What's new
By:

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

Can't ping 2nd router from Asus Ping Tool

blitzkrieg

blitzkrieg

Occasional Visitor
Hi all

I've an RT-AC66U_B1 running Merlin's 380.67.
OpenVPN setup as follows:
TUN. Push LAN to clients. Direct clients to redirect Internet traffic. Respond to DNS. Advertise DNS to clients.

A DLink router is connected to the Asus through each other's LAN port and in the same 192.168.4.0/25 subnet. So it is essentially a switch.

I can connect to OpenVPN successfully and able to access a NAS server no problem. But I can't ping nor access the DLink router 192.168.4.2 while in OpenVPN. However, I can ping the PCs, Asus router and Android devices.

Any additional routing/iptables need to be added?

Here's the untouched iptables:
Code: 
/root# iptables -L                                        
Chain INPUT (policy ACCEPT)                                                      
target     prot opt source               destination                              
ACCEPT     all  --  anywhere             anywhere                                
ACCEPT     udp  --  anywhere             anywhere             udp dpt:1194        
DROP       icmp --  anywhere             anywhere             icmp echo-request  
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED                                                                            
DROP       all  --  anywhere             anywhere             state INVALID      
PTCSRVWAN  all  --  anywhere             anywhere                                
PTCSRVLAN  all  --  anywhere             anywhere                                
ACCEPT     all  --  anywhere             anywhere             state NEW          
ACCEPT     all  --  anywhere             anywhere             state NEW          
ACCEPT     udp  --  anywhere             anywhere             udp spt:bootps dpt:bootpc                                                                            
INPUT_ICMP  icmp --  anywhere             anywhere                                
DROP       all  --  anywhere             anywhere                                
                                                                                 
Chain FORWARD (policy DROP)                                                      
target     prot opt source               destination                              
ipttolan   all  --  anywhere             anywhere                                
iptfromlan  all  --  anywhere             anywhere                                
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED                                                                            
ACCEPT     all  --  anywhere             anywhere                                
DROP       all  --  anywhere             anywhere                                
DROP       all  --  anywhere             anywhere             state INVALID      
ACCEPT     all  --  anywhere             anywhere                                
SECURITY   all  --  anywhere             anywhere                                
NSFW       all  --  anywhere             anywhere                                
ACCEPT     all  --  anywhere             anywhere             ctstate DNAT        
ACCEPT     all  --  anywhere             anywhere                                
                                                                                 
Chain OUTPUT (policy ACCEPT)                                                      
target     prot opt source               destination                              
                                                                                 
Chain ACCESS_RESTRICTION (0 references)                                          
target     prot opt source               destination                              
                                                                                 
Chain FUPNP (0 references)                                                        
target     prot opt source               destination                              
                                                                                 
Chain INPUT_ICMP (1 references)                                                  
target     prot opt source               destination                              
RETURN     icmp --  anywhere             anywhere             icmp echo-request  
RETURN     icmp --  anywhere             anywhere             icmp timestamp-request                                                                                
ACCEPT     icmp --  anywhere             anywhere                                
                                                                                 
Chain NSFW (1 references)                                                        
target     prot opt source               destination                              
                                                                                 
Chain PControls (0 references)                                                    
target     prot opt source               destination                              
ACCEPT     all  --  anywhere             anywhere                                
                                                                                 
Chain PTCSRVLAN (1 references)                                                    
target     prot opt source               destination                              
                                                                                 
Chain PTCSRVWAN (1 references)                                                    
target     prot opt source               destination                              
                                                                                 
Chain SECURITY (1 references)                                                    
target     prot opt source               destination                              
RETURN     tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,ACK/SYN limit: avg 1/sec burst 5                                                
DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,ACK/SYN                                                                        
RETURN     tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,ACK/RST limit: avg 1/sec burst 5                                                
DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,ACK/RST                                                                        
RETURN     icmp --  anywhere             anywhere             icmp echo-request limit: avg 1/sec burst 5                                                            
DROP       icmp --  anywhere             anywhere             icmp echo-request  
RETURN     all  --  anywhere             anywhere                                
                                                                                 
Chain iptfromlan (1 references)                                                  
target     prot opt source               destination                              
RETURN     all  --  anywhere             anywhere            account: network/netmask: 192.168.4.0/255.255.255.128 name: lan                                        
RETURN     all  --  anywhere             anywhere            account: network/netmask: 192.168.4.0/255.255.255.128 name: lan                                        
                                                                                 
Chain ipttolan (1 references)                                                    
target     prot opt source               destination                              
RETURN     all  --  anywhere             anywhere            account: network/netmask: 192.168.4.0/255.255.255.128 name: lan                                        
RETURN     all  --  anywhere             anywhere            account: network/netmask: 192.168.4.0/255.255.255.128 name: lan                                        
                                                                                 
Chain logaccept (0 references)                                                    
target     prot opt source               destination                              
LOG        all  --  anywhere             anywhere             state NEW LOG level warning tcp-sequence tcp-options ip-options prefix "ACCEPT "                      
ACCEPT     all  --  anywhere             anywhere                                
                                                                                 
Chain logdrop (0 references)                                                      
target     prot opt source               destination                              
LOG        all  --  anywhere             anywhere             state NEW LOG level warning tcp-sequence tcp-options ip-options prefix "DROP "                        
DROP       all  --  anywhere             anywhere

Here's the netstat routing table:
Code: 
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
44.125.x.1      0.0.0.0         255.255.255.255 UH        0 0          0 eth0
192.168.4.0     0.0.0.0         255.255.255.128 U         0 0          0 br0
10.8.0.0        0.0.0.0         255.255.255.128 U         0 0          0 tun21
44.125.x.0      0.0.0.0         255.255.255.0   U         0 0          0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
0.0.0.0         44.125.x.1      0.0.0.0         UG        0 0          0 eth0
Simple network view: hmnetwrk.jpg
OpenVPN setting: Screenshot_2017-07-26-16-42-23-1.png
 
This would appear to be an issue with the D-Link. Can you access the D-Link when directly connected to the LAN rather than through the VPN?
 
