Hello,
sorry for the stupid question but I'm trying to debug my mt2500.
I need a 25.12.4 image as it was released. If I download from firmware selector it gives me a 25.12.4 with the updates released in the meantimes....
By default firmware selector serves original files back to release date. You obtain updated images if you perform a custom build.
Here are manual downloads. Just choose the right file.
Keep your installation files localy, just in case 
Yes... I made an orrible mistake... I upgraded several other devices with non problem but my mt2500 now is unable to serve dhcp addresses to the AP....
Consider making a separate thread about it and post your configs, chances are it is something in your configs?
Not sure why the OP needs to create another thread. They just opened this one.
they don't need the old dnsmasq any more ... focus have shifted, I would agree with egc.
Aaah, I missed the remark about configs. I agree (albeit, a new thread may be overkill).
Ok, here are my configs...
On MT2500 (router)
config interface 'loopback'
option device 'lo'
option proto 'static'
list ipaddr '127.0.0.1/8'
config globals 'globals'
option dhcp_default_duid '000402c6ef91aa514057880b102f7ea991fa'
option ula_prefix 'fd9b:99f9:87cf::/48'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'
config interface 'lan'
option device 'br-lan'
option proto 'static'
list ipaddr '192.168.1.1/24'
option ip6assign '60'
option multipath 'off'
config interface 'wan'
option device 'eth1.835'
option proto 'pppoe'
option username 'x'
option password 'x'
option ipv6 'auto'
option norelease '1'
option multipath 'off'
config interface 'wan6'
option device 'eth1'
option proto 'dhcpv6'
option reqaddress 'try'
option reqprefix 'auto'
option norelease '1'
option multipath 'off'
config interface 'WG0'
option proto 'wireguard'
list addresses '10.6.0.1/32'
option private_key 'x'
option listen_port '51820'
option multipath 'off'
config wireguard_WG0
option description 'Router Ufficio'
option public_key 'x'
option private_key 'x'
list allowed_ips '10.6.0.2/32'
list allowed_ips '192.168.13.0/24'
option route_allowed_ips '1'
option persistent_keepalive '25'
config wireguard_WG0
option description 'Router Mare'
option public_key 'x'
option private_key 'x'
option persistent_keepalive '25'
list allowed_ips '10.6.0.6/32'
list allowed_ips '192.168.14.0/24'
option route_allowed_ips '1'
config wireguard_WG0
option description 'Router Mamma'
option public_key 'x'
option private_key 'x'
list allowed_ips '10.6.0.5/32'
list allowed_ips '192.168.12.0/24'
option route_allowed_ips '1'
option persistent_keepalive '25'
config wireguard_WG0
option description 'Giovanni'
option public_key 'x'
option route_allowed_ips '1'
option persistent_keepalive '25'
option private_key 'x'
list allowed_ips '10.6.0.3/32'
config wireguard_WG0
option description 'Tablet Giovanni'
option public_key 'x'
option private_key 'x'
list allowed_ips '10.6.0.8/32'
option persistent_keepalive '25'
option route_allowed_ips '1'
config wireguard_WG0
option description 'Roadwarrior preimpostato'
option public_key 'x'
option private_key 'x'
list allowed_ips '10.6.0.4/32'
option route_allowed_ips '1'
option persistent_keepalive '25'
config wireguard_WG0
option public_key 'x'
option private_key 'x'
option description 'Router preimpostato'
list allowed_ips '10.6.0.9/32'
list allowed_ips '192.168.15.0/24'
option route_allowed_ips '1'
option persistent_keepalive '25'
config interface 'WG1'
option proto 'wireguard'
option private_key 'x'
list addresses '10.6.1.1/32'
option listen_port '51821'
option multipath 'off'
config wireguard_WG1
option description 'Tablet Sofia'
option public_key 'x'
option private_key 'x'
option route_allowed_ips '1'
option persistent_keepalive '25'
list allowed_ips '10.6.1.2/32'
config wireguard_WG1
option description 'Cellulare Sofia'
option public_key 'x'
option private_key 'x'
list allowed_ips '10.6.1.3/32'
option route_allowed_ips '1'
option persistent_keepalive '25'
config wireguard_WG1
option description 'Portatile Sofia'
option public_key 'x'
option private_key 'x'
list allowed_ips '10.6.1.4/32'
option route_allowed_ips '1'
option persistent_keepalive '25'
config wireguard_WG1
option description 'Francesca'
option public_key 'x'
option private_key 'x'
list allowed_ips '10.6.1.5/32'
option route_allowed_ips '1'
option persistent_keepalive '25'
On WAX220 (AP)
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fdf9:b906:e0cf::/48'
option packet_steering '1'
option dhcp_default_duid '0004bdb0a6e1c07d4aea8441e109e2d65152'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'
config device
option name 'eth0'
option macaddr 'DA:DB:02:77:C1:AF'
config interface 'lan'
option device 'br-lan'
option proto 'dhcp'
if you need more I can give...
