Start with one additional VLAN (for whichever network you want). Add the bridge VLAN with the lan port tagged. Then create an unmanaged network interface. Finally, add an SSID which is linked to the unmanaged network interface.
Does that work? If so, repeat the process for the others.
Just here to share my experience with somehow similar situation.
I needed "stupid" AP which bridges "hostile" vlan with SSIDs on 2.4 and 5GHz. I have made management vlan interface in primary Ethernet interface. That interface was getting ip from dhcp server(static lease). After that I made a bridge containing the same Ethernet interface and added "hostile" vlan, ssids and everything worked as expekted.
Why uci/luci/startup scripts are not allowing me to attache ssids to vlan interface is beyond me, especially when manual configuration from cli is working fine,
Sorry, I was a bit unclear in my last post. VLANs on the new SSIDs are working, but I was curious about your suggestions for tuning the wifi for better speeds/range and reduced noise/interference.
Here is my wifi config as it currently stands.
config wifi-device 'radio0'
option type 'mac80211'
option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
option channel '1'
option band '2g'
option htmode 'HT20'
option cell_density '0'
config wifi-device 'radio1'
option type 'mac80211'
option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
option band '5g'
option htmode 'HE80'
option cell_density '0'
option channel '44'
config wifi-iface 'wifinet3'
option device 'radio0'
option mode 'ap'
option ssid 'LAN'
option encryption 'sae'
option key 'REDACTED'
option network 'lan'
option disabled '1'
config wifi-iface 'wifinet4'
option device 'radio1'
option mode 'ap'
option ssid 'LAN'
option encryption 'sae'
option key 'REDACTED'
option network 'lan'
config wifi-iface 'wifinet5'
option device 'radio0'
option mode 'ap'
option ssid 'IOT'
option encryption 'psk2'
option key 'REDACTED'
option network 'iot'
config wifi-iface 'wifinet6'
option device 'radio1'
option mode 'ap'
option ssid 'IOT'
option encryption 'psk2'
option key 'REDACTED'
option network 'iot'
config wifi-iface 'wifinet7'
option device 'radio0'
option mode 'ap'
option ssid 'GUEST'
option encryption 'psk2'
option key 'REDACTED'
option network 'guest'
config wifi-iface 'wifinet8'
option device 'radio1'
option mode 'ap'
option ssid 'GUEST'
option encryption 'psk2'
option key 'REDACTED'
option network 'guest'
config wifi-iface 'wifinet9'
option device 'radio0'
option mode 'ap'
option ssid 'LAN-hidden'
option encryption 'sae'
option hidden '1'
option key 'REDACTED'
option network 'lan'
I've still got the one hidden network in there with the old SSID until I finish transitioning my devices to the new networks.
In case it helps, here are the channel analyses from the new AP:
Hi @benbergman
Indeed that is what I did. I am currently setting up a new set of E8450 (1 router + 1 AP, with VLANs just like you)
If I do not define any firewall zones the AP, GUEST VLAN does not access internet.
When I connect on GUEST interface (Wifi or Cable), I do get a correct IP. But no Internet access.
Any thoughts on this? Did you get this issue?
Been following haha. I think I can talk reasonably well about the wireless stuff but eh.
Looks like 2.4ghz band is going to be a mess regardless. (Which is usually the case?)
You're saying you don't achieve good speeds on 2.4? Or on 5?
Regarding 2.4ghz:
1,6,11 is the split if you don't have channel 12/13/14 and don't have 802.11b to worry about.
But lots of things are still programmed for 1,6,11 even where 1,5,9,13 works.
But the important thing is to optimise for your co-channel interference so you can decode and back off properly. Rather than having adjacent channel interference.
I would stick to channel 1 on that AP as your neigbours have inconsistent channel selection per the photos for upper channels 6 and greater on 2.4ghz.
A reasonable image:
https://upload.wikimedia.org/wikipedia/commons/4/4a/NonOverlappingChannels2.4GHz802.11-en.svg
Regarding 5ghz:
149-161 looks to be fine too as it's below -90dbm. But clients on that network could get closer ( it's not just the AP that will cause the interference).
On 5ghz band I'd move to 149-161 unless you have equipment that doesn't like that band. ( On the assumption that you want to avoid DFS channels, and assuming 149-161 isn't DFS in your area.)
I usually have to compromise on leaving at least some AP's on channels 36-48 to handle older international clients whilst avoiding the channels 52-64. (Which are DFS in my area, but should handle most international clients).
I'm assuming you mean your firewall zones are setup on the router but not on the AP? (That is what I've done). I just checked and it turns out I am having the same issue (I guess I didn't test my guest network very well). I'll have to dig into this some more. Let me know if you solve it!
