Because you have different subnets it is possible to setup clean routing. I assume the following network setup for example:
10.10.10.1 10.10.10.2 192.168.1.13 192.168.1.1 +----------+
/ \ / \ wan | |
ROUTER A <-----------> (eth0)RPI(wlan0) <~.~.~.~.~.~.> ROUTER B <--> | INTERNET |
\ ethernet wifi / | |
+<--------> LAN-Device AdminPC <~.~.~.>+ +----------+
/ \
10.10.10.3 192.168.1.2
As far as your AdminPC is on the same network as router B there shouldn't be any difficulties by fiddling with the default route on the raspi. Usually the route to the subnet is set by the kernel to:
rpi ~$ ip route list 192.168.1.0/24
192.168.1.0/24 dev wlan0 proto dhcp scope link src 192.168.1.13
If this isn't touched you should always reach the raspi with ssh. But if the DHCP-Server on Router B is configured the right way it will also give the default route to its clients so they can get into the internet automatically. Your routing table should look similar to this:
rpi ~$ ip route
default via 192.168.1.1 dev wlan0 proto dhcp src 192.168.1.13 metric 1024
10.10.10.0/24 dev eth0 proto dhcp scope link src 10.10.10.2
192.168.1.0/24 dev wlan0 proto dhcp scope link src 192.168.1.13
192.168.1.1 dev wlan0 proto dhcp scope link src 192.168.1.13 metric 1024
If the default route isn't set by the DHCP-Server then do:
rpi ~$ sudo ip route del default
rpi ~$ sudo ip route add default via 192.168.1.1 dev wlan0 src 192.168.1.13
Now from your raspi you can ping 10.10.10.3 and 192.168.1.2 and 8.8.8.8 (google nameserver on the internet). You cannot ping 10.10.10.3 from the AdminPC. There is no routing on your raspi. To do this you have to enable ip forwarding and setup a NAT (network address translation) on eth0 on the raspi and set a route to 10.10.10.0/24 on the AdminPC:
rpi ~$ echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
1
rpi ~$ sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
This also ensures that devices from 10.10.10.0/24 cannot connect to devices on 192.168.1.0/24. NAT is a one way translation.
AdminPC ~$ sudo ip route add 10.10.10.0/24 via 192.168.1.13 dev wlan0 src 192.168.1.2
But if you can it is better to set the route to 10.10.10.0/24 on router B. Then you have to do it only there and not on each device.
Without warranty ;-)
For a very simple disaster recovery as far as you haven't made persistent settings you can start a reboot job:
rpi ~$ sudo bash -c 'sleep 15m && systemctl reboot' &
[1] 708
rpi ~$ jobs
[1]+ Running sudo bash -c 'sleep 15m && systemctl reboot' &
rpi ~$
This will reboot your raspi after 15 minutes. Don't forget the PID, here 708, to kill the job when you are ready.
rpi ~$ sudo kill 708
If everything works as expected you can make the settings persistent. How to to that depends on what you are using: old style networking, dhcpcd, or systemd-networkd. You can make a generic systemd unit that should always work:
rpi ~$ sudo systemctl --force --full edit set-forward.service
In the editor insert these statements, save it and quit the editor:
[Unit]
Description=setup forwarding with NAT
After=network.target
Wants=network.target
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/echo 1 > /proc/sys/net/ipv4/ip_forward
ExecStart=/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
Install]
WantedBy=multi-user.target
Enable the unit:
rpi ~$ sudo systemctl enable set-forward.service
Install the same unit on the AdminPC but only with one:
ExecStart=/sbin/ip route add 10.10.10.0/24 via 192.168.1.13 dev wlan0 src 192.168.1.2
