Argthtjtr

In the network shown below, the Netgear router has a LAN interface address of 192.168.1.1 and its DHCP assigns addresses starting at 1.201.

The Linksys router's LAN interface address is 192.168.0.1 and its DHCP assigns addresses starting at 0.101. Its WAN interface is attached to the Netgear router at a static address of 192.168.1.10.

The problem is that computers on the .1.201 subnet cannot reach computers on the .0.101 subnet, even after disabling NAT and SPI firewall on the Linksys router, and adding a static route at the Netgear router as follows:

Destination IP: 192.168.0.0

Mask: 255.255.255.0

Gateway IP: 192.168.1.10

A tracert gets as far as 192.168.1.10 (192.168.0.1) then dies.

I wondered if the problem might be the return trip, but the existing route table at the Linksys router shown below already has an entry for 192.168.1.0 as follows, and won't let me add another route (complains about invalid static route):

Destination IP: 192.168.1.0

Mask: 255.255.255.0

Gateway: 0.0.0.0

Interface: WAN

Computers on the .0.101 subnet can reach computers on the .1.201 subnet - it is the reverse which is the problem.

Incidentally, the Netgear router is connected to the internet via its WAN port, and all computers on both networks can reach the internet.

My ultimate goal is to limit access from .1.201 to .0.101 to certain computers only, via static route(s).

Network diagram at http://flymike.dreamhosters.com/Static%20Route%20Problem.jpg

Do you have a specific reason why you want some devices to be on a different IP subnet than other devices? If not, then make "Router B" be just a bridge. Turn off its NAT, Router, Firewall, and DHCP server features. Let it get its own IP address via its built-in DHCP client just like any other device.

If you have a router that doesn't let you turn off NAT gatewaying or IP forwarding/routing, you can just stop using its WAN port. Just plug one of its LAN ports into the other router's LAN port. If you have a router that doesn't let you turn off its DHCP service, try setting its DHCP IP address lease pool to zero (i.e. give it a zero-length range of IP addresses to serve out via DHCP).

By the way, if you really do have a good reason to keep "Router B" as an IP-forwarding router instead of just a bridge, your problem is probably with the static route you put on Router A. You needed to point Router A that the upstream/WAN/.1.x subnet IP address of Router B. That's the only interface that Router A can "see" of Router B. But it looks from your Question like you tried to point Router A and the "downstream/LAN/0.x subnet IP address of Router B, which still doesn't tell Router A how to reach that subnet.

Its a bit complex to answer the question meaningfully without more information. (A diagram, OS's and more information about the setup of each client might be usefull, as would what happens on a traceroute in the reverse direction. Also copies of the routing tables on each router, and the IP addresses assigned to each interface on the routers are really required).

From the limited information provided to me I suspect the gateway on router B might be wrong, or it is missing a static route.

In general terms, and where I suspect your problem lies -

The WAN interface on router B needs to be in the range of the LAN interface on A (eg 192.168.1.253), and needs to be static. Router A in term needs a route specified for 192.168.0.0/24 vi 192.168.1.253 (assuming 192.168.1.253 is the address of the LAN interface on A)

Similarly, Router B needs a static route to router A (192.168.1.1) for 192.168.1.0/24.