BPI-R3 fail on Guest wireless SSID's

Hi,

I Installed a new BPI-R3 with the latest Openwrt release (OpenWrt 23.05.0 r23497-6637af95aa / LuCI openwrt-23.05 branch git-23.236.53405-fc638c8) and took over DNS registrations for my local devices and recreated my local wireless SSID's.

It didn't stay on for more then an hour when clients were connected to the guest ssid's (2 identical SSID's for 2.4 and 5Ghz). This is a home setup with less then 30 devices connected in total, replacing a 6 year old TP-Link, running the same tasks.

After adding thermal pads to all the 6 chips (two pads were included with the supplied fan controlled cooler) it looks like temperature is not an issue.

I configured the guest id's identical to the old router (also Openwrt 22.x version), and after the crashed threw it away and recreated these using the documentation on this site.

Logs only show DNSmasq entries (allready changed the logs to stay after power cycle, and put the logs to warning level).

On my main SSID it all works and I haven't seen strange devices on the guest id.

So it looks to me, no issues are there anymore on the temps, leaving configuration as a source for problems.

How to troubleshoot this, supply you with data to investigate with me?

Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have

ubus call system board; \
uci export network; uci export wireless; \
uci export dhcp; uci export firewall; \
ls -l  /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*

Thanks for the instruction, here I go with the details:

{
        "kernel": "5.15.134",
        "hostname": "OpenWrt",
        "system": "ARMv8 Processor rev 4",
        "model": "Bananapi BPI-R3",
        "board_name": "bananapi,bpi-r3",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.0",
                "revision": "r23497-6637af95aa",
                "target": "mediatek/filogic",
                "description": "OpenWrt 23.05.0 r23497-6637af95aa"
        }
}
package network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd60:f33f:503f::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'sfp2'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ip6assign '60'
        list ipaddr '192.168.0.1/24'

config device
        option name 'br-wan'
        option type 'bridge'
        list ports 'eth1'
        list ports 'sfp2'

config device
        option name 'eth1'
        option macaddr 'macadress'

config device
        option name 'wan'
        option macaddr 'macadress'

config interface 'wan'
        option device 'eth1.6'
        option proto 'pppoe'
        option username 'provideruser'
        option password 'providerpass'
        option ipv6 'auto'

config interface 'wan6'
        option device 'br-wan'
        option proto 'dhcpv6'

config device
        option type '8021q'
        option ifname 'eth1'
        option vid '6'
        option name 'eth1.6'
        option mtu '1508'

config interface 'guest'
        option proto 'static'
        list ipaddr '192.168.2.1/24'
        list dns '208.67.222.222'
        list dns '208.67.220.220'

package wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option channel '6'
        option band '2g'
        option htmode 'HE40'
        option cell_density '0'
        option country 'NL'
        option txpower '15'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'Zee'
        option encryption 'sae-mixed'
        option isolate '1'
        option key 'wirelesskey'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option channel '36'
        option band '5g'
        option htmode 'HE80'
        option cell_density '1'
        option country 'NL'
        option txpower '20'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'Zee'
        option encryption 'sae-mixed'
        option key 'wirelesskey'
        option isolate '1'

config wifi-iface 'wifinet2'
        option device 'radio0'
        option mode 'ap'
        option ssid 'naamkleineman'
        option encryption 'sae-mixed'
        option key 'wirelesskey'
        option network 'guest'
        option disabled '1'

config wifi-iface 'wifinet3'
        option device 'radio1'
        option mode 'ap'
        option ssid 'naamkleineman'
        option encryption 'sae-mixed'
        option key 'wirelesskey'
        option network 'guest'
        option disabled '1'

package dhcp

config dnsmasq
        option localise_queries '1'
        option rebind_protection '1'
        option domain 'mydomain.nl'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'
        option logqueries '1'
        list server '185.93.175.43'
        list server '185.232.98.76'
        option nonwildcard '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'
        list dhcp_option '3,192.168.0.1'
        list dhcp_option '6,192.168.0.1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config domain
        option ip '192.168.0.5'
        option name 'nas'

config host
        option name 'printer'
        option ip '192.168.0.8'
        option mac 'macadress'

config host
        option ip '192.168.0.2'
        option name 'repeater'
        option mac 'macadress'

