Dreadful (10Mbps 5GHz) WiFi performance (Flint 2)

agoose77 · October 3, 2026, 7:58pm

Hi all,

I've noticed very slow Wi-Fi speeds on my home network, consisting of two MT6000 (GL.INet Flint 2) and ASUS RT-N56U (which is out of range of the main MT6000 nodes).

Here's a speed-test on my primary PPPoE Flint2 5 GHz channel. I had thought that only my 2.4GHz network was affected, but now it's my 5GHz network. Meanwhile, my ethernet homelab is getting >700Mbps

Here are the details on my laptop (SSID/BSSID replaced):

IN-USE  BSSID              SSID                           MODE   CHAN  RATE         SIGNAL  >
*       FF:FF:FF:FF:FF:FA  my-network                     Infra  128   540 Mbit/s   57      >
        FF:FF:FF:FF:FF:AA  my-network                     Infra  1     540 Mbit/s   55      >
        FF:FF:FF:FF:FF:FB  my-network                     Infra  13    260 Mbit/s   49      >
        8A:1B:F4:D0:02:26  --                             Infra  1     195 Mbit/s   44      >
        80:72:15:2A:D1:A2  SKYZQINM                       Infra  11    260 Mbit/s   42      >
        FF:FF:FF:FF:FF:AB  my-network                     Infra  64    540 Mbit/s   37      >
        D0:1B:F4:D0:02:22  EE-39HPMT                      Infra  1     195 Mbit/s   34      >
        8A:1B:F4:D0:02:23  EE WiFi                        Infra  1     195 Mbit/s   34      >
        14:08:05:5F:1C:AD  SKY9RDCD                       Infra  6     540 Mbit/s   34      >
        90:91:64:82:A7:70  TNCAPAC32A9_EXT                Infra  6     270 Mbit/s   34      >
        7A:97:41:97:1B:E7  --                             Infra  1     195 Mbit/s   32      >
        70:97:41:97:1B:E3  BT-8CCJ5G                      Infra  1     195 Mbit/s   32      >
        7A:97:41:97:1B:E4  EE WiFi                        Infra  1     195 Mbit/s   30      >
        80:75:1F:54:F3:C2  SKYGRB2P                       Infra  11    260 Mbit/s   30      >
        10:62:E5:79:23:4F  DIRECT-4E-HP ENVY 4520 series  Infra  6     65 Mbit/s    25      >
        D4:5D:64:9F:29:C8  RebelBase_2.4G                 Infra  10    1170 Mbit/s  25

I'm running OpenWRT on the Flints with a custom patch that fixes 802.11r. I have only noticed this speed regression in the last week, and I've been running the custom patch for more like two. My hunch is the two aren't correlated. I'm only using 802.11r on my 5GHz network

I have 25 devices on the 2.4GHz STA, and 5 on the 5GHz STA (for the PPPoE Flint2 node I'm connected to).

The issue is transient — as we speak, I'm now getting >650Mbps on the same channel.

Can anyone think of techniques or tools to try here to diagnose the issue? I want to properly rule in/out what's going wrong.

Here's my current thinking:

I am ruling out interference on the 5GHz band, because I barely pick up other 5GHz networks
I'm ruling out load on the AP, because of the above btop screenshot
I'm ruling out WAN performance failures, because of my homelab result.
I'm ruling out the other W-Fi client STAs, because I also saw this when I disabled all Wi-Fi channels apart from a temporarily-named SSID that only this device connected to.
I'm ruling out SQM because I've turned it off and on with no difference.

mroek · October 3, 2026, 10:29pm

This weekend I retired my R7800s for two new Flint2s. I built a 25.12 snapshot image for them, but the only changes I made was to add some packages and replace mbedtls with OpenSSL.

I have observed something that could be similar to what you are seeing, where my phone (Galaxy S26 Ultra) can sometimes get into some weird state with high latency and low performance. It doesn't happen very often, but I have seen it on both the Flint2s, where one is just a dumb ap, while the other is my main router.

The issue clears if I just temporarily turn off and back on WiFi on the phone, which obviously causes the phone to reconnect. A speedtest on the phone can saturate my internet line (500/500) when it works as it should, but if it gets into this state, I get just a few Mbps, just like you reported.

