Editing /etc/config/wireless

linuxuser · July 27, 2026, 9:14pm

What is wrong with this wifi-configuration? I have a working similar configuration and configured everything by editing the file with vim.

root@TUF-AX4200:~# cat /etc/config/wireless

config wifi-device 'radio0'
option type 'mac80211'
option path 'platform/soc/18000000.wifi'
option channel '1'
option band '2g'
option htmode 'HE20'
option cell_density '0'
option country 'DE'

config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'MYSSID.4x-m'
option encryption 'sae-mixed'
option key 'MYPASSWD'
option disabled '1'
option ocv '0'

config wifi-device 'radio1'
option type 'mac80211'
option path 'platform/soc/18000000.wifi+1'
option channel '100'
option band '5g'
option htmode 'HE40'
option cell_density '0'
option country 'DE'

config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'MYSSID.5x-2'
option encryption 'psk2'
option key 'MYPASSWD'
option ocv '0'

config wifi-iface 'wifinet2'
option device 'radio0'
option ssid 'UPSTREAM'
option encryption 'sae'
option key 'MYPASSWD'
option mode 'sta'
option bssid '0A:BF:B8:*:*:*'
option wds '1'
option network 'lan'

LilRedDog · July 27, 2026, 9:21pm

Turn the radios on?

linuxuser · July 27, 2026, 9:30pm

I want 5GHz only as access point, I disabled 2.4G. Didn't I?

LilRedDog · July 27, 2026, 9:49pm

linuxuser:

config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'MYSSID.4x-m'
option encryption 'sae-mixed'
option key 'MYPASSWD'
option disabled '1'
option ocv '0'

linuxuser:


config wifi-iface 'wifinet2'
option device 'radio0'      <-----???
option ssid 'UPSTREAM'
option encryption 'sae'
option key 'MYPASSWD'
option mode 'sta'          <------???
option bssid '0A:BF:B8:*:*:*'
option wds '1'
option network 'lan'

What are you trying to do?

LilRedDog · July 27, 2026, 9:50pm

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):

Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

linuxuser · July 27, 2026, 10:05pm

I want to replace a working Asus AX53U (25.12.5) with a new Asus TUF-4200. So I just replaced the parts of the the new conifiguration with the old one.

I think we do not need to discuss wds, it works. I have a wireless access point without an ethernet cable. It could be that luci configures something automatically. I had a similar problem a few days ago and solved it, but I don't know why.

not so easy, there are different networks, pcs with no internet connection. You are asking for the whole ocnfiguration. This will take a while.

In other words I see no network signal with Luci, while I see this with similar devices. It will take a while to post all this informations.

LilRedDog · July 27, 2026, 10:14pm

Hold on then...

You want to extend, ad-hoc style?
You have a config that worked, but you don't care what works as long as you can extend without a cord, yes?

New hardware may not tolerate commands the other put up with because it ignored options it could not implement...

linuxuser · July 27, 2026, 10:30pm

It is a lot easier to post the working configuration, because this router is in the same network. Please note, I did not simply copy the configuration files to the other device. I checked the relevant settings. Maybe I deleted a line or forgot one. DHCP-server is disabled.

Maybe you can compare the wireless file.

root@AX53U-K1:~# ubus call system board
{
"kernel": "6.12.94",
"hostname": "AX53U-K1",
"system": "MediaTek MT7621 ver:1 eco:3",
"model": "ASUS RT-AX53U",
"board_name": "asus,rt-ax53u",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "25.12.5",
"firmware_url": "``https://downloads.openwrt.org/``",
"revision": "r33051-f5dae5ece4",
"target": "ramips/mt7621",
"description": "OpenWrt 25.12.5 r33051-f5dae5ece4",
"builddate": "1782737960"
}
}

root@AX53U-K1:~# cat /etc/config/network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fd93:e06d:c0dd::/48'
option packet_steering '1'
option dhcp_default_duid '0004e8baa562baf7409ea9d88e5495bf2420'

config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.178.22'
option netmask '255.255.255.0'
option ip6assign '60'
option gateway '192.168.178.1'
list dns '192.168.178.1'

config interface 'wan'
option device 'wan'
option proto 'dhcp'