config host
        option name 'Marantz'
        option mac 'macadress'
        option ip '192.168.0.7'

config domain
        option ip '192.168.0.5'
        option name 'wa'

config domain
        option name 'ais'
        option ip '192.168.0.5'

config domain
        option ip '192.168.0.5'
        option name 'www'

config domain
        option name 'printer'
        option ip '192.168.0.8'

config host
        option name 'musicbox'
        option ip '192.168.0.9'
        option mac 'macadress'

config domain
        option ip '192.168.0.9'
        option name 'pihole'

config domain
        option name 'webint'
        option ip '192.168.0.5'

config host
        option name 'ntb100886'
        option mac 'macadress'
        option ip '192.168.0.66'

config dhcp 'LAN3'
        option interface 'LAN3'
        option ignore '1'

config host
        option dns '1'
        option mac 'macadress'
        option name 'nas'
        option ip '192.168.0.5'

config domain
        option ip '192.168.0.5'
        option name 'kdav'

config domain
        option name 'wm'
        option ip '192.168.0.21'

config domain
        option name 'mc01'
        option ip '192.168.0.21'

config domain
        option name 'smtp'
        option ip '192.168.0.21'

config domain
        option name 'carddav'
        option ip '192.168.0.5'

config domain
        option name 'mail'
        option ip '192.168.0.21'

config domain
        option name 'autodiscover'
        option ip '192.168.0.21'

config domain
        option name 'autoconfig'
        option ip '192.168.0.21'

config domain
        option name 'nc'
        option ip '192.168.0.21'

config domain
        option name 'MI'
        option ip '192.168.254.155'

config host
        option name 'macbook-roelof'
        option dns '1'
        option mac 'macadress'
        option ip '192.168.0.252'
        option duid '0001000129919c5760f81db6928a'

config host
        option name 'Laptop-judith'
        option dns '1'
        option mac 'macadress'
        option ip '192.168.0.186'
        option duid '000100011f9ad3b0548ca0d8518d'

config host
        option name 'GW-macadress'
        option ip '192.168.0.149'
        option mac 'macadress'

config host
        option name 'pc-judith'
        option dns '1'
        option mac 'macadress'
        option ip '192.168.0.205'

config domain
        option ip '192.168.0.5'
        option name 'taiga'

config host
        option name 'envoy'
        option ip '192.168.0.183'
        option mac 'macadress'

config domain
        option name 'ncnz'
        option ip '192.168.0.21'

config domain
        option name 'off'
        option ip '192.168.0.21'

config dhcp 'guest'
        option interface 'guest'
        option start '100'
        option limit '150'
        option leasetime '12h'
        list dhcp_option '3,192.168.2.1'
        list dhcp_option '6,208.67.222.222,208.67.220.220'

package firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'
        option flow_offloading '1'
        option flow_offloading_hw '1'
        option drop_invalid '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        option masq '1'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'FWGuest'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'guest'

config forwarding
        option src 'FWGuest'
        option dest 'wan'

config forwarding
        option src 'wan'
        option dest 'lan'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'wm.mydomain.nl'
        option src 'wan'
        option src_dport '443'
        option dest_ip '192.168.0.21'
        option dest_port '443'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'HTTP Port Forwarding'
        list proto 'tcp'
        option src 'wan'
        option src_dport '80'
        option dest_ip '192.68.0.21'
        option dest_port '80'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'Crashplan Forwarding'
        option src 'wan'
        option src_dport '4242'
        option dest_ip '192.168.0.5'
        option dest_port '4242'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'ac server 8081'
        option src 'wan'
        option src_dport '8081'
        option dest_ip '192.168.0.205'
        option dest_port '8081'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'ac 9600'
        option src 'wan'
        option src_dport '9600'
        option dest_ip '192.168.0.205'
        option dest_port '9600'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'ac server 27000-27037'
        option src 'wan'
        option src_dport '27000-27037'
        option dest_ip '192.168.0.205'
        option dest_port '27000-27037'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'ac server 4380'
        option src 'wan'
        option src_dport '4380'
        option dest_ip '192.168.0.205'
        option dest_port '4380'

config rule
        option name 'Block Printer'
        option src 'lan'
        list src_ip '192.168.0.8'
        option dest 'wan'
        option target 'REJECT'

