[Problem] IP Wireless

dexter74 · April 18, 2023, 1:33am

Good morning,
I would like a hand for the commissioning of the wifi network.
When I make my WIFI network without a password, I manage to connect and when I put a WPA2 password, I cannot authenticate myself.

https://openwrt.org/toh/asus/rt-ac88u
OpenWrt 22.03.1 r19777-2853b6d652

Tue Apr 18 03:27:20 2023 daemon.notice hostapd: wlan0: ACS-COMPLETED freq=2412 channel=1
Tue Apr 18 03:27:20 2023 kern.info kernel: [  333.401085] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
Tue Apr 18 03:27:20 2023 kern.info kernel: [  333.407627] Network: port 2(wlan0) entered blocking state
Tue Apr 18 03:27:20 2023 kern.info kernel: [  333.413049] Network: port 2(wlan0) entered forwarding state
Tue Apr 18 03:27:20 2023 daemon.notice netifd: Network device 'wlan0' link is up
Tue Apr 18 03:27:20 2023 daemon.notice hostapd: wlan0: interface state ACS->ENABLED
Tue Apr 18 03:27:20 2023 daemon.notice hostapd: wlan0: AP-ENABLED
Tue Apr 18 03:27:21 2023 daemon.info hostapd: wlan0: STA 50:98:39:07:29:3e IEEE 802.11: associated
Tue Apr 18 03:27:23 2023 daemon.info hostapd: wlan0: STA 50:98:39:07:29:3e IEEE 802.11: disassociated
Tue Apr 18 03:27:24 2023 daemon.info hostapd: wlan0: STA 50:98:39:07:29:3e IEEE 802.11: disassociated
Tue Apr 18 03:27:31 2023 daemon.info hostapd: wlan0: STA 50:98:39:07:29:3e IEEE 802.11: associated
Tue Apr 18 03:27:35 2023 daemon.info hostapd: wlan0: STA 50:98:39:07:29:3e IEEE 802.11: disassociated
Tue Apr 18 03:28:07 2023 kern.info kernel: [  379.942887] device wlan0 left promiscuous mode
Tue Apr 18 03:28:07 2023 kern.info kernel: [  379.947546] Network: port 2(wlan0) entered disabled state
Tue Apr 18 03:28:07 2023 daemon.notice hostapd: Remove interface 'wlan0'
Tue Apr 18 03:28:07 2023 daemon.notice hostapd: wlan0: interface state ENABLED->DISABLED
Tue Apr 18 03:28:07 2023 daemon.notice hostapd: wlan0: AP-DISABLED
Tue Apr 18 03:28:07 2023 daemon.notice hostapd: wlan0: CTRL-EVENT-TERMINATING
Tue Apr 18 03:28:07 2023 daemon.err hostapd: rmdir[ctrl_interface=/var/run/hostapd]: Permission denied
Tue Apr 18 03:28:07 2023 daemon.notice hostapd: nl80211: deinit ifname=wlan0 disabled_11b_rates=0
Tue Apr 18 03:28:07 2023 daemon.notice hostapd: nl80211: Failed to remove interface wlan0 from bridge Network: Invalid argument
Tue Apr 18 03:28:08 2023 daemon.notice netifd: radio0 (4936): command failed: No error information (-524)
Tue Apr 18 03:28:08 2023 daemon.notice netifd: Wireless device 'radio0' is now down
Tue Apr 18 03:28:08 2023 daemon.notice netifd: radio0 (4954): command failed: No error information (-524)
Tue Apr 18 03:28:09 2023 daemon.notice netifd: radio0 (4954): command failed: I/O error (-5)
Tue Apr 18 03:28:10 2023 daemon.notice hostapd: Configuration file: /var/run/hostapd-phy0.conf (phy wlan0) --> new PHY
Tue Apr 18 03:28:10 2023 kern.info kernel: [  383.377965] Network: port 2(wlan0) entered blocking state
Tue Apr 18 03:28:10 2023 kern.info kernel: [  383.383488] Network: port 2(wlan0) entered disabled state
Tue Apr 18 03:28:10 2023 kern.info kernel: [  383.389163] device wlan0 entered promiscuous mode
Tue Apr 18 03:28:10 2023 daemon.notice hostapd: wlan0: interface state UNINITIALIZED->COUNTRY_UPDATE
Tue Apr 18 03:28:10 2023 daemon.notice hostapd: ACS: Automatic channel selection started, this may take a bit
Tue Apr 18 03:28:10 2023 daemon.notice hostapd: wlan0: interface state COUNTRY_UPDATE->ACS
Tue Apr 18 03:28:10 2023 daemon.notice hostapd: wlan0: ACS-STARTED
Tue Apr 18 03:28:11 2023 daemon.notice netifd: Wireless device 'radio0' is now up

