Why is my WiFi repeater accessible from both subnets?

Followed this guide top to bottom and didn't have any issues: https://openwrt.org/docs/guide-user/network/wifi/relay_configuration

Locally I have an internal Ethernet NIC set back to DHCP as per the guide. It is also being assigned an IPV6 address automatically, but I do have custom DNS server settings configured on the adapter (both IPv4 and IPv6 [Cloudflare if it matters]) Bing bang boom, everything is working, although my AT&T Fiber Gateway is not showing the static IP on the WAN side (..1.10) and of course doesn't show the LAN side by design (..2.10).

Thing is, I can leave my NIC in DHCP mode and leave the Subnet Mask and IP Address fields blank, yet I can still open SSH and LuCI via browser at either IP: 192.168.1.10 and 192.168.2.10. Since I'm being assigned a an address from the gateway at 192.168.1.254 I must be on that default subnet, and ipconfig confirms. But how the hell can I still access 192.168.2.10 (repeater with my ethernet cable plugged in)?

Sorry if this has lots of useless info. I can give any info required. here is my UCI config (sensitive fields removed):

dhcp.@dnsmasq[0]=dnsmasq
dhcp.@dnsmasq[0].domainneeded='1'
dhcp.@dnsmasq[0].boguspriv='1'
dhcp.@dnsmasq[0].filterwin2k='0'
dhcp.@dnsmasq[0].localise_queries='1'
dhcp.@dnsmasq[0].rebind_protection='1'
dhcp.@dnsmasq[0].rebind_localhost='1'
dhcp.@dnsmasq[0].local='/lan/'
dhcp.@dnsmasq[0].domain='lan'
dhcp.@dnsmasq[0].expandhosts='1'
dhcp.@dnsmasq[0].nonegcache='0'
dhcp.@dnsmasq[0].authoritative='1'
dhcp.@dnsmasq[0].readethers='1'
dhcp.@dnsmasq[0].leasefile='/tmp/dhcp.leases'
dhcp.@dnsmasq[0].resolvfile='/tmp/resolv.conf.d/resolv.conf.auto'
dhcp.@dnsmasq[0].nonwildcard='1'
dhcp.@dnsmasq[0].localservice='1'
dhcp.@dnsmasq[0].ednspacket_max='1232'
dhcp.lan=dhcp
dhcp.lan.interface='lan'
dhcp.lan.start='100'
dhcp.lan.limit='150'
dhcp.lan.leasetime='12h'
dhcp.lan.dhcpv4='server'
dhcp.lan.ignore='1'
dhcp.lan.ra='relay'
dhcp.lan.ra_flags='none'
dhcp.lan.ndp='relay'
dhcp.wan=dhcp
dhcp.wan.ignore='1'
dhcp.wan.interface='wwan'
dhcp.wan.ra='relay'
dhcp.wan.ndp='relay'
dhcp.wan.master='1'
dhcp.wan.start='100'
dhcp.wan.limit='150'
dhcp.wan.leasetime='12h'
dhcp.wan.ra_flags='none'
dhcp.odhcpd=odhcpd
dhcp.odhcpd.maindhcp='0'
dhcp.odhcpd.leasefile='/tmp/hosts/odhcpd'
dhcp.odhcpd.leasetrigger='/usr/sbin/odhcpd-update'
dhcp.odhcpd.loglevel='4'
dropbear.@dropbear[0]=dropbear
dropbear.@dropbear[0].PasswordAuth='on'
dropbear.@dropbear[0].RootPasswordAuth='on'
dropbear.@dropbear[0].Port='22'
firewall.@defaults[0]=defaults
firewall.@defaults[0].input='ACCEPT'
firewall.@defaults[0].output='ACCEPT'
firewall.@defaults[0].forward='REJECT'
firewall.@defaults[0].synflood_protect='1'
firewall.@zone[0]=zone
firewall.@zone[0].name='lan'
firewall.@zone[0].input='ACCEPT'
firewall.@zone[0].output='ACCEPT'
firewall.@zone[0].forward='ACCEPT'
firewall.@zone[0].network='lan' 'wwan' 'REPEATER' 'WWAN6'
firewall.@include[0]=include
