No DHCP on Guest Wifi

meinereiner · February 20, 2025, 2:41pm

Hi,

I want to set up an AP with 2 separate vlans: home (10) and guest(11). DHCP shall get provided by the main router, not the AP (to prevent IP address problems).
The AP is connected via Ethernet and also gets on the different interfaces a correct IP.
The firewall is completely disabled.

ubus call system board
{
	"kernel": "5.15.134",
	"hostname": "repeater-og",
	"system": "Atheros AR7242 rev 1",
	"model": "AVM FRITZ!WLAN Repeater 300E",
	"board_name": "avm,fritz300e",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05.0",
		"revision": "r23497-6637af95aa",
		"target": "ath79/generic",
		"description": "OpenWrt 23.05.0 r23497-6637af95aa"
	}
}
root@repeater-og:~# cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd6d:9813:89c3::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan.10'
	option proto 'dhcp'

config interface 'Guest'
	option proto 'dhcp'
	option device 'br-lan.11'

config bridge-vlan
	option device 'br-lan'
	option vlan '10'
	list ports 'eth0:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '11'
	list ports 'eth0:t'

config device
	option name 'eth0'

root@repeater-og:~# cat /etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'pci0000:00/0000:00:00.0'
	option channel 'auto'
	option band '2g'
	option htmode 'HT20'
	option cell_density '0'

config wifi-iface 'wifinet0'
	option device 'radio0'
	option mode 'ap'
	option ssid 'HomeWifi'
	option encryption 'sae-mixed'
	option key 'geheim1'
	option network 'lan'
	option wpa_disable_eapol_key_retries '1'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'

config wifi-iface 'wifinet1'
	option device 'radio0'
	option mode 'ap'
	option ssid 'GuestWifi'
	option encryption 'sae-mixed'
	option key 'geheim2'
	option wpa_disable_eapol_key_retries '1'
	option network 'Guest'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'

root@repeater-og:~# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'hybrid'
	option ra 'hybrid'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

root@repeater-og:~# cat /etc/config/firewall
config defaults
	option syn_flood	1
	option input		REJECT
	option output		ACCEPT
	option forward		REJECT
# Uncomment this line to disable ipv6 rules
#	option disable_ipv6	1

config zone
	option name		lan
	list   network		'lan'
	option input		ACCEPT
	option output		ACCEPT
	option forward		ACCEPT

config zone
	option name		wan
	list   network		'wan'
	list   network		'wan6'
	option input		REJECT
	option output		ACCEPT
	option forward		REJECT
	option masq		1
	option mtu_fix		1

config forwarding
	option src		lan
	option dest		wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
	option name		Allow-DHCP-Renew
	option src		wan
	option proto		udp
	option dest_port	68
	option target		ACCEPT
	option family		ipv4

# Allow IPv4 ping
config rule
	option name		Allow-Ping
	option src		wan
	option proto		icmp
	option icmp_type	echo-request
	option family		ipv4
	option target		ACCEPT

config rule
	option name		Allow-IGMP
	option src		wan
	option proto		igmp
	option family		ipv4
	option target		ACCEPT

# Allow DHCPv6 replies
# see https://github.com/openwrt/openwrt/issues/5066
config rule
	option name		Allow-DHCPv6
	option src		wan
	option proto		udp
	option dest_port	546
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-MLD
	option src		wan
	option proto		icmp
	option src_ip		fe80::/10
	list icmp_type		'130/0'
	list icmp_type		'131/0'
	list icmp_type		'132/0'
	list icmp_type		'143/0'
	option family		ipv6
	option target		ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Input
	option src		wan
	option proto	icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	list icmp_type		router-solicitation
	list icmp_type		neighbour-solicitation
	list icmp_type		router-advertisement
	list icmp_type		neighbour-advertisement
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Forward
	option src		wan
	option dest		*
	option proto		icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-IPSec-ESP
	option src		wan
	option dest		lan
	option proto		esp
	option target		ACCEPT

config rule
	option name		Allow-ISAKMP
	option src		wan
	option dest		lan
	option dest_port	500
	option proto		udp
	option target		ACCEPT


### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
#	option src		lan
#	option src_ip	192.168.45.2
#	option dest		wan
#	option proto	tcp
#	option target	REJECT