ColinTaylor said:
This would appear to be an issue with the D-Link. Can you access the D-Link when directly connected to the LAN rather than through the VPN?
Click to expand...
Yup the DLink can be ping/accessed normally when directly in LAN, but not through VPN. Quite strange that pinging other devices through VPN is OK, just can't access the webUI of the DLink.
 
Sorry to ask such a basic question :rolleyes: but I don't use OpenVPN. When your VPN client connects to say the NAS, what IP address does it have? Is it a 192.168.4.x address, a 10.8.0.x or something else. I can imagine that the D-Link might not like clients that don't come from 192.168.4.x.
 
ColinTaylor said:
Sorry to ask such a basic question :rolleyes: but I don't use OpenVPN. When your VPN client connects to say the NAS, what IP address does it have? Is it a 192.168.4.x address, a 10.8.0.x or something else. I can imagine that the D-Link might not like clients that don't come from 192.168.4.x.
Click to expand...
VPN clients will have 10.8.0.x address. Just can't pin point which iptables or routing table to allow it to connect to the DLink.
 
There won't be any additional routing required on the Asus (because the traffic is already on the LAN, it doesn't need routing). The problem is probably the iptables rules or routing on the D-Link which is blocking any non-192.168.4.x traffic.

Edit: Thinking a bit more about this... it's probably the routing on the D-Link. The traffic will be getting to the D-Link but when it tries to send a reply it doesn't know where the 10.8.0.x network is, so it sends it out the default route, which is the WAN interface.
 
Last edited:
ColinTaylor said:
There won't be any additional routing required on the Asus (because the traffic is already on the LAN, it doesn't need routing). The problem is probably the iptables rules or routing on the D-Link which is blocking any non-192.168.4.x traffic.

Edit: Thinking a bit more about this... it's probably the routing on the D-Link. The traffic will be getting to the D-Link but when it tries to send a reply it doesn't know where the 10.8.0.x network is, so it sends it out the default route, which is the WAN interface.
Click to expand...
Ahh, ok make sense.. the DLink is an 850L, so it's abit handicapped. Anyway, Asus and DLink is connected to the LAN ports, not WAN port, will try to figure out how's the routing gonna be.
 
According to the D-Link manual there is a "Routing" page that looks like you can setup a static route back to the Asus for the 10.8.0.x network. :) Hopefully the "Interface" can be set to something other than "WAN".
 
Looks like a dead end to me. There's no 'LAN' option in the Static Route page of the DLink 850L, nor editing the webUI HTML to 'LAN'.
HOwever, if I connect to another OpenVPN server(TUN/NAS) connected to the DLink, I'm able to ping/access the DLink router.
Hmm, any additional settings in the Asus router OpenVPN?
 
ColinTaylor said:
Sorry I'm out of ideas, but then I don't know much about OpenVPN.
Click to expand...
No worries.
Anyway, I've narrowed down the culprit; apparently can't ping the DLink router within the Asus Ping Tool! Even through PuTTY SSH fails.
Soo its not OpenVPN's fault. Somehow the routing table is incomplete? From what I can see, the 192.168.4.0/25 subnet is listed. Anybody any ideas?
Code: 
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
44.125.x.1      *               255.255.255.255 UH        0 0          0 eth0
192.168.4.0     *               255.255.255.128 U         0 0          0 br0
10.8.0.0        *               255.255.255.0   U         0 0          0 tun21
44.125.x.0      *               255.255.255.0   U         0 0          0 eth0
127.0.0.0       *               255.0.0.0       U         0 0          0 lo
default         44.125.x.1      0.0.0.0         UG        0 0          0 eth0
upload_2017-7-30_13-4-41.png
 
You must log in or register to reply here.

Similar threads

spacemanspiff
RT-AX86U running Merlin serving DNS - possible Malware infection
2
Replies
31
Views
2K
ColinTaylor
C
adri
Firewall, Port Forwarding, and DoS Question
Replies
8
Views
915
ColinTaylor
C
S
Asus EULA now requiring explicit user consent
Replies
16
Views
523
spacemanspiff
spacemanspiff
v.y.k
iptables pkts & bytes numbers are too low on Merlin 3004.388
Replies
13
Views
1K
v.y.k
v.y.k
N
Skynet SkyNet/Firewall blocking all ping requests, including outbound
Replies
6
Views
1K
nearlyheadlessarvie
N
Similar threads
Thread starter Title Forum Replies Date
R OpenVPN client can't connect to local resources over port 80/443, but can ping them by IP Asuswrt-Merlin 6
M Can't ping ipv6 with all connected devices Asuswrt-Merlin 0
thelonelycoder Is curl the new ping? Asuswrt-Merlin 2
M Solved No ping on WG - BUG? Asuswrt-Merlin 20
CntrlAltDel Not able to ping to WAN Asuswrt-Merlin 7
N How to allow different VPN clients ping each other? Asuswrt-Merlin 5
Lee MacMillan Can no longer access router GUI Asuswrt-Merlin 6
L Pass ipv6 prefix to downstream router Asuswrt-Merlin 6
S 3006.102.4 - DNS Director New Redirect With "Router" NOT Working Asuswrt-Merlin 7
AppleBag Halp! Getting router bootloop after latest firmware upgrade. Asuswrt-Merlin 13

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 928 (members: 19, guests: 909)
Back
Top
✖