No DHCP leases through bridged access point

tadaa3x · May 4, 2025, 8:47pm

I am trying to set up a router for my home network. I configured separate networks for consumer devices (network "endg") and for IOT devices (network "haust").
For the IOT devices, the router runs the DHCP server. This works nicely, both via ethernet cable and via the IOT WiFi network.
For the consumer devices, DHCP should be handled by the main router in my network. This does not work: clients that connect via one of the consumer WiFis fail to get an IP address. This is what a failed attempt looks like in the routers system log:

Sun May  4 22:34:54 2025 daemon.info hostapd: phy0-ap1: STA e2:89:f0:e9:cc:ff IEEE 802.11: authenticated
Sun May  4 22:34:54 2025 daemon.info hostapd: phy0-ap1: STA e2:89:f0:e9:cc:ff IEEE 802.11: associated (aid 1)
Sun May  4 22:34:54 2025 daemon.notice hostapd: phy0-ap1: AP-STA-CONNECTED e2:89:f0:e9:cc:ff auth_alg=open
Sun May  4 22:34:54 2025 daemon.info hostapd: phy0-ap1: STA e2:89:f0:e9:cc:ff WPA: pairwise key handshake completed (RSN)
Sun May  4 22:34:54 2025 daemon.notice hostapd: phy0-ap1: EAPOL-4WAY-HS-COMPLETED e2:89:f0:e9:cc:ff
Sun May  4 22:34:55 2025 daemon.warn dnsmasq-dhcp[1]: DHCP packet received on phy0-ap1 which has no address
Sun May  4 22:34:56 2025 daemon.warn dnsmasq-dhcp[1]: DHCP packet received on phy0-ap1 which has no address
Sun May  4 22:34:58 2025 daemon.warn dnsmasq-dhcp[1]: DHCP packet received on phy0-ap1 which has no address
Sun May  4 22:35:02 2025 daemon.warn dnsmasq-dhcp[1]: DHCP packet received on phy0-ap1 which has no address
Sun May  4 22:35:10 2025 daemon.warn dnsmasq-dhcp[1]: DHCP packet received on phy0-ap1 which has no address
Sun May  4 22:35:13 2025 daemon.notice hostapd: phy0-ap1: AP-STA-DISCONNECTED e2:89:f0:e9:cc:ff

While the use of VLANs in the router and my main switch complicates the configuration a bit, it seems to me that my setup for the network for consumer devices, "endg", resembles what is described in the OpenWrt wiki under Wi-Fi Extender/Repeater with Bridged AP over Ethernet. Therefore, I would expect DHCP broadcasts to be forwarded to the main router.

Details of my configuration:
ubus call system board

{
        "kernel": "6.6.86",
        "hostname": "Haustechnikrouter",
        "system": "MediaTek MT7621 ver:1 eco:3",
        "model": "ASUS RT-N56U B1",
        "board_name": "asus,rt-n56u-b1",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "24.10.1",
                "revision": "r28597-0425664679",
                "target": "ramips/mt7621",
                "description": "OpenWrt 24.10.1 r28597-0425664679",
                "builddate": "1744562312"
        }
}

/etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'
        option ula_prefix 'fd3a:ab34:5e88::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'wan'

config bridge-vlan
        option device 'br-lan'
        option vlan '3'
        list ports 'lan1:u*'
        list ports 'lan2:u*'
        list ports 'lan3:u*'
        list ports 'lan4:u*'
        list ports 'wan:t'

config device
        option type '8021q'
        option ifname 'wan'
        option vid '2'
        option name 'wan.2'

config interface 'endg'
        option proto 'static'
        option device 'wan.2'
        option ipaddr '192.168.2.197'
        option netmask '255.255.255.0'
        option gateway '192.168.2.1'
        option broadcast '192.168.2.255'
        option type 'bridge'
        list dns '192.168.2.1'

config interface 'haust'
        option proto 'static'
        option device 'br-lan.3'
        option ipaddr '192.168.3.1'
        option netmask '255.255.255.0'

/etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'endg'
        option interface 'endg'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option ignore '1'

config dhcp 'haust'
        option interface 'haust'
        option start '201'
        option limit '250'
        option leasetime '12h'

/etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
        option channel 'auto'
        option band '2g'
        option htmode 'HT20'
        option cell_density '0'
        option country 'DE'
        option frag '784'
        option rts '534'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option mode 'ap'
        option ssid 'TIMS'
        option encryption 'psk2'
        option key '[***]'
        option wds '1'
        option wpa_disable_eapol_key_retries '1'
        option network 'haust'

config wifi-device 'radio1'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
        option band '5g'
        option cell_density '0'
        option htmode 'VHT20'
        option channel '36'
        option country 'DE'
        option frag '784'
        option rts '534'

config wifi-iface 'wifinet1'
        option device 'radio1'
        option mode 'ap'
        option ssid 'TIMS'
        option encryption 'psk2'
        option key '[***]'
        option wpa_disable_eapol_key_retries '1'
        option network 'haust'
        option disabled '1'

config wifi-iface 'wifinet2'
        option device 'radio0'
        option mode 'ap'
        option ssid 'MALDI-TOFht2_4'
        option encryption 'psk2'
        option key '[***]'
        option network 'endg'
        option wpa_disable_eapol_key_retries '1'

config wifi-iface 'wifinet3'
        option device 'radio1'
        option mode 'ap'
        option ssid 'MALDI-TOFht5'
        option encryption 'psk2'
        option key '***'
        option wpa_disable_eapol_key_retries '1'
        option network 'endg'

/etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option synflood_protect '1'

config zone
        option name 'endgeraete'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'endg'

config zone
        option name 'haustechnik'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'haust'

config forwarding
        option src 'endgeraete'
        option dest 'haustechnik'

Any ideas how to fix or further diagnose the problem?

psherman · May 4, 2025, 10:40pm

You've got a few problems.

Starting with the network file, delete this:

next, add a bridge VLAN for VLAN 2:

config bridge-vlan
        option device 'br-lan'
        option vlan '2'
        list ports 'wan:t'

from the endginterface, change the device to br-lan.2 and remove the bridge line. You can also remove the broadcast line. It will look like this:

config interface 'endg'
        option proto 'static'
        option device 'br-lan.2'
        option ipaddr '192.168.2.197'
        option netmask '255.255.255.0'
        option gateway '192.168.2.1'
        list dns '192.168.2.1'

Next, you need to enable masquerading on your upstream network's firewall zone. It should look like this:

config zone
        option name 'endgeraete'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        list network 'endg'

You can delete this:

And then add this:

config forwarding
        option src 'haustechnik'
        option dest 'endgeraete'

Keep in mind that your current configuration doesn't actually secure your trusted devices from the IoT devices, but this will at least allow that network to function properly.

Meanwhile, for your wifi, is there a reason you've set frag and rts parameters?

tadaa3x · May 6, 2025, 8:44pm

Thanks for your help, Peter, and sorry for the delay.

psherman:

You've got a few problems.

Starting with the network file, delete this:
tadaa3x:
config device
        option type '8021q'
        option ifname 'wan'
        option vid '2'
        option name 'wan.2'
next, add a bridge VLAN for VLAN 2:
config bridge-vlan
        option device 'br-lan'
        option vlan '2'
        list ports 'wan:t'
from the endginterface, change the device to br-lan.2 and remove the bridge line. You can also remove the broadcast line. It will look like this:
config interface 'endg'
        option proto 'static'
        option device 'br-lan.2'
        option ipaddr '192.168.2.197'
        option netmask '255.255.255.0'
        option gateway '192.168.2.1'
        list dns '192.168.2.1'

Followed your advice and my DHCP problems are gone!

psherman:

Next, you need to enable masquerading on your upstream network's firewall zone. It should look like this:

config zone
        option name 'endgeraete'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        list network 'endg'

You can delete this:

And then add this:

config forwarding
        option src 'haustechnik'
        option dest 'endgeraete'

I think here you are explaining how I would provide internet access for my IOT devices. This is not what I aim for: I would like to be able to access the web interface of the IOT devices from my trusted devices, and nothing else. Therefore, I did not perform these steps.

