Devices local to Cradlepoint not accessible via Tailscale

[bmwagner18]

I have a Cradlepoint is on a remote network with subnet of 192.168.1.0/24. There is another device on the subnet at 192.168.1.140 that I am able to ping at the NetCloud console from the Troubleshooting tab but when I try to access it through Tailscale I am unable to access it.

I've tried enabling the route on the Tailscale web UI and pinging directly at 192.168.1.140 from another device on the Tailnet and I've tried using 4via6. Both result in this showing up on the logs:

Thu Nov 14th 15:01:48 2024	tailscale	ERR	2024/11/14 20:01:48 netcheck: DetectCaptivePortal(found=false)	
Thu Nov 14th 15:01:32 2024	tailscale	ERR	2024/11/14 20:01:32 exec ping of 192.168.1.140 failed in 3.919646ms: exit status 1	
Thu Nov 14th 15:01:27 2024	tailscale	ERR	2024/11/14 20:01:27 exec ping of 192.168.1.140 failed in 5.042896ms: exit status 1	
Thu Nov 14th 15:01:22 2024	tailscale	ERR	2024/11/14 20:01:22 exec ping of 192.168.1.140 failed in 3.623354ms: exit status 1	
Thu Nov 14th 15:01:17 2024	tailscale	ERR	2024/11/14 20:01:17 exec ping of 192.168.1.140 failed in 4.037542ms: exit status 1	
Thu Nov 14th 14:31:49 2024	tailscale	ERR	2024/11/14 19:31:49 exec ping of 192.168.1.140 failed in 3.934125ms: exit status 1	
Thu Nov 14th 14:31:44 2024	tailscale	ERR	2024/11/14 19:31:44 exec ping of 192.168.1.140 failed in 4.030021ms: exit status 1	
Thu Nov 14th 14:31:39 2024	tailscale	ERR	2024/11/14 19:31:39 exec ping of 192.168.1.140 failed in 3.637541ms: exit status 1	
Thu Nov 14th 14:31:34 2024	tailscale	ERR	2024/11/14 19:31:34 exec ping of 192.168.1.140 failed in 3.607541ms: exit status 1	

The Cradlepoint is running OS v7.24.22. Do I need to modify the Network settings on the Cradlepoint to enable the route?

TIA,
Ben

[dapplegatecp]

Hi, sorry for the delay. On the Cradlepoint, did you try enabling a firewall allow explicitly for Router Zone to Lan zone? This should work, the incoming traffic will be sourced from the router IP address

[bmwagner18]

Is this the firewall table you are referring to?

Just to confirm, if I do change the "Default Deny All" on the first line to "Default Allow All" this will not open the LAN to anyone who is privy to my public IP to access the LAN will it?

[bmwagner18]

Was this what you meant by Router zone to LAN zone? I still get the same error showing up in the logs with that rule added.