[Solved] Unifi 6 lite guest wlan DHCP problems since 23.05

Installing and Using OpenWrt
1

Hi,

I have upgraded my dump ap (Unifi 6 lite) to 23.05 and after that clients connecting to the guest wlan do not get ip addresses any more. I have tried both 23.05.0 and 23.05.2. However the same config works when downgrading to 22.03 again. Almost the same config also works on my Unifi 6 LR with 23.05 and 22.03. The normal net (lan) works fine in all configurations.
Furthermore dhcp works on the device itself as it gets an IP with udhcpc -i br-guest.
Factory reseting the device and reconfiguring it from scratch did not help.

My APs are configured dump. So odhcpd, dnsmasq and firewall are disabled. They use VLAN tags to seperate networks. Here are some details.

# ubus call system board
{
	"kernel": "5.15.137",
	"hostname": "ap02-unifi6-lite",
	"system": "MediaTek MT7621 ver:1 eco:3",
	"model": "Ubiquiti UniFi 6 Lite",
	"board_name": "ubnt,unifi-6-lite",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05.2",
		"revision": "r23630-842932a63d",
		"target": "ramips/mt7621",
		"description": "OpenWrt 23.05.2 r23630-842932a63d"
	}
}

# cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdc2:9ba5:551d::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan'

config interface 'lan'
	option device 'br-lan'
	option proto 'dhcp'
	option ip6assign '60'

config device 'br_guest'
	option type 'bridge'
	option name 'br-guest'
	list ports 'lan.123'

config interface 'guest'
	option device 'br-guest'
	option proto 'none'

# cat /etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
	option channel '1'
	option band '2g'
	option htmode 'HT20'
	option disabled '0'
	option country 'DE'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option ssid 'ssid'
	option encryption 'sae-mixed'
	option key '****'

config wifi-device 'radio1'
	option type 'mac80211'
	option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
	option channel '48'
	option band '5g'
	option htmode 'HE80'
	option disabled '0'
	option country 'DE'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid 'ssid'
	option encryption 'sae-mixed'
	option key '****'

config wifi-iface 'guest0'
	option device 'radio0'
	option mode 'ap'
	option network 'guest'
	option ssid 'ssid Gast'
	option encryption 'sae-mixed'
	option key '****'
	option isolate '1'

config wifi-iface 'guest1'
	option device 'radio1'
	option mode 'ap'
	option network 'guest'
	option ssid 'ssid Gast'
	option encryption 'sae-mixed'
	option key '****'
	option isolate '1'

The log file does not seem interesting.

# logread -f
Wed Jan 24 01:58:47 2024 daemon.info hostapd: phy1-ap1: STA **:c0:**:b3:**:bb IEEE 802.11: associated (aid 1)
Wed Jan 24 01:58:47 2024 daemon.notice hostapd: phy1-ap1: AP-STA-CONNECTED **:c0:**:b3:**:bb auth_alg=sae
Wed Jan 24 01:58:47 2024 daemon.info hostapd: phy1-ap1: STA **:c0:**:b3:**:bb WPA: pairwise key handshake completed (RSN)
Wed Jan 24 01:58:47 2024 daemon.notice hostapd: phy1-ap1: EAPOL-4WAY-HS-COMPLETED **:c0:**:b3:**:bb

However the log file on the main router (running OpenWRT 23.05) looks interesting:

# logread -f
Wed Jan 24 02:09:07 2024 daemon.info dnsmasq-dhcp[1]: DHCPDISCOVER(br-guest) 192.168.123.148 **:c0:**:b3:**:bb
Wed Jan 24 02:09:07 2024 daemon.info dnsmasq-dhcp[1]: DHCPOFFER(br-guest) 192.168.123.148 **:c0:**:b3:**:bb
Wed Jan 24 02:09:07 2024 daemon.info dnsmasq-dhcp[1]: DHCPDISCOVER(br-guest) 192.168.123.148 **:c0:**:b3:**:bb
Wed Jan 24 02:09:07 2024 daemon.info dnsmasq-dhcp[1]: DHCPOFFER(br-guest) 192.168.123.148 **:c0:**:b3:**:bb

My understanding is that the DHCP request reaches the main router but the response gets lost.
I do not expect the main router to be the problem as the other ap on the Unifi 6 LR and the old version on the Unifi 6 Lite work fine. But for the reference here is its config:

# cat /etc/config/network 

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd3c:d545:9ccd::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.23.1'
	option netmask '255.255.255.0'
	option ip6assign '64'

config interface 'wan'
	option device 'eth1'
	option proto 'pppoe'
	option username '****'
	option password '****'
	option ipv6 '1'
	option peerdns '0'
	option dns '127.0.0.1'

config interface 'wan6'
	option device '@wan'
	option proto 'dhcpv6'
	option peerdns '0'
	option dns '0::1'

config device 'br_guest'
	option type 'bridge'
	option name 'br-guest'
	list ports 'eth0.123'

config interface 'guest'
	option device 'br-guest'
	option proto 'static'
	option ipaddr '192.168.123.1'
	option netmask '255.255.255.0'
	option ip6assign '64'

# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '2048'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'
	option noresolv '1'
	list server '127.0.0.1#5453'
	list server '0::1#5453'
	option dnssec '1'
	option dnsseccheckunsigned '1'
	option confdir '/tmp/dnsmasq.d'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '250'
	option leasetime '10d'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	option ra_slaac '1'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'guest'
	option interface 'guest'
	option start '100'
	option limit '250'
	option leasetime '1h'
	option dhcpv6 'server'
	option ra 'server'

config domain
	option ip '192.168.2.1'
	option name 'modem'

config host
	option mac '80:**:**:f7:**:5a'
	option ip '192.168.23.2'
	option name '****'
	option dns '1'
...

# cat /etc/config/firewall 

config defaults
	option syn_flood '1'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone 'guest'
	option name 'guest'
	option network 'guest'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'

config forwarding 'guest_wan'
	option src 'guest'
	option dest 'wan'
	option target 'ACCEPT'

config rule 'guest_dns'
	option name 'Guest allow DNS'
	option src 'guest'
	option dest_port '53'
	option proto 'tcp udp'
	option target 'ACCEPT'

config rule 'guest_dhcp'
	option name 'Guest allow DHCP'
	option src 'guest'
	option dest_port '67'
	option proto 'udp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule 'guest_icmp'
	option name 'Guest allow ping'
	option src 'guest'
	option proto 'icmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule 'guest_dhcp6'
	option name 'Guest allow DHCP6'
	option src 'guest'
	option dest_port '547'
	option proto 'udp'
	option family 'ipv6'
	option target 'ACCEPT'

config rule 'guest_icmp6'
	option name 'Guest allow ping6'
	option src 'guest'
	option proto 'icmp'
	option family 'ipv6'
	option target 'ACCEPT'

Any help is highly appriciated.

2

Let's start with your main router...

While not related to your issue, it is not generally recommended to self-reference DNS. Use a public DNS server of your choosing so that the wan has a defined and valid DNS server. From there, dnsmasq will do the reset based its configuration.

Your DHCP pool is invalid for both the lan and guest networks...

You have a /24 network which make the valid range of addresses .1 - .254. The limit is the size of the DHCP pool, so you've got a starting address of 100 with a size of 250 which means the pool is 100-349 (the equation is start - (start + limit - 1)).

Change the limit to <=155 (or change your start). This is true on both networks.

Next, on your AP...

Don't use sae-mixed. It is best to use either WPA2 or WPA3, but not mixed mode. This tends to cause problems with a lot of devices. I recommend wpa2 (psk2) for now.

Restart both devices after you make these changes and test again. If it doesn't work, we'll make an adjustment to the way the U6-lite's VLAN is defined.

3

Hi @psherman,

thanks a lot for your kind reply.

I configured self-referencing DNS to use stubby for encrypted DNS queries. However for testing I have reverted my changes.

Furthermore I fixed the DHCP pool by using `option limit '150' in both networks. Thanks again for pointing this out.

As you suggest I set the WLAN encryption to WPA2 in both aps and in both networks.

# grep encryption /etc/config/wireless 
	option encryption 'wpa2-psk'
	option encryption 'wpa2-psk'
	option encryption 'wpa2-psk'
	option encryption 'wpa2-psk'

After that I completely disconnected the working ap (my Unifi 6 LR) and use its switch port for my Unifi 6 lite.

But still I do not get any ip address when connecting to the guest network. Connecting to the normal (lan) network still works fine.

What adjustments to the Unifi 6 lite VLAN configuration would you recommend?

Is there anything else I could try?

4

Ok... thanks for fixing those other items and testing.

We'll set up bridge-vlans... here's how:

first, delete this:

Next, add the following:

config bridge-vlan
	option device 'br-lan'
	option vlan '1'
	list ports 'lan:u*'

config bridge-vlan
	option device 'br-lan'
	option vlan '123'
	list ports 'lan:t'

Now, edit your network interfaces to use the bridge vlans as follows:

config interface 'lan'
	option device 'br-lan.1'
	option proto 'dhcp'

config interface 'guest'
	option device 'br-lan.123'
	option proto 'none'

Then reboot your U6-lite and test again.

5

Hi @psherman,

your the best!
Using bridge-vlans works, even with sae-mixed.

Many many thanks for your quick reply.

Kind regards,
Ben

6

awesome! Glad I could help!

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks! :slight_smile:

7

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.