firewall.@include[0].path='/etc/firewall.user'
luci.main=core
luci.main.lang='auto'
luci.main.mediaurlbase='/luci-static/bootstrap'
luci.main.resourcebase='/luci-static/resources'
luci.main.ubuspath='/ubus/'
luci.flash_keep=extern
luci.flash_keep.uci='/etc/config/'
luci.flash_keep.dropbear='/etc/dropbear/'
luci.flash_keep.openvpn='/etc/openvpn/'
luci.flash_keep.passwd='/etc/passwd'
luci.flash_keep.opkg='/etc/opkg.conf'
luci.flash_keep.firewall='/etc/firewall.user'
luci.flash_keep.uploads='/lib/uci/upload/'
luci.languages=internal
luci.sauth=internal
luci.sauth.sessionpath='/tmp/luci-sessions'
luci.sauth.sessiontime='3600'
luci.ccache=internal
luci.ccache.enable='1'
luci.themes=internal
luci.themes.Bootstrap='/luci-static/bootstrap'
luci.apply=internal
luci.apply.rollback='90'
luci.apply.holdoff='4'
luci.apply.timeout='5'
luci.apply.display='1.5'
luci.diag=internal
luci.diag.dns='openwrt.org'
luci.diag.ping='openwrt.org'
luci.diag.route='openwrt.org'
network.loopback=interface
network.loopback.device='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='fd3b:e10b:ea38::/48'
network.@device[0]=device
network.@device[0].name='br-lan'
network.@device[0].type='bridge'
network.@device[0].ports='eth0.1'
network.lan=interface
network.lan.device='br-lan'
network.lan.proto='static'
network.lan.netmask='255.255.255.0'
network.lan.ip6assign='60'
network.lan.ipaddr='192.168.2.10'
network.@device[1]=device
network.@device[1].name='eth0.2'
network.@device[1].macaddr='80:3f:5d:f8:39:b3'
network.@switch[0]=switch
network.@switch[0].name='switch0'
network.@switch[0].reset='1'
network.@switch[0].enable_vlan='1'
network.@switch_vlan[0]=switch_vlan
network.@switch_vlan[0].device='switch0'
network.@switch_vlan[0].vlan='1'
network.@switch_vlan[0].ports='0 1 2 3 6t'
network.@switch_vlan[1]=switch_vlan
network.@switch_vlan[1].device='switch0'
network.@switch_vlan[1].vlan='2'
network.@switch_vlan[1].ports='5 6t'
network.wwan=interface
network.wwan.proto='static'
network.wwan.ipaddr='192.168.1.10'
network.wwan.netmask='255.255.255.0'
network.wwan.gateway='192.168.1.254'
network.wwan.dns='192.168.1.254'
network.REPEATER=interface
network.REPEATER.proto='relay'
network.REPEATER.ipaddr='192.168.1.10'
network.REPEATER.network='lan' 'wwan'
network.WWAN6=interface
network.WWAN6.proto='dhcpv6'
network.WWAN6.reqaddress='none'
network.WWAN6.reqprefix='auto'
rpcd.@rpcd[0]=rpcd
rpcd.@rpcd[0].socket='/var/run/ubus/ubus.sock'
rpcd.@rpcd[0].timeout='30'
rpcd.@login[0]=login
rpcd.@login[0].username= 
rpcd.@login[0].password= 
rpcd.@login[0].read='*'
rpcd.@login[0].write='*'
system.@system[0]=system
system.@system[0].hostname='OpenWrt'
system.@system[0].timezone='UTC'
system.@system[0].ttylogin='0'
system.@system[0].log_size='64'
system.@system[0].urandom_seed='0'
system.ntp=timeserver
system.ntp.enabled='1'
system.ntp.enable_server='0'
system.ntp.server='0.openwrt.pool.ntp.org' '1.openwrt.pool.ntp.org' '2.openwrt.pool.ntp.org' '3.openwrt.pool.ntp.org'
ucitrack.@network[0]=network
ucitrack.@network[0].init='network'
