Google Wifi OpenWrt [mesh] network flaky

greza · December 27, 2025, 3:58am

Hello,
I am very new to OpenWrt. I have 4 Google Wifi (Gale) devices, which I flashed to OpenWrt 24.10.2 r28739-d9340319c6 / LuCI openwrt-24.10 branch 25.168.50434~d6b13f6, kernel version 6.6.93

In order to have better coverage I tried to build a mesh (as defined here) out of it.

All devices have 2.4 and 5GHz antennas. Qualcomm Atheros IPQ4019 802.11ac/n and Qualcomm Atheros IPQ4019 802.11b/g/n

Mesh is set up on 5GHz network devices. I have set up WPA3 SAE encryption with all keys matching.

I have thres ESSIDs: two for 5GHz (blacked out on the picture and Guest) and one for 2.4GHz (marked with later V). All physical Google Wifi units advertise exactly the same ESSIDs with exactly the same password and parameters.

My ISP router does NOT have WiFi enabled. Only one of the Google Wifi units is connected to the router through cable and has IP assigned to its wan interface.

All four units have lan interfaces with hardcoded IPs (192.168.86.[1-4]) and all are in AccessPoint mode.

Basically, they have identical configurations, except for the lan IP addresses and one of them having WAN connection.

In associated station section all of them seem to see all other Mesh nodes.

The problem is that the units that are not the main ones seem to not work very well. I often lose the connection, or the computer claims that my network has no access to the internet, or the speed is pretty bad. I suspect that this happens when I am connected to one of the units that is not the main one, but I am not sure how to validate that hypothesis. I can see that the Associated Stations section on the Web UI of the main unit has by far the majority of the devices in home.

I tried playing with Wifi Roaming, but without Mesh I immediately lost connection between the units, so I had to go back to Mesh approach.

I am looking for any suggestions on how to debug the issue. What should I be looking for? Any specific tools or logs? I really do not want to go back to Google's standard system.

Any suggestion is greatly appreciated.
Thank you in advance.

brada4 · December 27, 2025, 9:21am

All AP service set has to have identical crypto and network bridge parameters.

Check yourself first, then add the file from "main ap" and the worst extender.

Also you can try to change ath10k firmware and kmod from -ct to mainline driver+fw or vice versa.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):

Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

greza · December 28, 2025, 1:12am

Thank you very much for the reply.

I did find some differences in the files, but not sure if they are significant.

Here is the ubus output from the main AP:

root@hostname:~# ubus call system board
{
	"kernel": "6.6.93",
	"hostname": "hostname",
	"system": "ARMv7 Processor rev 5 (v7l)",
	"model": "Google WiFi (Gale)",
	"board_name": "google,wifi",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "24.10.2",
		"revision": "r28739-d9340319c6",
		"target": "ipq40xx/chromium",
		"description": "OpenWrt 24.10.2 r28739-d9340319c6",
		"builddate": "1750711236"
	}
}

And here is ubus output from the suspected worst extender:

root@hostname4:~# ubus call system board
{
	"kernel": "6.6.93",
	"hostname": "hostnamet4",
	"system": "ARMv7 Processor rev 5 (v7l)",
	"model": "Google WiFi (Gale)",
	"board_name": "google,wifi",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "24.10.2",
		"revision": "r28739-d9340319c6",
		"target": "ipq40xx/chromium",
		"description": "OpenWrt 24.10.2 r28739-d9340319c6",
		"builddate": "1750711236"
	}
}

They seem to be identical, except for the hostname, which, I believe, is expected.

