How to Add a Static Route on the ASUS RT-AC66U

ASUS_RT-AC66U_newsBased on the popularity of my previous ASUS RT-AC66U post regarding SNMP, I have decided to put together a simple post on how to configure static routing on the home router known as the Dark Knight.

In my humble abode, the RT-AC66U is the core of my home network, providing DHCP and Wireless to a plethora of devices. However, I am also running a small home lab which I need to be able to access from my home desktop. Hence the need for static routes.

Specifically, my home lab hosts the following networks; 10.1.0.0/24, 10.2.0.0/24, 10.3.0.0/24. The IP address of my ASUS RT-AC66U is the default one of 192.168.0.1. My desktop is on the 192.168.0.0/24 network.

In order for me to access my lab from my desktop (and from the rest of my home network), I need to tell my ASUS how to route traffic destined for my 10. networks.

In order to accomplish this, we first need to navigate to LAN on the left pane, and then selecting the Route tab.

static_routes_asus_rt-AC66u

As shown in the screenshot above, we first need to select the “YES” radio button to “Enable Static Routes”. Next we enter a network ip (or static ip — if that’s what we are up to) into the “Network/Host IP “field. Then we enter our netmask into the field that is not surprisingly labeled Netmask”. In my case my netmask is 255.255.255.0.

Now we move on to the field labeled “Gateway”. Here we need to enter what the next network hop for that a packet that is needs to route to our lab network. In my environment, this is 192.168.0.11, which is another router.

Then select “LAN” from the drop down as all our traffic will route to the internal LAN only, and not out to the internet or WAN. Now click the plus sign to add your new route.

Now when a packet destined for one of my lab networks outlined above hits my ASUS router, it will be forwarded to 192.168.0.11, which is my lab router.

Note that you can also add static routes via the busybox command line, however I am not going to go into that today. Its simple enough to add them in the WebUI.

21 thoughts on “How to Add a Static Route on the ASUS RT-AC66U

  1. Pingback: Configure the Asus RT-AC66U Router as a Caching DNS Server with Bind | Fatmin.com

  2. Pingback: Install and Configure SNMP on the Asus RT-AC66U Router | Fatmin.com

  3. Pingback: Disk I/O Monitoring on the Asus RT-AC66U Router | Fatmin.com

  4. I am having trouble getting my static routes to work. After I set them up I can ping the final IP but am unable to connect to the GUI. Is there anything else you have to set in the Asus GUI to allow traffic between the two networks?

    Like

    • David, can you elaborate? I read your post a few times, but I am not exactly clear on the exact situation. For example, do you mean that after you add your static route, you can then ping an IP in the address space of the route? What do you mean by you cannot connect to the GUI? Do you mean from your workstation? Or from the IP that you pinged previously?

      Note that you are not actually configuring the router to allow traffic between the two networks, rather you telling the router to redirect certain network traffic (for the designated ip ranges) to take a specific next network hop, instead of the default one that would normally be out to the internet. The next hop needs to know what to do with this traffic and where to send it so that it can get to its destination. The next hop also needs to know how to send traffic back to the asus router. Is your next hop router plugged directly into the asus router?

      Like

      • Settings
        Network/Host IP “192.168.171.0”
        Netmask “255.255.255.0”
        Gateway “192.168.0.171”
        I can successfully ping 192.168.171.10 from my computer at 192.168.0.xx
        When I enter 192.168.171.10 into Firefox or Chrome I am unable to connect to the user interface.
        192.168.0.171 is connected wireless to the Asus router.

        When i remove the routes on the router and set them up on my computer everything works fine. I want the routes on the router so I can also access with other devices.

        Like

  5. I have the same problem as David. My topology:

    —Cisco3550—(Ethernet-cable)–ASUS-RT-N66U—(wireless)—myLaptop

    I have an ASUS RT-N66U connected to a Cisco router. I have the ASUS set up with a static route such as 100.100.100.0 255.255.255.0 (for a lab subnet behind the Cisco router) pointing to next hop 192.168.1.100 (Cisco router interface connected to ASUS). Similarly, on the Cisco router I have created a default route 0.0.0.0 0.0.0.0 pointing to 192.168.1.1 (which is my ASUS router interface). This works great, I can access public DNS servers and ping google.com from my Cisco router. From my laptop I can ping devices in the 100.100.100.x subnet. So basic IP connectivity is fine…. BUT…. from my Laptop I can’t connect to TCP port 80, 443, or 8443, or whatever in the destination subnet 100.100.100.x as long as the traffic must traverse the ASUS. Wireshark shows my outbound requests and no response packets. There are no ACLs on my Cisco router. I verified when directly connected to the 192.168.1.x subnet on the Cisco router- I *can* connect to various TCP ports on my destination servers, which shows they are working fine. This points the finger clearly at ASUS doing the blocking.

