With a single VLAN active on my WAX620 (untagged under bridge vlan filtering as well as on my network switch) I get ~700 Mbps download speeds.
As soon as I active my guest and IOT VLANS (all vlans tagged under bridge vlan filter and on network switch) my download speeds drop to ~180 Mbps on the primary LAN.
Has anyone else had similar experiences?
Let's look at your configurations in the problematic state (i.e. slow transfers):
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
One thing I noticed, not that I know if it matters, is my network port is listed as lan instead of eth0.
Another thing, after I flashed the sysupgrade i had to reinstall LUCI, not sure if any other packages might have been dropped as well? OpenWrt on this hardware is still pretty new.
cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
list ipaddr
config globals 'globals'
option ula_prefix 'fd85:2070:a1f8::/48'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan'
option ipv6 '1'
config interface 'lan'
option device 'br-lan.74'
option proto 'static'
option ipaddr '192.168.74.6'
option netmask '255.255.255.0'
option gateway '192.168.74.1'
config bridge-vlan
option device 'br-lan'
option vlan '74'
list ports 'lan:t*'
config bridge-vlan
option device 'br-lan'
option vlan '76'
list ports 'lan:t'
config bridge-vlan
option device 'br-lan'
option vlan '77'
list ports 'lan:t'
config interface 'lan_guest'
option proto 'static'
option device 'br-lan.76'
option ipaddr '192.168.76.6'
option netmask '255.255.255.0'
option gateway '192.168.74.1'
config interface 'lan_IOT'
option proto 'static'
option device 'br-lan.77'
option ipaddr '192.168.77.6'
option netmask '255.255.255.0'
option gateway '192.168.74.1'
cat /etc/config/wireless
config wifi-device 'radio0'
option type 'mac80211'
option path 'platform/soc@0/c000000.wifi'
option band '5g'
option channel '104'
option htmode 'HE80'
option country 'US'
option cell_density '0'
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'iuselinux'
option encryption 'psk2'
option key
config wifi-device 'radio1'
option type 'mac80211'
option path 'platform/soc@0/c000000.wifi+1'
option band '2g'
option channel '1'
option htmode 'HE20'
option cell_density '0'
option country 'US'
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'iuselinux'
option encryption 'psk2'
option key
config wifi-iface 'wifinet2'
option device 'radio0'
option mode 'ap'
option ssid 'iuselinux_guest'
option encryption 'psk2'
option key
option network 'lan_guest'
config wifi-iface 'wifinet3'
option device 'radio1'
option mode 'ap'
option ssid 'iuselinux_guest'
option encryption 'psk2'
option key
option network 'lan_guest'
config wifi-iface 'wifinet4'
option device 'radio0'
option mode 'ap'
option ssid 'iuselinux_IOT'
option encryption 'psk2'
option key
option network 'lan_IOT'
config wifi-iface 'wifinet5'
option device 'radio1'
option mode 'ap'
option ssid 'iuselinux_IOT'
option encryption 'psk2'
option key
option network 'lan_IOT'
cat /etc/config/dhcp
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option localservice '1'
option ednspacket_max '1232'
list server '192.168.74.XXX'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'disabled'
option ignore '1'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
cat /etc/config/firewall
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
option flow_offloading '1'
option flow_offloading_hw '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'DROP'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
Make these unmanaged:
It should look like this:
config interface 'lan_guest'
option proto 'none'
option device 'br-lan.76'
config interface 'lan_IOT'
option proto 'none'
option device 'br-lan.77'
Restart and test again.
Still slow with all vlans active, i will note that i have several other access points that are not configured as you instructed, i can and will change them all to match, but I don't know if that will affect this current issue.
here are the configs for while the system is full speed with the lan untagged:
cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
list ipaddr
config globals 'globals'
option ula_prefix 'fd85:2070:a1f8::/48'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan'
option ipv6 '1'
config interface 'lan'
option device 'br-lan.74'
option proto 'static'
option ipaddr '192.168.74.6'
option netmask '255.255.255.0'
option gateway '192.168.74.1'
config bridge-vlan
option device 'br-lan'
option vlan '74'
list ports 'lan:t*'
config bridge-vlan
option device 'br-lan'
option vlan '76'
list ports 'lan:t'
config bridge-vlan
option device 'br-lan'
option vlan '77'
list ports 'lan:t'
config interface 'lan_guest'
option proto 'none'
option device 'br-lan.76'
config interface 'lan_IOT'
option proto 'none'
option device 'br-lan.77'
cat /etc/config/wireless
config wifi-device 'radio0'
option type 'mac80211'
option path 'platform/soc@0/c000000.wifi'
option band '5g'
option channel '104'
option htmode 'HE80'
option country 'US'
option cell_density '0'
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'iuselinux'
option encryption 'psk2'
option key
config wifi-device 'radio1'
option type 'mac80211'
option path 'platform/soc@0/c000000.wifi+1'
option band '2g'
option channel '1'
option htmode 'HE20'
option cell_density '0'
option country 'US'
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'iuselinux'
option encryption 'psk2'
option key
config wifi-iface 'wifinet2'
option device 'radio0'
option mode 'ap'
option ssid 'iuselinux_guest'
option encryption 'psk2'
option key
option network 'lan_guest'
config wifi-iface 'wifinet3'
option device 'radio1'
option mode 'ap'
option ssid 'iuselinux_guest'
option encryption 'psk2'
option key
option network 'lan_guest'
config wifi-iface 'wifinet4'
option device 'radio0'
option mode 'ap'
option ssid 'iuselinux_IOT'
option encryption 'psk2'
option key
option network 'lan_IOT'
config wifi-iface 'wifinet5'
option device 'radio1'
option mode 'ap'
option ssid 'iuselinux_IOT'
option encryption 'psk2'
option key
option network 'lan_IOT'
cat /etc/config/firewall
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
option flow_offloading '1'
option flow_offloading_hw '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'DROP'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
cat /etc/config/dhcp
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option localservice '1'
option ednspacket_max '1232'
list server '192.168.74.124'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'disabled'
option ignore '1'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
The lan is still tagged:
But I did notice an issue here... remove the * from above -- that should only be used if it is untagged (i.e. :u*)
That must have been a copy and paste error, i tried to duplicate what was shown and it still didn't work, here is what works full speed (i also tried everything tagged again and removed the primary "*" to no avail):
cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
list ipaddr
config globals 'globals'
option ula_prefix 'fd85:2070:a1f8::/48'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan'
option ipv6 '1'
config interface 'lan'
option device 'br-lan.74'
option proto 'static'
option ipaddr '192.168.74.6'
option netmask '255.255.255.0'
option gateway '192.168.74.1'
config bridge-vlan
option device 'br-lan'
option vlan '74'
list ports 'lan'
config bridge-vlan
option device 'br-lan'
option vlan '76'
config bridge-vlan
option device 'br-lan'
option vlan '77'
config interface 'lan_guest'
option proto 'none'
option device 'br-lan.76'
config interface 'lan_IOT'
option proto 'none'
option device 'br-lan.77'
Ok... so let's talk about what's upstream....
What is immediately upstream of the WAX620? Are you changing the configuration of that upstream device? We should probably review it.
Also, what is the output of:
ubus call system board
Found it, ugh...
i didn't pay enough attention, first option on this link is SNAPSHOT:
That would explain why I had to reinstall LUCI.
I uploaded 24.10.1 and all seems to be good to go.
Thank you again for your patience and willingness to help.