It turned out that after correcting /etc/config/network, I could access the internet from a device connected to WiFi network TIMS (member of haust). I could fix this by adjusting the default firewall rules:

config defaults
        option input 'REJECT'
        option output 'REJECT'
        option forward 'REJECT'
        option synflood_protect '1'

With the updated firewall default rules I think I do have separated the IOT devices from the trusted devices - is this correct?

No, these are probably leftovers from my attempts to get it working somehow.
Should I just remove those settings?

psherman · May 6, 2025, 10:29pm

Great!

Yes, that is what I was suggesting.

Ok. Do they need internet access, though? Or are these purely local devices with no need for internet connectivity?

This isn't the normal way to achieve that.

Let's see the updated config files for review. And more importantly, is it actually working the way you want?

Yes.

tadaa3x · May 7, 2025, 8:34am

/etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'
        option ula_prefix 'fd3a:ab34:5e88::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'wan'

config bridge-vlan
        option device 'br-lan'
        option vlan '3'
        list ports 'lan1:u*'
        list ports 'lan2:u*'
        list ports 'lan3:u*'
        list ports 'lan4:u*'
        list ports 'wan:t'

config interface 'endg'
        option proto 'static'
        option ipaddr '192.168.2.197'
        option netmask '255.255.255.0'
        option gateway '192.168.2.1'
        list dns '192.168.2.1'
        option device 'br-lan.2'

config interface 'haust'
        option proto 'static'
        option device 'br-lan.3'
        option ipaddr '192.168.3.1'
        option netmask '255.255.255.0'

config bridge-vlan
        option device 'br-lan'
        option vlan '2'
        list ports 'wan:t'

/etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
        option channel 'auto'
        option band '2g'
        option htmode 'HT20'
        option cell_density '0'
        option country 'DE'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option mode 'ap'
        option ssid 'TIMS'
        option encryption 'psk2'
        option key '[***]'
        option wds '1'
        option wpa_disable_eapol_key_retries '1'
        option network 'haust'

config wifi-device 'radio1'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
        option band '5g'
        option cell_density '0'
        option htmode 'VHT20'
        option channel '36'
        option country 'DE'

config wifi-iface 'wifinet1'
        option device 'radio1'
        option mode 'ap'
        option ssid 'TIMS'
        option encryption 'psk2'
        option key '[***]'
        option wpa_disable_eapol_key_retries '1'
        option network 'haust'
        option disabled '1'

config wifi-iface 'wifinet2'
        option device 'radio0'
        option mode 'ap'
        option ssid 'MALDI-TOFht2_4'
        option encryption 'psk2'
        option key '[***]'
        option network 'endg'
        option wpa_disable_eapol_key_retries '1'

config wifi-iface 'wifinet3'
        option device 'radio1'
        option mode 'ap'
        option ssid 'MALDI-TOFht5'
        option encryption 'psk2'
        option key '[***]'
        option wpa_disable_eapol_key_retries '1'
        option network 'endg'

/etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'REJECT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'endgeraete'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'endg'

config zone
        option name 'haustechnik'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'haust'

config forwarding
        option src 'endgeraete'
        option dest 'haustechnik'

Yes:

Devices connected to the 'haust' network via ethernet or WiFi get an IP address in the 192.168.3.0/24 range. They can ping each other, but not devices in the 'endg' network. They do not have access to the internet.
Devices connected to the 'endg' network via WiFi or via the switch connected to the router's wan interface get an IP address in the 192.168.2.0/24 range. They can ping each other and devices in the 'haust' network. They do have access to the internet.

They will have to get along without internet access. I just want to be able to reach their webinterface and enable them to communicate with each other.

Would you recommend to change the setup then?

I removed them.
However, I now think that I did not enter those manually for testing purposes, given that they are set identically for both WiFi interfaces. Could it be that these are standard settings for my router that make sense? So far I have not had any WiFi issues after removing them.

Thanks again for your help.