Thanks to all
In particular:
/etc/config/dhcp
... and where/how does the AP come into the picture ?
MT2500
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option localservice '0'
option ednspacket_max '1232'
list server '127.0.0.1#5054'
list server '/mask.icloud.com/'
list server '/mask-h2.icloud.com/'
list server '/use-application-dns.net/'
list server '127.0.0.1#5053'
option doh_backup_noresolv '-1'
option noresolv '1'
list doh_backup_server '127.0.0.1#5054'
list doh_backup_server '/mask.icloud.com/'
list doh_backup_server '/mask-h2.icloud.com/'
list doh_backup_server '/use-application-dns.net/'
list doh_backup_server '127.0.0.1#5053'
list doh_server '127.0.0.1#5053'
config dhcp 'lan'
option interface 'lan'
option start '10'
option limit '90'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
option ra_preference 'medium'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option leasefile '/tmp/odhcpd.leases'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
option piodir '/tmp/odhcpd-piodir'
option hostsdir '/tmp/hosts'
config host
option name 'Vuzero'
list mac 'b8:a3:86:07:17:e4'
option ip '192.168.1.14'
config host
option name 'BrotherPrinter'
option ip '192.168.1.50'
list mac '2c:33:7A:6b:ca:8c'
config host
option name 'Shield'
list mac '00:04:4B:B3:96:75'
option ip '192.168.1.53'
config host
option name 'WAX220'
list mac 'DA:DB:02:77:C1:AF'
option ip '192.168.1.11'
config host
option name 'B1300'
option ip '192.168.1.12'
list mac '94:83:c4:01:d7:51'
config host
option ip '192.168.1.38'
list mac 'e0:46:ee:18:f0:bc'
option name 'Gs308'
WAX220
config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
option filter_aaaa '0'
option filter_a '0'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option ignore '1'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/odhcpd.leases'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
option piodir '/tmp/odhcpd-piodir'
option hostsdir '/tmp/hosts'
I have an mt2500 as router connected to a wax220 AP.
After upgrade to 25.12.5 every client connected via wifi doesn't receive a IP address, so no connection
Just to give more insight.
If I connect the MT2500 directly to my PC it gives an IP address, so it seems that the problem is between the mt2500 and the wax220.
Now I replaced the MT2500 with a backup ER-X with an old 25.10.3 and it works as expected, as it was my MT2500 until the upgrade to 25.12.5
I assume the WAX 220 received its IP?
Seems so reading the WAX log...
[29 giu 2026, 15:02:05 CEST] daemon.notice: netifd: lan (2524): udhcpc: broadcasting select for 192.168.1.11, server 192.168.1.1
[29 giu 2026, 15:02:09 CEST] daemon.notice: netifd: lan (2524): udhcpc: broadcasting select for 192.168.1.11, server 192.168.1.1
[29 giu 2026, 15:02:09 CEST] daemon.notice: netifd: lan (2524): udhcpc: lease of 192.168.1.11 obtained from 192.168.1.1, lease time 43200
But if I check a WDS device I have I can see this in the logs:
[1 lug 2026, 12:05:41 CEST] daemon.notice: wpa_supplicant[1258]: phy1-sta0: CTRL-EVENT-BEACON-LOSS
[1 lug 2026, 12:05:41 CEST] daemon.notice: netifd: Network device 'phy1-sta0' link is down
[1 lug 2026, 12:05:41 CEST] kern.info: [48253.718438] br-lan: port 3(phy1-sta0) entered disabled state
[1 lug 2026, 12:05:41 CEST] kern.warn: [48253.888850] ath10k_ahb a800000.wifi: peer-unmap-event: unknown peer id 1
[1 lug 2026, 12:05:41 CEST] kern.warn: [48253.888939] ath10k_ahb a800000.wifi: peer-unmap-event: unknown peer id 1
[1 lug 2026, 12:05:41 CEST] kern.warn: [48253.894657] ath10k_ahb a800000.wifi: peer-unmap-event: unknown peer id 1
[1 lug 2026, 12:05:41 CEST] daemon.notice: wpa_supplicant[1258]: phy1-sta0: CTRL-EVENT-DISCONNECTED bssid=94:18:65:43:76:4a reason=4 locally_generated=1
