OpenWrt One: TWT Setup Failure with ESP32-C6 (OpenWrt 25.12.0-rc5)

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello,
I’m developing battery-powered devices using ESP32-C6 and am unable to establish Target Wake Time (TWT) sessions. I tried several firmware versions. Also the latest rc (25.12.0.rc5). I always get the response:

(itwt)rx response, unexpected setup command:7(reject)

from my esp32c6.
I also own a ZyXEL NWA55AXE (no OpenWRT firmware) and there twt works fine with the same firmware on the controller.

i tried the following options:

option twt_responder '1'
option hostapd_options 'he_twt_responder=1'

but it does not change anything.
The logs do not contain no TWT-related messages.The device connects to the network properly but twt is not set up and nothing in the logs is mentioning twt or its setup failure...
The phy info says that the phy has a TWT Responder.
Here is the output of iw phy0 info:

root@OpenWrt:~# iw phy0 info 
Wiphy phy0
	wiphy index: 0
	max # scan SSIDs: 4
	max scan IEs length: 2200 bytes
	max # sched scan SSIDs: 0
	max # match sets: 0
	Retry short limit: 7
	Retry long limit: 4
	Coverage class: 0 (up to 0m)
	Device supports AP-side u-APSD.
	Device supports T-DLS.
	Available Antennas: TX 0x3 RX 0x3
	Configured Antennas: TX 0x3 RX 0x3
	Supported interface modes:
		 * IBSS
		 * managed
		 * AP
		 * AP/VLAN
		 * monitor
		 * mesh point
		 * P2P-client
		 * P2P-GO
	Band 1:
		Capabilities: 0x9ff
			RX LDPC
			HT20/HT40
			SM Power Save disabled
			RX Greenfield
			RX HT20 SGI
			RX HT40 SGI
			TX STBC
			RX STBC 1-stream
			Max AMSDU length: 7935 bytes
			No DSSS/CCK HT40
		Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
		Minimum RX AMPDU time spacing: 2 usec (0x04)
		HT TX/RX MCS rate indexes supported: 0-15
		HE Iftypes: managed
			HE MAC Capabilities (0x08011a000040):
				+HTC HE Supported
				Trigger Frame MAC Padding Duration: 2
				OM Control
				Maximum A-MPDU Length Exponent: 3
				A-MSDU in A-MPDU
			HE PHY Capabilities: (0x22704e926d09f30e4e3f00):
				HE40/2.4GHz
				242 tone RUs/2.4GHz
				Device Class: 1
				LDPC Coding in Payload
				HE SU PPDU with 1x HE-LTF and 0.8us GI
				NDP with 4x HE-LTF and 3.2us GI
				STBC Tx <= 80MHz
				STBC Rx <= 80MHz
				Full Bandwidth UL MU-MIMO
				DCM Max Constellation: 2
				DCM Max Constellation Rx: 2
				SU Beamformer
				SU Beamformee
				Beamformee STS <= 80MHz: 3
				Beamformee STS > 80MHz: 3
				Sounding Dimensions <= 80MHz: 1
				Sounding Dimensions > 80MHz: 1
				Codebook Size SU Feedback
				Codebook Size MU Feedback
				Triggered CQI Feedback
				Partial Bandwidth Extended Range
				Partial Bandwidth DL MU-MIMO
				PPE Threshold Present
				Power Boost Factor ar
				HE SU PPDU & HE PPDU 4x HE-LTF 0.8us GI
				Max NC: 1
				20MHz in 40MHz HE PPDU 2.4GHz
				20MHz in 160/80+80MHz HE PPDU
				80MHz in 160/80+80MHz HE PPDU
				DCM Max BW: 1
				Longer Than 16HE SIG-B OFDM Symbols
				Non-Triggered CQI Feedback
				TX 1024-QAM
				RX 1024-QAM
				RX Full BW SU Using HE MU PPDU with Compression SIGB
				RX Full BW SU Using HE MU PPDU with Non-Compression SIGB
			HE RX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: not supported
				4 streams: not supported
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: not supported
				4 streams: not supported
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			PPE Threshold 0x19 0x1c 0xc7 0x71 
		HE Iftypes: AP
			HE MAC Capabilities (0x00051a081044):
				+HTC HE Supported
				TWT Responder
				BSR
				OM Control
				Maximum A-MPDU Length Exponent: 3
				BQR
				A-MSDU in A-MPDU
				OM Control UL MU Data Disable RX
			HE PHY Capabilities: (0x02204e926f09afc8000c00):
				HE40/2.4GHz
				LDPC Coding in Payload
				NDP with 4x HE-LTF and 3.2us GI
				STBC Tx <= 80MHz
				STBC Rx <= 80MHz
				Full Bandwidth UL MU-MIMO
				DCM Max Constellation: 2
				DCM Max Constellation Rx: 2
				SU Beamformer
				SU Beamformee
				MU Beamformer
				Beamformee STS <= 80MHz: 3
				Beamformee STS > 80MHz: 3
				Sounding Dimensions <= 80MHz: 1
				Sounding Dimensions > 80MHz: 1
				Codebook Size SU Feedback
				Codebook Size MU Feedback
				Triggered SU Beamforming Feedback
				Triggered MU Beamforming Feedback
				Partial Bandwidth Extended Range
				PPE Threshold Present
				Max NC: 1
				STBC Tx > 80MHz
				STBC Rx > 80MHz
				TX 1024-QAM
				RX 1024-QAM
			HE RX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: not supported
				4 streams: not supported
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: not supported
				4 streams: not supported
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			PPE Threshold 0x19 0x1c 0xc7 0x71 
		HE Iftypes: mesh point
			HE MAC Capabilities (0x00011a000040):
				+HTC HE Supported
				OM Control
				Maximum A-MPDU Length Exponent: 3
				A-MSDU in A-MPDU
			HE PHY Capabilities: (0x02200c0000000000008000):
				HE40/2.4GHz
				LDPC Coding in Payload
				STBC Tx <= 80MHz
				STBC Rx <= 80MHz
			HE RX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: not supported
				4 streams: not supported
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: not supported
				4 streams: not supported
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
		Frequencies:
			* 2412.0 MHz [1] (20.0 dBm)
			* 2417.0 MHz [2] (20.0 dBm)
			* 2422.0 MHz [3] (20.0 dBm)
			* 2427.0 MHz [4] (20.0 dBm)
			* 2432.0 MHz [5] (20.0 dBm)
			* 2437.0 MHz [6] (20.0 dBm)
			* 2442.0 MHz [7] (20.0 dBm)
			* 2447.0 MHz [8] (20.0 dBm)
			* 2452.0 MHz [9] (20.0 dBm)
			* 2457.0 MHz [10] (20.0 dBm)
			* 2462.0 MHz [11] (20.0 dBm)
			* 2467.0 MHz [12] (20.0 dBm)
			* 2472.0 MHz [13] (20.0 dBm)
			* 2484.0 MHz [14] (disabled)
	valid interface combinations:
		 * #{ IBSS } <= 1, #{ AP, mesh point } <= 16, #{ managed } <= 19,
		   total <= 19, #channels <= 1, STA/AP BI must match, radar detect widths: { 20 MHz (no HT), 20 MHz, 40 MHz, 80 MHz, 160 MHz }

