I have two LAN subnets that I need to link together they are and

There is a m0n0wall running on It's LAN connection goes out to our network switch, and it's WAN port goes out to our ADSL modem. WAN is connected via PPPoE.

The subnet contains all of our office workstations. The subnet contains development servers and test machines that need to obtain internet access and be "managed" by computers on the subnet, but need to be on their own subnet as well.

I have a Draytek 2820N configured on with it's WAN2 port configured as and a default gateway of Machines on the 5.0 subnet can connect to the internet via the m0n0wall just fine.

I configured a static route on the m0n0wall LAN interface, Network and Gateway

Machines on the 5.0 subnet can ping machines on the 4.0 network but the reverse does not work. I configured a new firewall rule on the m0n0wall that allows any traffic on the LAN interface with a source IP of to be allowed. The DrayTek firewall is currently configured to pass all traffic regardless.

When I try to ping a machine in the 5.0 subnet from 4.0 I see this in my m0n0wall log:

BLOCK 14:45:27.888157 LAN, type echoreply/0 ICMP

So the reply is being sent from the 5.0 subnet but is not being allowed to reach my workstation because the firewall is blocking it. Why is the firewall blocking it ?

I hope the explanation of my network is clear, please ask if you require further clarification.

Thank you.

  • I'm not familiar with the Draytek router. Is it possible that it's NAT/MASQUERADE-ing the 5.0 network to the 4.0 network? That might explain why pings from 5.0 to 4.0 work, but not the other way around. Feb 12, 2011 at 16:24
  • Is it possible to add another network port to the monowall router, or does it have a free port available for use?
    – Flash
    Jun 4, 2012 at 13:14
  • Sounds complicated. A picture would help. Even one made out of ascii art. It sounds like you have two firewalls in play. The draytek and the monowall, is that right?
    – hookenz
    Jan 14, 2013 at 20:23

1 Answer 1


If the ICMP packet was sent from to 192.168.5.x and the reply is received from I wonder if this could be considered a spoof. In the m0n0wall advanced settings I notice these 2 options:

  • Spoof Checking blocks packets not sourced from the subnet of the interface the packet was received on
  • Bypass firewall rules for traffic on the same interface

I don't know the inner workings of m0n0wall. But I wonder if there are system firewall rules added that are not actually shown in the rules web interface that may be blocking the echoreply.

Can you goto /exec.php and post the output of command:

ipfw list

This would probably be of help in debugging.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.