one is with dhcp IP and that config works fine, no matter if it wifi or ethernet connection.
So lets leave dhcp config for a while.

Second config is with static IP.
I would like to have possibility to easily switch between ethernet and wifi connections without changing anything in config. Now it looks like this:
/etc/config/network

        option ifname           'lo'                 
        option proto            'static'             
        option ipaddr           '127.0.0.1'          
        option netmask          '255.0.0.0'          
                                                     
config globals 'globals'                             
        option ula_prefix       'fdd3:9a1a:c9d9::/48'
                                                     
config interface 'lan'                
        option  ifname          'eth0 eth1'
		option	type			'bridge'
        option  proto           'static'        
        option  ipaddr          '192.168.2.88'        
        option  netmask         '255.255.252.0'        
        option  gateway         '192.168.2.1'  
        list    dns             '192.168.2.1'  
        list    dns             '8.8.8.8'              
                                                       
config interface 'wlan'                            
        option  proto           'static'        
        option  ipaddr          '192.168.2.89'        
        option  netmask         '255.255.255.0'        
        option  gateway         '192.168.2.1'  
        list    dns             '192.168.2.1'  
        list    dns             '8.8.8.8'
                                      
config interface 'wan' 
        option  ifname           'eth1'     
        option  proto           'dhcp'
        option  ipv6            'auto'

It is working (no matter if wifi or ethernet connection), but look at the netmasks.
It makes sense to you?

@arjuniet
Did you see my latest reply?
Do you have any comment?
Later we can switch to my DHCP config variant to finally confirm its correctness.

During wifi link & your dhcp config to work properly table must be
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 192.168.2.1 0.0.0.0 UG 0 0 0 wlan0
192.168.2.0 * 255.255.255.0 U 0 0 0 br-lan < it shouldnt be here as
192.168.2.0 * 255.255.255.0 U 0 0 0 wlan0

During wifi link & your static config to work properly table must be
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 192.168.2.1 0.0.0.0 UG 0 0 0 wlan0
192.168.0.0 * 255.255.252.0 U 0 0 0 br-lan here also it shouldnt be here
192.168.0.0 * 255.255.252.0 U 0 0 0 wlan0

it is because the bridge is up all the way even when eth interfaces are down

when you change mask it worked
192.168.0.0 * 255.255.252.0 U 0 0 0 br-lan
192.168.0.0 * 255.255.255.0 U 0 0 0 wlan0 . < it is given priority as its prefix lenth is more its a preferred route

so during static dont configure same mast on both br-lan

let me know what all problems are left with your setup

default 192.168.2.1 0.0.0.0 UG 0 0 0 wlan0 or br-lan
192.168.0.0 * 255.255.255.0 U 0 0 0 wlan0 . or br-lan

For proper working this must be the routing table two routes\

i still doubt that this is not what you are exactly trying to achieve

do you want . HA or sumthing ?