I have a home network with 3 subnets (I like to play around!)

I've been struggling with something that I thought would be easy, but after a few days I'm no closer to the answer. My network is depicted in this image

The main subnet is, which is connected to the subnet via a laptop with an ethernet ( and wifi ( adapter.

I am running hostapd and dhcpd on the laptop with the 2 NIC's (with IP Maquearading) - so I am using it as a WiFi hotspot. The setup there is working fine (has been for some time). I recently added a wifi router, which is connected to the subnet via a WAN connector ethernet link (, dishing out DHCP addresses in the subnet range.

The main subnet is connected to a Linux box ( which acts as a gateway router to the internet for the internal network (with IP Masquerading for packets to and from the public internet).

If I am on the Linux box (router) I can ping as well as (after adding the entries in the routing table to reach the subnet):

ip route add via

My goal is to reach the mobile phone ( from the laptop ( connected wirelessly to the wifi router, which in turn is connected to the subnet.

This is where things go wrong. I thought that the packets originating from - which are destined for - will be sent to (the default gateway for the wireless router), and since can ping, I assumed that this would work (because of the routing entry mentioned above).

IP Forwarding is enabled on the Linux router ( as well as on the laptop acting as a WiFi hotspot. Is what I am trying to do here possible, or am I missing some fundamental concept?

  • Routing tables

Routing table for
Destination   Gateway       Genmask     Flags Metric   Ref     Use Iface         UG    10      0        0 eth0   U      0      0        0 eth0   U      0      0        0 eth1   UG     0      0        0 eth1

Routing table for
Destination Gateway       Genmask       Flags Metric Ref  Use Iface       UG     0     0    0   eth0 U      0     0    0   eth0 U      0     0    0   wlan0

Thank you all!


And here I have to admit to a very blind oversight, and answering my own question (at least the part that tripped me over!)

I have a script that start and stop my Linux router settings (setting firewall rules, enable IP forwarding an Masquerading etc), and doing the "reverse" on a stop command. One of the lines in the stop sections was:

iptables -P FORWARD DROP

This sets the FORWARD policy to DROP - effectively killing packet forwarding, and hence was the cause of all my problems! In the end it was as simple as adding the

ip route add via

route to the routing table on the Linux router. Packets from different subnets are correctly forwarded to, from where they are forwarded further if need be, via the GW for subnet

Thanx to wurtel and user2999479 who'se answers made me dig further into my own setup :)

| improve this answer | |

As you did on the Gateway Linux box, can you add a route on the Wifi Router (What make/model router is that anyway?)?

From experience, I've noticed differences in how different IP stacks handle certain IP services, such as DHCP, Masquerading, & Forwarding. It also might be worth noting the OS and version of TCP/IP on & to assist with further troubleshooting.

| improve this answer | |

The masquerading on is what's causing trouble. The ping packets may reach but the return pongs are being masqueraded, and hence aren't received by

There's no need to do masquerading (NAT) on anyway. traffic should be able to reach your whole internal network as-is, provided you have routes set up correctly. When wants to go to the internet, then masquerading performed on should be enough (if configured correctly and routes to and are set up correctly on

You won't be able to ping either, unless you can tell your wifi router not to perform masquerading.

| improve this answer | |
  • Thanx for the suggestion. I disabled masquerading on, but I still cannot connect. I tried to take the wireless router out of the equation. I have another box (Raspberry Pi) also on the subnet (IP: Even from this box I cannot reach – Vetkop Dec 16 '15 at 16:55
  • I've added the routing tables for and to the original question – Vetkop Dec 16 '15 at 17:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.