	HT Capability overrides:
		 * MCS: ff ff ff ff ff ff ff ff ff ff
		 * maximum A-MSDU length
		 * supported channel width
		 * short GI for 40 MHz
		 * max A-MPDU length exponent
		 * min MPDU start spacing
	max # scan plans: 1
	max scan plan interval: -1
	max scan plan iterations: 0
	Supported extended features:
		* [ VHT_IBSS ]: VHT-IBSS
		* [ RRM ]: RRM
		* [ BEACON_RATE_LEGACY ]: legacy beacon rate setting
		* [ BEACON_RATE_HT ]: HT beacon rate setting
		* [ BEACON_RATE_VHT ]: VHT beacon rate setting
		* [ FILS_STA ]: STA FILS (Fast Initial Link Setup)
		* [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
		* [ CONTROL_PORT_OVER_NL80211 ]: control port over nl80211
		* [ ACK_SIGNAL_SUPPORT ]: ack signal level support
		* [ TXQS ]: FQ-CoDel-enabled intermediate TXQs
		* [ SCAN_RANDOM_SN ]: use random sequence numbers in scans
		* [ SCAN_MIN_PREQ_CONTENT ]: use probe request with only rate IEs in scans
		* [ CAN_REPLACE_PTK0 ]: can safely replace PTK 0 when rekeying
		* [ AIRTIME_FAIRNESS ]: airtime fairness scheduling
		* [ STA_TX_PWR ]: TX power control per station
		* [ AQL ]: Airtime Queue Limits (AQL)
		* [ CONTROL_PORT_NO_PREAUTH ]: disable pre-auth over nl80211 control port support
		* [ DEL_IBSS_STA ]: deletion of IBSS station support
		* [ SCAN_FREQ_KHZ ]: scan on kHz frequency support
		* [ CONTROL_PORT_OVER_NL80211_TX_STATUS ]: tx status for nl80211 control port support
		* [ FILS_DISCOVERY ]: FILS discovery frame transmission support
		* [ UNSOL_BCAST_PROBE_RESP ]: unsolicated broadcast probe response transmission support
		* [ BEACON_RATE_HE ]: HE beacon rate support (AP/mesh)
		* [ BSS_COLOR ]: BSS coloring support
		* [ POWERED_ADDR_CHANGE ]: can change MAC address while up

I hope someone can help me here...