psherman · April 18, 2023, 2:10am

It appears that you have enabled legacy mode and also wpa/wpa2 mixed mode operation.

Turn off legacy mode unless there is a very specific need for it. And use wpa2 mode encryption only.

If that doesn't fix the problem, please post your config (and be sure to note which SSID/network is affected by this issue:

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

dexter74 · April 18, 2023, 2:19am

/etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'
        option ula_prefix 'fd48:5714:7e8a::/48'

config interface 'wan'
        option device 'wan'
        option proto 'static'
        option ipaddr '192.168.1.100'
        option netmask '255.255.255.0'
        option gateway '192.168.1.1'
        option broadcast '192.168.1.255'
        list dns '8.8.8.8'
        list dns_search 'HOME'
        option delegate '0'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'
        option auto '0'
        option reqaddress 'try'
        option reqprefix 'auto'

config interface 'Secours'
        option proto 'static'
        option device 'extsw'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'
        option type 'bridge'

config device
        option type 'bridge'
        option name 'Network'
        option bridge_empty '1'
        list ports 'lan1'
        list ports 'wlan0'

config bridge-vlan
        option device 'Network'
        option vlan '1'
        list ports 'lan1:t*'

config bridge-vlan
        option device 'Network'
        option vlan '2'
        list ports 'lan1:t'

config interface 'Vlan1'
        option proto 'static'
        option device 'Network.1'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'

config interface 'VLAN2'
        option proto 'static'
        option device 'Network.2'
        option ipaddr '192.168.3.1'
        option netmask '255.255.255.0'

etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path '18000000.axi/bcma0:7/pci0000:00/0000:00:00.0/0000:01:00.0'
        option band '2g'
        option cell_density '1'
        option country 'FR'
        option channel '6'
        option txpower '10'

config wifi-device 'radio1'
        option type 'mac80211'
        option path '18000000.axi/bcma0:8/pci0001:00/0001:00:00.0/0001:01:00.0'
        option band '5g'
        option htmode 'VHT80'
        option cell_density '0'
        option channel 'auto'

config wifi-iface 'wifinet0'
        option device 'radio1'
        option mode 'ap'
        option ssid 'OpenWrt'
        option network 'VLAN2'
        option key 'Admin123456'
        option encryption 'psk2+tkip'

/etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'
        option start '100'
        option limit '150'
        option leasetime '12h'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'Secours'
        option interface 'Secours'
        option start '2'
        option leasetime '1h'
        option limit '5'

config dhcp 'Vlan1'
        option interface 'Vlan1'
        option start '2'
        option limit '253'
        option leasetime '24h'

config dhcp 'VLAN2'
        option interface 'VLAN2'
        option start '2'
        option leasetime '24h'
        option limit '253'

/etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'secours'
        option forward 'REJECT'
        option input 'ACCEPT'
        option output 'ACCEPT'
        list network 'Secours'

config zone
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option name 'Vlan1'
        list network 'Vlan1'

config zone
        option input 'ACCEPT'
        option output 'ACCEPT'
        option name 'Vlan2'
        option family 'ipv4'
        option forward 'ACCEPT'
        list network 'VLAN2'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option masq '1'
        option mtu_fix '1'
        option forward 'REJECT'
        list network 'wan'
        list network 'wan6'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option proto 'esp'
        option target 'ACCEPT'
        option dest 'Vlan1'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'
        option dest 'Vlan1'

config forwarding
        option src 'Vlan1'
        option dest 'wan'

config forwarding
        option src 'Vlan2'
        option dest 'Vlan1'

config forwarding
        option src 'Vlan2'
        option dest 'secours'

config forwarding
        option src 'Vlan2'
        option dest 'wan'

psherman · April 18, 2023, 2:26am

Is it working now (you seem to have marked this as solved), or are you still having issues?