Thanks for these tips. I've kept my AP on channel 1 and my router on 6 for 2.4GHz and 157 and 44 respectively for 5GHz (it looks like 149-161 is outside DFS in my area too).
Re. speed issues, using iperf3 from a wired PC to my router (router running iperf3 server) I get 861 Mbits/sec. From my laptop through the 5GHz connection on the AP I get 74.6 Mbits/sec. On 2.4GHz through the AP to the router I get 17.0 Mbits/sec. Neither is great, but 2.4 is particularly bad.
FYI, I just did these tests after adjusting the channels. The speeds before were similar.
I just tried turning on software and hardware flow offloading on the router firewall (I read somewhere it can help with speeds) and now iperf3 score on 5GHz is 130 Mbits/sec. 2.4 kind of jumped all over the place at first, but it seems to have stabilized at its higher values of 34.5 Mbits/sec. So about double the speeds without flow control, but still lower than I'd like.
I was kind of hopping you had the solution. Guest we will have to solve this then.
So far, nothing I have done or tried changes anything to the outcome. The Guest is always isolated.
One other stuff, not relevant with the Router Firewall Zone issue we have.
I had noticed in @onemarcfifty's video, that on the AP, his interfaces have colors (not grey). This would suppose the interfaces are actually in Firewall Zones.
I'll test this part after solving Router issue.
We'd need more parameters of the link and whether something else is wrong?
Quite possible to only get 74Mbps if you're far away or obstructed?
How far are you away from the AP? What laptop is it, is it like a 1x1 802.11n card/802.11ac card?
I guess to start what OS is the laptop? What i'd be after is something like 'wavemon` on linux or using the option key on mac when clicking the wifi.
On windows I think you can use netsh to get wlanSignalQuality as a percentage then convert that to what you are getting in dbm approximately?
Similarly on openwrt one can check what the AP is seeing the client as in terms of signal strength and coding rate? It will tell you what the speed of that coding rate is so you can then see if you're anywhere close to the 50% or so maximum?
i.e. 1x1 802.11n client on 40MHz is only good for 150mbps. Which 75Mbps real world is quite close to.
I'm about 6 meters from the AP on the same floor (it is ceiling mounted in the hallway, no direct line of sight).
Laptop is a 2019 MacBook Pro running macOS 14.6.1 (iperf result is now 130 Mbits/sec with flow offloading enabled). I'm not sure what controller is used for the wifi, but it supports 802.11 a/b/g/n/ac.
From the AP:
-74/-92 dBm
130.0 Mbit/s, 80 MHz, VHT-MCS 1, VHT-NSS 2, Short GI
325.0 Mbit/s, 80 MHz, VHT-MCS 7, VHT-NSS 1, Short GI
I also did an iperf3 test from my Android Pixel 7 Pro (114Mbits/sec)
-72/-92 dBm
6.0 Mbit/s, 20 MHz
408.3 Mbit/s, 80 MHz, HE-MCS 4, HE-NSS 2, HE-GI 1
And my Linux laptop (Dell XPS 13 9360 - I believe it supports AC) and got 20.7 Mbits/sec.
-85/-92 dBm
6.0 Mbit/s, 80 MHz
292.6 Mbit/s, 80 MHz, VHT-MCS 6, VHT-NSS 1, Short GI
Thanks!
Yeah that's quite low signal power. I'd want something at least in the -55 to -65 dBm range.
And as you can see NSS (Number of Spatial Streams) is also ending up as one?
How thick is the wall? But yeah i think it's a "layer 1" issue haha.
Can you please try directly under the AP to compare?
edit, just had the thought:
Can we sanity check your transmit power/channel selection on your AP?
If you're on 80MHz channels I think picking 157 isn't going to work? I thought if you needed an 80MHz channel on 149-161 you had to set 155? Would 157 go through to channel 169? I don't run 80Mz channels so IDK.....
You might be in 161-165 which is reducing your transmit power down to like 13dBm?
edit2:
Yeah setting anything other than 149 on my RT3200 when on 80MHz channels causes havoc... 157 even though in the interface I have until 173 causes problems. Can't do much testing as I need to revert....
edit3:
Also of note is you probably want to match the channel of your neighbour that is in the 149-161 band exactly so you have co-channel interference not adjacent channel interference.
UPDATE : I stripped the config of non essential stuff I had previously configured.
VLAN and firewall is perfectly working on GUEST. (1 router + no AP)
Now I have to identify what was actually causing the issue. I'll keep this thread updated. (Give me few days)
If you'd like a review of your current config, please post it here. (I assume it's just the router currently... do you have an AP that you need to configure next?)
