I recently upgraded from 23.05 to 24.10.4 and I’ve noticed one of my banking apps just hags on the login page when using the Wi-Fi.
The set up I have is my ISP router my main OpenWrt router sits behind this and then I also have another router flashed with OpenWrt that is a AP that talks wirelessly to the main OpenWrt.
Everything was working fine on 23.05 but once I noticed this issue. The only thing of note I did differently was using wpad-mesh-wolfssl instead of openssl like I had on 25.05. The reason I did this was because my AP didn’t have enough flash and I read wolfssl took up a lot less memory.
Anyway I wasn’t sure how to debug it so I put the logs into ChatGPT and it focused in on
Logs show repeated br-lan: received packet on wlX-meshX with own address as source messages — indicating a bridging loop.
It suggested creating another interface called mesh and assigning IPs with the AP taking the IP of the main OpenWrt router as it’s gateway IP. I did try this but I was doing it wirelessly on the AP router so it never worked.
I was going to do a fresh install on both with 24.10.5 but I’m not sure that will fix it or not.
How should I go about debugging this?
When I connect to the main router via WireGuard on my phone (and on data) or on the ISP WiFi the banking app works fine it’s only on the WiFi from the OpenWrt routers.
You've not given any crucial information.
Can you confirm the router model, why you've updated to 24.10.4 instead of 24.10.5 and confirm your network configuration?
I would say could. Because every time yet it was just non individual Mac addresses and no actual bridge loop. But we will know more if OP has ensured it.
Well yes, duplicate mac addresses could cause the problem, that's true.
But the snippets of information he has given us sound so familiar ie the many instances on this forum where someone assumes "mesh" means roaming. Maybe not in this case but unless we get some config info we may never know.
He does say:
But that is a strange way of describing a mesh connection if you are aware of what mesh actually is.
Then we have the "Banking Ap" - does he have Internet access other than to his bank? All very suspicious.
A very garbled story.
I am making a guess here, based on what we know and what has happened in other threads.
I’ll be the first to admit that my knowledge is limited when it comes to this. I wanted a mesh as the signal in one part of the house is quite poor and there is a desktop computer and printer both connected to the AP router. Prior to setting up the mesh I had used a repeater using DD-WRT on a very old Linksys router. The reason I wanted mesh was for faster speed and I liked the way it did the handover to the closest WiFi as the old set up would hang on the WiFi network that was first connected to and not swap to the closer one.
What would be the best config to share? the wireless config?
Hostname OpenWrt-b (Main OpenWrt router)
Model Linksys E8450 (UBI)
Also you have two mesh interfaces defined in your wireless config, this of course will create a mesh-bridge-loop - to the network this is just like putting a PA system microphone next to the speakers - It will howl and scream until it's dead... "Dead" being saturated with packets whizzing round and round.
I had it in my mind WiFi roaming the client device does the switching while with WiFi mesh its the routers that decide which network the client device should be connected to?
The mesh config is there for both 2.4GHz and 5GHz but on the main router I’ve disabled the 2.4GHz mesh however both are enabled the AP mesh. If this is the cause then why am I only seeing an issue on a Banking App and nothing else?
A mesh is a wireless backhaul consisting of mesh nodes. Normal user/client devices cannot connect directly to a mesh backhaul because they are not mesh nodes. Instead they must connect to an access point that is either connected to a mesh node or, more usually, built in to a mesh node.
The mesh backhaul will be saturated by the mesh-bridge-loop so everything will be super slow and erratic.
Banking apps tend to be very sensitive and do all sorts of security cross checking, so perhaps that is the reason... Who knows...
Cool. I’ll will disable on the AP router, test it out and report back.
Sure. However to save space and install wpad-mesh-wolfssl on the AP router I removed opkg package but I can give you the output of /usr/lib/opkg/status.
Removing standard packages does not save any space as the files are just marked as deleted, not actually deleted. Also manually installing uses more pace than you might expect.
This is what the Firmware Selector is for, you build a compressed flash image containing only what you need.
if you are struggling for space, you probably don't need ip-tiny as Busybox has a built in ip applet, you don't need curl, you can use the default wget functionality and more. I addition, as far as I know wpad-mesh-mbedtls is smaller than the pretty much obsolete wpad-mesh-wolfssl.
You should step back and review what you are trying to achieve with all your addon packages.
I did the same when installing 23.05 the only difference is that I didn’t remove opkg and installed wpad-mesh-openssl instead of wolfssl. The only reason I did anything different for 24.10 was because it was a larger image and I had to find make more room so I could at least build an image.
May I ask what you would recommend? What I’m trying to achieve is 1. boot the WiFi in another part of the house 2. do this wirelessly 3. everyone connected to the WiFi network can print on a printer connected to the AP router.
There was a reason I did go for wolfssl over mbedtls but I cannot remember now but it could as been as simple as a tutorial I saw online recommend wolfssl or openssl. However I do plan to do a fresh install of both routers to 24.10.5 so I can use mbedtls there to see if that makes a difference.
Where does wireguard come into this?
Why do you need curl, etherwake, ip-tiny, ddns-scripts, ddns-scripts-services?
There are a lot of things you are not telling us.
You say your "main" router is a Linksys E8450 and you are struggling for space....
This has 512MB ram and 128MB flash so would cover your declared use case without even breaking a sweat.....
Without giving us proper information about what you are trying to do, any recommendation would be a waste of time.
However, if you have been led astray by outdated online tutorials and/or ChatGPT and actually only want your 3 requirements above, then we can help.
I am struggling for space on the router that is acting as an AP (which also has a desktop and printer connected to it via Ethernet) which is a TP-Link Archer C6 v2 (EU/RU/JP). Most recently I had a lot of issues even installing the custom image as while I was able to create an image the overlays folder got mounted to overlayfs:/tmp/root and it took a while to realise this was happening. The main router that is in another part of the house is the E8450 router, as you have correctly identified I do not have any limitation of space on this router (it’s why I bought it due to my struggles with the TP router). I have also set up this with WireGuard so that when I am outside the country I can access websites that would be otherwise geoblocked. As this set up is actually in my parents house I’ve used WireGuard so that I can login to the router, do a WoL so that I can remote into the desktop computer.
I could be a fault as I’m not aware what information could be considered relevant.
Exactly my motivation for posting here.
Hopefully I’ve given more colour to what I want from OpenWrt. The next action point for me is to do a clean install on both routers with 24.10.5 and use wpad-mesh-mbedtls instead of wolfssl.
A reminder of my set up. I’ve got an ISP router and directly connected to that I have my main OpenWrt router (I’ve called it OpenWrt-b) and then connected wirelessly to this is my dump AP router (a TP-Link router which I’ve called OpenWrt-tp).
Tonight I upgraded the main router to 24.10.5 by doing a fresh install. To remove all the noise I only set up the WiFi so no wpad-mesh packages, no mesh config, no WireGuard, no custom images. Just a clean image from https://firmware-selector.openwrt.org/ and the only config I changed was the routers IP, name and the below wireless config. Unfortunately I ended up with the same result that on an Android phone I couldn’t use a banking app. However if I use a browser I am able to get to the login page (something I cannot do on the app).
Anyway to see what URLs the app was requesting I downloaded https://play.google.com/store/apps/details?id=com.celzero.bravedns&hl=en_IE on my phone and something stage happened. I was able to get to the login page and login too while connected to OpenWrt Wifi. Once I stopped the Rethink DNS & Firewall the banking app (aib) went back to timing out.