config rule
        option name 'Jellyfin'
        option src 'FWGuest'
        option src_port '8096'
        option dest 'lan'
        list dest_ip '192.168.0.5'
        option dest_port '8096'
        option target 'ACCEPT'

config rule
        option name 'Ping outbound'
        list proto 'igmp'
        option src 'FWGuest'
        option dest 'wan'
        option target 'ACCEPT'

config rule
        option name 'Guest DHCP'
        list proto 'udp'
        option src 'FWGuest'
        option target 'ACCEPT'
        option dest_port '67-68'
        option enabled '0'

config rule
        option name 'Guest DNS'
        option src 'FWGuest'
        option dest_port '53'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Block guest acces to LAN'
        list proto 'all'
        option src 'FWGuest'
        option dest 'lan'
        option target 'DROP'

lrwxrwxrwx    1 root     root            16 Oct  9 21:45 /etc/resolv.conf -> /tmp/resolv.conf
-rw-r--r--    1 root     root            55 Nov  4 22:42 /tmp/resolv.conf
-rw-r--r--    1 root     root           124 Nov  4 22:40 /tmp/resolv.conf.d/resolv.conf.auto
-rw-r--r--    1 root     root            50 Nov  4 22:40 /tmp/resolv.conf.ppp

/tmp/resolv.conf.d:
-rw-r--r--    1 root     root           124 Nov  4 22:40 resolv.conf.auto
==> /etc/resolv.conf <==
search mydomain.nl
nameserver 127.0.0.1
nameserver ::1

==> /tmp/resolv.conf <==
search mydomain.nl
nameserver 127.0.0.1
nameserver ::1

==> /tmp/resolv.conf.d <==
head: /tmp/resolv.conf.d: I/O error

==> /tmp/resolv.conf.ppp <==
nameserver 185.93.175.43
nameserver 185.232.98.76

==> /tmp/resolv.conf.d/resolv.conf.auto <==
# Interface wan
nameserver 185.93.175.43
nameserver 185.232.98.76
# Interface wan_6
nameserver 2a10:3780:2:52:185:93:175:43

In testing I had the two Guest rules active (Guest DNS and Guest DHCP), but then also it failed. Off coarse I had the Guest SSID's active when testing.

Overall the configuration is not too wrong. A few remarks:
sfp2 is part of both lan and wan bridge. In general wan bridge is not needed and can cause other issues, so better remove it.

With option ipv6 auto you create a pseudointerface wan_6 to handle IPv6 traffic. You can delete the wan6.

DNS servers should not be entered there.

If you want to advertise them to the guest clients, the option 6 in dhcp is the way. Option 3 is not needed, it is automatic.

masquerade on lan is not needed

It doesn't make any difference, the input policy for guest zone is to allow all.

You probably shouldn't allow wan->lan :slight_smile:

Ping is ICMP protocol, not IGMP, and the rule is not needed as you have already the guest->wan forwarding enabled.

There is no forwarding from guest->lan, so the rule is not needed.

  1. It's not clear if any device ever managed to connect to the guest SSID. I understand from the sentence that they were connected for an hour.

Then I understand that something crashed.
2. Do the devices connect to the guest SSID? Have you tried with a device that successfully connects to the lan SSID, e.g your laptop or mobile phone?
3. Is there anything in the logs when a device tries to connect?

I changed all the minor points (however minor, looking at wan to lan, hmm, thanks!)
Devices were able to connect to the guest network, it was the media box for instance, succesfully connecting to the network, and now also connected to the network using the active radio's. After two hours it disconnected, and the fan was at a higher pitch, router inaccessible, also by wire.

I looked at the logs when the router crashed and after reboot, did not see anything going wrong.

I will test later today if the changes have an impact, and if the logging differs when connecting devices to either networks.
I also have monitoring active for cpu, memory and temps, now no special readings, everyting pritty low, 55 degrees C is the highest for I think the active SFP.

I would also check the power supply. It is a silent suspect in such cases.

There’s a couple of known bugs that could explain what you’re seeing :

Shrug,
I am running the latest and greatest release on my BPI-R3, and played with snapshots, and rc's before.
I have never witnessed a freeze, nor instability.

Thanks for all your input!

@buggz are you using the wireless part, are you using an sfp to connect to fiber? What case are you using and cooling? There may be differences.
Also the topics about instability do exist, I am nog the only one having issues with the router.