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
Here are the channels it will let me pick (country in advanced settings is set to Canada, which might explain differences between channels)
I have max transmit power left as driver default and it claims the current power is 23 dBm (also kind of in the screenshot), which is also the highest option in the drop down.
In the channel analysis table, my neighbours are also using 157, which is why I chose it. I'll try some other channels in a bit though to see if they improve speeds.
I'll also try a test under the AP later. The house is from the 50s and has a double layer of drywall everywhere, so maybe that is contributing?
Edit: I just reran the iperf3 test from my phone about 1 foot away from the AP and got 596 Mbits/sec, so maybe it is the drywall! I guess I either need more/better placed APs or a stronger one or something?
Awesome, thanks for confirming! I don't think you'll get more speed with a different channel selection but eh. Maybe moving to 40mhz channels and avoiding interference could actually achieve better speeds.
Yeah. You'll probably be limited by EIRP. And you don't want to create an extremely unbalanced link. (Phones will especially be a problem there). If you must have things mounted in the hallway then I'd go for directional antennas. Is this a 4x4 or 2x2 AP? That and/or beamforming could get you a little better of a link.
However concrete / brick / drywall / wood will attenuate a lot. Also if it's a ceiling mount AP the antenna pattern will also be a factor. In general IMO mounting in hallways isn't the best if you want high performance. It can be OK if you just want coverage.
My experience with thick wood and concrete buildings is effectively one AP per room if you want more than 50Mbps performance. But too many AP's means you will probably run out of 80MHz channels. Hence why I'm on 40MHz channels haha. I think the best free solution to do a heat map estimation might be ubiquiti's tools? It's just a basic 10db / 20db per wall attenuation for wood / concrete i think.
Another way is to manually do a heatmap walking around with your phone and/or laptop to map RSSI etc. IDK about free / open source things that don't cost money. I've heard recommendations for ubiquiti's site analyser but I think you need a ubiquiti router otherwise it doesn't work?
This is a Unifi 6 Lite (I thought I was buying the LR but misread the ebay listing and thought I'd give it a try) which is only 2x2. Sounds like I should flash the stock firmware back on here and swap it out for something better and/or several to distribute through the house.
I'll have to look around for some free tools. I've heard people use their robot vacuums with hacked firmware to get detailed heatmaps - maybe this is a good excuse to get a fancy vacuum!
My router has been working for a while and I don't think I've really changed anything in the course of this thread (except transitioning to non-hidden SSIDs). The new AP config is the issue, though I can provide my router config too if it helps. My current issues are:
root@OpenWrt-AP:~# ubus call system board
{
"kernel": "5.15.162",
"hostname": "OpenWrt-AP",
"system": "MediaTek MT7621 ver:1 eco:3",
"model": "Ubiquiti UniFi 6 Lite",
"board_name": "ubnt,unifi-6-lite",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "23.05.4",
"revision": "r24012-d8dd03c46f",
"target": "ramips/mt7621",
"description": "OpenWrt 23.05.4 r24012-d8dd03c46f"
}
}
root@OpenWrt-AP:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd5c:0987:7013::/48'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan'
config interface 'lan'
option device 'br-lan.101'
option proto 'static'
option ipaddr '192.168.1.3'
option netmask '255.255.255.0'
option ip6assign '60'
option gateway '192.168.1.1'
config bridge-vlan
option device 'br-lan'
option vlan '101'
list ports 'lan:t'
config interface 'iot'
option proto 'none'
option device 'br-lan.103'
config interface 'guest'
option proto 'none'
option device 'br-lan.102'
config interface 'cams'
option proto 'none'
option device 'br-lan.104'
config bridge-vlan
option device 'br-lan'
option vlan '102'
list ports 'lan:t'
config bridge-vlan
option device 'br-lan'
option vlan '103'
list ports 'lan:t'
config bridge-vlan
option device 'br-lan'
option vlan '104'
list ports 'lan:t'
root@OpenWrt-AP:~# cat /etc/config/wireless
config wifi-device 'radio0'
option type 'mac80211'
option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
option channel '1'
option band '2g'
option htmode 'HT20'
option cell_density '0'
option country 'CA'
config wifi-device 'radio1'
option type 'mac80211'
option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
option band '5g'
option htmode 'HE80'
option cell_density '0'
