Can not get IP on known MAC

Cer · May 9, 2025, 6:47pm

I had several Archer C7 running 19.07, one as router the others as AP. All working perfectly fine.
As part of upgrading to another WAN connection, I replaced the router and an AP with Flint2 devices and updated a remaining C7 to 24.10. I believe all was working fine until... now it doesn't...

Symptoms:

connecting to the wifi of the router is OK
connecting to lan on one of the AP is OK
connecting with my laptop to the AP wifi is NOT OK
connecting with an android phone to the AP wifi is OK
connecting with the laptop to the AP wifi with MAC set to randomise is OK

It appears that a known MAC doesn't an IP from the router whereas a new one does.
I believe the last thing I did before it stopped working was playing around with roaming (802.11r), but disabling that again doesn't fix it.

Any ideas?

psherman · May 9, 2025, 6:53pm

We'd need to see your configs to understand what is going on with your environment. Also, it's not clear how many devices (i.e. routers/APs) you have in your network, so please provide a topology diagram and then the configs of all of those devices:

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

brada4 · May 9, 2025, 6:59pm

Also draw the map of your network, like freehand, noting device names(models). Something could have went foul in unsupported 19->24 upgrade, can you reset and redo configuration from unzipped conf backup?

Cer · May 9, 2025, 7:06pm

topology is this:


                       \|/              \|/
                        |                |
                      Flint2          Archer C7
                        |                |
     \|/                |                |
      |-----------------------------------
    Flint2
      |
      |
   ISP router
      |
      |

The Flint2s I installed from, scratch (the WAN config had to change due to the new ISP router), the Archer C7 I updated while keeping the config.

I'll get to the config files next.

brada4 · May 9, 2025, 7:13pm

Thanks for info, you had to update archer one version at a time 19->21->22->23->24
21-22 had fw3->fw4 upgraded
So front flint is freshly installed and configured? In this case we need to check only C7 whether it is in proper bridged/dumb AP mode.

Cer · May 9, 2025, 7:14pm

for the router:

ubus call system board
{
        "kernel": "6.6.86",
        "hostname": "Flint2-Zolder",
        "system": "ARMv8 Processor rev 4",
        "model": "GL.iNet GL-MT6000",
        "board_name": "glinet,gl-mt6000",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "24.10.1",
                "revision": "r28597-0425664679",
                "target": "mediatek/filogic",
                "description": "OpenWrt 24.10.1 r28597-0425664679",
                "builddate": "1744562312"
        }
}

cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd21:9ce3:a930::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'lan5'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '10.0.0.1'
        option netmask '255.255.255.0'
        option gateway '10.0.0.1'

config interface 'wan'
        option device 'eth1'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth1'
        option proto 'dhcpv6'

cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option band '2g'
        option channel '13'
        option htmode 'HE20'
        option country 'BE'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'Blabla'
        option encryption 'psk2'
        option key 'x'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option band '5g'
        option channel '48'
        option htmode 'HE160'
        option country 'BE'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'Blabla50'
        option encryption 'psk2'
        option key 'x'

cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option localservice '1'
        option ednspacket_max '1232'
        option port '54'
        option noresolv '1'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '99'
        option leasetime '12h'
        option dhcpv4 'server'
        list dhcp_option '3,10.0.0.1'
        list dhcp_option '6,10.0.0.1'
        list dhcp_option '15,lan'
        list dns ''

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config host
        option dns '1'
        option name 'Something'
        option ip '10.0.0.210'
        option mac '00'

and a while bunch more host entries

cat /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

Cer · May 9, 2025, 7:19pm

for the Flint2 AP: (here I did mess around in luci trying to explicitely add the wifi to lan, but I think I undid all of that)

ubus call system board

{
        "kernel": "6.6.86",
        "hostname": "Flint2-Living",
        "system": "ARMv8 Processor rev 4",
        "model": "GL.iNet GL-MT6000",
        "board_name": "glinet,gl-mt6000",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "24.10.1",
                "revision": "r28597-0425664679",
                "target": "mediatek/filogic",
                "description": "OpenWrt 24.10.1 r28597-0425664679",
                "builddate": "1744562312"
        }

cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdfd:41e8:ce16::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth1'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'lan5'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '10.0.0.4'
        option netmask '255.255.255.0'
        option gateway '10.0.0.1'

cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option band '2g'
        option channel '3'
        option htmode 'HE20'
        option country 'BE'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option mode 'ap'
        option ssid 'Blabla'
        option encryption 'psk2'
        option key 'x'
        option network 'lan'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option band '5g'
        option channel '100'
        option htmode 'HE160'
        option country 'BE'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option mode 'ap'
        option ssid 'Blabla50'
        option encryption 'psk2'
        option key 'x'
        option network 'lan'

cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option ignore '1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

cat /etc/config/firewall
config defaults
        option syn_flood '1'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

Cer · May 9, 2025, 7:21pm

OK. I do have a backup of the config, so I should be able to do that. But this will take some time.

But I have another Archer C7 also (which used to be the router), that is still on 19 and when connecting that as an AP (with a lan port), it shows the same effect.

psherman · May 9, 2025, 7:26pm

remove the gateway line:

Cer:

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '10.0.0.1'
        option netmask '255.255.255.0'
        option gateway '10.0.0.1'

Remove the last line (dns):

Cer:

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '99'
        option leasetime '12h'
        option dhcpv4 'server'
        list dhcp_option '3,10.0.0.1'
        list dhcp_option '6,10.0.0.1'
        list dhcp_option '15,lan'
        list dns ''

Those are the only specific changes I would recommend.

However... I think the root of the problem may be in the changes you've made to the DNS handling in general:

Cer:

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option localservice '1'
        option ednspacket_max '1232'
        option port '54'
        option noresolv '1'

I'm assuming you're using DoH/DoT or Adblock or something... that can interfere with the DHCP server operation, too.

Cer · May 9, 2025, 7:43pm

no improvement.

I did install Adguard. It seemed to be working fine for a few days until I replaced the Archer with the 2nd Flint2. And I didn't change anything on the router Flint2 while doing so, except at the very end enabling 802.11r (which may not be related at all).

Cer · May 9, 2025, 8:41pm

I have now cleared the configuration of the router (in backup/flash hardware: 'perform reset') en set it up again without adguard.
The behaviour stays similar. But now I realise my description may not be fully correct and I did encounter some anomalies during the day as well. Depending on the AP I tried to connect to, it could sometimes take quite long (10 seconds?) before the connection was established and sometimes not at all (probably the same DHCP issue). Then, without intervention in the settings, the AP would be much easier to connect to; at least for a while.
That is what I am seeing right now as well. The Flint2 AP is now seemingly behaving OK and giving me an IP, whereas the C7 AP now doesn't give an IP. A few hours ago, this was reversed.

Cer · May 9, 2025, 9:10pm

And.... it may be down to a flaky switch...
I will continue testing tomorrow. Thanks for the suggestions and for bearing with me.

Cer · May 10, 2025, 8:57am

It looks like it may have been caused by an errant (and now obsolete) port trunking setting on the switches. Seems to be working now.

I will open a new topic on how to recover my faulty C7 update.

brada4 · May 10, 2025, 10:18am

reset conf in failsafe mode (search forum for guide) and type back settings from unzipped v19 backup.

Can not get IP on *known* MAC

Can not get IP on known MAC