I did do a dump with iw while the phone was in this state, and it shows a staggering amount of errors/failures, and a very asymmetic phy rate, despite a very good signal strength:

root@MT6000:/etc/config# iw dev phy1-ap0 station dump XX:XX:XX:XX:XX:XX
Station xx:xx:xx:xx:xx:xx (on phy1-ap0)
authorized: yes
authenticated: yes
associated: yes
preamble: short
WMM/WME: yes
MFP: no
TDLS peer: no
inactive time: 500 ms
rx bytes: 4202431
rx packets: 49116
tx bytes: 123054085
tx packets: 85966
tx retries: 11949
tx failed: 12165
rx drop misc: 0
signal: -42 [-46, -52, -46, -49] dBm
signal avg: -45 [-48, -54, -49, -53] dBm
tx bitrate: 288.2 MBit/s 80MHz HE-MCS 3 HE-NSS 2 HE-GI 0 HE-DCM 0
tx duration: 4564065 us
rx bitrate: 1200.9 MBit/s 80MHz HE-MCS 11 HE-NSS 2 HE-GI 0 HE-DCM 0
rx duration: 1476455 us
last ack signal:-44 dBm
avg ack signal: -42 dBm
airtime weight: 256
expected throughput: 246.445Mbps
DTIM period: 2
beacon interval:100
short preamble: yes
short slot time:yes
connected time: 1021 seconds
associated at [boottime]: 43351.311s
associated at: 1791032093606 ms
current time: 1791033114778 ms

I am not using 802.11r at the moment (I had it enabled, but I suspected it could have something to do with the problem), but this was after I had turned it off, so most likely not. I am curious about which 802.11r patch you are talking about, though. Is a patch needed for this to work on the Flint2?

I don't really think my phone is to blame here, but there is clearly something happening in the interaction between the phone and the Flint2 that makes things go sideways.

Sorry I can't be of any help, but my issue could perhaps be related to yours, so I thought I'd just throw it in.

agoose77 · October 4, 2026, 7:47am

Thanks for sharing. I'll check mine today. I've also replaced wpad with openssl.

@mroek if you use 802.11r for faster roaming, you may see

nl80211: kernel reports: key addition failed

in the logs.

You can use

github.com/openwrt/openwrt

mac80211: defer AP-side FT key upload until station association (#23181)

main ← AndreaCovelli:ft-ap-side-ft-key-upload-main

opened 03:05PM - 01 May 26 UTC

AndreaCovelli

+193 -1

AP-side Fast Transition can derive and hand over the pairwise PTK while the peer… already has a station entry but before mac80211 marks it associated. Today `ieee80211_add_key()` rejects that with `-ENOENT`, which bubbles up to hostapd as: ``` nl80211: kernel reports: key addition failed ``` On OpenWrt APs this is the log line commonly seen during 802.11r roaming. It is mostly harmless under WPA2 because userspace retries once the STA is associated, but under WPA3/PMF the timing window is much tighter and the same rejection can break the roam. Accept AP/AP_VLAN pre-association pairwise keys when mac80211 can fall back automatically to software crypto. Keep each deferred key in mac80211 and upload it only after the driver's AUTH-to-ASSOC transition succeeds. Refresh the key's RX_MGMT and SPP_AMSDU flags from the association parameters before upload. If hardware upload fails, software crypto remains available. Validation: - reproduced the issue on two Filogic OpenWrt APs (`Cudy WR3000P v1` and `Cudy WR3000E v1`) during 802.11r FT roams - validated the narrowed AP/AP_VLAN condition on both APs - after flashing the patched images, repeated bidirectional FT roams completed without new `nl80211: kernel reports: key addition failed` log entries on either AP Upstream submission: This PR carries the OpenWrt backport of the [AP-side FT key-upload fix submitted to linux-wireless](https://lore.kernel.org/r/20260905174744.1434165-1-andcov23@gmail.com/). The change is scoped to AP/AP_VLAN pairwise keys when automatic software fallback is allowed. Drivers advertising `SW_CRYPTO_CONTROL` and EPP peers retain their existing behavior.

to fix this, and I have a Gist here. You don't need to build the sysupgrade image, just the mac80211 package.

DiGz_Au · October 4, 2026, 8:30am

Disable twt for wifi. Fixes it. Due to link getting stuck in a 6mbps state in either sending or receiving its the only fix ive found to fix wifi.

agoose77 · October 4, 2026, 8:40am

Where would I find that in Luci?

agoose77 · October 4, 2026, 8:47am

I have quite a few retries, although order of magnitude less than the packets:

