Wifi not authenticating via VLAN after update to OpenWRT v23.05.3 on Netgear R8000

Recent I updated my 3 routers from a pre-DSA OpenWRT version to the latest version. It works perfectly, bar the issue in the title. I've found two other forum posts with the same issue but both died off without resolution.

The main router is the Netgear R8000. I have two additional routers which act as Dumb APs and they work fine via either wired or WiFi connections via either VLAN. These ironically run off the R8000 that has the issue. I have setup a simple VLAN, one has full LAN access and the other is isolated and Internet only. The VLAN is configured in the Devices tab of the Interfaces via Luci. There is a default br-lan Bridge device which I have assigned VLANs to one of the ports that goes to other APs. The interfaces for each network are assigned to teh VLAN network device that OpenWRT automatically creates after assigning the VLAN IDs to the switch ports.

The issue with the main router is the Wifi won't auth if the config is assigned to a VLAN. If I set it to open, it works fine. If I create a Wifi config and assign it to a test Interface that doesn't use a VLAN, it works fine. If I use any type of encryption, it doesn't auth at all. I should note that the VLAN works fine via a wired connection from this router.

I suspect I have a config issue that I've missed due to the DSA changes or a bug has been introduced to the current build, does anyone have any suggestions?

Hi @pixelocdguy

without config files ... :slight_smile:
so,please from SSH/CLI

cat /etc/config/network
cat /etc/config/wireless

No problem, please see below:

Network Config

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'

config interface 'lan'
        option device 'br-lan.1'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'lan1:t*'
        list ports 'lan2:u*'
        list ports 'lan3:u*'

config bridge-vlan
        option device 'br-lan'
        option vlan '3'
        list ports 'lan1:t'

config interface 'iot'
        option proto 'static'
        option device 'br-lan.3'
        option ipaddr '10.0.0.1'
        option netmask '255.255.255.0'

config interface 'test'
        option proto 'static'
        option device 'phy1-ap0'
        option ipaddr '172.16.1.1'
        option netmask '255.255.255.0'
        option type 'bridge'

Wireless Config

config wifi-iface 'wifinet0'
        option device 'radio1'
        option mode 'ap'
        option ssid 'Test'
        option encryption 'psk2'
        option key '********'
        option network 'test'

config wifi-iface 'wifinet1'
        option device 'radio0'
        option mode 'ap'
        option ssid 'LAN'
        option encryption 'psk2'
        option key '********'
        option network 'lan'

config wifi-iface 'wifinet2'
        option device 'radio2'
        option mode 'ap'
        option ssid 'IoT'
        option encryption 'psk2'
        option isolate '1'
        option key '********'
        option network 'iot'

config wifi-iface 'wifinet3'
        option device 'radio2'
        option mode 'ap'
        option ssid 'IoTOpen'
        option encryption 'none'
        option isolate '1'
        option network 'iot'

So in the above, "Test" which is assigned to a test network interface that is only connected to the Wifi with no VLAN works, and "IoTOpen" which is assigned to the IoT VLAN but has no encryption works.

are you sure that want vlan1 tagged ? on other devices it is tagged also ?

please remove the whole block above

there is NO 'lan' network defined in your config

this is OK, but ... you defined this in two place

will interfere with rest of config

please remove

whole 'wifinet0' block
whole 'wifinet1' block
whole 'wifinet3' block
whole 'test' interface block

after these deletions, post your config again

Yes - this is VLAN 3 on Switch Port 1 which is used for the IoT VLAN. One of the APs in plugged into this port and is working correctly (both VLANs and via Ethernet/Wifi).

Done!

config interface 'lan'

It's just above the bridge-vlan section.

There is only 1 network interface called 'iot'. The other is a Wifi config of the same name.

No problem, I only added that as a test to check that WiFi was actually working without a VLAN (it did work). Removed.

Done!

Network:

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'

config interface 'lan'
        option device 'br-lan.1'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'lan1:t*'
        list ports 'lan2:u*'
        list ports 'lan3:u*'

config bridge-vlan
        option device 'br-lan'
        option vlan '3'
        list ports 'lan1:t'

config interface 'iot'
        option proto 'static'
        option device 'br-lan.3'
        option ipaddr '10.0.0.1'
        option netmask '255.255.255.0'

Wireless:

config wifi-iface 'wifinet2'
        option device 'radio2'
        option mode 'ap'
        option ssid 'IoT'
        option encryption 'psk2'
        option isolate '1'
        option key '********'
        option network 'iot'

Thanks!

sorry, my mistake

and now, with this config ?
did you get expected results ?
configs look OK
if it is still not working, my last idea is firewall
maybe you put some blocking rule in firewall or similar
so, as last resort, try temporary
/etc/init.d/firewall stop
to have clear situation