    Is there a setting on ASUS to ensure wide open connectivity between wireless and wired Ethernet ports, including for any static routes? I also want to preserve the firewall functionality to protect the LAN and wireless from inbound requests via the WAN.

    Like

    • I figured out an ugly hack… telneting in, looking at iptables -L FORWARD -v to see which rules were getting hit, and I verified incrementing counters on the ‘any any INVALID rule’ (it’s the third one in my version of the firmware). As soon as I deleted this rule (e.g. iptables -D FORWARD 3) it enabled my access to webservers on that subnet.

      I don’t think this is a safe long term strategy because the rule is ‘any any’. I’m still trying to figure out where the nonvolatile config is stored so I can modify it, and trying to figure out a more surgical modification, such as a permit rule for ‘br0 br0 INVALID’ ahead of the block rule for ‘any any’ INVALID. That way invalid packets that are attack attempts coming in via eth0 (i.e. “the internet/WAN”) would still be blocked but my traffic between ports on the bridge interface would still get through. Progress though!

      Like

      • My final solution (working) that is good enough for me: instead of doing “iptables -D FORWARD 3” to delete the offending drop rule… I insert a rule above that accepts INVALID as long as the input and output interfaces are br0 (i.e. inside of my network- not the Eth0 WAN interface). Just type this after telneting into the router:
        iptables -I FORWARD 3 -i br0 -o br0 -j ACCEPT

        Of course, this presumes the third rule in your list is the offending INVALID line, and you want to open a little hole just in front of it. Note the following output that shows which rules are getting hit before and after, where you can see the INVALID rule dropping packets before the change, then the new rule I added hitting after the change, where the desired packet flow is actually working now.

        username@RT-N66U:/tmp/home/root# iptables -L FORWARD -v
        Chain FORWARD (policy ACCEPT 531 packets, 32018 bytes)
        pkts bytes target prot opt in out source destination
        2081 113K ACCEPT all — any any anywhere anywhere state RELATED,ESTABLISHED
        0 0 DROP all — !br0 eth0 anywhere anywhere
        5 2268 DROP all — any any anywhere anywhere state INVALID
        1 52 ACCEPT all — br0 br0 anywhere anywhere
        0 0 ACCEPT all — any any anywhere anywhere ctstate DNAT
        username@RT-N66U:/tmp/home/root#
        username@RT-N66U:/tmp/home/root# iptables -I FORWARD 3 -i br0 -o br0 -j ACCEPT
        username@RT-N66U:/tmp/home/root#
        username@RT-N66U:/tmp/home/root# iptables -L FORWARD -v
        Chain FORWARD (policy ACCEPT 535 packets, 32252 bytes)
        pkts bytes target prot opt in out source destination
        2092 113K ACCEPT all — any any anywhere anywhere state RELATED,ESTABLISHED
        0 0 DROP all — !br0 eth0 anywhere anywhere
        1049 88944 ACCEPT all — br0 br0 anywhere anywhere
        11 4600 DROP all — any any anywhere anywhere state INVALID
        1 52 ACCEPT all — br0 br0 anywhere anywhere
        0 0 ACCEPT all — any any anywhere anywhere ctstate DNAT

        Like

      • So now that I have had a chance to think about this, it kinda makes sense. The router only allows http connections from its local network. If I recall there is a setting to allow connections from WAN, I wonder if this will also allow connections from your other internal networks. Not that you want to also allow access from the WAN, but this might be the setting that would allow the access you want.

        Like

  6. I am suffering the same issue with an AC68U and routing to another network. I am using raspberry pis as OpenVPN servers with a remote site. When the static route is setup on the router I can ping the other networks devices but I can’t connect via RDP, SAMBA, HTTP etc. I can see the rejected package counter going up when this is happening.

    If I use a little TP-Link WR710N connected to my AC68U via WISP mode and set the route on this; I can fully access the other network.

    I have raised a support ticket with Asus UK and am talking with PeterS about this issue.

    I’ll keep you updated with my findings.

    Like

    • I understand the issue has been passed to the next line support team.Fingers crossed we start to get some positive momentum to fixing the issue.

      Like

      • I’ve a very similar setup with the same problem as Nathan. AC56U here.

        Waiting for your results. I’m thinking about opening another ticket…

        Like

  7. Pingback: Dual-router setup w/ a dedicated VPN Router: A step-by-step tutorial

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s