Why linux generates ARP broadcast for packets that match the LAN route?

I have two physical devices, a router and an access point, both installed with OpenWRT.

The router has two interfaces, one for LAN (192.168.1.1/24), the other for WAN. The AP also has two interfaces, one for LAN (192.168.1.2/24), the other for for WiFi (192.168.2.1/24). The two LAN interfaces are connected with a wire.

On the router, a route for WiFi is set up:

ip route add 192.168.2.0/24 via 192.168.1.1

When I ping 192.168.2.1 on the router, I hope that the echo request would go through the wire with a source IP 192.168.1.1 and a destination IP 192.168.2.1, and the router would get an echo reply back, but it turns out the router generates ARP broadcasts asking for the MAC address for 192.168.2.1 which is sent to AP's LAN interface and then ignored.

How could I make the router work as intended?

The problem is you didn't tell your router where to send the packets, to which device that has access to that network.

You used the IP you have on the same host that can't access the 192.168.2.0/24 network so you are basically telling him to use himself as router for that network, it then sends ARP through the NIC that has the local IP you specified, trying to find the device with 192.168.2.1 IP connected to the same physical network(switch) as 192.168.1.1 NIC.

If you add the route with specifying the remote host in via section then everything should work.

ip route add 192.168.2.0/24 via 192.168.1.2

You then tell your router to send the packets that need to go to 192.168.2.0./24 network to device that has 192.168.1.2 IP, that is on the same network, and then that device will handle the routing to other network.