VLAN1 working via ethernet but only partially over wireless

[AmbassadorDave]

I'm new here to OpenWrt and trying to use it to configure a Linksys MX4300 (LN1301) as a VLAN capable 'dumb' access point. I've been trying to follow OneMarcFifty's videos on the configuration and think I've got it ooooh-sooo-close. Yet what I've ended up with is failing to pull a DHCP IPv4 address from the router when connecting over the WiFi ESSID set to VLAN 1. Pulling a DHCP IP address from an ethernet port set for VLAN 1 works, as does pulling an IP from either an ethernet port or WiFi ESSID set to VLAN 11.

I've searched through the OpenWrt documentation and these forums and haven't found anything that's helped. Making matters more perplexing for me is that I can confirm the router receives the DHCP request and offers an IP back. I'm not sure whether the offer fails to reach the client or if the reply ACK fails to get back to the router. Again, it works on the same computer via Ethernet, and fails on either the computer or an Android phone over WiFi.

Anyone have any thoughts? I would really appreciate any help offered!

My setup is OPNsense Router <--> VLAN Switches <--> OpenWrt WAP (on WAN ethernet) <--> computer (port 1 or SSID "stats" for VLAN 1, port 2/3 or SSID "share" for VLAN 11)

The basics of how I setup the WAP is:

1. Flash axir's snapshot build for the MX4300
2. Login to Luci & set password & static IP
3. Set custom DNS server to the router
4. Disable DHCP
5. Delete the WAN/WAN6 interfaces
6. Add WAN to the br-lan bridge
7. Disable firewall/dnsmasq/odhcpd services & reboot
8. Enable VLAN filtering on the br-lan device, setup VLANs (1 untagged & primary on ethernet port 1, 11 untagged/primary on ports 2 & 3, both tagged on WAN), and change the LAN interface from br-lan to br-lan.1
9. Edit the radio1 network to set to US & preferred SSID "stats" and enable (LAN network stays default)
10. Add a new bridge device to br-lan.11
11. Add a new interface "share", unmanaged, and connect to br-lan.11
12. Add a new radio1 network "share", connect to "share" network interface, and enable

This is the results:
/etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd2e:ebfd:713::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'wan'

config device
        option name 'lan1'
        option macaddr 'd8:ec:5e:94:77:56'

config device
        option name 'lan2'
        option macaddr 'd8:ec:5e:94:77:56'

config device
        option name 'lan3'
        option macaddr 'd8:ec:5e:94:77:56'

config interface 'lan'
        option device 'br-lan.1'
        option proto 'static'
        option ipaddr '10.10.1.20'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option gateway '10.10.1.1'
        list dns '10.10.1.1'

config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'lan1:u*'
        list ports 'wan:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '11'
        list ports 'lan2:u*'
        list ports 'lan3:u*'
        list ports 'wan:t'

config device
        option type 'bridge'
        option name 'share'
        list ports 'br-lan.11'

config interface 'share'
        option proto 'none'
        option device 'share'

config device
        option type 'bridge'
        option name 'stats'
        list ports 'br-lan.1'

[psherman]

delete this:

@AmbassadorDave

config device
        option type 'bridge'
        option name 'share'
        list ports 'br-lan.11'

and delete this, too:

@AmbassadorDave

config device
        option type 'bridge'
        option name 'stats'
        list ports 'br-lan.1'

Then edit share to look like this:

config interface 'share'
        option proto 'none'
        option device 'br-lan.11'

then reboot and test again.

[AmbassadorDave]

Much appreciated for the help. I deleted those two, modified the third, and everything still works the same as far as I can tell. I can still pull an IP from VLAN 1 over ethernet port 1, and VLAN 11 over SSID "share". Still no return response over VLAN 1 using SSID "stats". Might you have other thoughts I can try?

[psherman]

let's see the updated config:

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

[AmbassadorDave]

Here's the config items as requested, and again, thanks for your continued aid.

ubus call system board

{
        "kernel": "6.6.56",
        "hostname": "OpenWrt",
        "system": "ARMv8 Processor rev 4",
        "model": "Linksys MX4300",
        "board_name": "linksys,mx4300",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "SNAPSHOT",
                "revision": "r0-3138184",
                "target": "qualcommax/ipq807x",
                "description": "OpenWrt SNAPSHOT r0-3138184"
        }
}

cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd2e:ebfd:713::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'wan'

config device
        option name 'lan1'
        option macaddr 'd8:ec:5e:94:77:56'

config device
        option name 'lan2'
        option macaddr 'd8:ec:5e:94:77:56'

config device
        option name 'lan3'
        option macaddr 'd8:ec:5e:94:77:56'

config interface 'lan'
        option device 'br-lan.1'
        option proto 'static'
        option ipaddr '10.10.1.20'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option gateway '10.10.1.1'
        list dns '10.10.1.1'

config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'lan1:u*'
        list ports 'wan:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '11'
        list ports 'lan2:u*'
        list ports 'lan3:u*'
        list ports 'wan:t'

config interface 'share'
        option proto 'none'
        option device 'br-lan.11'

cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc@0/c000000.wifi'
        option band '5g'
        option channel '36'
        option htmode 'HE80'
        option disabled '1'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt'
        option encryption 'none'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc@0/c000000.wifi+1'
        option band '2g'
        option channel '1'
        option htmode 'HE20'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'stats'
        option encryption 'none'

config wifi-device 'radio2'
        option type 'mac80211'
        option path 'platform/soc@0/c000000.wifi+2'
        option band '5g'
        option channel '100'
        option htmode 'HE80'
        option disabled '1'

config wifi-iface 'default_radio2'
        option device 'radio2'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt'
        option encryption 'none'

config wifi-iface 'wifinet3'
        option device 'radio1'
        option mode 'ap'
        option ssid 'share'
        option encryption 'none'
        option network 'share'

cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '0'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

cat /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include 'qcanssecm'
        option type 'script'
        option path '/etc/firewall.d/qca-nss-ecm'

[AmbassadorDave]

I've also been looking at my VLAN settings on the network switches & router. Haven't found anything definitive, yet messing with the switch port connected to the MX4300 WAP was interesting.

Switch port set to VLAN 1 untagged, behavior as reported:
[ethernet port 1 can pull VLAN 1 IP, WiFi "stats" cannot]

Switch port set to VLAN 1 tagged, behavior flips:
[ethernet port 1 cannot pull VLAN 1 IP, WiFi "stats" can]

I left the PVID setting for the switch port the same (VLAN 1, accepts "all" tagged/untagged) for both attempts.

VLAN 11 via ethernet or "share" pulled an IP as expected in both cases. VLAN 11 is set as tagged on the switch port and is set as the PVID on ethernet ports LAN 2 & 3.

With the switch port set to VLAN 1 tagged, I could access the management interfaces for the WAP & switches, yet for some reason not that of the OPNsense router. I'm going to look into that a bit further as well.

Still throwing me for a loop why this near binary behavior on VLAN 1...either ethernet or WiFi works, yet not both!

[psherman]

The syntax all looks right. At least that would be true for official openwrt.

As you know…

@AmbassadorDave

        "release": {
                "distribution": "OpenWrt",
                "version": "SNAPSHOT",
                "revision": "r0-3138184",

… this did not come from here. Your device is actually not supported by the project, so there isn’t an option to use official Openwrt.

Because we don’t know what has been changed by the maintainer of the build you downloaded, you’ll need to ask them for help.