ucitrack.@network[0].affects='dhcp'
ucitrack.@wireless[0]=wireless
ucitrack.@wireless[0].affects='network'
ucitrack.@firewall[0]=firewall
ucitrack.@firewall[0].init='firewall'
ucitrack.@firewall[0].affects='luci-splash' 'qos' 'miniupnpd'
ucitrack.@olsr[0]=olsr
ucitrack.@olsr[0].init='olsrd'
ucitrack.@dhcp[0]=dhcp
ucitrack.@dhcp[0].init='dnsmasq'
ucitrack.@dhcp[0].affects='odhcpd'
ucitrack.@odhcpd[0]=odhcpd
ucitrack.@odhcpd[0].init='odhcpd'
ucitrack.@dropbear[0]=dropbear
ucitrack.@dropbear[0].init='dropbear'
ucitrack.@httpd[0]=httpd
ucitrack.@httpd[0].init='httpd'
ucitrack.@fstab[0]=fstab
ucitrack.@fstab[0].exec='/sbin/block mount'
ucitrack.@qos[0]=qos
ucitrack.@qos[0].init='qos'
ucitrack.@system[0]=system
ucitrack.@system[0].init='led'
ucitrack.@system[0].exec='/etc/init.d/log reload'
ucitrack.@system[0].affects='luci_statistics' 'dhcp'
ucitrack.@luci_splash[0]=luci_splash
ucitrack.@luci_splash[0].init='luci_splash'
ucitrack.@upnpd[0]=upnpd
ucitrack.@upnpd[0].init='miniupnpd'
ucitrack.@ntpclient[0]=ntpclient
ucitrack.@ntpclient[0].init='ntpclient'
ucitrack.@samba[0]=samba
ucitrack.@samba[0].init='samba'
ucitrack.@tinyproxy[0]=tinyproxy
ucitrack.@tinyproxy[0].init='tinyproxy'
uhttpd.main=uhttpd
uhttpd.main.listen_http='0.0.0.0:80' '[::]:80'
uhttpd.main.listen_https='0.0.0.0:443' '[::]:443'
uhttpd.main.redirect_https='0'
uhttpd.main.home='/www'
uhttpd.main.rfc1918_filter='1'
uhttpd.main.max_requests='3'
uhttpd.main.max_connections='100'
uhttpd.main.cert='/etc/uhttpd.crt'
uhttpd.main.key='/etc/uhttpd.key'
uhttpd.main.cgi_prefix='/cgi-bin'
uhttpd.main.lua_prefix='/cgi-bin/luci=/usr/lib/lua/luci/sgi/uhttpd.lua'
uhttpd.main.script_timeout='60'
uhttpd.main.network_timeout='30'
uhttpd.main.http_keepalive='20'
uhttpd.main.tcp_keepalive='1'
uhttpd.main.ubus_prefix='/ubus'
uhttpd.defaults=cert
uhttpd.defaults.days='730'
uhttpd.defaults.key_type='ec'
uhttpd.defaults.bits='2048'
uhttpd.defaults.ec_curve='P-256'
uhttpd.defaults.country='ZZ'
uhttpd.defaults.state='Somewhere'
uhttpd.defaults.location='Unknown'
uhttpd.defaults.commonname='OpenWrt'
wireless.radio0=wifi-device
wireless.radio0.type='mac80211'
wireless.radio0.channel='36'
wireless.radio0.hwmode='11a'
wireless.radio0.path='pci0000:00/0000:00:00.0/0000:01:00.0'
wireless.radio0.htmode='VHT80'
wireless.radio0.disabled='1'
wireless.default_radio0=wifi-iface
wireless.default_radio0.device='radio0'
wireless.default_radio0.network='lan'
wireless.default_radio0.mode='ap'
wireless.default_radio0.ssid='OpenWrt'
wireless.default_radio0.encryption='none'
wireless.radio1=wifi-device
wireless.radio1.type='mac80211'
wireless.radio1.channel='11'
wireless.radio1.hwmode='11g'
wireless.radio1.path='platform/10180000.wmac'
wireless.radio1.htmode='HT20'
wireless.radio1.cell_density='0'
wireless.wifinet2=wifi-iface
wireless.wifinet2.device='radio1'
wireless.wifinet2.mode='sta'
wireless.wifinet2.ssid= 
wireless.wifinet2.encryption='psk2'
wireless.wifinet2.key=
wireless.wifinet2.network='wwan WWAN6'