Station c6:c3:f1:1c:fd:a5 (on phy1-ap0)
	authorized:	yes
	authenticated:	yes
	associated:	yes
	preamble:	long
	WMM/WME:	yes
	MFP:		no
	TDLS peer:	no
	inactive time:	310 ms
	rx bytes:	191380799
	rx packets:	163944
	tx bytes:	59385751
	tx packets:	116516
	tx retries:	7140
	tx failed:	7167
	rx drop misc:	2
	signal:  	-63 [-71, -68, -68, -66] dBm
	signal avg:	-63 [-73, -67, -69, -68] dBm
	tx bitrate:	960.7 MBit/s 80MHz HE-MCS 9 HE-NSS 2 HE-GI 0 HE-DCM 0
	tx duration:	9917585 us
	rx bitrate:	1441.3 MBit/s 160MHz HE-MCS 7 HE-NSS 2 HE-GI 0 HE-DCM 0
	rx duration:	9965856 us
	last ack signal:-65 dBm
	avg ack signal:	-65 dBm
	airtime weight: 256
	expected throughput:	795.781Mbps
	DTIM period:	2
	beacon interval:100
	short slot time:yes
	connected time:	466 seconds
	associated at [boottime]:	50421.843s
	associated at:	1791103011973 ms
	current time:	1791103477355 ms

DiGz_Au · October 4, 2026, 8:53am

SSH and disable it.

uci set wireless.radio0.he_twt_responder='0'
uci set wireless.radio1.he_twt_responder='0'

I think those are correct.

agoose77 · October 4, 2026, 8:57am

Does this require a restart? I didn't see any difference.

DiGz_Au · October 4, 2026, 9:03am

Just restart wireless

agoose77 · October 4, 2026, 9:09am

No luck, still ~10Mbps on 5GHz.

DiGz_Au · October 4, 2026, 9:11am

If its more than 6mbps then I can't help you. I know when latency blows out and its less than 6mbps its a power saving thing.

agoose77 · October 4, 2026, 9:19am

Another sample on my main router, rather than the dumb AP:

Station c6:c3:f1:1c:fd:a5 (on phy1-ap0)
	authorized:	yes
	authenticated:	yes
	associated:	yes
	preamble:	long
	WMM/WME:	yes
	MFP:		no
	TDLS peer:	no
	inactive time:	0 ms
	rx bytes:	138447275
	rx packets:	111101
	tx bytes:	29487973
	tx packets:	73280
	tx retries:	15781
	tx failed:	15782
	rx drop misc:	2
	signal:  	-75 [-81, -81, -85, -78] dBm
	signal avg:	-75 [-80, -80, -84, -78] dBm
	tx bitrate:	1729.6 MBit/s 160MHz HE-MCS 8 HE-NSS 2 HE-GI 0 HE-DCM 0
	tx duration:	6545102 us
	rx bitrate:	864.6 MBit/s 160MHz HE-MCS 4 HE-NSS 2 HE-GI 0 HE-DCM 0
	rx duration:	4972797 us
	last ack signal:-4 dBm
	avg ack signal:	-2 dBm
	airtime weight: 256
	expected throughput:	1354.554Mbps
	DTIM period:	2
	beacon interval:100
	short slot time:yes
	connected time:	44 seconds
	associated at [boottime]:	51999.026s
	associated at:	1791105483920 ms
	current time:	1791105528611 ms

mroek · October 4, 2026, 10:28am

Thanks for the tip, but I am unsure if twt was even enabled on mine. I checked the hostapd conf files, and they show:

root@MT6000:/etc/config# cat /var/run/hostapd-phy0.conf | grep twt
he_twt_required=0
root@MT6000:/etc/config# cat /var/run/hostapd-phy1.conf | grep twt
he_twt_required=0

Doesn't that mean twt is disabled by default?

DiGz_Au · October 4, 2026, 10:59am

Yeah that should mean its disabled. I know for my flint 4 I also had to disable twt for wifi to work properly on my s26u. The gl inet fw on bith flint 2 and 4 work fine without changes though

agoose77 · October 4, 2026, 6:09pm

Testing on https://fast.com, the download speed is ~70-90Mbps (my ISP provides~90), whilst the download is suspiciously close to exactly 10 Mbps each time (when it is not behaving normally). Meanwhile, my laptop is behaving normally with very different download and latency:

Laptop:

Phone

psherman · October 4, 2026, 6:20pm

It might be a good idea to look at your configs...

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):

Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

agoose77 · October 4, 2026, 6:36pm

root@Router:~# ubus call system board
{
	"kernel": "6.12.94",
	"hostname": "Router",
	"system": "ARMv8 Processor rev 4",
	"model": "GL.iNet GL-MT6000",
	"board_name": "glinet,gl-mt6000",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "25.12-SNAPSHOT",
		"firmware_url": "https://downloads.openwrt.org/",
		"revision": "r32295+756-c25265953b",
		"target": "mediatek/filogic",
		"description": "OpenWrt 25.12-SNAPSHOT r32295+756-c25265953b",
		"builddate": "1782737960"
	}
}

root@Router:~# cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	list ipaddr '127.0.0.1/8'

