Configure Static Routes¶
Static routes tell t1n1wall how to reach networks that are not directly connected and are not covered by the default route. They are required when traffic to a specific subnet must go through a router other than the WAN gateway.
Web UI location¶
System > Static Routes
When you need a static route¶
Static routes are needed when:
- Multiple routers on the LAN — a downstream router connects additional subnets that t1n1wall does not know about
- VPN subnets — an IPsec or L2TP tunnel exposes a remote subnet but routing to it requires an explicit entry
- Split routing — certain destination subnets should use a different gateway than the WAN default route
- Management network — a separate OOB management subnet is reachable via a dedicated router on an optional interface
You do not need a static route for: - Subnets directly connected to t1n1wall interfaces (these are learned automatically) - Traffic that should go through the WAN default gateway
Adding a route¶
Go to System > Static Routes and click Add.
| Field | Notes |
|---|---|
| Interface | Which t1n1wall interface the next-hop router is connected to (LAN, WAN, OPT, etc.) |
| Network | Destination subnet in CIDR notation (e.g., 10.20.0.0/24) |
| Gateway | Next-hop IP address — must be reachable on the selected interface |
| Description | Route purpose |
Example: reach a remote subnet via a LAN router¶
A router at 192.168.1.254 on LAN connects the 10.20.0.0/24 subnet.
| Field | Value |
|---|---|
| Interface | LAN |
| Network | 10.20.0.0/24 |
| Gateway | 192.168.1.254 |
| Description | Remote office subnet via LAN router |
After applying, t1n1wall will forward packets destined for 10.20.0.0/24 to 192.168.1.254 instead of the WAN gateway.
IPv6 routes¶
If IPv6 is enabled, a separate IPv6 Routes tab is available on the same page. Configuration is identical but uses IPv6 addresses and prefixes.
Apply¶
Route changes require clicking Apply after saving. A banner appears when there are unapplied changes.
Validation¶
After applying:
- From a LAN host, attempt to reach a host in the routed subnet (e.g.,
ping 10.20.0.1) - If routing fails, verify:
- The gateway IP is reachable from t1n1wall (
Diagnostics > Ping, source interface = LAN, destination = gateway IP) - The downstream router has a return route back to the LAN subnet (or a default route pointing through t1n1wall)
- Firewall rules on the relevant interface permit the traffic
Firewall rules for routed subnets¶
A static route tells t1n1wall where to send packets, but firewall policy still controls whether packets are permitted. If traffic to or from the routed subnet is blocked by firewall rules, connectivity will fail even with a correct route.
Add rules on the appropriate interface (the interface the traffic arrives on) to permit the required flows.