Static Route not working

My network got 4 vlans (all untagged) , and a wan.
I am using ..

Now in the Vlan / Sub-Network, there is a (3d party)router as client with ip .
This router is the only one that can reach a specific "hidden" internet network with specific services, in the range (and

I thougt this is an easy task.
I added a static route on that interface vlan ( to the target network with that router as gateway.
Unfortunatly, completly unsuccessfull. It looks like openWRT ignores that route .. and tries to go over the standard gateway, and fails - and i have no idea why. I did reboot .. often.
I turned the firwall off ( allowed all zones to connect everywhere, all protocols ) to be sure that this is not the reason for failure.
Please see the screenshot with all configuration info and the unsuccessfull tracert.

If I configure the same route on one windows client (on machin directly on the client .. it works.
I have no idea left, seems i am to dumb, many many thx 4 helping out in advance

working windows client (add route .. dirctly on client)


As in your screenshot with tracert
no, it does NOT go to standard gateway
it is only step1 and step2 in tracert
so, i suppose that your primary router try to forward traffic to (unknown router) and there is some kind of block/firewall on this unknown router
it is unknown how this second (unknown) router is attached to OWRT ?

1 Like

Just a thought does perform nat so that the main router knows how to return to this router?

thx 4 analyzing.
the router is on
the ip was set static in the router. no dhcp.
its connect over a switch with the openWRT device. openwrt device has the ip and acts as dhcp etc , serves well for all machines in the network

id did not add the static ip into the 3rd party router, a technician did it.

it seems that the 3rd-party router works.. see the screenshot from teh windows machine where i added the route manually on the machine.

yes, it is a valid question, but we have no info about this second router, so i was saving my ideas for later :smiley:

hmm. yes i am sure the 3rd party router does NAT. if you look at the last screenshot where the windows machines is successfull, you see the 3rd party router translating the 84.. IP address into a 10.. adress

the question is:
how the second router is attached? with WAN port ?
if so (logical) then there must be some kind of firewall on this R#2 which prevent connection flowing from WAN to LAN/VPN/whatever

1 Like

ok. lets try to answer it this way.
the windows machine that is successfull is in the network connected through the same switch with the openwrt device ( as the 3rd party router (

I opened a putty on openwrt device, pinged that 3rd party router. see screenshot pls

I did read your question again.
I must confess I cant tell you if the connection between openwrt and that 3rd party router is over WAN port or LAN port. but it seems clear that the 3rp party router does some NAT, as seen on the screenshot from the successfull windows machine.

I would like to add one more info, that might help.

If I ping the 3rdparty router ( from a machine from the Network, it does not answer. If I ping another windows machine in the network, ping works.
Somehow the 3rd party router sees to be picky. It (maybe) only answers to packets that originate from "his" network (

The failing tracert .. originates from a machine in network. it sends packets to the openwrt device that should route the packets to the 3rd party router is it possible that the problem originates here? that the 3rd party router does for some reason not accept the routed packets from openwrt device (

Ok, you don't provide answers ... how we can help you ?

almost every firewall allow ping on WAN side
almost every firewall block tracert
every firewall block WAN -> LAN flow with new connections incoming from WAN side

so, until you provide answers on questions ...

1 Like

I really appreciate your analyses and questions and hints.
As I can not access the 3rd party router currently, lets assume you are right, we are connected to the WAN Port.

The question remains .. why does the tracert of the windows machine (that has a static route configured), being on the same switch as the openwrt device (and therefore also going through the wan port with its tracert) get through , and the openwrtdevice that acts as router does not get through, trying to route packets of another windows machine (without static route configured on that machine directly) in the Network?

I will draw the situation to make things clearer.

thx again for helping me out

here is a drawing of the situation:

  • Allow forwarding on LAN Zone
  • If doesn't work, provide information requested by NPeca75



BTW, you can define this as one range -


The Forwarding did the job.

I would be greatfull if somebody who understands could explain why this setting is necessary / why it does work with forwarding enabled.

many thx !!!

1 Like

Sure - simple:

  • Your SRC device is in network/zone x
  • Your Router No. 2 is in network/zone x
  • This means a forwarding allow rule is required
  • The default forwarding rule in your screenshot was set to Reject (not sure how that changed from the default)
  • Changing to Accept fixes this

To be clear the "Forward" rules for the zone mean "Intra-zone Forwarding" (i.e. across routers/interfaces in the same zone) - hence why it must be allowed.

many thx again 4 explanation.

if i understand right, this is also the setting that would forbid two devices on the same network (e.g. a guest network) to talk to each other (if they need to take a route over the router to talk to each other)

i alway thought that "forward" only makes sense if there are more than one network in a zone.
learned again something very usefull, thx.

  • Yes, this is correct in the case of clients on 2 different PHYs (e.g. Wireguard interface and Ethernet in the same LAN zone) - or as in your case, routing across 2 different Ethernet interfaces
  • It will not stop LAN talk on the same bridge, Ethernet, Layer 2 network, etc.

Correct, in this case you do have more than one network in the same zone. via dev v12_latido

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.