Nanners,

First welcome to this forum.
'There's never enough info to find any kind of disturbance.'

You say you followed the instructions on: https://openwrt.org/docs/guide-user/network/wifi/relay_configuration
It could be working, but maybe not on the right way (routes).
What hardware are you using as router and repeater and which version of OpenWrt are they running?

You did also create the relayd bridge, as mentioned here: https://openwrt.org/docs/guide-user/network/wifi/relay_configuration#installing_relayd_package
The repeater itself (under the hood) works with .2.10 to pass all data to .1.10
Therefore it should not be possible to access .2.10 (repeater) if you got a .1.10 dhcp ip. That can only with PC static connected to repeater in the right subnet.

So it's also written on the mentioned page:

The LAN interface subnet will be used only as a “management” interface, as devices connecting to the Wi-Fi repeater will be on the main network's subnet instead. If the relayd device becomes unreachable, you will have to configure a PC with a static address in the same subnet as the LAN interface (eg. 192.168.2.10 for our example) to connect and be able to use LuCI GUI or SSH.

Check if all settings mentioned in the LAN Interface section (and others) are correct and if relayd is working (Status / Processes and or System / Startup / Initscripts)

DG.

Thanks for the welcome and suggestions. I am very new to OpenWRT, but fortunately in a situation with this that allows for, essentially, a sandboxed network and all the trial and error and experimenting I can handle. I did indeed configure the relayd bridge as per the guide and I am currently using 22.0.3 on a Wavlink WL-WN530HG4 however, when this cropped up I was on 22.02.2. I went ahead and reset then flashed the latest and despite the very limited space, relayd and luci-proto-relay seem to fit and install and initialize without getting wonky, so going forward it'll be 22.0.3. I am doing the setup line by line again, but I have a couple other stupid questions:

The guide explicitly states that relayd only handles IPv4, so when I enable IPv6 as per the guide, none of the IPv6 traffic should cross that Relay Bridge I configured and it is being handled by SLAAC and some other upstream sorcery I don't understand? Also, the Relay Bridge should be in an undefined firewall zone? The guide doesn't make it clear outside of which interfaces it should attach to.

One more question... I should have no trouble setting up a Master AP on the same radio as the client/main internet access to RG after relayd is configured, right? In order to make this an actual repeater that can extend and allow wireless devices in addition to ethernet?

nanners,

The documentation writes indeed only IPv4, so your traffic could run over IPv6 if you enabled it.
Try with IPv6 off?
'Stupid questions don't exist, only stupid answers.' <- my dad :slight_smile:

Firewall is explicite mentioned in the docs: https://openwrt.org/docs/guide-user/network/wifi/relay_configuration#check_firewall_zone_settings
The Interface / Repeater_Bridge links WWAN and LAN together (for relayd).
image

I don't know how IPv6 is being handled this way.

About your last question, as far as I can see: yes, radio mostly auto? and wifi same as main router.
Repeater passes all requests to main router (dhcp & traffic, IPv6?).
It works as expansion of main router, all devices in one LAN.

Better not take latest OpenWrt version but latest stable release (22.03.0), not a snapshot or rc version.
You can create your own builds on the Download OpenWrt Firmware page, where you can remove & add packages for your device:
https://firmware-selector.openwrt.org/?version=22.03.0&target=ramips%2Fmt7620&id=wavlink_wl-wn530hg4

Click on arrow before Customize installed packages and edit your packages.
It will take some time then you can download your (own) build.

Hope that it will bring you any further.

DG.

Oh the firmware customization, I have gone through that a few times trying to replace wpad-basic-wolfssl with wpad-mesh-wolfssl for a different router. It's a great system, but:

On a ramips/mt76** build like this with very little wiggle room for extras, is the builder "smart" in terms of not building an image that will be too big? If it does end up pulling in a bunch of dependencies because a user does something silly like add "nano" or something with 20 dependencies or whatever, does it go ahead and do it up and bring in everything nano needs and spit out a 10mb image and assume the user sees the problem? And in reverse, if I wanna trim fat and decide to cut out ppp and the luci-ppp package, is the build system capable of not also culling every dependency up or down on each package and just remove those if nothing depends on them? I ask because I had a hell of a time trying to get an error with failed output and some 0 error "green" complete builds I got back out broke luci for me (my fault certainly, but hard to spot first when a build gives no errors).

Update:

I have flashed 21.02.1 per your suggestion and setup everything as per the relay guide EXCEPT IPv6. I followed until the UCI shell configuration instruction begins. Everything seems like it's working fine, BUT I've got the same issue. Also, the guide notes that my Overview should not know the IP of the Host on my Client AP and instead show a ? in place. I am not showing the ? and am showing the host. If I enable IPv6 I think it even resolves the host down to device.attlocal.* (AT&T Fiber, no choice). Here is a picture:

Here is the guide image:

nanners,

I doubt it, but you can also remove packages you don't need (but make sure you don't remove 'needed' packages).
And there is not much error checking, therefore you should make your own build environment which gives all info back.

Your setup gets more clear to me, it has only Wifi on your repeater, your router has only wired connections.

But it's weird that you see that ip address (192.168.1.254), although it's the 'real' host.
Are you sure that after removing the WAN interface also the corresponding firewall zone is gone?
(Warning: These actions will also automatically remove any redundant firewall traffic and port forwarding rules.)

