Can't ping devices on LAN

I’ve got 2 Access Points attached to my laptop’s ethernet port via a PoE switch. I’ve assigned static IPs & names to them with dnxmasq (successfully, I believe). However, ping and ssh say they’re unreachable. So what have I missed, and how can I successfully ping 10.0.0.10?

More info: The dnsmasq logs confirm that the DHCP transaction was successful, and my APs should now be 10.0.0.10 and 10.0.0.11, on an infinite lease. My laptop’s ethernet interface enp0s31f6 is on 10.0.0.0, and I can ping 10.0.0.0, even without dnsmasq running.

(Stack-wise, I’m using systemd, wayland, sway (started from console, no logind / display manager). iwd for wireless (so no NetworkManager). I’m listing these in case there’s some GDM/Gnome/NM magic that would set up interfaces better or something)

My main theory is that something I haven’t done with either ip or dnsmasq somehow "enables routing".

To start the system running, I do (as root):

# ip link set enp0s31f6 up
# ip addr add 10.0.0.0/16 dev enp0s31f6
# systemctl start dnsmasq.service

Here’s the machine that doesn’t go "ping":

$ ping 10.0.0.10
PING 10.0.0.10 (10.0.0.10) 56(84) bytes of data.
From 10.0.0.0 icmp_seq=1 Destination Host Unreachable
From 10.0.0.0 icmp_seq=2 Destination Host Unreachable
From 10.0.0.0 icmp_seq=3 Destination Host Unreachable
[...]

On the plus side it appears to know that pings to this IP need to come from the ethernet interface’s IP. Worth adding that iwd / wifi networking works fine and I can ping hosts on the internet.

I haven’t used ip route to set anything manually, but it looks like it does the right thing(?):

$ ip route | grep 10.0
10.0.0.0/16 dev enp0s31f6 proto kernel scope link src 10.0.0.0

ip address confirms that I’ve added the 10.* subnet (if that’s the right term). I’ve snipped the output here to show only the relevant interface:

$ ip addr
...
2: enp0s31f6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether e8:6a:64:1f:02:64 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.0/16 scope global enp0s31f6
       valid_lft forever preferred_lft forever
    inet6 fe80::ea6a:64ff:fe1f:264/64 scope link proto kernel_ll 
       valid_lft forever preferred_lft forever
...

Here’s /etc/dnsmasq.conf

interface=enp0s31f6
dhcp-authoritative
bind-interfaces

# Static IPs: (mac, name, IP, lease-time)
dhcp-host=e8:6a:64:1f:02:64,host,10.0.0.0,infinite
dhcp-host=78:8a:20:06:b1:b0,ap1,10.0.0.10,infinite
dhcp-host=18:e8:29:47:66:a4,ap2,10.0.0.11,infinite

# Dynamic range of IPs to supply:
dhcp-range=10.0.1.0,10.0.100.255,255.255.0.0,5m # TODO change 5m @@

## Probably-irrelevant DNS stuff:
# Set gateway / probably only for internet forwarding
dhcp-option=3,10.0.0.0
# Set DNS servers to announce / ?
dhcp-option=6,10.0.0.0