Tagging not working for APs - TP-LInk AX23

ElToro · January 24, 2025, 5:59pm

I have a hard time getting tagging to work on APs on my network. I've got five different wireless networks and corresponding VLANs; Movistar, Ezviz, HomeWIFI, IoT, and Guest. The latter three are available on APs throughout the network via tagging and roaming. HomeWIFI is the principal LAN and untagged, while IoT and Guest are tagged. This works fine when connecting directly to the router, but does not work on the APs. All APs and the router are TP-Link AX23s.

I can connect to the router on all wireless networks. When I try to do the same on an AP, I only get a connection on the untagged network (HomeWIFI; lan.99). When trying to connect to any other wireless network, the client lingers for a while and then falls back to HomeWIFI.

The tagging on the AP looks like this:

There is no firewall on the AP. The only interface is the LAN with the VLANs 10 (T), 20 (T), and 99 (U*).

Journal on a client trying to connect to the AP:

Jan 02 09:47:40 debian NetworkManager[970]: <info>  [1704185260.9902] dhcp: init: Using DHCP client 'internal'
Jan 02 09:47:40 debian NetworkManager[970]: <info>  [1704185260.9906] manager: (lo): new Loopback device (/org/freedesktop/NetworkManager/Devices/1)
Jan 02 09:47:40 debian NetworkManager[970]: <info>  [1704185260.9917] device (lo): state change: unmanaged -> unavailable (reason 'connection-assumed', sys-iface-state: 'ext>
Jan 02 09:47:40 debian NetworkManager[970]: <info>  [1704185260.9922] device (lo): state change: unavailable -> disconnected (reason 'connection-assumed', sys-iface-state: '>
Jan 02 09:47:40 debian NetworkManager[970]: <info>  [1704185260.9929] device (lo): Activation: starting connection 'lo' (285f5935-e571-425a-ac2c-48e739287d67)
Jan 02 09:47:40 debian NetworkManager[970]: <info>  [1704185260.9933] device (wlp0s20f3): driver supports Access Point (AP) mode
Jan 02 09:47:40 debian NetworkManager[970]: <info>  [1704185260.9939] manager: (wlp0s20f3): new 802.11 Wi-Fi device (/org/freedesktop/NetworkManager/Devices/2)
Jan 02 09:47:40 debian NetworkManager[970]: <info>  [1704185260.9942] device (wlp0s20f3): state change: unmanaged -> unavailable (reason 'managed', sys-iface-state: 'externa>
Jan 02 09:47:41 debian NetworkManager[970]: <info>  [1704185261.2325] device (wlp0s20f3): set-hw-addr: set MAC address to C6:40:A4:20:27:F4 (scanning)
Jan 02 09:47:41 debian NetworkManager[970]: <info>  [1704185261.4348] device (lo): state change: disconnected -> prepare (reason 'none', sys-iface-state: 'external')
Jan 02 09:47:41 debian NetworkManager[970]: <info>  [1704185261.4350] device (lo): state change: prepare -> config (reason 'none', sys-iface-state: 'external')
Jan 02 09:47:41 debian NetworkManager[970]: <info>  [1704185261.4352] device (lo): state change: config -> ip-config (reason 'none', sys-iface-state: 'external')

Output from the router:

# ubus call system board
{
	"kernel": "5.15.167",
	"hostname": "HomeWIFI",
	"system": "MediaTek MT7621 ver:1 eco:3",
	"model": "TP-Link Archer AX23 v1",
	"board_name": "tplink,archer-ax23-v1",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05.5",
		"revision": "r24106-10cc5fcd00",
		"target": "ramips/mt7621",
		"description": "OpenWrt 23.05.5 r24106-10cc5fcd00"
	}
}

# cat /etc/config/
dhcp      firewall  network   system    uhttpd
dropbear  luci      rpcd      ucitrack  wireless
root@HomeWIFI:~# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '1'
	option ednspacket_max '1232'
	option port '53'
	option logqueries '1'
	option logdhcp '1'
	option logfacility '-'

config dhcp 'lan'
	option interface 'lan'
	option start '200'
	option limit '50'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'iot'
	option interface 'iot'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'guest'
	option interface 'guest'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'movistar'
	option interface 'movistar'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'wifi_bridge'
	option interface 'wifi_bridge'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'ezviz'
	option interface 'ezviz'
	option start '100'
	option limit '150'
	option leasetime '12h'

# cat /etc/config/network 

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd1e:879c:eb77::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'lan'
	option device 'br-lan.99'
	option proto 'static'
	option ipaddr '10.0.0.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option gateway '192.168.1.1'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

config bridge-vlan
	option device 'br-lan'
	option vlan '10'
	list ports 'lan1:t'
	list ports 'lan3:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '20'
	list ports 'lan1:t'
	list ports 'lan3:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '30'
	list ports 'lan1:t'
	list ports 'lan3:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '40'
	list ports 'lan1:t'
	list ports 'lan3:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '50'
	list ports 'lan1:t'
	list ports 'lan3:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '99'
	list ports 'lan1:t'
	list ports 'lan2:u*'
	list ports 'lan3:t'
	list ports 'lan4:u*'

config interface 'iot'
	option proto 'static'
	option device 'br-lan.10'
	option ipaddr '10.0.1.1'
	option netmask '255.255.255.0'
	option gateway '10.0.0.1'
	option broadcast '10.0.1.255'

config interface 'guest'
	option proto 'static'
	option device 'br-lan.20'
	option ipaddr '10.0.2.1'
	option netmask '255.255.255.0'
	option gateway '10.0.0.1'
	option broadcast '10.0.2.255'

config interface 'movistar'
	option proto 'static'
	option device 'br-lan.30'
	option ipaddr '10.0.3.1'
	option netmask '255.255.255.0'
	option gateway '10.0.0.1'
	option broadcast '10.0.3.255'

config interface 'wifi_bridge'
	option proto 'static'
	option device 'br-lan.40'
	option ipaddr '10.0.4.1'
	option netmask '255.255.255.0'
	option gateway '10.0.0.1'
	option broadcast '10.0.4.255'

config interface 'ezviz'
	option proto 'static'
	option device 'br-lan.50'
	option ipaddr '10.0.5.1'
	option netmask '255.255.255.0'
	option gateway '10.0.0.1'
	option broadcast '10.0.5.255'