I did some testing and when enabling the guest network, dhcp is extremely slow. No output in the logging, so the why of it is puzzling. I ran a short test and with this finding I quitted the testing.

I also did some load testing using: https://github.com/richb-hanover/OpenWrtScripts These ran without a problem.

Below the current (changed) config, hope you can find what is going wrong.

	"kernel": "5.15.134",
	"hostname": "OpenWrt",
	"system": "ARMv8 Processor rev 4",
	"model": "Bananapi BPI-R3",
	"board_name": "bananapi,bpi-r3",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05.0",
		"revision": "r23497-6637af95aa",
		"target": "mediatek/filogic",
		"description": "OpenWrt 23.05.0 r23497-6637af95aa"
	}
}
package network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd60:f33f:503f::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'
	list ports 'sfp2'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ip6assign '60'
	list ipaddr '192.168.0.1/24'

config device
	option name 'br-wan'
	option type 'bridge'
	list ports 'eth1'
	list ports 'sfp2'

config device
	option name 'eth1'
	option macaddr 'mac adress'

config device
	option name 'wan'
	option macaddr 'mac adress'

config interface 'wan'
	option device 'eth1.6'
	option proto 'pppoe'
	option username 'fake@provider'
	option password 'pass'
	option ipv6 'auto'

config device
	option type '8021q'
	option ifname 'eth1'
	option vid '6'
	option name 'eth1.6'
	option mtu '1508'

config interface 'guest'
	option proto 'static'
	list ipaddr '192.168.2.1/24'

package wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi'
	option channel '6'
	option band '2g'
	option htmode 'HE40'
	option cell_density '0'
	option country 'NL'
	option txpower '15'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option ssid 'Zee'
	option encryption 'sae-mixed'
	option isolate '1'
	option key 'pass'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi+1'
	option channel '36'
	option band '5g'
	option htmode 'HE80'
	option cell_density '1'
	option country 'NL'
	option txpower '20'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid 'Zee'
	option encryption 'sae-mixed'
	option key 'pass'
	option isolate '1'

config wifi-iface 'wifinet2'
	option device 'radio0'
	option mode 'ap'
	option ssid 'naamkleineman'
	option encryption 'sae-mixed'
	option key 'pass'
	option network 'guest'
	option disabled '1'

config wifi-iface 'wifinet3'
	option device 'radio1'
	option mode 'ap'
	option ssid 'naamkleineman'
	option encryption 'sae-mixed'
	option key 'pass'
	option network 'guest'
	option disabled '1'

package dhcp

config dnsmasq
	option localise_queries '1'
	option rebind_protection '1'
	option domain 'nijenzee.nl'
	option expandhosts '1'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '1'
	option ednspacket_max '1232'
	option logqueries '1'
	list server '185.93.175.43'
	list server '185.232.98.76'
	option nonwildcard '0'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'
	list dhcp_option '3,192.168.0.1'
	list dhcp_option '6,192.168.0.1'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config domain
	option ip '192.168.0.5'
	option name 'nas'

config host
	option name 'printer'
	option ip '192.168.0.8'
	option mac 'mac adress'

config host
	option ip '192.168.0.2'
	option name 'repeater'
	option mac 'mac adress'

config host
	option name 'Marantz'
	option mac 'mac adress'
	option ip '192.168.0.7'

config domain
	option ip '192.168.0.5'
	option name 'wa'

config domain
	option name 'ais'
	option ip '192.168.0.5'

config domain
	option ip '192.168.0.5'
	option name 'www'

config domain
	option name 'printer'
	option ip '192.168.0.8'

config host
	option name 'musicbox'
	option ip '192.168.0.9'
	option mac 'mac adress'

config domain
	option ip '192.168.0.9'
	option name 'pihole'

config domain
	option name 'webmin'
	option ip '192.168.0.5'

config host
	option name 'ntb100886'
	option mac 'mac adress'
	option ip '192.168.0.66'

config dhcp 'LAN3'
	option interface 'LAN3'
	option ignore '1'

config host
	option dns '1'
	option mac 'mac adress'
	option name 'nas'
	option ip '192.168.0.5'

config domain
	option ip '192.168.0.5'
	option name 'kdav'

