Apple/AirPlay Protocol not working

simon_lefisch · May 18, 2024, 3:55pm

Hello everyone!

I’m wondering if someone can help me out or provide a bit of info for my issue…..

I have a pfSense firewall with a LAN VLAN and a WLAN VLAN with all traffic/protocols allowed between them, a Netgear R7800 running OpenWRT as a dumb AP, and a TP-Link EAP615v1 AP that is also running OpenWRT.

Both APs are configured using Dynamic PSK, and they work perfect as far as the “password based VLAN” function. However I’ve noticed that the when using Apple devices, the AirPlay protocol doesn’t seem to be working on the R7800 (ie; from my iPhone to my Apple TV). When connected to the TP-Link AP, I can AirPlay just fine.

So I’m curious if anyone has had any issues with the AirPlay protocol, or any other Apple protocols, using an R7800 or any other device. When I was first configuring the R7800, it was a bit of a mess to get it working so I reset it just to be sure nothing was “stuck” and reconfigured from scratch (re-flashed OpenWRT). I know for sure it has nothing to do with my pfSense since, as I mentioned before, AirPlay works just fine on the TP-Link AP.

Thanks for any insight anyone can provide

trendy · May 18, 2024, 7:38pm

Do you mean that when both Apple devices are connected to the TP-Link , Airplay is working, but when both devices are connected to the R7800 it is not? Are you sure you haven't enabled client isolation in R7800?
It's not when one device is on TP-Link and the other on R7800?

simon_lefisch · May 19, 2024, 5:38am

Hello @trendy, thanks for the reply.

Yes, when both iPhone and Apple TVs are on the TP-Link APs, airplay works great. When both are on the R7800, I cannot airplay.

I did check client isolation on the R7800 and it is not enabled. It is strange that everything works fine on the TP-Link but not the R7800. I’ve gone over all the settings between both APs and they are the same. Any other ideas?

If you need any config info, let me know and I will gladly share.

LilRedDog · May 19, 2024, 6:03am

Remove the one that works and then try.
However you need to do it. This will isolate a daisy-chain problem.

simon_lefisch · May 19, 2024, 6:17am

Hi @LilRedDog, not sure what you mean, but I assume you talking about removing the working AP? If so, the TP-Link AP is not in use. I tested everything separately.

If this isn’t what you mean, can you clarify?

LilRedDog · May 19, 2024, 6:30am

Yes, that is what I meant.

Save your config and make your client the 'working AP'.
It will only help. one way or another.
Then you can use the save to restore it.

simon_lefisch · May 19, 2024, 3:52pm

I guess maybe I’m still a little confused. You want me to save the config of the TP-Link (which I already made a backup of after I configured it JIC) and restore it to the R7800? If that’s what you mean, won’t that cause issues on the R7800 since it’s a totally different device? Especially since the R7800 has a physical switch and the TP-Link has a virtual switch (DSA IIRC).

Sorry for all the questions, just tryin g to make sure I understand what you’re asking me to do.

trendy · May 19, 2024, 5:11pm

Could you post a bit here the following from the R7800?

Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have

ubus call system board; \
uci export network; uci export wireless; \
uci export dhcp; uci export firewall

simon_lefisch · May 19, 2024, 6:08pm

@trendy info is below. Passwords have been redacted and SSID's and IPs have been changed to something generic.

Note that the R7800 is NOT handling DHCP or Firewall. That is all done by my pfSense.

root@R7800:~# ubus call system board
{
	"kernel": "5.15.137",
	"hostname": "R7800",
	"system": "ARMv7 Processor rev 0 (v7l)",
	"model": "Netgear Nighthawk X4S R7800",
	"board_name": "netgear,r7800",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05.2",
		"revision": "r23630-842932a63d",
		"target": "ipq806x/generic",
		"description": "OpenWrt 23.05.2 r23630-842932a63d"
	}
}

root@R7800:~# uci export network
package network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd60:c227:0684::/48'
	option packet_steering '1'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '1 2 3 4 6t'

config switch_vlan
	option device 'switch0'
	option vlan '20'
	option ports '4t 6t'

config switch_vlan
	option device 'switch0'
	option vlan '21'
	option ports '4t 6t'

config device
	option type 'bridge'
	option name 'br-vlan1'
	list ports 'eth1.1'

config device
	option type 'bridge'
	option name 'br-vlan20'
	list ports 'eth1.20'

