I have a Y configuration with three routers. DSL Modem | board router A (192.168.10.0/24)-- guest router B(192.168.100/24) | | private router C (192.168.0.0/24) Router A runs Toastman 7454 VPN mod. Router B runs DD-WRT. Route C runs Toastman 7454 Ext mod. Both connections are WAN-LAN. Outbound works perfect from either C subnet and B subnet. The routing table is following: HTML: Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 184.108.40.206 0.0.0.0 255.255.255.255 UH 0 0 0 ppp0 192.168.100.0 192.168.10.2 255.255.255.0 UG 0 0 0 br0 192.168.10.0 0.0.0.0 255.255.255.0 U 0 0 0 br0 192.168.0.0 192.168.10.3 255.255.255.0 UG 0 0 0 br0 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo 0.0.0.0 220.127.116.11 0.0.0.0 UG 0 0 0 ppp0 Where 18.104.22.168 is the WAN ip. 192.1168.10.2 is the WAN side of IP of router B, and 192.168.10.3 is for router C. Accept ICMP/ping are enabled on both router B and C. Now, I can access machine in C subnet (192.168.100.0) from machines within B subnet (192.168.0.0). But for some reasons that I can't do the reverse, ie. from 192.168.100.0 to 192.168.0.0. I can also log in to tomato in router A and ping/trace to 192.168.10.3 (router C's WAN IP), it succeed. But if I ping/trace to router C's LAN side IP (192.168.0.1), it fails. So essentially I can do A->B, C->B. But I can't do B->C, or A->C. The firewall in router C should not be an issue since I simply just test the ping to the router itself. I am not sure where I did wrong. Need your help. Thanks.