config domain
	option name 'wm'
	option ip '192.168.0.21'

config domain
	option name 'mc01'
	option ip '192.168.0.21'

config domain
	option name 'smtp'
	option ip '192.168.0.21'

config domain
	option name 'carddav'
	option ip '192.168.0.5'

config domain
	option name 'mail'
	option ip '192.168.0.21'

config domain
	option name 'autodiscover'
	option ip '192.168.0.21'

config domain
	option name 'autoconfig'
	option ip '192.168.0.21'

config domain
	option name 'nc'
	option ip '192.168.0.21'

config domain
	option name 'eh'
	option ip '192.168.64.2'

config domain
	option name 'MI'
	option ip '192.168.254.155'

config host
	option name 'macbook-roelof'
	option dns '1'
	option mac 'mac adress'
	option ip '192.168.0.252'
	option duid '0001000129919c5760f81db6928a'

config host
	option name 'Laptop-judith'
	option dns '1'
	option mac 'mac adress'
	option ip '192.168.0.186'
	option duid '000100011f9ad3b0548ca0d8518d'

config host
	option name 'GW-B8D7AF2BC161'
	option ip '192.168.0.149'
	option mac 'mac adress'

config host
	option name 'pc-judith'
	option dns '1'
	option mac 'mac adress'
	option ip '192.168.0.205'

config domain
	option ip '192.168.0.5'
	option name 'taiga'

config host
	option name 'envoy'
	option ip '192.168.0.183'
	option mac 'mac adress'

config domain
	option name 'ncnz'
	option ip '192.168.0.21'

config domain
	option name 'off'
	option ip '192.168.0.21'

config dhcp 'guest'
	option interface 'guest'
	option start '100'
	option limit '150'
	option leasetime '12h'
	list dhcp_option '6,208.67.222.222,208.67.220.220'

config domain
	option name 'rtr'
	option ip '192.168.0.1'

package firewall

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'
	option flow_offloading '1'
	option flow_offloading_hw '1'
	option drop_invalid '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'FWGuest'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'guest'

config forwarding
	option src 'FWGuest'
	option dest 'wan'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'wm.nijenzee.nl'
	option src 'wan'
	option src_dport '443'
	option dest_ip '192.168.0.21'
	option dest_port '443'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'http forward'
	option family 'ipv4'
	list proto 'tcp'
	option src 'wan'
	option src_dport '80'
	option dest_ip '192.168.0.21'
	option dest_port '80'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'Crashplan Forwarding'
	option src 'wan'
	option src_dport '4242'
	option dest_ip '192.168.0.5'
	option dest_port '4242'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'ac server 8081'
	option src 'wan'
	option src_dport '8081'
	option dest_ip '192.168.0.205'
	option dest_port '8081'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'ac 9600'
	option src 'wan'
	option src_dport '9600'
	option dest_ip '192.168.0.205'
	option dest_port '9600'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'ac server 27000-27037'
	option src 'wan'
	option src_dport '27000-27037'
	option dest_ip '192.168.0.205'
	option dest_port '27000-27037'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'ac server 4380'
	option src 'wan'
	option src_dport '4380'
	option dest_ip '192.168.0.205'
	option dest_port '4380'

config rule
	option name 'Block Printer'
	option src 'lan'
	list src_ip '192.168.0.8'
	option dest 'wan'
	option target 'REJECT'

config rule
	option name 'Jellyfin'
	option src 'FWGuest'
	option src_port '8096'
	option dest 'lan'
	list dest_ip '192.168.0.5'
	option dest_port '8096'
	option target 'ACCEPT'

config rule
	option name 'Ping outbound'
	list proto 'igmp'
	option src 'FWGuest'
	option dest 'wan'
	option target 'ACCEPT'

config rule
	option name 'Guest DHCP'
	list proto 'udp'
	option src 'FWGuest'
	option target 'ACCEPT'
	option dest_port '67-68'
	option enabled '0'

config rule
	option name 'Guest DNS'
	option src 'FWGuest'
	option dest_port '53'
	option target 'ACCEPT'
	option enabled '0'

config rule
	option name 'Block guest acces to LAN'
	list proto 'all'
	option src 'FWGuest'
	option dest 'lan'
	option target 'DROP'
	option enabled '0'

lrwxrwxrwx    1 root     root            16 Oct  9 21:45 /etc/resolv.conf -> /tmp/resolv.conf
-rw-r--r--    1 root     root            55 Nov 12 13:16 /tmp/resolv.conf
-rw-r--r--    1 root     root           124 Nov  4 22:40 /tmp/resolv.conf.d/resolv.conf.auto
-rw-r--r--    1 root     root            50 Nov  4 22:40 /tmp/resolv.conf.ppp