1 Like
2

You can also force twt via hostap parameter.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):

Screenshot 2025-10-20 at 8.14.14 PM

Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
2 Likes
3

Hello,
thank you for your response! Here is the output:

root@OpenWrt:~# ubus call system board
{
	"kernel": "6.12.71",
	"hostname": "OpenWrt",
	"system": "ARMv8 Processor rev 4",
	"model": "OpenWrt One",
	"board_name": "openwrt,one",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "25.12.0-rc5",
		"firmware_url": "https://downloads.openwrt.org/",
		"revision": "r32673-482ba7230a",
		"target": "mediatek/filogic",
		"description": "OpenWrt 25.12.0-rc5 r32673-482ba7230a",
		"builddate": "1771363837"
	}
}
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd75:18ea:5213::/48'
	option dhcp_default_duid '00045c347bd4f42e4dedb843aa836ef413c5'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'
	list ports 'eth1'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.2'
	option netmask '255.255.255.0'
	option ip6assign '60'
	list dns '192.168.1.1'
	option dns_metric '1'
	option gateway '192.168.1.1'

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi'
	option band '2g'
	option htmode 'HE20'
	option num_global_macaddr '7'
	option cell_density '0'
	option channel '9'
	option txpower '20'
	option country 'DE'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option ssid 'ssid1'
	option encryption 'psk2'
	option key 'redact'
	option disassoc_low_ack '0'
	option skip_inactivity_poll '1'
	#option twt_responder '1'
	#option hostapd_options 'he_twt_responder=1'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi+1'
	option band '5g'
	option channel '40'
	option htmode 'HE160'
	option num_global_macaddr '7'
	option cell_density '0'
	option country 'DE'

config wifi-iface 'wifinet2'
	option device 'radio0'
	option mode 'ap'
	option ssid 'ssid2'
	option encryption 'psk2'
	option key '<redact>'
	option disassoc_low_ack '0'
	option skip_inactivity_poll '1'
	option wmm '0'
	option network 'lan'
	#option twt_responder '1'
	#option hostapd_options 'he_twt_responder=1'

config wifi-iface 'wifinet3'
	option device 'radio1'
	option mode 'ap'
	option ssid 'ssid1'
	option encryption 'psk2'
	option key '<redact>'
	option disabled '1'

config wifi-iface 'wifinet4'
	option device 'radio1'
	option mode 'ap'
	option ssid 'ssid2'
	option encryption 'psk2'
	option key '<redact>'
	option disabled '1'

config wifi-iface 'wifinet5'
	option device 'radio1'
	option mode 'ap'
	option ssid 'fivegissel'
	option encryption 'psk2'
	option key '<redact>'
	option network 'lan'
	option skip_inactivity_poll '1'
	option disassoc_low_ack '0'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '1'
	option ednspacket_max '1232'
	option allservers '1'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'disabled'
	option dynamicdhcp '0'

config odhcpd 'odhcpd'
	option leasefile '/tmp/odhcpd.leases'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'
	option piodir '/tmp/odhcpd-piodir'
	option hostsdir '/tmp/hosts'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
	option syn_flood '1'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'DROP'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

root@OpenWrt:~#

I tried the commented out options:

	#option twt_responder '1'
	#option hostapd_options 'he_twt_responder=1'

but they don't work. I'm a bit clueless...

4

Those options are per-radio....
Also add

        option he_bss_color '64'

This randomizes AP colour so that clients do not have to parse all packets from the air.

5

Hello brada4.
thank you for your fast response. I tried the following config for the device:

root@OpenWrt:~# cat /etc/config/wireless | head -15

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi'
	option band '2g'
	option htmode 'HE20'
	option num_global_macaddr '7'
	option cell_density '0'
	option channel '9'
	option txpower '20'
	option country 'DE'
	option twt_responder '1'                   
	option hostapd_options 'he_twt_responder=1'
	#option he_bss_color '64'

root@OpenWrt:~#

with and without the he_bss_color option. With the he_bss_color option the device was not able to connect to the network. I still get the same error on the device...

6

Well to start - hostapd_options is list

Once it is a list you can add more parameters like force twt
x https://git.w1.fi/cgit/hostap/tree/hostapd/hostapd.conf#n879

bss colouring is basic part of wifi6 (it is unavoidable field in packet) , since that is not supported you may need to actually enable (hackish) ht-twt

7

Can you try

option hostapd_options 'he_twt_required=1'
8

hostapd_options is list.

9

I've tried several options and nothing is working.
Also this one:

option hostapd_options 'ht_vht_twt_responder=1 peer_to_peer_twt=1 he_twt_responder=1 he_twt_required=1'

When I turn off he_twt_responder the error message disappears but I can see on the powerprofle that its not working / not eabled.

Any Ideas?

10

Should not matter the format but formally it is

list hostapd_options 'ht_vht_twt_responder=1'
list hostapd_options 'peer_to_peer_twt=1'
list hostapd_options 'he_twt_responder=1'
list hostapd_options 'he_twt_required=1'

There is no option for selecting twt timeout in 1/1024s cycles
Try to set mode to AC then only one option applies (but probably no other client will connect)