dexter74 · April 18, 2023, 2:29am

not resolve.

psherman · April 18, 2023, 2:38am

Ok... I see a bunch of things going on...

first, remove the option type 'bridge' from this stanza:

dexter74:

config interface 'Secours'
        option proto 'static'
        option device 'extsw'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'
        option type 'bridge'

remove 'wlan0' from this next stanza. The radios should never be added in the main network config.

Remove the * from this (it should just be 'lan1:t'):

change the encryption type to psk2 (instead of psk2+tkip)

dexter74:

config wifi-iface 'wifinet0'
        option device 'radio1'
        option mode 'ap'
        option ssid 'OpenWrt'
        option network 'VLAN2'
        option key 'Admin123456'
        option encryption 'psk2+tkip'

Try those and test again.

dexter74 · April 18, 2023, 2:42am

Hello,

I'm sorry , i'm french and i not understand to "stanza".

I need remove line ?

psherman · April 18, 2023, 2:45am

No worries... This means a group of lines. this is a stanza:

dexter74:

config interface 'Secours'
        option proto 'static'
        option device 'extsw'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'
        option type 'bridge'

You need to remove the line that has option type 'bridge'.

dexter74 · April 18, 2023, 3:02am

I need reboot after Edit ?

psherman · April 18, 2023, 3:03am

yes, reboot is a good way to ensure all services are reloaded.

dexter74 · April 18, 2023, 3:06am

It's not work .

 systemctl --failed
  UNIT LOAD ACTIVE SUB DESCRIPTION
0 loaded units listed.

psherman · April 18, 2023, 3:08am

I've never seen that error. Can you post your current configs?

dexter74 · April 18, 2023, 3:10am

dmesg

[    2.486373] b53-srab-switch: probe of b53-srab-switch failed with error -22
[    2.538075] bgmac_bcma: probe of bcma0:6 failed with error -524
[    5.178305] hub 3-0:1.0: config failed, hub doesn't have any ports! (err -19)
[   13.355712] brcmfmac 0000:01:00.0: Direct firmware load for brcm/brcmfmac4366c-pcie.asus,rt-ac88u.bin failed with error -2
[   13.579812] brcmfmac 0000:01:00.0: Direct firmware load for brcm/brcmfmac4366c-pcie.asus,rt-ac88u.txt failed with error -2
[   13.590961] brcmfmac 0000:01:00.0: Direct firmware load for brcm/brcmfmac4366c-pcie.txt failed with error -2
[   13.888102] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available
[   14.065764] brcmfmac 0001:01:00.0: Direct firmware load for brcm/brcmfmac4366c-pcie.asus,rt-ac88u.bin failed with error -2
[   14.080262] brcmfmac 0001:01:00.0: Direct firmware load for brcm/brcmfmac4366c-pcie.asus,rt-ac88u.txt failed with error -2
[   14.091461] brcmfmac 0001:01:00.0: Direct firmware load for brcm/brcmfmac4366c-pcie.txt failed with error -2
[   14.368705] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'
        option ula_prefix 'fd48:5714:7e8a::/48'

config interface 'wan'
        option device 'wan'
        option proto 'static'
        option ipaddr '192.168.1.100'
        option netmask '255.255.255.0'
        option gateway '192.168.1.1'
        option broadcast '192.168.1.255'
        list dns '8.8.8.8'
        list dns_search 'HOME'
        option delegate '0'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'
        option auto '0'
        option reqaddress 'try'
        option reqprefix 'auto'

config interface 'Secours'
        option proto 'static'
        option device 'extsw'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'

