BridgedAP loses connection upon reboot?

I now have a new main router running, the GL-MT6000 with Openwrt 24.10. That runs great on its own, very fast and very good wifi signal.

Furthermore, I have two APs, a WAX202 (attic) and WAX206 (basement/office). Somehow I can configure the WAX202 (with 24.10) as BridgedAP. If I configure the AP and connect it to the GL-MT600 after configuration (without switching it off), then it works fine. I can reach the AP itself on the network and devices connect to it, I can also reach the connected devices (including a moOde music player) on the network.

However, if I restart the AP, then the wifi network is still in the air, but I can no longer reach the AP, devices do not connect and the lights on the AP no longer flash as if there is no activity.

Both the GL-MT6000 and the WAX202 are freshly installed with a 24.10 image. On the MT6000 I only added a guest network and activated wifi, but no extra packages or anything. The WAX202 is also completely standard, and then followed the BridgedAP config.

When my old R7800 was still the main router, and all APs were running on 23.05.* restarting was never a problem, network was always stable. So I don't really understand where the change in behavior comes from. Does anyone know where I should start to solve this?

How are the WAX20x devices connected to the the main router/network? Are both devices connected by Ethernet?

Let's take a look at the complete configs from each of the devices. We'll start with one of the WAX20x units.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

Thanks for helping out!

Both APs are connected by Ethernet indeed. Main router MT6000 is behind a isp router, MT6000 is in the DMZ of this one. To my knowledge in my config the isp router handles dns.

root@Zolder:~# ubus call system board
{
	"kernel": "6.6.73",
	"hostname": "Zolder",
	"system": "MediaTek MT7621 ver:1 eco:3",
	"model": "Netgear WAX202",
	"board_name": "netgear,wax202",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "24.10.0",
		"revision": "r28427-6df0e3d02a",
		"target": "ramips/mt7621",
		"description": "OpenWrt 24.10.0 r28427-6df0e3d02a",
		"builddate": "1738624177"
	}
}
root@Zolder:~# 

root@Zolder:~# cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix '
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'wan'

config device
	option name 'lan1'
	option macaddr '

config device
	option name 'lan2'
	option macaddr '

config device
	option name 'lan3'
	option macaddr '

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.3'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option gateway '192.168.1.1'
	list dns '192.168.1.1'

config device
	option name 'wan'
	option macaddr 

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'
	option auto '0'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'
	option auto '0'
	option reqaddress 'try'
	option reqprefix 'auto'
	option norelease '1'

root@Zolder:~# 


root@Zolder:~# cat /etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
	option band '2g'
	option channel '11'
	option htmode 'HE20'
	option country 'NL'
	option cell_density '0'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option ssid 'Termini_2.4GHz'
	option encryption 'psk2+ccmp'
	option key 
	option ieee80211r '1'
	option mobility_domain '123E'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'

config wifi-device 'radio1'
	option type 'mac80211'
	option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0+1'
	option band '5g'
	option channel '52'
	option htmode 'HE40'
	option country 'NL'
	option cell_density '0'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid 'Termini_5GHz'
	option encryption 'psk2+ccmp'
	option key '
	option ieee80211r '1'
	option mobility_domain '123F'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'

root@Zolder:~# 

root@Zolder:~# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option ignore '1'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

root@Zolder:~# 


root@Zolder:~# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option ignore '1'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

root@Zolder:~# cat /etc/config/firewall
config defaults
	option syn_flood	1
	option input		REJECT
	option output		ACCEPT
	option forward		REJECT
# Uncomment this line to disable ipv6 rules
#	option disable_ipv6	1

config zone
	option name		lan
	list   network		'lan'
	option input		ACCEPT
	option output		ACCEPT
	option forward		ACCEPT

config zone
	option name		wan
	list   network		'wan'
	list   network		'wan6'
	option input		REJECT
	option output		ACCEPT
	option forward		REJECT
	option masq		1
	option mtu_fix		1

config forwarding
	option src		lan
	option dest		wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
	option name		Allow-DHCP-Renew
	option src		wan
	option proto		udp
	option dest_port	68
	option target		ACCEPT
	option family		ipv4

# Allow IPv4 ping
config rule
	option name		Allow-Ping
	option src		wan
	option proto		icmp
	option icmp_type	echo-request
	option family		ipv4
	option target		ACCEPT

config rule
	option name		Allow-IGMP
	option src		wan
	option proto		igmp
	option family		ipv4
	option target		ACCEPT

# Allow DHCPv6 replies
# see https://github.com/openwrt/openwrt/issues/5066
config rule
	option name		Allow-DHCPv6
	option src		wan
	option proto		udp
	option dest_port	546
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-MLD
	option src		wan
	option proto		icmp
	option src_ip		fe80::/10
	list icmp_type		'130/0'
	list icmp_type		'131/0'
	list icmp_type		'132/0'
	list icmp_type		'143/0'
	option family		ipv6
	option target		ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Input
	option src		wan
	option proto	icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	list icmp_type		router-solicitation
	list icmp_type		neighbour-solicitation
	list icmp_type		router-advertisement
	list icmp_type		neighbour-advertisement
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Forward
	option src		wan
	option dest		*
	option proto		icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-IPSec-ESP
	option src		wan
	option dest		lan
	option proto		esp
	option target		ACCEPT

config rule
	option name		Allow-ISAKMP
	option src		wan
	option dest		lan
	option dest_port	500
	option proto		udp
	option target		ACCEPT


### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
#	option src		lan
#	option src_ip	192.168.45.2
#	option dest		wan
#	option proto	tcp
#	option target	REJECT

# block a specific mac on wan
#config rule
#	option dest		wan
#	option src_mac	00:11:22:33:44:66
#	option target	REJECT

# block incoming ICMP traffic on a zone
#config rule
#	option src		lan
#	option proto	ICMP
#	option target	DROP

# port redirect port coming in on wan to lan
#config redirect
#	option src			wan
#	option src_dport	80
#	option dest			lan
#	option dest_ip		
#	option dest_port	80
#	option proto		tcp

# port redirect of remapped ssh port (22001) on wan
#config redirect
#	option src		wan
#	option src_dport	22001
#	option dest		lan
#	option dest_port	22
#	option proto		tcp

### FULL CONFIG SECTIONS
#config rule
#	option src		lan
#	option src_ip	192.168.45.2
#	option src_mac	00:11:22:33:44:55
#	option src_port	80
#	option dest		wan
#	option dest_ip	194.25.2.129
#	option dest_port	120
#	option proto	tcp
#	option target	REJECT

#config redirect
#	option src		lan
#	option src_ip	192.168.45.2
#	option src_mac	00:11:22:33:44:55
#	option src_port		1024
#	option src_dport	80
#	option dest_ip	194.25.2.129
#	option dest_port	120
#	option proto	tcp
root@Zolder:~# 


Since the WAX202 is being used as a bridged AP and you've added the wan port to br-lan, delete all of these:

I recommend against the use of 802.11r unless there is an actual demonstrated need for it. It usually causes more problems than it solves. Consider removing it from all devices (last 4 lines in this section, for example):

I also recommend using the same SSID and passphrase for 2.4 and 5G radios, and making that the same across all of your APs. Make sure your channels are non-overlapping.

Restart that device and then test again. It should work. If the WAX206 has similar issues and a similar config, the same fixes may apply there. Feel free to post that here if you'd like me to review it.

OK, thanks. Regarding the wan/wan6 interfaces. I've unchecked "bring up on boot" as in the BridgedAP instructions, there it's either this or delete the interfaces all together.

And I'll delete the 802.11r option, had that since I saw a video from OneMarcFifty.

Regarding the same SSID for both radios, I set up separately as certain domotica only operate on 2.4GHz and it's easier to connect in this way.

But I'll try and report back

Hi, I tried what you suggested, except for changing the SSID names. Unfortunately the WAX202 on the attic does not come back online.
When I try the ip address (192.168.1.3) I briefly see LuCi in the left uppercorner of my browser window and then I get the notification that 192.168.1.3 cannot be connected to.

Before I rebooted the WAX202 I rebooted my ISP modem/router and the GL_MT6000 main router. They both came back online fine,

Any other things I could try to understand what is happening?

I didn't notice it before... eth0 should not be part of the bridge... remove it:

Thanks, I'll try that!

By the way, it's literally stated in the bridged AP instruction in the user guide...

Move the WAN interface into the br-lan: In Network → Interfaces, click the “Devices” tab. Click the Configure... button for br-lan. In the Bridge ports dropdown, ensure that both Ethernet adapters are checked.

https://openwrt.org/docs/guide-user/network/wifi/wifiextenders/bridgedap#configuration_via_luci

That is a recent edit and not required.

I tried again, reset the wax202 to default and configured from scratch. Unfortunately no change, I cannot access the AP via the network and no connection can be made.

Try moving it next to your main router and connecting with a known good short Ethernet cable.

And let’s review the latest config.

It seems it's finally fixed with the eth0 out of the bridge!

I just had to wait a bit longer upon rebooting it seems. I'll do a final check/reboot now.

Interesting, with a reboot from LuCi, the AP does not come back online. But when I power cycle for about 5 min, it does come back online.

Not sure how that is possible, but at least I have a working network with APs again. Many thanks @psherman!

I was having the same issue. Taking the eth0 out of the bridge worked for me, too. I factory reset a half dozen times as I figured I had configured something wrong, but that seems to have been the issue. This was on a Netgear EAX11v2

1 Like

I guess the config instructions on the BridgedAP should be adapted to prevent this issue for others.

The LuCi instructions i mean as I interpreted from these instructions that eth0 had to be added to the bridge.
https://openwrt.org/docs/guide-user/network/wifi/wifiextenders/bridgedap#configuration_via_luci

Juts my first glance at it and I can see that there are some major issues with the bridged AP wiki. Looks like it might have been edited with old versions in mind and has syntax that does not apply anymore.

1 Like

I just made a bunch of edits to the wiki to improve its accuracy and to ensure that it is complaint with modern OpenWrt syntax and methods. Please let me know if I've missed anything.

I just read the instructions quickly. You've made them easier, especially the Fine tuning part.

Also the advise for dnsmasq, firewall and probably also odhcpd were removed. Does this mean I should enable in my config again, is that the best recommendation?

And I noticed there is nothing mentioned on either disabling or deleting the WAN and WAN6 interfaces. Is that not recommended any more?

One minor thing. I noticed when setting the static lan address, the notification you get is slightly different in 24.10. It gives "keep unchecked" instead of "Apply and keep settings" as in the screenshot given in the instructions.

While not recommended, it is fine to have the services disabled. What is critical, though, is that the dhcp server is explicitly disabled in the config file.

You might not have seen as I edited when you were typing, but what is the recommendation regarding the WAN interfaces?