# block a specific mac on wan
#config rule
#	option dest		wan
#	option src_mac	00:11:22:33:44:66
#	option target	REJECT

# block incoming ICMP traffic on a zone
#config rule
#	option src		lan
#	option proto	ICMP
#	option target	DROP

# port redirect port coming in on wan to lan
#config redirect
#	option src			wan
#	option src_dport	80
#	option dest			lan
#	option dest_ip		192.168.16.235
#	option dest_port	80
#	option proto		tcp

# port redirect of remapped ssh port (22001) on wan
#config redirect
#	option src		wan
#	option src_dport	22001
#	option dest		lan
#	option dest_port	22
#	option proto		tcp

### FULL CONFIG SECTIONS
#config rule
#	option src		lan
#	option src_ip	192.168.45.2
#	option src_mac	00:11:22:33:44:55
#	option src_port	80
#	option dest		wan
#	option dest_ip	194.25.2.129
#	option dest_port	120
#	option proto	tcp
#	option target	REJECT

#config redirect
#	option src		lan
#	option src_ip	192.168.45.2
#	option src_mac	00:11:22:33:44:55
#	option src_port		1024
#	option src_dport	80
#	option dest_ip	194.25.2.129
#	option dest_port	120
#	option proto	tcp

I had the config running for some time on another repeater but this had then also the problem that it was suddenly getting "slow on wifi" and was then just reachable (on the web interface) within the other vlan.

What am I doing wrong here?

brada4 · February 20, 2025, 3:10pm

Sometimes (at boot) guest joins wrong vlan, workaround in bug report here:

github.com/openwrt/openwrt

Clients are unable to connect to the wireless network

opened 10:45AM - 19 Jan 25 UTC

grifos

target/ramips bug Official Image release/24.10

### Describe the bug Since the first 24.10.0 RC releases, wireless clients coul…d not establish a successful network connection. The OpenWrt logs were showing clients connected then disconnected after about 30 seconds. The clients showed similar logs but never had any actual network connectivity at all. ``` Tue Jan 7 13:08:29 2025 daemon.info hostapd: wl1.101: STA aa:bb:cc:01:23:45 IEEE 802.11: authenticated Tue Jan 7 13:08:29 2025 daemon.info hostapd: wl1.101: STA aa:bb:cc:01:23:45 IEEE 802.11: associated (aid 1) Tue Jan 7 13:08:29 2025 daemon.notice hostapd: wl1.101: AP-STA-CONNECTED aa:bb:cc:01:23:45 auth_alg=open Tue Jan 7 13:08:29 2025 daemon.info hostapd: wl1.101: STA aa:bb:cc:01:23:45 RADIUS: starting accounting session 7D707FBCB13EEE03 Tue Jan 7 13:08:29 2025 daemon.info hostapd: wl1.101: STA aa:bb:cc:01:23:45 WPA: pairwise key handshake completed (RSN) Tue Jan 7 13:08:29 2025 daemon.notice hostapd: wl1.101: EAPOL-4WAY-HS-COMPLETED aa:bb:cc:01:23:45 Tue Jan 7 13:09:00 2025 daemon.notice hostapd: wl1.101: AP-STA-DISCONNECTED aa:bb:cc:01:23:45 Tue Jan 7 13:09:23 2025 daemon.info hostapd: wl1.101: STA aa:bb:cc:01:23:45 IEEE 802.11: authenticated Tue Jan 7 13:09:23 2025 daemon.info hostapd: wl1.101: STA aa:bb:cc:01:23:45 IEEE 802.11: associated (aid 1) Tue Jan 7 13:09:23 2025 daemon.notice hostapd: wl1.101: AP-STA-CONNECTED aa:bb:cc:01:23:45 auth_alg=open Tue Jan 7 13:09:23 2025 daemon.info hostapd: wl1.101: STA aa:bb:cc:01:23:45 RADIUS: starting accounting session BB50B2A50135313A Tue Jan 7 13:09:23 2025 daemon.info hostapd: wl1.101: STA aa:bb:cc:01:23:45 WPA: pairwise key handshake completed (RSN) Tue Jan 7 13:09:23 2025 daemon.notice hostapd: wl1.101: EAPOL-4WAY-HS-COMPLETED aa:bb:cc:01:23:45 Tue Jan 7 13:10:08 2025 daemon.notice hostapd: wl1.101: AP-STA-DISCONNECTED aa:bb:cc:01:23:45 Tue Jan 7 13:10:10 2025 daemon.info hostapd: wl1.101: STA aa:bb:cc:01:23:45 IEEE 802.11: authenticated Tue Jan 7 13:10:10 2025 daemon.info hostapd: wl1.101: STA aa:bb:cc:01:23:45 IEEE 802.11: associated (aid 1) Tue Jan 7 13:10:10 2025 daemon.notice hostapd: wl1.101: AP-STA-CONNECTED aa:bb:cc:01:23:45 auth_alg=open Tue Jan 7 13:10:10 2025 daemon.info hostapd: wl1.101: STA aa:bb:cc:01:23:45 RADIUS: starting accounting session 60129E9B594E6574 Tue Jan 7 13:10:10 2025 daemon.info hostapd: wl1.101: STA aa:bb:cc:01:23:45 WPA: pairwise key handshake completed (RSN) Tue Jan 7 13:10:10 2025 daemon.notice hostapd: wl1.101: EAPOL-4WAY-HS-COMPLETED aa:bb:cc:01:23:45 Tue Jan 7 13:10:16 2025 daemon.notice hostapd: wl1.101: AP-STA-DISCONNECTED aa:bb:cc:01:23:45 ``` ### OpenWrt version r28304-6dacba30a7 ### OpenWrt release 24.10.0-rc5 ### OpenWrt target/subtarget ramips/mt7621 ### Device Netgear WAX202 ### Image kind Official downloaded image ### Steps to reproduce 1- Configure a wireless network. Use a custom interface name, for example: `wl1.101` 2- On Network > Interfaces > Devices, configure the corresponding wireless device `wl1.101` with default settings 3- The wireless clients can no longer connect to that SSID. Restarting the wireless device seems to resolve but the problem reappears after a reboot. ### Actual behaviour I reconfigured the AP from scratch and it looks like the WiFi fails when I configure the wireless network devices under Network > Interfaces > Devices. I'm using custom wireless interface names and as long as the corresponding device is left unconfigured the WiFi works fine, while if I configure it, even if leaving everything default (like with the code below), the WiFi starts failing. Restarting the wireless device (on the Wireless page) seems to fix it, but after a reboot the problem reappears. ``` uci add network device # =cfg1f0f15 uci set network.@device[-1].name='wl1.101' ``` I then unconfigured the wireless devices on my other MT7621+MT7915E devices and now they're also working fine under 24.10.0-rc5. ### Expected behaviour Clients should connect successfully to the wireless network even when the wireless device is configured on the OpenWrt device. ### Additional info Thank you for the work you do guys, OpenWrt is magnificent. ### Diffconfig ```text ``` ### Terms - [x] I am reporting an issue for OpenWrt, not an unsupported fork.