config globals 'globals'
	option dhcp_default_duid 'DUIDDUIDDUID'
	option ula_prefix 'ffff:ffff:ffff::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'
	list ports 'lan5'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ip6assign '60'
	list ipaddr '192.168.68.1/24'
	option multipath 'off'

config interface 'wan'
	option device 'eth1'
	option proto 'pppoe'
	option type 'bridge'
	option username 'USERNAME'
	option password 'PASSWORD'
	option ipv6 'auto'
	option norelease '1'
	option multipath 'off'

config interface 'wan6'
	option device 'eth1'
	option proto 'dhcpv6'

root@Router:~# cat /etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi'
	option band '2g'
	option channel '13'
	option country 'GB'
	option cell_density '0'
	option htmode 'HE20'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi+1'
	option band '5g'
	option channel '128'
	option htmode 'HE160'
	option country 'GB'
	option cell_density '0'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid 'SSID'
	option encryption 'psk2'
	option key 'KEYKEY'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'
	option ieee80211k '1'
	option bss_transition '1'

config wifi-iface 'wifinet1'
	option device 'radio0'
	option mode 'ap'
	option ssid 'SSID'
	option encryption 'psk2'
	option key 'KEYKEY'
	option network 'lan'

root@Router:~# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'
	option ra_preference 'medium'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option leasefile '/tmp/odhcpd.leases'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'
	option piodir '/tmp/odhcpd-piodir'
	option hostsdir '/tmp/hosts'

root@Router:~# cat /etc/config/firewall
config defaults
	option syn_flood	1
	option input		REJECT
	option output		ACCEPT
	option forward		REJECT
# Uncomment this line to disable ipv6 rules
#	option disable_ipv6	1

config zone
	option name		lan
	list   network		'lan'
	option input		ACCEPT
	option output		ACCEPT
	option forward		ACCEPT

config zone
	option name		wan
	list   network		'wan'
	list   network		'wan6'
	option input		REJECT
	option output		ACCEPT
	option forward		DROP
	option masq		1
	option mtu_fix		1

config forwarding
	option src		lan
	option dest		wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
	option name		Allow-DHCP-Renew
	option src		wan
	option proto		udp
	option dest_port	68
	option target		ACCEPT
	option family		ipv4

# Allow IPv4 ping
config rule
	option name		Allow-Ping
	option src		wan
	option proto		icmp
	option icmp_type	echo-request
	option family		ipv4
	option target		ACCEPT

config rule
	option name		Allow-IGMP
	option src		wan
	option proto		igmp
	option family		ipv4
	option target		ACCEPT

# Allow DHCPv6 replies
# see https://github.com/openwrt/openwrt/issues/5066
config rule
	option name		Allow-DHCPv6
	option src		wan
	option proto		udp
	option dest_port	546
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-MLD
	option src		wan
	option proto		icmp
	option src_ip		fe80::/10
	list icmp_type		'130/0'
	list icmp_type		'131/0'
	list icmp_type		'132/0'
	list icmp_type		'143/0'
	option family		ipv6
	option target		ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Input
	option src		wan
	option proto	icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	list icmp_type		router-solicitation
	list icmp_type		neighbour-solicitation
	list icmp_type		router-advertisement
	list icmp_type		neighbour-advertisement
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Forward
	option src		wan
	option dest		*
	option proto		icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-IPSec-ESP
	option src		wan
	option dest		lan
	option proto		esp
	option target		ACCEPT

config rule
	option name		Allow-ISAKMP
	option src		wan
	option dest		lan
	option dest_port	500
	option proto		udp
	option target		ACCEPT

psherman · October 4, 2026, 7:04pm

Any particular reason you're using snapshot?

Have you tried 25.12.5 (not snapshot)?

Try 40MHz or 80MHz channel width instead of 160.

I'd recommend removing all of the 802.11r related items (the last 5 lines).

agoose77:

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid 'SSID'
	option encryption 'psk2'
	option key 'KEYKEY'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'
	option ieee80211k '1'
	option bss_transition '1'

agoose77 · October 4, 2026, 7:54pm

Any particular reason you're using snapshot?

My understanding is snapshot pertains to the image being built from a git rev? I built the snapshot from the latest release using https://gist.github.com/agoose77/4336ddeaafbca45f3e5d1fc9f5ebf63c.

Fast transition is broken in main, see https://github.com/openwrt/openwrt/pull/23181.

In theory, I should be able to use the official released image, and simply replace mac80211. Let me try that.

agoose77 · October 4, 2026, 9:48pm

Changing the channel width didn't fix it. I'm now running the configs without 802.11k, 802.11r, or BSS to see what happens. But, I'm not hopeful — this also happens on my 2.4GHz network that doesn't have those settings enabled.