Contents of /etc/config/network from main AP:

root@hostname:~# cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'XXXX:YYYY:ZZZZ::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan'
	option ipv6 '0'

config device
	option name 'lan'
	option macaddr 'zz:zz:zz:zz:zz:zz'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.86.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config device
	option name 'wan'
	option macaddr 'yy:yy:yy:yy:yy:yy'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

config interface 'tailscale'
	option proto 'none'
	option device 'tailscale0'
	list dns '8.8.8.8'
	list dns '8.8.4.4'
	list dns '1.1.1.1'
	list dns '1.0.0.1'

And from the extender:

root@hostname4:~# cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'AAAA:BBBB:CCCC::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan'
	option ipv6 '0'

config device
	option name 'lan'
	option macaddr 'qq:ww:ee:rr:tt:yy'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.86.4'
	option netmask '255.255.255.0'
	option ip6assign '60'
	list dns '8.8.8.8'
	list dns '8.8.4.4'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option gateway '192.168.86.1'

config device
	option name 'wan'
	option macaddr 'ww:ee:rr:tt:yy:uu'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

The differences are

ula prefix
MAC addresses
static IP address on lan
extender points to main AP as gateway
extender has DNS addresses
main AP has tailscale interface

I have also checked the differences with another extender (which I am not pasting here for brevity) and they look the same.

/etc/config/wireless from the main AP:

root@hostname:~# cat /etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/soc/a000000.wifi'
	option band '2g'
	option channel '1'
	option cell_density '0'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option ssid 'SSIDV'
	option encryption 'sae-mixed'
	option key 'SSIDVKey'
	option ocv '0'
	option ieee80211k '1'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'platform/soc/a800000.wifi'
	option band '5g'
	option channel '36'
	option htmode 'VHT80'
	option cell_density '0'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid 'SSID'
	option encryption 'sae-mixed'
	option key 'SSIDKey'
	option ocv '0'
	option ieee80211r '1'
	option mobility_domain 'XXXX'
	option ft_over_ds '0'
	option ieee80211k '1'
	option bss_transition '1'

config wifi-iface 'wifinet2'
	option device 'radio1'
	option mode 'mesh'
	option encryption 'sae'
	option mesh_id 'Mesh'
	option mesh_fwding '1'
	option mesh_rssi_threshold '0'
	option key 'MeshKey'
	option network 'lan'

config wifi-iface 'wifinet3'
	option device 'radio1'
	option mode 'ap'
	option ssid 'Guest'
	option encryption 'sae-mixed'
	option key 'GuestKey'
	option ocv '0'
	option network 'lan'

And /etc/config/wireless from the extender:

root@hostname4:~# cat /etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/soc/a000000.wifi'
	option band '2g'
	option channel '1'
	option cell_density '0'
	option txpower '30'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'platform/soc/a800000.wifi'
	option band '5g'
	option channel '36'
	option htmode 'VHT80'
	option cell_density '0'
	option txpower '23'

config wifi-iface 'wifinet4'
	option device 'radio0'
	option mode 'ap'
	option ssid 'SSIDV'
	option encryption 'sae-mixed'
	option key 'SSIDVKey'
	option ocv '0'
	option network 'lan'
	option ieee80211k '1'

config wifi-iface 'wifinet1'
	option device 'radio1'
	option mode 'ap'
	option ssid 'SSID'
	option encryption 'sae-mixed'
	option key 'SSIDKey'
	option ocv '0'
	option network 'lan'
	option ieee80211r '1'
	option mobility_domain 'XXXX'
	option ft_over_ds '0'
	option ieee80211k '1'
	option bss_transition '1'

config wifi-iface 'wifinet2'
	option device 'radio1'
	option mode 'mesh'
	option encryption 'sae'
	option mesh_id 'Mesh'
	option mesh_fwding '1'
	option mesh_rssi_threshold '0'
	option key 'MeshKey'
	option network 'lan'

config wifi-iface 'wifinet3'
	option device 'radio1'
	option mode 'ap'
	option ssid 'Guest'
	option encryption 'sae-mixed'
	option key 'GuestKey'
	option ocv '0'
	option network 'lan'

The differences here are

the extender has txpower option set on wifi-device configurations.
order and names of wifi-iface configs are different, but I doubt that this is important
order of option network 'lan' is different; also doubtful that it is important

On to DHCP configuration...
Main AP:

root@hostname:~# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '1'
	option ednspacket_max '1232'

config dhcp 'lan'
	option interface 'lan'
	option start '10'
	option limit '250'
	option leasetime '12h'
	option dhcpv4 'server'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config host
	option name 'static1'
	option ip '192.168.86.11'
	list mac 'aa:ss:dd:ff:gg:hh'
 ...