Something looks to be wrong, but I don't see what.
Could you check your settings with the items within CLI setup?
In your list I see twice the local IP, but it is not shown in the CLI setup overview:

network.lan.ipaddr='192.168.2.1'
network.repeater_bridge=interface
network.repeater_bridge.proto='relay'
network.repeater_bridge.network='lan wwan'
network.wwan=interface
network.wwan.proto='dhcp'
firewall.@zone[0].network='lan repeater_bridge wwan'
dhcp.lan.ignore='1'
wireless.radio0.hwmode='11g'
wireless.radio0.country='00'
wireless.radio0.channel='1'
wireless.radio0.disabled='0'
wireless.@wifi-iface[0]=wifi-iface
wireless.@wifi-iface[0].device='radio0'
wireless.@wifi-iface[0].mode='ap'
wireless.@wifi-iface[0].encryption='none'
wireless.@wifi-iface[0].ssid='OpenWrt'
wireless.@wifi-iface[0].network='lan'
wireless.@wifi-iface[1]=wifi-iface
wireless.@wifi-iface[1].network='wwan'
wireless.@wifi-iface[1].ssid='Violetta'
wireless.@wifi-iface[1].encryption='psk2'
wireless.@wifi-iface[1].device='radio0'
wireless.@wifi-iface[1].mode='sta'
wireless.@wifi-iface[1].bssid='C8:D5:FE:C8:61:B0'
wireless.@wifi-iface[1].key='myWifiPasswordHere'

I also see dhcp items in your list but it should be off on local lan on repeater.

dhcp.@dnsmasq[0]=dnsmasq
dhcp.@dnsmasq[0].domainneeded='1'
dhcp.@dnsmasq[0].boguspriv='1'
dhcp.@dnsmasq[0].filterwin2k='0'
dhcp.@dnsmasq[0].localise_queries='1'
dhcp.@dnsmasq[0].rebind_protection='1'
dhcp.@dnsmasq[0].rebind_localhost='1'
dhcp.@dnsmasq[0].local='/lan/'
dhcp.@dnsmasq[0].domain='lan'
dhcp.@dnsmasq[0].expandhosts='1'
dhcp.@dnsmasq[0].nonegcache='0'
dhcp.@dnsmasq[0].authoritative='1'
dhcp.@dnsmasq[0].readethers='1'
dhcp.@dnsmasq[0].leasefile='/tmp/dhcp.leases'
dhcp.@dnsmasq[0].resolvfile='/tmp/resolv.conf.d/resolv.conf.auto'
dhcp.@dnsmasq[0].nonwildcard='1'
dhcp.@dnsmasq[0].localservice='1'
dhcp.@dnsmasq[0].ednspacket_max='1232'
dhcp.lan=dhcp
dhcp.lan.interface='lan'
dhcp.lan.start='100'
dhcp.lan.limit='150'
dhcp.lan.leasetime='12h'
dhcp.lan.dhcpv4='server'

So make sure dhcp is OFF on your repeater.

DG.

"Relay bridge" is not compatible with IPv6. It's based on intercepting ARP and mapping all IPs of clients being repeated to the incoming MAC of the repeater. This is implemented only for IPv4.

If it is possible to install static routes in your main router, you could use symmetric routing instead.

Here's a funny thing.. When I use the 5Ghz radio to bridge AP to AP rather than the 2.4Ghz, everything works as it should. I now have to set my IP and subnet to ..2.* in order to connect to the now-working bridge. This also changed the Host to a proper ? as it now really doesn't see it. I have absolutely no idea why this made any difference unless Windows 11 was doing some "realtime invisible WLAN correction" in the background and not only adjusting my routing to work across subnets but then being evil and not even telling me. At this point I am not surprised at the virtualization of everything Windows 11 Pro does, so maybe it is also Skynet.

One more thing I did find to have overlooked because it isn't actually stated implicitly in the guide is which firewall zone the repeater_bridge belongs on. What I ended up doing was creating a new zone (bridgezone) and adding LAN, WWAN, and WWAN6 to it as per this alternate config guide:

As of right now, the machine is running and I'm afraid to touch anything. The only thing left is to enable the Master AP in order to allow WiFi, but I'm gonna run 100 ft of cat5 so I can move this bridge router into the planned garage spot.

Right, I did know that but I was under the impression that I was circumventing the bridge with IPv6 by using the setup guide. Should I remove the WWAN6 interface from the repeater zone though? Should the WWAN6 interface be "touching" anything besides the LAN and getting the upstream IP6 details?

This is how my overview appears now btw:

nanners,

If you don't need any IPv6 from the repeater-side then yes, all other answers: no.

So it looks like its working, although as wifi-repeater.
This should also work by cable, I persume.

There is also a message in the beginning of repeater-setup that says:
Using relayd as instructed in this article isn't guaranteed to work with all Openwrt compatible devices or wifi networks.

Maybe you should consider to setup a mesh network:

DG.