config interface 'wan6'
option device 'wan'
option proto 'dhcpv6'

root@AX53U-K1:~# cat /etc/config/wireless

config wifi-device 'radio0'
option type 'mac80211'
option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
option channel '11'
option band '2g'
option htmode 'HE20'
option cell_density '0'
option country 'AT'

config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'MYSSID.4x-m'
option encryption 'sae-mixed'
option key 'MYPASSWD'
option disabled '1'

config wifi-device 'radio1'
option type 'mac80211'
option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0+1'
option channel '157'
option band '5g'
option htmode 'HE40'
option country 'AT'
option cell_density '0'

config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'MYSSID.5x-2'
option encryption 'psk2'
option key 'MYPASSWD'

config wifi-iface 'wpa3_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'MYSSID.5x-3'
option encryption 'sae'
option key 'MYPASSWD'

config wifi-iface 'mix_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'MYSSID.5x-m'
option encryption 'sae-mixed'
option key 'MYPASSWD'
option disabled '1'

config wifi-iface 'wifinet2'
option device 'radio0'
option ssid 'UPSTREAM'
option encryption 'sae'
option key 'MYPASSWD'
option mode 'sta'
option bssid '0A:BF:B8:::*'
option wds '1'
option network 'lan'

root@AX53U-K1:~# cat /etc/config/dhcp

config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
option filter_aaaa '0'
option filter_a '0'

config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
option ra_slaac '1'
list ra_flags 'managed-config'
list ra_flags 'other-config'
option ignore '1'

config dhcp 'wan'
option interface 'wan'
option ignore '1'

config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/odhcpd.leases'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
option piodir '/tmp/odhcpd-piodir'
option hostsdir '/tmp/hosts'

root@AX53U-K1:~# cat /etc/config/firewall

config defaults
option syn_flood	1
option input		REJECT
option output		ACCEPT
option forward		REJECT

Uncomment this line to disable ipv6 rules

option disable_ipv6	1

config zone
option name		lan
list   network		'lan'
option input		ACCEPT
option output		ACCEPT
option forward		ACCEPT

config zone
option name		wan
list   network		'wan'
list   network		'wan6'
option input		REJECT
option output		ACCEPT
option forward		REJECT
option masq		1
option mtu_fix		1

config forwarding
option src		lan
option dest		wan

We need to accept udp packets on port 68,

see https://dev.openwrt.org/ticket/4108

config rule
option name		Allow-DHCP-Renew
option src		wan
option proto		udp
option dest_port	68
option target		ACCEPT
option family		ipv4

Allow IPv4 ping

config rule
option name		Allow-Ping
option src		wan
option proto		icmp
option icmp_type	echo-request
option family		ipv4
option target		ACCEPT

config rule
option name		Allow-IGMP
option src		wan
option proto		igmp
option family		ipv4
option target		ACCEPT

Allow DHCPv6 replies

see https://github.com/openwrt/openwrt/issues/5066

config rule
option name		Allow-DHCPv6
option src		wan
option proto		udp
option dest_port	546
option family		ipv6
option target		ACCEPT

config rule
option name		Allow-MLD
option src		wan
option proto		icmp
option src_ip		fe80::/10
list icmp_type		'130/0'
list icmp_type		'131/0'
list icmp_type		'132/0'
list icmp_type		'143/0'
option family		ipv6
option target		ACCEPT

Allow essential incoming IPv6 ICMP traffic

config rule
option name		Allow-ICMPv6-Input
option src		wan
option proto	icmp
list icmp_type		echo-request
list icmp_type		echo-reply
list icmp_type		destination-unreachable
list icmp_type		packet-too-big
list icmp_type		time-exceeded
list icmp_type		bad-header
list icmp_type		unknown-header-type
list icmp_type		router-solicitation
list icmp_type		neighbour-solicitation
list icmp_type		router-advertisement
list icmp_type		neighbour-advertisement
option limit		1000/sec
option family		ipv6
option target		ACCEPT