config device
        option type 'bridge'
        option name 'Network'
        option bridge_empty '1'
        list ports 'lan1'

config bridge-vlan
        option device 'Network'
        option vlan '1'
        list ports 'lan1:t*'

config bridge-vlan
        option device 'Network'
        option vlan '2'
        list ports 'lan1:t'

config interface 'Vlan1'
        option proto 'static'
        option device 'Network.1'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'

config interface 'VLAN2'
        option proto 'static'
        option device 'Network.2'
        option ipaddr '192.168.3.1'
        option netmask '255.255.255.0'

config wifi-device 'radio0'
        option type 'mac80211'
        option path '18000000.axi/bcma0:7/pci0000:00/0000:00:00.0/0000:01:00.0'
        option band '2g'
        option cell_density '1'
        option country 'FR'
        option channel '6'
        option txpower '10'

config wifi-device 'radio1'
        option type 'mac80211'
        option path '18000000.axi/bcma0:8/pci0001:00/0001:00:00.0/0001:01:00.0'
        option band '5g'
        option htmode 'VHT80'
        option cell_density '0'
        option channel 'auto'
        option noscan '1'

config wifi-iface 'wifinet0'
        option device 'radio1'
        option mode 'ap'
        option ssid 'OpenWrt'
        option network 'VLAN2'
        option key 'Azerty74'
        option encryption 'psk2'

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'
        option start '100'
        option limit '150'
        option leasetime '12h'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'Secours'
        option interface 'Secours'
        option start '2'
        option leasetime '1h'
        option limit '5'

config dhcp 'Vlan1'
        option interface 'Vlan1'
        option start '2'
        option limit '253'
        option leasetime '24h'

config dhcp 'VLAN2'
        option interface 'VLAN2'
        option start '2'
        option leasetime '24h'
        option limit '253'

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'secours'
        option forward 'REJECT'
        option input 'ACCEPT'
        option output 'ACCEPT'
        list network 'Secours'

config zone
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option name 'Vlan1'
        list network 'Vlan1'

config zone
        option input 'ACCEPT'
        option output 'ACCEPT'
        option name 'Vlan2'
        option family 'ipv4'
        option forward 'ACCEPT'
        list network 'VLAN2'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option masq '1'
        option mtu_fix '1'
        option forward 'REJECT'
        list network 'wan'
        list network 'wan6'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option proto 'esp'
        option target 'ACCEPT'
        option dest 'Vlan1'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'
        option dest 'Vlan1'

config forwarding
        option src 'Vlan1'
        option dest 'wan'

config forwarding
        option src 'Vlan2'
        option dest 'Vlan1'

config forwarding
        option src 'Vlan2'
        option dest 'secours'

config forwarding
        option src 'Vlan2'
        option dest 'wan'

The t* is vlan .

Firmware: https://pkgs.org/search/?q=brcmfmac-firmware

psherman · April 18, 2023, 4:46am

I wonder if this is the problem... this isn't part of the official OpenWrt repo.

Are you running an official version of OpenWrt?

dexter74 · April 18, 2023, 12:25pm

Hello,
i use only official without custom firmware, i think is bug to firmware official in openwrt.

psherman · April 18, 2023, 3:30pm

I'd recommend resetting to defaults and then trying the wireless config as the first step. Relative to the defaults, change only the absolute minimum of items to make it functional (don't add any VLANs yet).

Make a backup of your current config before you reset.

dexter74 · April 18, 2023, 11:04pm

Hi,
I already tried, but it didn't work

theMan · April 18, 2023, 11:20pm

Wifi is an utter mess with OpenWrt on this device. Use DD-WRT or Freshtomato, you can accomplish the same thing with much better performance.

dexter74 · April 19, 2023, 9:01am

Hi,

Freshtomato doesn't take ports 5-8. (Exit)
DD-WRT: I need help
OpenWrt: Bugged on wireless key authentication.

0 Good Firmware all works ... I Will think i hate ASUS.

Wifi work to default, i need assistant for create Wifi with my VLAN.

system · April 29, 2023, 9:01am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.