DHCP from the extender:

root@hostname4:~# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option cachesize '1000'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '1'
	option ednspacket_max '1232'

config dhcp 'lan'
	option interface 'lan'
	option start '10'
	option limit '200'
	option leasetime '12h'
	option dhcpv4 'server'
	option ignore '1'
	option dynamicdhcp '0'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

Differences:

In dhcp 'lan' config limit option has different values 250 vs 200
In dhcp 'lan' config on extender there are two more options: ignore '1' and dynamicdhcp '0', which are not present on the main AP.
main AP has static host configs

Also, when looking at another extender I see that I have the following options not set on the bad extender:

	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

Finally, firewall

On the main AP:

root@hostname:~# cat /etc/config/firewall

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone 'lan'
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list device 'tun+'

config zone 'wan'
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'tailscale'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'tailscale'

config forwarding
	option src 'tailscale'
	option dest 'lan'

config forwarding
	option src 'tailscale'
	option dest 'wan'

config forwarding
	option src 'lan'
	option dest 'tailscale'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'BLABLABLA'
	option family 'ipv4'
	list proto 'tcp'
	option src 'wan'
	option src_dport 'XXXX'
	option dest_ip '192.168.86.XX'
	option dest_port 'XX'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'BLABLA'
	list proto 'tcp'
	option src 'wan'
	option src_dport 'ZZ'
	option dest_ip '192.168.86.ZZ'
	option dest_port 'ZZ'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'FOOFOO'
	option src 'wan'
	option src_dport 'AAAA'
	option dest_ip '192.168.86.AA'
	option dest_port 'AAAA'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'FOO FOO Daemon'
	option src 'wan'
	option src_dport 'QQQQ'
	option dest_ip '192.168.86.QQ'
	option dest_port 'QQQQ'

config rule 'ovpn'
	option name 'Allow-OpenVPN'
	option src 'wan'
	option dest_port 'SSSSS'
	option proto 'udp'
	option target 'ACCEPT'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'WireGuard'
	list proto 'udp'
	option src 'wan'
	option src_dport 'DDDDD'
	option dest_ip '192.168.86.DD'
	option dest_port 'DDDDD'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'OpenVpn BARBAR'
	list proto 'udp'
	option src 'wan'
	option src_dport '1194'
	option dest_ip '192.168.86.WW'
	option dest_port '1194'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'BOBOBOBO'
	option src 'wan'
	option src_dport 'VVVVV'
	option dest_ip '192.168.86.VV'
	option dest_port 'VVVVV'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'POPOPOPOt'
	option src 'wan'
	option src_dport 'BBBBB'
	option dest_ip '192.168.86.BB'
	option dest_port 'BBBBB'

And from extender:

root@hostname4:~# cat /etc/config/firewall 
config defaults
	option syn_flood	1
	option input		REJECT
	option output		ACCEPT
	option forward		REJECT
# Uncomment this line to disable ipv6 rules
#	option disable_ipv6	1

config zone
	option name		lan
	list   network		'lan'
	option input		ACCEPT
	option output		ACCEPT
	option forward		ACCEPT

config zone
	option name		wan
	list   network		'wan'
	list   network		'wan6'
	option input		REJECT
	option output		ACCEPT
	option forward		REJECT
	option masq		1
	option mtu_fix		1

config forwarding
	option src		lan
	option dest		wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
	option name		Allow-DHCP-Renew
	option src		wan
	option proto		udp
	option dest_port	68
	option target		ACCEPT
	option family		ipv4

# Allow IPv4 ping
config rule
	option name		Allow-Ping
	option src		wan
	option proto		icmp
	option icmp_type	echo-request
	option family		ipv4
	option target		ACCEPT

config rule
	option name		Allow-IGMP
	option src		wan
	option proto		igmp
	option family		ipv4
	option target		ACCEPT

