Archer AX23 - Hardware or software issue?

TechFish · August 31, 2026, 7:39pm

I have an Archer AX23 AX1800 vers 1 with openwrt with 24.10.3. My internet service is 1000/750 Fiber. As noted in this thread, some users were trying to help me troubleshoot on why I get lower than expected speeds:

Wired: 650-700/550-600
Wireless (right beside the router): 180/100-120

What I've tried:

A variety of different ethernet cables;
Setting packet steering set to enabled or enabled (all cpus);
Setting flow offloading type to Software or Hardware; and
Enabling the 5Ghz wireless network + 802.11k (Neighbor Reports) and 802.11v (BSS Transition Management). WiFi speeds did increase to 400/300-400.

However, there wasn't a determination on whether this is a software or hardware issue. Any advice would be appreciated.

frollic · August 31, 2026, 7:50pm

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):

Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

TechFish · August 31, 2026, 8:10pm

{
	"kernel": "6.6.104",
	"hostname": "OpenWrt",
	"system": "MediaTek MT7621 ver:1 eco:3",
	"model": "TP-Link Archer AX23 v1",
	"board_name": "tplink,archer-ax23-v1",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "24.10.3",
		"revision": "r28872-daca7c049b",
		"target": "ramips/mt7621",
		"description": "OpenWrt 24.10.3 r28872-daca7c049b",
		"builddate": "1758316778"
	}
}

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd98:...'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config bridge-vlan
	option device 'br-lan'
	option vlan '1'
	list ports 'lan1:u*'
	list ports 'lan2:u*'
	list ports 'lan3:u*'

config bridge-vlan
	option device 'br-lan'
	option vlan '10'
	list ports 'lan1:t'
	list ports 'lan4:u*'

config bridge-vlan
	option device 'br-lan'
	option vlan '20'
	list ports 'lan1:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '30'
	list ports 'lan1:t'

config interface 'lan'
	option device 'br-lan.1'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'work'
	option device 'br-lan.10'
	option proto 'static'
	option ipaddr '192.168.10.1'
	option netmask '255.255.255.0'

config interface 'guest'
	option device 'br-lan.20'
	option proto 'static'
	option ipaddr '192.168.20.1'
	option netmask '255.255.255.0'

config interface 'iot'
	option device 'br-lan.30'
	option proto 'static'
	option ipaddr '192.168.30.1'
	option netmask '255.255.255.0'

config interface 'wan'
	option device 'wan.40'
	option proto 'pppoe'
	option username 'xxx'
	option password 'xxx'
	option ipv6 'auto'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

config device
	option name 'wan.40'
	option type '8021q'
	option ifname 'wan'
	option vid '40'
	option mtu '1492'

config device
	option name 'wan'
	option mtu '1492'

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
	option band '2g'
	option channel '1'
	option htmode 'HE20'
	option cell_density '0'

config wifi-device 'radio1'
	option type 'mac80211'
	option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0+1'
	option band '5g'
	option channel '36'
	option htmode 'HE80'
	option cell_density '0'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option ssid 'xxx'
	option encryption 'sae-mixed'
	option key 'xxx'
	option ocv '0'
	option ieee80211k '1'
	option bss_transition '1'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid 'xxx'
	option encryption 'sae-mixed'
	option key 'xxx'
	option ocv '0'
	option ieee80211k '1'
	option bss_transition '1'

config wifi-iface 'wifi_work'
	option device 'radio0'
	option mode 'ap'
	option ssid 'yyy'
	option encryption 'sae-mixed'
	option key 'xxx'
	option network 'work'
	option hidden '1'
	option ocv '0'
	option ieee80211k '1'
	option bss_transition '1'
	option isolate '1'

config wifi-iface 'wifi_work_5g'
	option device 'radio1'
	option mode 'ap'
	option ssid 'yyy'
	option encryption 'sae-mixed'
	option key 'xxx'
	option network 'work'
	option hidden '1'
	option ocv '0'
	option ieee80211k '1'
	option bss_transition '1'
	option isolate '1'