Allow essential forwarded IPv6 ICMP traffic

config rule
option name		Allow-ICMPv6-Forward
option src		wan
option dest		*
option proto		icmp
list icmp_type		echo-request
list icmp_type		echo-reply
list icmp_type		destination-unreachable
list icmp_type		packet-too-big
list icmp_type		time-exceeded
list icmp_type		bad-header
list icmp_type		unknown-header-type
option limit		1000/sec
option family		ipv6
option target		ACCEPT

config rule
option name		Allow-IPSec-ESP
option src		wan
option dest		lan
option proto		esp
option target		ACCEPT

config rule
option name		Allow-ISAKMP
option src		wan
option dest		lan
option dest_port	500
option proto		udp
option target		ACCEPT

EXAMPLE CONFIG SECTIONS

do not allow a specific ip to access wan

#config rule

option src		lan

option src_ip	192.168.45.2

option dest		wan

option proto	tcp

option target	REJECT

block a specific mac on wan

#config rule

option dest		wan

option src_mac	00:11:22:33:44:66

option target	REJECT

block incoming ICMP traffic on a zone

#config rule

option src		lan

option proto	ICMP

option target	DROP

port redirect port coming in on wan to lan

#config redirect

option src			wan

option src_dport	80

option dest			lan

option dest_ip		192.168.16.235

option dest_port	80

option proto		tcp

port redirect of remapped ssh port (22001) on wan

#config redirect

option src		wan

option src_dport	22001

option dest		lan

option dest_port	22

option proto		tcp

FULL CONFIG SECTIONS

#config rule

option src		lan

option src_ip	192.168.45.2

option src_mac	00:11:22:33:44:55

option src_port	80

option dest		wan

option dest_ip	194.25.2.129

option dest_port	120

option proto	tcp

option target	REJECT

#config redirect

option src		lan

option src_ip	192.168.45.2

option src_mac	00:11:22:33:44:55

option src_port		1024

option src_dport	80

option dest_ip	194.25.2.129

option dest_port	120

option proto	tcp

lleachii · July 28, 2026, 12:00am

This needs to be changed back to the default auto.

I think you got lucky selecting 157.

This is because:

the upstream AP selects the channel
the STA connection must be established before the AP SSID will activate on air

I'm not even gonna ask why you have both an AP and STA connected to the same network.

hnyman · July 28, 2026, 4:33am

In general, the sae-mixed may be problematic for some devices. Preferably have separate SSIDs for wpa2 and wpa3.

linuxuser · July 28, 2026, 10:34am

Done, it doesn't work (no signal shown) and I never did this with my other devices, I only used the same channel for the upstream.

Short explanation: I have very thick walls and very old devices, and Mesh doesn't work with all devices. I use 2.4G for the upstream, but the phones connect to an AP with 5GHz, works fine with all others.

Simply very thick walls. Can happen that 2m distance is not reachable through a wall.

Please note, sae-mixed is a placeholder.

option disabled '1'

For testing I removed as much as possible.

Here are some queries now. I have to change cables, keyboard, monitor, etc. to post data from the AX4200.

root@TUF-AX4200:~# ubus call system board
{
"kernel": "6.12.94",
"hostname": "TUF-AX4200",
"system": "ARMv8 Processor rev 4",
"model": "ASUS TUF-AX4200",
"board_name": "asus,tuf-ax4200",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "25.12.5",
"firmware_url": "https://downloads.openwrt.org/",
"revision": "r33051-f5dae5ece4",
"target": "mediatek/filogic",
"description": "OpenWrt 25.12.5 r33051-f5dae5ece4",
"builddate": "1782737960"
}
}

new wireless:

root@TUF-AX4200:~# cat /etc/config/wireless

config wifi-device 'radio0'
option type 'mac80211'
option path 'platform/soc/18000000.wifi'
option channel 'auto'
option band '2g'
option htmode 'HE20'
option cell_density '0'
option country 'DE'

config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'MYSSID.4x-m'
option encryption 'sae-mixed'
option key 'MYPASSWD'
option disabled '1'
option ocv '0'

config wifi-device 'radio1'
option type 'mac80211'
option path 'platform/soc/18000000.wifi+1'
option channel 'auto'
option band '5g'
option htmode 'HE40'
option cell_density '0'
option country 'DE'

config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'MYSSID.5x-2'
option encryption 'psk2'
option key 'MYPASSWD'

config wifi-iface 'wifinet2'
option device 'radio0'
option ssid 'UPSTREAM'
option encryption 'sae'
option key 'MYPASSWD'
option mode 'sta'
option bssid '0A:BF:B8:::*'
option wds '1'
option network 'lan'
option ocv '0'

lleachii · July 28, 2026, 10:59am

I don't understand the response.