option channel '157'
option country 'CA'
config wifi-iface 'wifinet3'
option device 'radio0'
option mode 'ap'
option ssid 'LAN'
option encryption 'sae'
option key 'REDACTED'
option network 'lan'
option disabled '1'
config wifi-iface 'wifinet4'
option device 'radio1'
option mode 'ap'
option ssid 'LAN'
option encryption 'sae'
option key 'REDACTED'
option network 'lan'
config wifi-iface 'wifinet5'
option device 'radio0'
option mode 'ap'
option ssid 'IOT'
option encryption 'psk2'
option key 'REDACTED'
option network 'iot'
config wifi-iface 'wifinet6'
option device 'radio1'
option mode 'ap'
option ssid 'IOT'
option encryption 'psk2'
option key 'REDACTED'
option network 'iot'
config wifi-iface 'wifinet7'
option device 'radio0'
option mode 'ap'
option ssid 'GUEST'
option encryption 'psk2'
option key 'REDACTED'
option network 'guest'
config wifi-iface 'wifinet8'
option device 'radio1'
option mode 'ap'
option ssid 'GUEST'
option encryption 'psk2'
option key 'REDACTED'
option network 'guest'
config wifi-iface 'wifinet9'
option device 'radio0'
option mode 'ap'
option ssid 'LAN-old (hidden)'
option encryption 'sae'
option hidden '1'
option key 'REDACTED'
option network 'lan'
root@OpenWrt-AP:~# cat /etc/config/dhcp
config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
option filter_aaaa '0'
option filter_a '0'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option ignore '1'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
root@OpenWrt-AP:~# cat /etc/config/firewall
config defaults
option syn_flood 1
option input REJECT
option output ACCEPT
option forward REJECT
# Uncomment this line to disable ipv6 rules
# option disable_ipv6 1
config zone
option name lan
list network 'lan'
option input ACCEPT
option output ACCEPT
option forward ACCEPT
config zone
option name wan
list network 'wan'
list network 'wan6'
option input REJECT
option output ACCEPT
option forward REJECT
option masq 1
option mtu_fix 1
config forwarding
option src lan
option dest wan
# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
option name Allow-DHCP-Renew
option src wan
option proto udp
option dest_port 68
option target ACCEPT
option family ipv4
# Allow IPv4 ping
config rule
option name Allow-Ping
option src wan
option proto icmp
option icmp_type echo-request
option family ipv4
option target ACCEPT
config rule
option name Allow-IGMP
option src wan
option proto igmp
option family ipv4
option target ACCEPT
# Allow DHCPv6 replies
# see https://github.com/openwrt/openwrt/issues/5066
config rule
option name Allow-DHCPv6
option src wan
option proto udp
option dest_port 546
option family ipv6
option target ACCEPT
config rule
option name Allow-MLD
option src wan
option proto icmp
option src_ip fe80::/10
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family ipv6
option target ACCEPT
# Allow essential incoming IPv6 ICMP traffic
config rule
option name Allow-ICMPv6-Input
option src wan
option proto icmp
list icmp_type echo-request
list icmp_type echo-reply
list icmp_type destination-unreachable
list icmp_type packet-too-big
list icmp_type time-exceeded
list icmp_type bad-header
list icmp_type unknown-header-type
list icmp_type router-solicitation
list icmp_type neighbour-solicitation
list icmp_type router-advertisement
list icmp_type neighbour-advertisement
option limit 1000/sec
option family ipv6
option target ACCEPT
# Allow essential forwarded IPv6 ICMP traffic
config rule
option name Allow-ICMPv6-Forward
option src wan
option dest *
option proto icmp
list icmp_type echo-request
list icmp_type echo-reply
list icmp_type destination-unreachable
list icmp_type packet-too-big
list icmp_type time-exceeded
list icmp_type bad-header
list icmp_type unknown-header-type
option limit 1000/sec
option family ipv6
option target ACCEPT
config rule
option name Allow-IPSec-ESP
option src wan
option dest lan
option proto esp
option target ACCEPT
config rule
option name Allow-ISAKMP
option src wan
option dest lan
option dest_port 500
option proto udp
option target ACCEPT
Your ap looks correct.
Check upstream - it is likely that the router and/or switch is not properly configured on the guest network. How have you verified the guest network is functioning in general (what tests have you done)?
Yes. It is a dns issue. That is missing below:
You need to add (assuming that your main router is also serving dns):
list dns '192.168.1.1'
But what packages are you planning to install?
Yup, that did the trick, and it fixed both the package install issue and the guest wifi issue (and for the LuCI folks, the setting is in Network > Interfaces > Edit > Advanced Settings > Use custom DNS servers)
I wanted to get iperf installed on the AP so I could eliminate any other network infrastructure from the equation when doing speed tests.