Alexa app not seeing devices

[routerlooter]

I'm installed a Netgear R7800 router running ACwifidude's NSS build at my parents house, and the WiFi is working well now, after some teething problems that turned out to be nothing to do with the router.

I've been able to use the various TP-Link, Kasa, Tapo, and TCP Smart apps on my Dad's phone to reset the smart plugs and lights and connect them to the IoT 2.4Ghz SSID on the router, and the apps work fine to control them, but although the Alexa app then notifies me that it's detected new devices, when I open it it shows them as non-responsive, so they can't be controlled by it or the Echo Dots. I've tried disabling and re-enabling some of the skills, and it detects and adds the devices again but they're still shown as non-responsive.

Is there anything special I need to do in OpenWRT to allow the Alexa app to see the devices?

At the moment I've assigned the IoT 2.4Ghz SSID to the LAN firewall zone and network because I encountered some problems with the IoT_WAN zone/network that I'd created (my phone wasn't able to get an IP address when the SSID was assigned to that, and I had to make sure they could control their devices before I left as I probably won't get back there until next weekend), so the IoT devices shouldn't be blocked from accessing the Internet by the firewall and should have the same access to it as the devices plugged into the LAN ports, and to the phone which was connected to the main 5Ghz SSID.

[psherman]

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

Also, please clarify -- is your phone on the main lan? Are all of the alexa devies on the IoT_WAN network?

Have you tested to see what happens if you connect your phone to the same network as the alexa devices?

[psherman]

Per this thread, it seems that the issue might be isolate clients turned on for the SSID. This would make it impossible for the alexa devices to be able to control some types of devices.

[routerlooter]

It seems that this probably was the issue. The last test I did yesterday was linking the IoT SSID to the LAN firewall zone and interface and that doesn't have client isolation enabled but the Alexa app was still showing the devices as non-responsive. However I just phoned my Dad to check and he says its not saying that now, so it looks like it's updated since I left.

So the phone and the IoT devices are currently all on the main lan network.

I've pasted my config files below. I've currently got two SSIDs that I'm using for IoT devices, m-IoT and m-X. The the latter is what the cameras at the front of the house were using previously, so I needed to create that SSID temporarily to allow them to work until I can get them down and reset them to use the m-IoT SSID. If I disable client isolation on those two SSIDs and then move them from the LAN interface to the IoT-WAN interface, should that work? I set the options for the IoT-WAN zone to accept, accept, accept when I was trying to get it to work, so should I change those back to reject, accept, reject?

root@OpenWrt:~# ubus call system board
{
        "kernel": "5.15.120",
        "hostname": "OpenWrt",
        "system": "ARMv7 Processor rev 0 (v7l)",
        "model": "Netgear Nighthawk X4S R7800",
        "board_name": "netgear,r7800",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "SNAPSHOT",
                "revision": "r23580+21-b993a00b82",
                "target": "ipq806x/generic",
                "description": "OpenWrt SNAPSHOT r23580+21-b993a00b82"
        }
}

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd88:ca3e:c279::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth1.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'eth0.2'
        option proto 'dhcp'
        option broadcast '1'

config interface 'wan6'
        option device 'eth0.2'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '1 2 3 4 6t'
        option vid '1'
        option description 'LAN'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '0t 5'
        option vid '2'
        option description 'WAN'

config interface 'Guest'
        option proto 'static'
        option ipaddr '10.10.10.10'
        option netmask '255.255.255.0'

config interface 'IoT_WAN'
        option proto 'static'
        option ipaddr '10.30.10.10'
        option netmask '255.255.255.0'
        option device 'br-iot'

config device
        option type 'bridge'
        option name 'br-iot'
        option bridge_empty '1'

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'soc/1b500000.pci/pci0000:00/0000:00:00.0/0000:01:00.0'
        option channel '161'
        option band '5g'
        option htmode 'VHT80'
        option cell_density '0'
        option txpower '27'
        option country 'GB'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'main'
        option encryption 'sae-mixed'
        option key 'r'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'soc/1b700000.pci/pci0001:00/0001:00:00.0/0001:01:00.0'
        option channel '8'
        option band '2g'
        option cell_density '0'
        option country 'GB'
        option htmode 'HT40'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option mode 'ap'
        option ssid 'm-IoT-LAN'
        option encryption 'psk2'
        option key 'r'
        option disabled '1'

config wifi-iface 'wifinet2'
        option device 'radio1'
        option mode 'ap'
        option ssid 'm-Guest'
        option encryption 'psk2'
        option isolate '1'
        option key 'r'
        option network 'Guest'
        option disabled '1'

config wifi-iface 'wifinet3'
        option device 'radio1'
        option mode 'ap'
        option ssid 'm-24G'
        option encryption 'psk2'
        option key 'r'
        option network 'lan'

config wifi-iface 'wifinet4'
        option device 'radio1'
        option mode 'ap'
        option ssid 'm-IoT'
        option encryption 'psk2'
        option network 'lan'
        option key 'r'

config wifi-iface 'wifinet5'
        option device 'radio0'
        option mode 'ap'
        option ssid 'm-IoT-5G'
        option encryption 'sae-mixed'
        option key 'r'
        option disabled '1'\
        option isolate '1'

config wifi-iface 'wifinet6'
        option device 'radio1'
        option mode 'ap'
        option ssid 'm-X'
        option encryption 'psk2'
        option key 'r'
        option network 'lan'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'
        option confdir '/tmp/dnsmasq.d'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        option ra_slaac '1'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'Guest'
        option interface 'Guest'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'

config dhcp 'IoT_WAN'
        option interface 'IoT_WAN'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include 'nss_ecm'
        option type 'script'
        option path '/etc/firewall.d/qca-nss-ecm'
        option family 'any'
        option reload '1'

config zone
        option name 'Guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'Guest'

config zone
        option name 'IoT_WAN'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'IoT_WAN'

config forwarding
        option src 'Guest'
        option dest 'wan'

config forwarding
        option src 'IoT_WAN'
        option dest 'wan'

config forwarding
        option src 'lan'
        option dest 'IoT_WAN'

config zone
        option name 'IoT'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config rule
        option name 'Guest DHCP and DNS'
        option src 'Guest'
        option dest_port '53 67 68'
        option target 'ACCEPT'

config forwarding
        option src 'lan'
        option dest 'IoT'

config rule
        option name 'IoT DHCP and DNS'
        option src 'IoT'
        option target 'ACCEPT'
        option dest_port '53 67 68'

config rule
        option name 'IoT-WAN DHCP and DNS'
        option src 'IoT_WAN'
        option dest_port '53 67 68'
        option target 'ACCEPT'

config rule
        option name 'allow_forward'
        option src 'wan'
        list src_ip '192.168.0.0/16'
        list src_ip '10.0.0.0/8'
        option dest '*'
        option target 'ACCEPT'

config rule
        option name 'Allow-Admin'
        list proto 'tcp'
        option src 'wan'
        option dest_port '20 80 443'
        option target 'ACCEPT'