I have a very basic question about a routing issue I have right now.

So my central server with the ip of my own network is the router for the ip net On the client I have a WiFi connection to an access point which serves the ip net

How can I add a route to so all clients in can reach

What I have tested so far (ipv4 forwarding and iptables masquerading has been taken care of):

Adding the a route on like

route add -net netmask dev br0

makes it possible on to reach the network, but thats it. A traceroute from any other client shows that the requests get stuck at and therefore they can not reach the other network until I configure the same route on all of them individually. But this contradicts the idea of being the gateway.

The routing table of after using the above noted command looks like this:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface         <WANIP IS HERE>         UG        0 0          0 eth0 U         0 0          0 br0
<WANIP IS HERE> U         0 0          0 eth0 UG        0 0          0 br0

What am I missing here?

Thank you very much for your time and answers to this probably very silly issue!

  • I believe that the DHCP server needs to be configure so that it informs automatically to the computers in that he is a route for the other subnet Not sure how to do it though. This is only required because is considered non routable subnet and unless a route is specified for each then the clients won't try to make a request.
    – Torrien
    Jan 8, 2019 at 4:01
  • Maybe take a look at ral-arturo.org/2018/09/12/dhcp-static-route.html
    – Torrien
    Jan 8, 2019 at 4:07
  • @Torrien so based on your answer it could help to change the subnet from to something like Jan 8, 2019 at 4:30

2 Answers 2


Normally the gateway (in this case your system) will send ICMP redirect messages to direct clients to a different gateway when it has a route to the required network via another host on the same network (i.e. in your case).

However for that you need to add an iptables rule to allow forwarding from the internal network to the internal network, which perhaps doesn't sound logical, but actually is, as it's effectively sending traffic from the internal network to the internal network.

Add the following rule:

iptables -A FORWARD -i br0 -o br0 -j ACCEPT

Now, when a client host on your network wants to access 172.20.10.x, that host sends the packet to its default gateway i.e. That default gateway knows that the route to is via, so it sends back to the client host an ICMP redirect 172.20.10.x to host packet. The client host adds a temporary route for the target host and will use as the gateway for that host.

The client host has to be configured to accept such ICMP redirects, as these may present a security issue when rogue redirects are sent to divert traffic to a fake gateway, however it is the default in Linux, Windows also accepts them. In Linux it can be controlled via the net.ipv4.conf.default.accept_redirects sysctl setting.

  • Thank you very much so far for the detailed answer! Now the whole situation makes a lot more sense to me. So I have applied the above mentioned iptables rule to the server and sending a ping does work now. But any other request, like a http request to port 80, still fails. What am I missing? Jan 8, 2019 at 15:12
  • That's strange, if ping works then http should also work. Just to check: the hosts on the 172.20.10.x network know that from their side 10.0.0.x is reachable via that same second "gateway"? I.e. the same "trick" might need to be done on the other network.
    – wurtel
    Jan 9, 2019 at 8:21

To the previous answer of @Wurtel I would add that you would need to also type:

echo 1 > /proc/sys/net/ipv4/ip_forward

Moreover, you have to also masquerade your connections by:


Otherwise the outgoing traffic will not be properly treated.

  • Masquerading is not necessary in this scenario, the real IPs are routed. Good point about ip_forward though.
    – wurtel
    Jan 9, 2019 at 8:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.