config wifi-iface 'wifi_guest'
	option device 'radio0'
	option mode 'ap'
	option ssid 'zzz'
	option encryption 'sae-mixed'
	option key 'xxx'
	option network 'guest'
	option ieee80211k '1'
	option bss_transition '1'
	option ocv '0'
	option isolate '1'

config wifi-iface 'wifi_guest_5g'
	option device 'radio1'
	option mode 'ap'
	option ssid 'zzz'
	option encryption 'sae-mixed'
	option key 'xxx'
	option network 'guest'
	option ieee80211k '1'
	option bss_transition '1'
	option ocv '0'
	option isolate '1'

config wifi-iface 'wifi_iot'
	option device 'radio0'
	option mode 'ap'
	option ssid 'aaa'
	option encryption 'psk2'
	option network 'iot'
	option ieee80211k '1'
	option bss_transition '1'
	option key 'xxx'

config wifi-iface 'wifi_iot_5g'
	option device 'radio1'
	option mode 'ap'
	option ssid 'aaa'
	option encryption 'psk2'
	option key 'xxx'
	option network 'iot'
	option ieee80211k '1'
	option bss_transition '1'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	option ra_slaac '1'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'work'
	option interface 'work'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'

config dhcp 'guest'
	option interface 'guest'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'

config dhcp 'iot'
	option interface 'iot'
	option start '100'
	option limit '150'
	option leasetime '24h'
	option dhcpv4 'server'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'
	option flow_offloading '1'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'work'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'work'

config forwarding
	option src 'work'
	option dest 'wan'

config zone
	option name 'guest'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'guest'

config forwarding
	option src 'guest'
	option dest 'wan'

config zone
	option name 'iot'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'iot'

config forwarding
	option src 'iot'
	option dest 'wan'

# Exceptions

config rule
	option name 'Allow-IoT-DNS-DHCP'
	option src 'iot'
	option dest_port '53 67 68'
	option proto 'udp'
	option target 'ACCEPT'

config rule                                     
        option name 'Allow-IoT-DNS-DHCP'    
        option src 'work'                        
        option dest_port '53 67 68'            
        option proto 'udp'                   
        option target 'ACCEPT' 

config rule                                     
        option name 'Allow-IoT-DNS-DHCP'    
        option src 'guest'                        
        option dest_port '53 67 68'            
        option proto 'udp'                   
        option target 'ACCEPT'

frollic · August 31, 2026, 8:14pm

24.10.3 is very outdated and out of support, start by upgrading.

Remember the way the IP's written in the config changed starting 25.12, you should change to the new format just before you do the upgrade.

LilRedDog · August 31, 2026, 8:20pm

How many APs do you have?

frollic · August 31, 2026, 8:27pm

Is also a bad encryption.

TechFish · August 31, 2026, 8:57pm

I updated the firmware - same issue.

I have no additional AP other than the router.

What encryption do you recommend? Is this what is causing the wifi speeds to drop?

LilRedDog · August 31, 2026, 9:01pm

k tracks traffic across APs and picks the best throughput AP, not strongest signal.

BSS handles transitions/hand offs between APs.

You do not need them.
r has its own issues but you are not roaming so, you do not need that either.

Will this fix throughput? I dunno: I know your router is wasting cycles trying to do nothing if you keep them.

egc · September 1, 2026, 5:53am

Set a country code on both radio's

Use a different SSID for 2.4 and 5 GHz so that you know on which band you are

And update to at least 24.10.8 but better 25.12.5

eginnc · September 1, 2026, 12:53pm

WPA2-PSK with Forced CCMP (AES); option encryption 'psk2+ccmp'

128 bit is fine. If you choose CCMP-256 bit, you risk losing hardware wifi encryption, which won't help your speed problem. Older clients can choke on 256 bit too.

Use a good password (~60 bits of entropy) and it doesn't matter if an attacker captures your password hash. The cost of the electricity alone for a theoretical brute force attack would be many millions of dollars.

sae-mixed is false security - an attacker can just request a downgrade from WPA3 to WPA2 anyway - and as noted it usually just causes trouble in a home full of clients. I've found WPA3 to be troublesome as well and gave up on it.