/tmp/resolv.conf.d:
-rw-r--r--    1 root     root           124 Nov  4 22:40 resolv.conf.auto
==> /etc/resolv.conf <==
search nijenzee.nl
nameserver 127.0.0.1
nameserver ::1

==> /tmp/resolv.conf <==
search nijenzee.nl
nameserver 127.0.0.1
nameserver ::1

==> /tmp/resolv.conf.d <==
head: /tmp/resolv.conf.d: I/O error

==> /tmp/resolv.conf.ppp <==
nameserver 185.93.175.43
nameserver 185.232.98.76

==> /tmp/resolv.conf.d/resolv.conf.auto <==
# Interface wan
nameserver 185.93.175.43
nameserver 185.232.98.76
# Interface wan_6
nameserver 2a10:3780:2:52:185:93:175:43

Try to change the encryption of the WiFi to WPA2 ONLY or no encryption at all for the guest to verify it's not incompatibility with wpa3.

My laptop was failing on the guest network, when succesfully connected to the normal wifi, so wpa2 should not have been the issue on the slow dhcp behaviour.

Only thing to test would be if the hardware can not hold two wifi networks on the same set of channels with encryption. I will test that tonight.

You have the guest network associated with two radios for WiFi. In order fit this to work, you need a bridge.

config device
	option name 'br-guest'
	option type 'bridge'
config interface 'guest'
	option device 'br-guest'
	option proto 'static'
	list ipaddr '192.168.2.1/24'

You also have a bunch of issues in the firewall.

This can be deleted:

These two must be enabled. For the dns rule, it is best to specify tcp and udp protocols.

And this is also unnecessary and should be deleted.

1 Like

Hello,

I have mine configured as an AP?
I am receiving 5G WiFi from a router and outputting via Ethernet.
Yes, I used the 2.5GB SFP port with copper Ethernet port as well.
Works well here.
Oh, cooling, I have an 80mm USB powered fan on top of mine.
I have the kit that is on Amazon, with metal box, antennas, heat sinks, and enclosure.
I never did put the enclosure top on, nor installed the heat sinks, as I use the fan on top.

No, that isn't an AP.
An AP serves via WiFi?

That looks like only acting as a wifi client and not serving as an AP. That is a whole different use case, looking at mine serving both 2.4 and 5 Ghz and also serving two different SSID's. Nice what you did with the cooling btw. I have the same case with coolingblock and cooler, used extra cooling pads on the chips (only 2 were delivered) and drilled a lot of vent holes in the case.

All mentioned issues in the fw are solved and I configured the mentioned bridge. DHCP is working now on the guest network, so that is fixed!

The wifi is another story. I enabled it last night, configured the android tv player and set youtube in continous play (thats what the former router did without any issue) and it looked promising, only one moment the wifi went missing during two hours play. So I went to bed and woke up with a hanging router on both networks, totally not advertising anymore. I did notice a rise in cpu activity (I have a statistics package installed with graphs), temps did not go up very much. Unfourtunately the statistics were gone after a reboot and that was needed this morning....

So two steps forward, but still one step missing...

1 Like

Who can help me where to get support?

For now this device looks to me as a potential brick.
Only half functioning is not my belief of a step forward, comparing to where I started.

You may get better help on BPi forum. Your description is confusing things. If you say it's crashed, folks tend to assume it's about the kernel, yet it seems from your descriptions it is application errors. And as ever, did you take any kind of ESD precautions when building it? Momentarily touching metal does not count as just swivelling in your seat can regenerate a few thousands volts which can destroy components.

I am aware of ESD and have respected that.
So the config is not wrong and the assumption is bad hardware.

Dissapointing but also a fact to live with. I allready posted on the BPI forum, hopefully someone over there will help me diagnose it.

Since hardware diagnostics are also possible in openwrt, any thoughts about that?