Help with NAT subnet with L3 terminating on switch behind router

Hi guys,

​

This one is really making me scratch my head, and driving me crazy because I feel like I should know what's going on here! I'm hoping someone can help out, and also offer any advice for me as well about my setup.

​

So, I have a Cisco 861 and recently did a CCNA Wireless, and thus I've been trying to do some more complicated wireless setups on my home network aka lab network ;) Firstly, starting off with some Ruckus R710's that I am planning on using with Unleashed (controller on the AP). The Cisco 861, as I recently learnt, only supports two SVI's and it can't use any other license than Advanced Security - so, stuck with two SVI's .. poo. I also have an old 3750, which I'm hoping will support more than two SVIs, so my plan now is to terminate all my client and server layer 3 interfaces on the 3750 then have a backbone between the 3750 and 861 - it's a work in progress.

​

I have a mgmt / backbone VLAN (333) on both the router and switch. My data VLAN (1) currently terminates on an SVI on the router. The router is also the default gateway for the switch on VLAN 333.

​

I added SVI for VLAN 5 on the 3750. VLAN 5, at the moment, is testing wireless clients but the concept will become more permanent. The default gateway for VLAN 5 is the switch (192.168.5.254), and the switch also hands out DHCP.

​

Now hopefully that explanation was up to par, and made some amount of sense.

​

The problem I have is that the wireless clients have some really limited connectivity ...

​

From the switch, I can source pings from interface vlan 5 and ping the router's SVIs and the internet. The wireless clients receive a DHCP address from the 3750, and they can ping interface vlan 5 on the switch also (192.168.5.254). They cannot, however ping ANYTHING else on the network, literally just that one hop. They can't ping interface vlan 333 on the switch. They also cannot reach the internet. The switch has a default gateway of 172.31.254.254 (vlan 333 on router).

​

So, what's going on here. What have I missed? As I said, on the switch itself, I can ping everything with a source address from int vlan 5, so it seems like the wireless clients should also be working. Thought it might've been a port config, but then, the clients get the correct DHCP and can ping the switch so my trunk port should be good.

​

Here's a quick and dirty network diagram with some key information on it; https://imgur.com/4ZSqADw

​

Thanks everyone! :)

​

Edit: I do have a route on the 861 to point 192.168.5.0/24 back to 172.31.254.253 (the 3750) for return traffic.