config device
	option type 'bridge'
	option name 'br-vlan21'
	list ports 'eth1.21'

config interface 'vlan1'
	option device 'br-vlan1'
	option proto 'static'
	option ipaddr '192.168.1.200'
	option netmask '255.255.255.0'
	option gateway '192.168.1.1'
	list dns '192.168.1.1'

config interface 'vlan20'
	option proto 'none'
	option device 'br-vlan20'

config interface 'vlan21'
	option proto 'none'
	option device 'br-vlan21'

root@R7800:~# uci export wireless
package wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'soc/1b500000.pci/pci0000:00/0000:00:00.0/0000:01:00.0'
	option channel '36'
	option band '5g'
	option htmode 'VHT160'
	option cell_density '0'
	option country 'US'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan vlan1'
	option mode 'ap'
	option ssid 'SSID1'
	option encryption 'psk2'
	option key '********'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'soc/1b700000.pci/pci0001:00/0001:00:00.0/0001:01:00.0'
	option channel '2'
	option band '2g'
	option htmode 'HT40'
	option cell_density '0'
	option country 'US'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan vlan1'
	option mode 'ap'
	option ssid 'SSID2'
	option encryption 'psk2'
	option key '**********'

config wifi-iface 'wifinet2'
	option device 'radio1'
	option mode 'ap'
	option ssid 'SSID3'
	option encryption 'psk2'
	option key '***********'
	option network 'vlan21'

config wifi-vlan
	option name 'vl20'
	option network 'vlan20'
	option vid '20'

config wifi-station
	option key '**********'
	option vid '20'

root@R7800:~# uci export dhcp
package dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

root@R7800:~# uci export firewall
package firewall

config defaults
	option syn_flood '1'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

trendy · May 19, 2024, 8:34pm

Remove the lan.

I have never seen these before. WiFi is not aware of vlans, you should only bridge the SSID to an vlan subinterface.

Does it mean that they are stopped and disabled as services according to the dumbAP guide?
And are both problematic devices connected to the same SSID?

simon_lefisch · May 20, 2024, 9:09pm

The LAN is used for my laptop to connect to wirelessly. This is so I can connect to specific devices on VLAN (ie; servers, etc)

I started a thread and was able to resolve the issue I had in using this post. The current configuration I have for the R7800 was provided by the user NPeca76. If there is a different/better/correct way to configure the device with the DPSK function, I am more than willing to reconfigure it.

Also, this post is the configuration I was given for my TP-Link AP, which AirPlay works flawlessly on. I tried to mirror that config on the R7800 to the best of my ability but was unsuccessful. That's when I started the thread for the R7800 I referenced above.

Correct. DHCP, DNS, and Firewall services on the R7800 or stopped per the Dumb AP guide. I also pasted the script that will keep those services disabled when upgrading the firmware on the device.

Both devices are not on the same SSID, but they are on the same subnet. The reason for this is that browsing devices like iPhone/latops/etc use the "smaller pipe" of 2.4GHz and Apple TVs use the "larger pipe" for streaming. I'd prefer to have the Apple TVs hard wired but I haven't ran wire yet, so using 5GHz works for now. When using the TP-Link AP it is the same...iPhones on 2.4GHz radio and Apple TV on 5GHz. However AirPlay works fine even though they are on different SSIDs.

trendy · May 21, 2024, 10:43am

There is no lan interface.

Are you using Dynamic PSK/Password-based VLANs? It doesn't seem so, therefore you shouldn't complicate your setup. Bind one SSID to one vlan subinterface and that's enough.

I would also try to have them on the same SSID to verify if it works there.
Worst case, take a backup of the device, restore to defaults, make minimal changes to bring up WiFi SSIDs and test again.

simon_lefisch · May 21, 2024, 3:31pm

Ok, but let me describe what I would like with this unit....I would like it to be managed from the LAN VLAN (ie; 192.168.50.0/24 network). Then I can have the SSIDs for a different subnet (ie; 172.16.20.0/24 subnet). IF I need to reconfigure so I can manage the device from the LAN, that's fine.

Yes that's what I am trying to do. I am going to remove the Guest Wifi radio. However I do want to be able to connect to the LAN VLAN when needed.

If this helps, I have 3 VLANs, LAN (mainly for wired devices), WLAN (wireless devices), and Guest WLAN.

