Android devices refuse to connect, Apple devices regularly drop

Installing and Using OpenWrt
1

Hi all!

So, my issue is similar to that of Android won't connect to wifi but not the same.

My network setup is a bit unique. I use a Unifi UCG-Fiber as gateway/router, and have 2x Belkin RT3200 + 1x Netgear WAX220 acting as APs.

The config is pretty straightforward between the three nodes:

  • bridge all ETH ports into a single bridge type device
  • create bridge-vlan devices for my various VLANs (1 is untagged, main net, 2 is tagged, guest net, etc.)
  • create interfaces mapping the bridge-vlan devices to actual networks as defined by OWRT
root@heimdall:~# cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option packet_steering '1'
	option dhcp_default_duid 'xxxx'

config device 'switch'
	option name 'switch'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'
	list ports 'wan'
	option bridge_empty '1'
	option macaddr 'e8:9f:80:xx:xx:xx'

config bridge-vlan 'lan_vlan'
	option device 'switch'
	option vlan '1'
	option ports 'lan1 lan2 lan3 lan4 wan'

config bridge-vlan 'guest_vlan'
	option device 'switch'
	option vlan '2'
	option ports 'lan1:t lan2:t lan3:t lan4:t wan:t'

config bridge-vlan 'iot_vlan'
	option device 'switch'
	option vlan '3'
	option ports 'lan1:t lan2:t lan3:t lan4:t wan:t'

config bridge-vlan 'vpn_vlan'
	option device 'switch'
	option vlan '12'
	option ports 'lan1:t lan2:t lan3:t lan4:t wan:t'

config interface 'lan'
	option device 'switch.1'
	option proto 'dhcp'

config interface 'guest'
	option proto 'none'
	option device 'switch.2'

config interface 'iot'
	option proto 'none'
	option device 'switch.3'

config interface 'vpn_se'
	option proto 'dhcp'
	option device 'switch.12'

WiFi is similarly straightforward:

  • take default radio config of device + set up beamforming, BSS colouring
  • configure main wifi + side channels (guest net, IoT, VPN)
  • All on WPA2/WPA3 mix (got some older devices

Current config (sensitive data redacted, truncated to main net):

config wifi-device 'radio0'
	option type 'mac80211'
	option phy 'wl0'
	option band '2g'
	option channel 'auto'
	option htmode 'HT40'
	option he_su_beamformee '1'
	option he_bss_color '36'
	option cell_density '2'
	option country 'GB'

config wifi-device 'radio1'
	option type 'mac80211'
	option phy 'wl1'
	option band '5g'
	option channel 'auto'
	option htmode 'HE80'
	option he_su_beamformee '1'
	option he_bss_color '38'
	option cell_density '2'
	option country 'GB'

config wifi-iface 'wifinet0' // Main net, radio0
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option encryption 'sae-mixed'
	option ssid 'xxx'
	option key 'xxx'
	option ieee80211k '1'
	option ieee80211r '1'
	option nasid 'heimdall-2g'
	option mobility_domain 'd00d'
	option ft_over_ds '0'
	option pmk_r1_push '1'
	option time_advertisement '2'
	option time_zone 'GMT0BST,M3.5.0/1,M10.5.0'
	option ocv '2' // this has been 0 for a while, changed for testing, no result

config wifi-iface 'wifinet1' // Main net, radio1
	option mode 'ap'
	option device 'radio1'
	option network 'lan'
	option encryption 'sae-mixed'
	option ssid 'xxx' 
	option key 'xxx'
	option ieee80211k '1'
	option ieee80211r '1'
	option nasid 'heimdall-5g'
	option mobility_domain 'd00d'
	option ft_over_ds '0'
	option pmk_r1_push '1'
	option time_advertisement '2'
	option time_zone 'GMT0BST,M3.5.0/1,M10.5.0'
	option ocv '2' // this has been 0 for a while, changed for testing, no result

And on the WAX220:

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi'
	option band '2g'
	option htmode 'HE40'
	option channel 'auto'
	option he_su_beamformee '1'
	option he_bss_color '54'
	option cell_density '2'
	option country 'GB'
	option noscan '1'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi+1'
	option band '5g'
	option channel 'auto'
	option he_su_beamformee '1'
	option he_bss_color '56'
	option cell_density '2'
	option htmode 'HE80'
	option country 'GB'

config wifi-iface 'wifinet0'
    option mode 'ap'
	option device 'radio0'
	option network 'lan'
	option encryption 'sae-mixed'
	option ssid 'xxx'
	option key 'xxx'
	option ieee80211k '1'
	option ieee80211r '1'
	option nasid 'frigga-2g'
	option mobility_domain 'd00d'
	option ft_over_ds '0'
	option pmk_r1_push '1'
	option time_advertisement '2'
	option time_zone 'GMT0BST,M3.5.0/1,M10.5.0'
    option ocv '2' // this has been 0 for a while, changed for testing, no result

config wifi-iface 'wifinet1'
	option mode 'ap'
	option device 'radio1'
	option network 'lan'
	option encryption 'sae-mixed'
	option ssid 'xxx'
	option key 'xxx'
	option ieee80211k '1'
	option ieee80211r '1'
	option nasid 'frigga-5g'
	option mobility_domain 'd00d'
	option ft_over_ds '0'
	option pmk_r1_push '1'
	option time_advertisement '2'
	option time_zone 'GMT0BST,M3.5.0/1,M10.5.0'
    option ocv '2' // this has been 0 for a while, changed for testing, no result

DHCP and firewall are disabled, as these units are "dumb" APs only.

As you can see, everything is set up correctly, and this config has worked for quite a while, even on snapshot versions.

About a week ago I started noticing my iOS/iPadOS/macOS devices frequently dropping, and as of a few days ago, my older Android devices (Android 11/12/14) are completely refusing to connect.

I've upgraded to latest snapshot a few days ago (after noticing the Android issue, not before!), to r34914, and most recently this morning, to r34989, on all units. Unfortunately, this did not help, the issue is still present. Prior to that I was running a somewhat older build (upgraded them sometime around March).

Funny thing is, if I revert my security to WPA2-PSK, the affected devices all start to act appropriately, as expected. Switching back to WPA3-SAE or WPA2/WPA3 mixed mode results in the Android devices refusing to connect, claiming a bad password, and Apple devices irregularly dropping off WiFi.

I'm suspecting a change in the WPA3 handler, though I can't say why it started happening at all. Nonetheless, breaking compatibility with older Android devices (my Android 16/17 devices seem to be fine!) is not something most people can live with.

2

Are you sure all you devices are WPA3 capable?

Mixed mode is never a good solution, it might create more issues than it solves.

You could try to disable ipv6 too.

3

Try to force cipher to CCMP-AES, I think it now defaults to CCMP-256 which is not liked by older clients

4

Are you sure all you devices are WPA3 capable?

Not all, hence the mixed mode. I do have a handful of IoT devices that sadly refuse to connect to hidden SSIDs (my primary IoT net), and a handful of older game consoles etc. that are WPA2 only.

The issue only seems to appear on WPA3 compatible devices by the way.

You could try to disable ipv6 too.

I'd rather not, given my network is reliant on IPv6.

Try to force cipher to CCMP-AES, I think it now defaults to CCMP-256 which is not liked by older clients

WPA2/WPA3 mixed mode does not allow for setting the cipher unfortunately.

I'll give WPA3 + Force CCMP(AES) (encryption sae+ccmp) a try.

5

Awesome, forcing CCMP worked!

But defaulting to a known "faulty" cipher is not a good move, in my opinion...

(faulty in the sense that compatibility is low)

Also, the cipher field for WPA2/3 mixed is disabled. Might need a fix for that on the frontend.

EDIT: Might've rushed to a conclusion... Android devices are fixed, iOS still keeps dropping off.