Just for clarification, can you provide a brief summary of:

what's still not working
and what you desire

I realized the STA was on 2.4 GHz.

(So I just want to verify if the issue is wireless, network connection, etc. Please elaborate.)

linuxuser · July 28, 2026, 11:16am

Good question. It looks like it works, but the webif (Luci) doesn't show a signal, so I assumed it doesn't work. Please give me some time to check.

Since I can connect now via wifi, I see a signal, which I didn't before via Ethernet.

lleachii · July 28, 2026, 11:20am

Some graphics don't show connection until you have an association.

OK, take your time. If you need help later, posting a screenshot may help.

linuxuser · July 28, 2026, 3:23pm

It looks like my problems could be connected with regulations.

I assume there is maybe 1 rule with the most limiting regulations for the whole European Union, while it could depend on the country.

There are rules by the EU, while a country could make things "stronger".

Germany limits the channel to 165, while Austria and Switzerland (not in the EU) allow 173.

Setting the country to Austria and choosing channel 173 disables the radio, although it would be legal.

Couldn't set higher channels with Switzerland too, which has very similar rules compared to Austria.

I am testing with Android's Wifi Analyzer and couldn't get something higher than 165 with country Austria. This means I am limited with bandwidth. Not a big problem, but in some situations it could be an advantage.

linuxuser · July 28, 2026, 3:38pm

Played a little bit. No chance to get a higher channel than this:

hnyman · July 28, 2026, 3:52pm

Where is that "channel 173 is legal" coming from?

The Linux wireless regulatory database says:

https://git.kernel.org/pub/scm/linux/kernel/git/wens/wireless-regdb.git/tree/db.txt#n123

# AT as part of EU/CEPT accepted decisions 2005/513/EC (5GHz RLAN, EN 301 893)
# and 2006/771/EC (amended by 2008/432/EC, Short-Range Devices, EN 300 440)
#  EU decision 2005/513/EC: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02005D0513-20070213
#  EU decision 2006/771/EC: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02008D0432-20080611
#  EU decision 2021/1067/EC: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D1067&from=EN
# Harmonized CEPT countries (February 2021): https://docdb.cept.org/download/25c41779-cd6e/Rec7003e.pdf
# AT: https://www.rtr.at/TKP/was_wir_tun/telekommunikation/spectrum/bands/1997_bmvit-info-052010en.pdf
# AT: acceptance https://www.ris.bka.gv.at/Dokumente/BgblAuth/BGBLA_2014_II_63/BGBLA_2014_II_63.pdfsig
# Harmonized CEPT countries for 6 GHz (ECC Decision (20)01)
#  https://docdb.cept.org/implementation/16737
#  https://docdb.cept.org/download/4685
country AT: DFS-ETSI
	(2400 - 2483.5 @ 40), (100 mW)
	(5150 - 5250 @ 80), (200 mW), NO-OUTDOOR, AUTO-BW, wmmrule=ETSI
	(5250 - 5350 @ 80), (100 mW), NO-OUTDOOR, DFS, AUTO-BW, wmmrule=ETSI
	(5470 - 5725 @ 160), (500 mW), DFS, wmmrule=ETSI
	# short range devices (ETSI EN 300 440-1)
	(5725 - 5875 @ 80), (25 mW)
	# 6 GHz band
	(5945 - 6425 @ 320), (23), NO-OUTDOOR, wmmrule=ETSI
	# 60 GHz band channels 1-4 (ETSI EN 302 567)
	(57000 - 71000 @ 2160), (40)

So, the 5 GHz channels defined for Austria are capped at 168.

Practically the same rules for CH in the same file.

lleachii · July 28, 2026, 4:26pm

Just to add, editing your country code to something other than your router's current place of residence is [technically] illegal.

linuxuser · July 28, 2026, 6:30pm

Wikipedia says 173 is allowed in the EU, 177 not.

linuxuser · July 28, 2026, 6:32pm

So I understand, it is allowed indoor, which I would do.