psherman · February 20, 2025, 6:20pm

The above bug almost certainly doesn't apply as it is filed against a different version of OpenWrt (24.10.0 vs 23.05.0) and a different target platform (ramips/mt7621 vs ath79).

That said, the OpenWrt version should be upgraded to 23.05.5 or 24.10.0 to ensure that the latest security patches and bug fixes are applied.

The real issue, though, is likely the fact that DSA/bridge-VLAN syntax doesn't really apply since there is a single ethernet port and no built-in switch.

Therefore, let's make the appropriate edits:

Delete this:

meinereiner:

config bridge-vlan
	option device 'br-lan'
	option vlan '10'
	list ports 'eth0:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '11'
	list ports 'eth0:t'

config device
	option name 'eth0'

Edit br-lan to use eth0.10:

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0.10'

Now edit the lan interface to use br-lan:

config interface 'lan'
	option device 'br-lan'
	option proto 'dhcp'

Now, create a new bridge for the guest network using eth0.11:

config device
	option name 'br-guest'
	option type 'bridge'
	list ports 'eth0.11'

And edit the guest network to use br-guest. In addition, we'll make the guest network unmanaged:

config interface 'Guest'
	option proto 'none'
	option device 'br-guest'

Finally:

This is not necessary, nor is it recommended. Make sure the lan network in in the lan firewall zone, and that the zone has option input 'ACCEPT' defined. This way, if the firewall does become re-enabled (hint: this can happen durning sysupgrades), you will not be locked out.

Restart your system after making the changes and test.

meinereiner · February 21, 2025, 6:45am

Thank you very much for your support.
I have set it up accordingly and so far it is working. The firewall was only off for testing purposes, dont worry.

I think my issue was as well that I was setting it up not via config but via luci, which probably did other config than the constellation you suggested.

system · March 3, 2025, 6:46am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.