# Allow DHCPv6 replies
# see https://github.com/openwrt/openwrt/issues/5066
config rule
	option name		Allow-DHCPv6
	option src		wan
	option proto		udp
	option dest_port	546
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-MLD
	option src		wan
	option proto		icmp
	option src_ip		fe80::/10
	list icmp_type		'130/0'
	list icmp_type		'131/0'
	list icmp_type		'132/0'
	list icmp_type		'143/0'
	option family		ipv6
	option target		ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Input
	option src		wan
	option proto	icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	list icmp_type		router-solicitation
	list icmp_type		neighbour-solicitation
	list icmp_type		router-advertisement
	list icmp_type		neighbour-advertisement
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Forward
	option src		wan
	option dest		*
	option proto		icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-IPSec-ESP
	option src		wan
	option dest		lan
	option proto		esp
	option target		ACCEPT

config rule
	option name		Allow-ISAKMP
	option src		wan
	option dest		lan
	option dest_port	500
	option proto		udp
	option target		ACCEPT


### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
#	option src		lan
#	option src_ip	192.168.45.2
#	option dest		wan
#	option proto	tcp
#	option target	REJECT

# block a specific mac on wan
#config rule
#	option dest		wan
#	option src_mac	00:11:22:33:44:66
#	option target	REJECT

# block incoming ICMP traffic on a zone
#config rule
#	option src		lan
#	option proto	ICMP
#	option target	DROP

# port redirect port coming in on wan to lan
#config redirect
#	option src			wan
#	option src_dport	80
#	option dest			lan
#	option dest_ip		192.168.16.235
#	option dest_port	80
#	option proto		tcp

# port redirect of remapped ssh port (22001) on wan
#config redirect
#	option src		wan
#	option src_dport	22001
#	option dest		lan
#	option dest_port	22
#	option proto		tcp

### FULL CONFIG SECTIONS
#config rule
#	option src		lan
#	option src_ip	192.168.45.2
#	option src_mac	00:11:22:33:44:55
#	option src_port	80
#	option dest		wan
#	option dest_ip	194.25.2.129
#	option dest_port	120
#	option proto	tcp
#	option target	REJECT

#config redirect
#	option src		lan
#	option src_ip	192.168.45.2
#	option src_mac	00:11:22:33:44:55
#	option src_port		1024
#	option src_dport	80
#	option dest_ip	194.25.2.129
#	option dest_port	120
#	option proto	tcp

I believe I have not changed anything on the extender, since it looks like a default config with comments and option values with TABs instead of spaces. The other extender has an identical file.

On the main AP I have added a openvpn rule and a bunch of port forwards. I think the rest of the differences are in formatting.

Is there anything that catches your eye as obviously wrong? What should my next steps be?

Once again, thank you very much for your time!

hecatae · December 28, 2025, 4:31pm

Are you using the -ct WiFi firmware?

greza · December 29, 2025, 2:40am

Firmware Version	OpenWrt 24.10.2 r28739-d9340319c6 / LuCI openwrt-24.10 branch 25.168.50434~d6b13f6

I guess not.

Should I just copy the network wireless dhcp and firewall files to have them identical (except for the MAC and IP addresses)?

slh · December 29, 2025, 3:29am

Your output doesn't really tell anything about -ct or mainline, but if that question doesn't catch on, we might assume -ct (as that's default for OpenWrt and you'd have to make an active decision to use mainline). opkg list_installed | grep ath10k (and/ or dmesg | grep ath10k) will tell you, though.

greza · December 29, 2025, 8:49pm

# opkg list_installed | grep ath10k
ath10k-board-qca4019 - 20241110-r2
ath10k-firmware-qca4019-ct - 2020.11.08-r1
kmod-ath10k-ct - 6.6.93.2024.07.30~ac71b14d-r2

brada4 · December 29, 2025, 9:01pm

While wired on one AP first

opkg update 
opkg remove ath10k-firmware-qca4019-ct kmod-ath10k-ct 
opkg install ath10k-firmware-qca4019 kmod-ath10k

then restart the device and see if it becomes better.