6

I did not catch what build you are using but I saw some recent changes regarding this problem, but have no time to look it up

Edit maybe this one? :

7

Maybe those try to use WPA3 and are not happy with CCMP?

As said a working approach is to make two SSID's one with WPA2 + CCMP and one with WPA3

8

We're talking about recent Apple devices (M5 MBP, M5 iPad Pro, iPhone 17 PM), so WPA3 shouldn't be the issue. Right now I'm set up with WPA3+CCMP.

As for builds, I'm on r34989, which is the latest build as of this morning (so about 10 hours ago).

9

Your network config isn't quite right... let's fix that.

First thing to do is fix the bridge-vlan statements. Edit them all so that they look like this:

config bridge-vlan
	option device 'switch'
	option vlan '1'
	list ports 'lan1:u*'
	list ports 'lan2:u*'
	list ports 'lan3:u*'
	list ports 'lan4:u*'
	list ports 'wan:u*'

config bridge-vlan
	option device 'switch'
	option vlan '2'
	list ports 'lan1:t'
	list ports 'lan2:t'
	list ports 'lan3:t'
	list ports 'lan4:t'
	list ports 'wan:t'

config bridge-vlan
	option device 'switch'
	option vlan '3'
	list ports 'lan1:t'
	list ports 'lan2:t'
	list ports 'lan3:t'
	list ports 'lan4:t'
	list ports 'wan:t'

config bridge-vlan
	option device 'switch'
	option vlan '12'
	list ports 'lan1:t'
	list ports 'lan2:t'
	list ports 'lan3:t'
	list ports 'lan4:t'
	list ports 'wan:t'

It is worth stating at this point that it is probably not necessary, nor wise to have all ports configured as trunks unless you actually have VLAN aware devices connected to each port. For example, if you have an unmanaged switch connected to any of these ports, that could cause major problems with your network. Therefore, it makes sense to revisit the above config, but at least this should fix the general syntax issues that existed previously.

Change the vpn_se network to unmanaged (proto 'none'):

As previously mentioned, you should be using either wpa2 (psk2) or wpa3 (sae) not mixed mode.
Also... Remove all 802.11k and r options as well as other options from the config to get back to a more standard space -- delete the lines marked with -:

Do the same for the other radio and the other AP.

10

Sorry, was away for a holiday and haven't had a chance to reply.

Regarding the config:

  1. I wrote this when the big transition (was it 22.x or 23.x?) happened regarding network device definitions and haven't touched since. Marking the untagged bits does seem sensible.
  2. For tagged/untagged markings, I do need them - and I do have an unmanaged switch, however that hasn't caused any issues in the past ~5 years I've ran this config. Tagged networks are there for differentiated subnets, many of them which are exposed via WiFi, and the idea is that the LAN ports of all APs (keep in mind, these are dumb APs!) act as a switch, so I can plug both uplink and downlink into any port.
  3. I need mixed WPA2/WPA3 unfortunately. This is down to a handful of factors:
    1. I use Apple HomeKit, which, at the moment, has no "advanced" way of specifying WiFi networks for devices. It uses the main WiFi associated with the home, in my case, the primary SSID you've seen defined.
    2. Some devices (such as my Nanoleaf lighting setups, but also a number of ESPHome devices, etc.) require WPA2 and do NOT support WPA3. Setting my main net to WPA3 alone would result in those devices dropping from the network and never being able to be used. As per HomeKit issues, these devices cannot be put on a sidechannel network (say, the already existing IOT network and WiFi I've set up, which has a hidden SSID, lowered security to WPA2, and some upstream network rulings to allow HomeKit comms but block other interactions - ESPHome devices use this network, so does my Google Nest display and so on).
  4. 802.11 K and R are used for roaming alongisde usteer to allow devices to move between my 3 APs.

At this moment my main issue seems to be the fact that sae-mixed (WPA2/WPA3 mixed) does not come with the Cipher option to disable CCMP-256, which is the bit causing issues.