# cat /etc/config/wireless 

config wifi-device 'radio0'
	option type 'mac80211'
	option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
	option channel '1'
	option band '2g'
	option legacy_rates '1'
	option cell_density '0'
	option txpower '10'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'movistar'
	option mode 'ap'
	option ssid 'MOVISTAR_EC30'
	option encryption 'psk-mixed'
	option key '*******************'

config wifi-device 'radio1'
	option type 'mac80211'
	option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0+1'
	option channel '36'
	option band '5g'
	option htmode 'HE80'
	option cell_density '0'
	option txpower '3'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid 'HomeWIFI01_5G'
	option encryption 'sae'
	option key '*******************'
	option ieee80211r '1'
	option mobility_domain '9399'
	option ft_over_ds '0'

config wifi-iface 'wifinet2'
	option device 'radio1'
	option mode 'ap'
	option ssid 'IoT'
	option encryption 'sae-mixed'
	option key '*******************'
	option network 'iot'
	option ieee80211r '1'
	option mobility_domain '9310'
	option ft_over_ds '0'

config wifi-iface 'wifinet3'
	option device 'radio1'
	option mode 'ap'
	option ssid 'ezviz'
	option encryption 'psk-mixed'
	option key '*******************'
	option network 'ezviz'

config wifi-iface 'wifinet4'
	option device 'radio1'
	option mode 'ap'
	option ssid 'Guest'
	option encryption 'sae-mixed'
	option key '******************'
	option ieee80211r '1'
	option mobility_domain '9320'
	option ft_over_ds '0'
	option network 'guest'

# cat /etc/config/firewall 

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'iot'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'iot'

config zone
	option name 'guest'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'guest'

config zone
	option name 'movistar'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'movistar'

config zone
	option name 'wifi_bridge'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'wifi_bridge'

config zone
	option name 'ezviz'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'ezviz'

config forwarding
	option src 'lan'
	option dest 'ezviz'

config forwarding
	option src 'lan'
	option dest 'iot'

config forwarding
	option src 'lan'
	option dest 'movistar'

config forwarding
	option src 'lan'
	option dest 'wifi_bridge'

config forwarding
	option src 'guest'
	option dest 'wan'

config forwarding
	option src 'movistar'
	option dest 'wan'

config forwarding
	option src 'wifi_bridge'
	option dest 'wan'

config forwarding
	option src 'ezviz'
	option dest 'wan'

config rule
	option name 'DHCP DNS guest'
	option src 'guest'
	option dest_port '53 67 68'
	option target 'ACCEPT'
	list proto 'tcp'
	list proto 'udp'
	list proto 'icmp'

config rule
	option name 'DHCP DNS movistar'
	option src 'movistar'
	option dest_port '53 67 68'
	option target 'ACCEPT'
	list proto 'tcp'
	list proto 'udp'
	list proto 'icmp'

config rule
	option name 'DHCP DNS ezviz'
	option src 'ezviz'
	option dest_port '53 67 68'
	option target 'ACCEPT'
	list proto 'tcp'
	list proto 'udp'
	list proto 'icmp'

config rule
	option name 'DHCP DNS iot'
	option src 'iot'
	option dest_port '53 67 68'
	option target 'ACCEPT'
	list proto 'tcp'
	list proto 'udp'
	list proto 'icmp'

psherman · January 24, 2025, 9:03pm

Starting with the router, remove all of the gateway declarations from the interfaces. For example:

You can also remove the broadcast, since it's automatically calculated:

ElToro:

config interface 'iot'
	option proto 'static'
	option device 'br-lan.10'
	option ipaddr '10.0.1.1'
	option netmask '255.255.255.0'
	option gateway '10.0.0.1'
	option broadcast '10.0.1.255'

Next, don't use psk-mixed. Use WPA2 (psk2) instead.

ElToro:

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'movistar'
	option mode 'ap'
	option ssid 'MOVISTAR_EC30'
	option encryption 'psk-mixed'
	option key '*******************'

And I'd recommend disabling all of the 802.11r related items entirely (on this and any other APs) until everything is working properly:

ElToro:

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid 'HomeWIFI01_5G'
	option encryption 'sae'
	option key '*******************'
	option ieee80211r '1'
	option mobility_domain '9399'
	option ft_over_ds '0'

Make those changes, then let's look at the config of the AP.

ElToro · January 26, 2025, 8:34pm

Started from the top, and did all the things you suggested. Subsequently, and after fiddling a bit with the firewall-setup, I got everything working. After testing everything trice, I also re-enabled roaming. Works. Thanks!

Btw: I guess I should mention that I changed the tagging on the AP to

        wan lan1 lan2 lan3 lan4
VLAN10   T   T    T    T    -
VLAN20   T   -    -    -    -
VLAN99   U*  -    -    -    U*

The firewall setup on the AP:


lan > REJECT, accept - accept - accept
iot > lan,    reject - accept - reject
guest > lan,  reject - accept - reject

system · February 5, 2025, 8:34pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.