Unifi AP-Lite as "DUMB AP" behind Router Fritzbox 6490

Hello,

im new to OpenWrt.
I have used my two Unifi AP-Lite with Unifi Firmware and Unifi Controller.
Now i changed to OpenWrt on the two Unifi AP-Lite.
With the Unifi Firmware everything worked fine, but i love open source so i changed.

I set ub the two AP with this tutorial:
https://openwrt.org/docs/guide-user/network/wifi/dumbap

Not working:

  • WLAN Clients not shown in Overview of Fritzbox
  • tbd later
  • tbd later

Here my Network Overview:

How do I get the clients displayed in the Fritbox overview "Aktive Verbindungen"? With the Unifi-FW, all clients have always been displayed here:

Thanks for your support!

if your Unifi AP are transparent, as they should be in AP mode, you should be able to see all clients on your Fritz, assuming it's the acting DHCP.

The Clients get there IPs from the DHCP of the Fritzbox, but not shown in the overview "Aktive Verbindungen".

Maybe ther is somthing wrong in cached client network table of the fritzbox. Wehen i start with a new mac adress of a clienet it will be shown in the fritzbox.

I will test next week and give more feedback.

if you did the switch "just now" the client's (esp the wired ones, not directly connected to the Fritz) won't notice it, their DHCP leases would need to pass 50% of their lease time, before they request a renewal.

I have testest a bit more.

  • deleted all DHCP Leases in fritzbox
  • connect client to "HOME WLAN FLOOR-1" (openwrt)
    client is shown in list of fritzbox
  • connect to "HOME WLAN FLOOR-0" (fritzbox)
    client is shown in list of fritzbox
  • connect back again to "HOME WLAN FLOOR-1" (openwrt)
    client isn´t shown anymore in list of fritzbox an vever again until delete dhcp lease in fritzbox....

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

Here are the informations:

cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdxx:xxxx:xxxx::/xx'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'
	option ipv6 '0'
	option multicast '0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.0.7'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option gateway '192.168.0.1'
	list dns '192.168.0.201'

cat /etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'pci0000:00/0000:00:00.0'
	option channel '44'
	option band '5g'
	option htmode 'VHT40'
	option cell_density '0'
	option txpower '20'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'platform/ahb/18100000.wmac'
	option channel '1'
	option band '2g'
	option htmode 'HT20'
	option txpower '17'
	option cell_density '0'

config wifi-iface 'wifinet0'
	option device 'radio0'
	option mode 'ap'
	option ssid 'SSID-GUEST-0'
	option encryption 'psk2'
	option key 'password'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'
	option network 'lan'
	option isolate '1'

config wifi-iface 'wifinet1'
	option device 'radio0'
	option mode 'ap'
	option ssid 'SSID-HOME-0'
	option encryption 'psk2'
	option key 'password'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'
	option network 'lan'
	option isolate '1'

cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option cachesize '1000'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '1'
	option ednspacket_max '1232'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option ignore '1'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

cat /etc/config/firewall


config defaults
	option syn_flood '1'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

This should be "disabled" instead of "server" just to be sure that OpenWrt does not try to serve DHCP to the LAN. I'm not sure how this interacts with the "ignore" setting which you have properly set to 1 meaning don't serve DHCP.

When you say the client does not appear until I delete its lease, that doesn't make much sense. In OpenWrt used as a main router, the list of clients (not locally connected on wifi) is the list of DHCP leases.

While testing network changes, in the main router (Fritzbox), set DHCP lease time to be very short, so the clients renew leases frequently.

I set up the ap only with LuCI, an there i cant chage that.


Until now i dont get any ip of the range 100-150.

If i want to change that, then i have to change it using ssh?

I would recommend removing all 802.11r related items as well as the isolate option (unless you need isolation):

FWIW, both the guest SSID and the home SSID are using the same network, so there is little to no value in having two SSIDs.

I had previously done experiments with this... leaving it as server works fine with the ignore option. I recommend keeping it as the OP had it.

Your Unifi AP is presumably not the DHCP server, so you need to check your main rotuer (the FB 6490) for the DHCP config there.

I have disabled all 802.11r related items without sucess.

I know. I have only prepared this for the guest devices. The isolation of the guest clients will take place later. However, I have also deactivated "SSID-GUEST-0" once to be on the safe side, unfortunately without success.

This should only clarify that the ignore button works and the unifi AP does not create DHCP leases.

Could it have anything to do with the LLDP (Link Layer Discovery Protocol)?

Try removing the last two lines in this section:

Then restart and try again.

also why that

you delete that or

list dns '192.168.0.1'

you only need that if you need opkg update, for installing openwrt packages

Unfortunately, this attempt was also unsuccessful.

This is my pihole.

The strange thing is, that the fritzbox recognize the last activity of the device just seconds ago, but dont recognize that it is still active. (the status light is normally green, see red arrow)

Just to clarify the initial problem...

When you say that WLAN clients are not shown in the overview on the FB main router, does this mean that you don't see any indication that they are connected (for example, you should see DHCP leases for the clients)?

From the perspective of the FB, all of the clients that are connected to the Unifi APs will appear as if they are wired devices.

When the clients are connected to the unifi ap, i can see the clients in the overview of the fritzbox as wired clients, but as not active.

When the client is connected to the fritzbox, then the client is shown as active (wlan client)

I don't know what FB's definition of "active" is, but this may be expected behavior.

The FB can only be aware of a given client device when the client devices does one or more of the following things:

  • DHCP lease request/renewal
  • Accesses the internet
  • Responds to an ARP request
  • Establishes a connection to the router itself or vise versa (i.e. if the router itself polls the devices).

Beyond those specific situations, a client device won't have any traffic to/from/through the router, and therefore the router won't necessarily see it as an active device. Even if a wireless client device is talking to another device on the network, it still won't show up as active on the router since the router doesn't actually see any of that activity.

Ultimately, this may just be the way things are with respect to the way the router determines what is online and how often it does this.