Possible regression? Dual band SSID + 2 other SSIDS on the same bridge, connectivity problems

dijx · February 27, 2022, 12:00am

Hi all,

Sorry for being so elaborative

Router: Totolink X5000R, LuCI openwrt-21.02 branch (git-22.052.50801-31a27f3)/ OpenWrt 21.02-SNAPSHOT r16500-b99d7aecc8

3 SSIDS - 4 wlans, same bridge, same network. Also guest network, irrelevant as it cannot reach anything and the problem occurs even if not configured.
my - dual band network, mostly for devices that can remember only one SSID, so cannot roam - chromecast, yamacha amp etc. Beside:
my_2.4
my_5.0

Problem:
When device like notebook or phone is connected to dual band 'my' wlan, it cannot connect devices in 'my' if they uses the same radio/the same frequency. In other words, if my laptop join 'my' using 5G band and chromecast is also joined 'my' using 5G at the moment, I can't cast anything, I can't even ping it. At the same time, if Yamaha amp is using 2.4, Yamaha's Android apps are working fine. But if my phone will go 2.4 or Yamaha will go 5G, apps cannot detect it anymore.
If my phone is joined to my_2.4 or my_5.0, usualy there is no problem, however sometimes problem also appears; then I just have to switch to my_2.4 or my_5.0 and it starts to work. In fact, while I was writting that, my second notebook lost connection with chromecast, so I switched it to 2.4, then back to 5.0 and voila - chromecast detected again.
If it is a device with wired connection, it's always working.

I'm pretty sure that the problem was also present on my previous TL-WDR3600 router with OpenWrt 19.x, but back then Yamaha was always wired and chromecast was also wired soon after first problems appeared. Now I cannot connect these with ethernet, because router is in another place.

Wireless:

config wifi-device 'radio0'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
        option noscan '1'
        option hwmode '11g'
        option htmode 'HE40'
        option channel '1'
        option country 'PA'
        option txpower '24'
        option cell_density '0'
        option beacon_int '400'

config wifi-device 'radio1'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0+1'
        option cell_density '0'
        option noscan '1'
        option hwmode '11a'
        option channel '153'
        option country 'PA'
        option txpower '25'
        option htmode 'HE80'
        option beacon_int '100'


config wifi-iface 'my24'  
        option device 'radio0'
        option mode 'ap'      
        option ssid 'my_2.4'  
        option encryption 'psk2'
        option key '<pass>'

config wifi-iface 'my_dual24'                                                       
        option device 'radio0' 
        option mode 'ap'        
        option ssid 'my'                                                            
        option encryption 'psk2'                                                    
        option key '<pass>'


config wifi-iface 'iso_dual24'                                                       
        option device 'radio0' 
        option mode 'ap'        
        option ssid 'my_iso'                                                            
        option encryption 'psk2'                                                    
        option key '<pass2>'
        option network "br-lan"                                                     
        option enabled "0"   



config wifi-iface 'my50'
        option device 'radio1'
        option mode 'ap'
        option ssid 'my_5.0'
        option encryption 'psk2'
        option key '<pass>'

config wifi-iface 'my_dual50'                                                           
        option device 'radio1'                                                      
        option mode 'ap'                                                            
        option ssid 'my'                                                            
        option encryption 'psk2'                                                    
        option key '<pass>'

config wifi-iface 'iso_dual50'                                                      
        option device 'radio1'                                                      
        option mode 'ap'                                                            
        option ssid 'my_iso'                                                        
        option encryption 'psk2'                                                    
        option key '<pass2>'

Network:

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'
        option ula_prefix 'fd5e:bbbd:69e6::/48'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.0.1'
        option delegate '0'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'wlan0'
        list ports 'wlan1'
        list ports 'wlan1-1'
        list ports 'wlan0-1'
        option ipv6 '0'
        option promisc '1'
        option acceptlocal '1'

config interface 'ISO_guest'
        option proto 'static'
        option device 'br-iso'
        option ipaddr '192.168.100.1'
        option netmask '255.255.255.0'
        option delegate '0'


config device
        option type 'bridge'
        option name 'br-iso'
        list ports 'wlan0-2'
        list ports 'wlan1-2'
        option bridge_empty '1'
        option ipv6 '0'

Firewall:

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'
        option flow_offloading '1'
        option flow_offloading_hw '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Support-UDP-Traceroute'
        option src 'wan'
        option dest_port '33434:33689'
        option proto 'udp'
        option family 'ipv4'
        option target 'REJECT'
        option enabled '0'

config include
        option path '/etc/firewall.user'

config zone
        option name 'iso'
        option input 'ACCEPT'
        option output 'ACCEPT'
        list network 'ISO_guest'
        option forward 'ACCEPT'

config forwarding
        option src 'iso'
        option dest 'wan'

config forwarding
        option src 'lan'
        option dest 'iso'

config rule
        option name 'ISO2LAN block'
        list proto 'all'
        option src 'iso'
        option dest 'lan'
        option target 'DROP'

config rule
        option name 'ISO2GW block'
        list proto 'all'
        option src 'iso'
        list dest_ip '192.168.0.1'
        option target 'DROP'

dijx · February 27, 2022, 8:34pm

Well, it may be a regression:

github.com/openwrt/openwrt

FS#714 - ARP/Broadcast does not reach other clients in the same WLAN

opened 04:20PM - 17 Apr 17 UTC

openwrt-bot

flyspray

*Jakeler:* I have the default bridge with ethernet and WLAN in it. When i try t…o send data from a client to another, both connected to the same WLAN SSID, it doesn't work (Destination unreachable). Wireshark shows that it sends endless ARP requests to Broadcast, but the other clients in that WLAN never get it (and therefore can't answer). The broadcast gets still delivery to every client connected through Ethernet. If i create a second WLAN SSID (even on the same adapter) and and add it to the bridge, it gets also all broadcast packets from the other WLAN... So if i put the 2 clients in different WLAN SSIDs or ethernet they get the broadcast from each other, but not when both are connected to the same. The isolate option is not set in the wireless config. Archer C5 v1 with latest LEDE snapshot (no difference to 17.01 stable or rc).

grep -c ap_isolate /var/run/hostapd-phy*.conf
/var/run/hostapd-phy0.conf:2
/var/run/hostapd-phy1.conf:2

I did not set isolation, but all wlans have that apparently?

for f in $(find /sys/devices/virtual/net/br-lan/lower_wlan*/ -name hairpin_mode) ; do printf $f:  ; cat $f ; done
/sys/devices/virtual/net/br-lan/lower_wlan0-1/brport/hairpin_mode:0
/sys/devices/virtual/net/br-lan/lower_wlan0/brport/hairpin_mode:0
/sys/devices/virtual/net/br-lan/lower_wlan1-1/brport/hairpin_mode:0
/sys/devices/virtual/net/br-lan/lower_wlan1/brport/hairpin_mode:0

And if I change it to 1 like that all devices are able to ping each other:

for f in $(find /sys/devices/virtual/net/br-lan/lower_wlan*/ -name hairpin_mode) ; do echo 1 > $f ; printf $f:  ; cat $f ; done
/sys/devices/virtual/net/br-lan/lower_wlan0-1/brport/hairpin_mode:1
/sys/devices/virtual/net/br-lan/lower_wlan0/brport/hairpin_mode:1
/sys/devices/virtual/net/br-lan/lower_wlan1-1/brport/hairpin_mode:1
/sys/devices/virtual/net/br-lan/lower_wlan1/brport/hairpin_mode:1

Setting it all back to 0 reproduces the problem...