[1 lug 2026, 12:05:41 CEST] daemon.notice: wpa_supplicant[1258]: phy1-sta0: Added BSSID 94:18:65:43:76:4a into ignore list, ignoring for 10 seconds
[1 lug 2026, 12:05:45 CEST] daemon.notice: wpa_supplicant[1258]: phy1-sta0: Removed BSSID 94:18:65:43:76:4a from ignore list (clear)
[1 lug 2026, 12:05:45 CEST] daemon.notice: wpa_supplicant[1258]: phy1-sta0: SME: Trying to authenticate with 94:18:65:43:76:4a (SSID='ABaoaQu' freq=5580 MHz)
[1 lug 2026, 12:05:45 CEST] kern.info: [48257.253852] phy1-sta0: authenticate with 94:18:65:43:76:4a (local address=94:83:c4:01:d7:52)
[1 lug 2026, 12:05:45 CEST] kern.info: [48257.253926] phy1-sta0: send auth to 94:18:65:43:76:4a (try 1/3)
[1 lug 2026, 12:05:45 CEST] kern.info: [48257.262997] phy1-sta0: send auth to 94:18:65:43:76:4a (try 2/3)
[1 lug 2026, 12:05:45 CEST] kern.info: [48257.268523] phy1-sta0: send auth to 94:18:65:43:76:4a (try 3/3)
[1 lug 2026, 12:05:45 CEST] kern.info: [48257.274402] phy1-sta0: authentication with 94:18:65:43:76:4a timed out
[1 lug 2026, 12:05:45 CEST] daemon.notice: wpa_supplicant[1258]: phy1-sta0: Added BSSID 94:18:65:43:76:4a into ignore list, ignoring for 10 seconds
[1 lug 2026, 12:05:45 CEST] kern.warn: [48257.328410] ath10k_ahb a800000.wifi: peer-unmap-event: unknown peer id 1
[1 lug 2026, 12:05:48 CEST] daemon.notice: wpa_supplicant[1258]: phy1-sta0: Removed BSSID 94:18:65:43:76:4a from ignore list (clear)
[1 lug 2026, 12:07:16 CEST] daemon.notice: wpa_supplicant[1258]: phy1-sta0: SME: Trying to authenticate with 94:18:65:43:76:4a (SSID='ABaoaQu' freq=5580 MHz)
[1 lug 2026, 12:07:16 CEST] kern.info: [48348.837876] phy1-sta0: authenticate with 94:18:65:43:76:4a (local address=94:83:c4:01:d7:52)
[1 lug 2026, 12:07:16 CEST] kern.info: [48348.837949] phy1-sta0: send auth to 94:18:65:43:76:4a (try 1/3)
[1 lug 2026, 12:07:16 CEST] daemon.notice: wpa_supplicant[1258]: phy1-sta0: SME: Trying to authenticate with 94:18:65:43:76:4a (SSID='ABaoaQu' freq=5580 MHz)
[1 lug 2026, 12:07:16 CEST] kern.info: [48348.899662] phy1-sta0: authenticate with 94:18:65:43:76:4a (local address=94:83:c4:01:d7:52)
[1 lug 2026, 12:07:16 CEST] kern.info: [48348.899745] phy1-sta0: send auth to 94:18:65:43:76:4a (try 1/3)
[1 lug 2026, 12:07:16 CEST] daemon.notice: wpa_supplicant[1258]: phy1-sta0: Trying to associate with 94:18:65:43:76:4a (SSID='ABaoaQu' freq=5580 MHz)
[1 lug 2026, 12:07:16 CEST] kern.info: [48348.908237] phy1-sta0: authenticated
[1 lug 2026, 12:07:16 CEST] kern.info: [48348.917279] phy1-sta0: associate with 94:18:65:43:76:4a (try 1/3)
[1 lug 2026, 12:07:16 CEST] kern.info: [48348.919436] phy1-sta0: RX AssocResp from 94:18:65:43:76:4a (capab=0x111 status=0 aid=5)
[1 lug 2026, 12:07:16 CEST] kern.warn: [48348.924315] ath10k_ahb a800000.wifi: pdev param 0 not supported by firmware
[1 lug 2026, 12:07:16 CEST] kern.warn: [48348.930614] ath10k_ahb a800000.wifi: failed to enable peer stats info: -95
[1 lug 2026, 12:07:16 CEST] kern.info: [48348.937648] phy1-sta0: associated
so it seems that WAX negates connections to itself
So if you connect to the mt2500 you can browse and ssh to 192.168.1.11?
I assume your wax has only one ethernet port which is used for the trunk?
Impossible to know.
Mt2500 has wan connected to ONT and Lan to wax.
The debug is quite difficoult....
So how do you access the WAX 220?
OK.
And to be clear, why do you suspect an older version of dnsmasq would solve your issue?
So on to the wild guessing.
Maybe it is a wifi problem on the wax.
I think default cipher has changed for SAE authentication to CCMP-256 which is not liked by many older clients.
Use WPA2 and CCMP-AES for wireless security and see if that solves it
because dnsmasq e odhcp are the most relevant changes
I'll setup a permanent log to check what happens this evening and follow up...