Ok I'll give that a try when I get home and get back to you.

trendy · May 21, 2024, 7:50pm

There is vlan1 interface for that. lan interface doesn't exist, so there is no need to define it in wireless or other configurations.

This is not dynamic vlan.
What you should try to do is to bind one vlan subinterface to one SSID. Then you can connect to one SSID and be assigned to a specific vlan.

simon_lefisch · May 21, 2024, 9:30pm

Ok so I assume you mean to remove LAN entry out of the configuration below in the option network section of each radio? That's the only place where I can see anything referencing LAN.

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan vlan1'
        option mode 'ap'
        option ssid 'SSID1'
        option encryption 'psk2'
        option key '**********'
        option disabled '1'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan vlan1'
        option mode 'ap'
        option ssid 'SSID2'
        option encryption 'psk2'
        option key '**********'
        option disabled '1'

So I will bind it to VLAN1. Will that work?

simon_lefisch · May 22, 2024, 5:29am

So I tried having both devices on the same SSID and AirPlay does work. So seems like the config is incorrect on the AP. So you have any suggestions on how to configure it correctly?

psherman · May 22, 2024, 5:42am

Let's see the config you used in the latest test:

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

simon_lefisch · May 22, 2024, 6:07am

@psherman below is the info is below.

root@R7800:~# ubus call system board
{
        "kernel": "5.15.137",
        "hostname": "R7800",
        "system": "ARMv7 Processor rev 0 (v7l)",
        "model": "Netgear Nighthawk X4S R7800",
        "board_name": "netgear,r7800",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.2",
                "revision": "r23630-842932a63d",
                "target": "ipq806x/generic",
                "description": "OpenWrt 23.05.2 r23630-842932a63d"
        }
}

root@R7800:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd60:c227:0684::/48'
        option packet_steering '1'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '1 2 3 4 6t'

config switch_vlan
        option device 'switch0'
        option vlan '20'
        option ports '4t 6t'

config switch_vlan
        option device 'switch0'
        option vlan '21'
        option ports '4t 6t'

config device
        option type 'bridge'
        option name 'br-vlan1'
        list ports 'eth1.1'

config device
        option type 'bridge'
        option name 'br-vlan20'
        list ports 'eth1.20'

config device
        option type 'bridge'
        option name 'br-vlan21'
        list ports 'eth1.21'

config interface 'vlan1'
        option device 'br-vlan1'
        option proto 'static'
        option ipaddr '192.168.50.200'
        option netmask '255.255.255.0'
        option gateway '192.168.50.1'
        list dns '192.168.50.1'

config interface 'vlan20'
        option proto 'none'
        option device 'br-vlan20'

config interface 'vlan21'
        option proto 'none'
        option device 'br-vlan21'

root@R7800:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'soc/1b500000.pci/pci0000:00/0000:00:00.0/0000:01:00.0'
        option channel '36'
        option band '5g'
        option htmode 'VHT160'
        option cell_density '0'
        option country 'US'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'vlan1'
        option mode 'ap'
        option ssid 'SSID1'
        option encryption 'psk2'
        option key '********'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'soc/1b700000.pci/pci0001:00/0001:00:00.0/0001:01:00.0'
        option channel '2'
        option band '2g'
        option htmode 'HT40'
        option cell_density '0'
        option country 'US'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'vlan1'
        option mode 'ap'
        option ssid 'SSID2'
        option encryption 'psk2'
        option key '*********'

config wifi-vlan
        option name 'vl20'
        option network 'vlan20'
        option vid '20'

config wifi-station
        option key '********'
        option vid '20'

config wifi-vlan
        option name 'vl21'
        option network 'vlan21'
        option vid '21'

config wifi-station
        option key '*********'
        option vid '21'

root@R7800:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

root@R7800:~# cat /etc/config/firewall

config defaults
        option syn_flood '1'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

psherman · May 22, 2024, 6:16am

Try removing all of this.

simon_lefisch:

config wifi-vlan
        option name 'vl20'
        option network 'vlan20'
        option vid '20'

config wifi-station
        option key '********'
        option vid '20'

config wifi-vlan
        option name 'vl21'
        option network 'vlan21'
        option vid '21'

config wifi-station
        option key '*********'
        option vid '21'

simon_lefisch · May 22, 2024, 6:19am

If I remove all that, how will I be able to connect to the correct password based VLAN?