Wireless clients connected to another dumb AP is not reachable from wired clients in multiple AP setup

Installing and Using OpenWrt
1

Hi folks,

I've noticed a strange problem with my network setup, please find the diagram below.

image
image3136×2200 239 KB

The problem is that all WiFi clients (IoT devices, Laptops and Printer, etc.) are not pingable from wired clients if they are not connected to the same router, but they are reachable from wireless clients even if they are connected to different routers, and it is possible to ping those devices from the routers themselves.

For instance, Wired Client A cannot connect to Laptop B, IoT A and Printer A, it can connect to Laptop A, NAS A, NAS B, all the routers and the Internet.

But Laptop A which is also connected to Router A can ping all wireless clients connected to other routers.

If I connect Printer A or Laptop B to Router A, then they become pingable from Wired Client A.

All the wireless clients are reachable from NAS A and B.

I'm running OpenWRT 24.10.4, all the configs on the 3 routers are almost the same, only IP addresses are different. Please find configs from one of the routers below. DHCP is only enabled on the Internet Gateway and all devices are in the same subnet.


config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd95:1212:2663::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'
	list ports 'wan'
	option bridge_empty '1'
	option igmp_snooping '1'
	option promisc '0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '10.1.0.101'
	option netmask '255.0.0.0'
	option ip6assign '60'
	option gateway '10.0.0.1'
	list dns '10.0.0.1'




config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi'
	option channel 'auto'
	option band '2g'
	option htmode 'HE40'
	option cell_density '0'
	option mu_beamformer '1'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option ssid ''
	option encryption 'sae-mixed'
	option key ''
	option ieee80211r '1'
	option mobility_domain '333f'
	option ft_over_ds '1'
	option wpa_disable_eapol_key_retries '1'
	option ieee80211k '1'
	option time_advertisement '2'
	option wnm_sleep_mode '1'
	option wnm_sleep_mode_no_keys '1'
	option bss_transition '1'
	option ocv '0'
	option reassociation_deadline '20000'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi+1'
	option channel 'auto'
	option band '5g'
	option htmode 'HE160'
	option cell_density '0'
	option mu_beamformer '1'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid ''
	option encryption 'sae-mixed'
	option key ''
	option ieee80211r '1'
	option mobility_domain '333f'
	option ft_over_ds '1'
	option wpa_disable_eapol_key_retries '1'
	option ieee80211k '1'
	option time_advertisement '2'
	option wnm_sleep_mode '1'
	option wnm_sleep_mode_no_keys '1'
	option bss_transition '1'
	option reassociation_deadline '20000'
	option ocv '0'

I've spent several weeks to find an answer on the Internet but still couldn't figure it out, I would appreciate it if someone could help check and advise.

Thank you in advance.

2

Some reason there isn’t a lan1 in the br-lan bridge device? Common to see 4 LAN + 1 WAN combined as that is a very standard hardware configuration on low end routers - one Ethernet port (WAN) off the CPU and a four port Ethernet switch chip giving four LAN ports.

3

Network interfaces

The default network configuration is:

Interface Name Description Default configuration
br-lan LAN & WiFi 192.168.1.1/24
lanX (eth0) LAN ports (2 to 4) None
wan (eth0) WAN port DHCP
phy0-ap0 WiFi 2.4G Disabled
phy1-ap0 WiFi 5G Disabled

Switch Ports (for VLANs)

Numbers 2-4 are Ports 1-3 as labeled on the unit, number 4 is the Internet (WAN) on the unit, 0 is the internal connection to the router itself.

Port Switch port
Internet (WAN) 1
LAN 2 2
LAN 3 3
LAN 4 4

This is from the Wiki https://openwrt.org/inbox/toh/xiaomi/ax3000t, seems for some reason they decided to name the ports from 2 to 4.

4

Remove this from all of the devices. Reboot and test again.

Other things of note:

  • 802.11r and 802.11k often cause more issues than they solve. Consider removing these from all of your APs.
  • sae-mixed likewise can cause issues. Stick to wpa2 or wpa3. Not mixed mode.
5

Thank you, Peter. I've tried to remove those two lines but it doesn't work.

I have also tried to capture on Wired Client A, Router A and Router B with IoT A as destination, ARP requests can be seen on all interfaces, ARP replies are not visible to Router A but they are received by Wired Client A possibly because it's done on hardware level, ICMP or HTTP requests are received from lan2 on Router A but it seems the packets have never been forwarded to other interfaces, and all the packets except ARP requests are not received by Router B. If I understand correctly, those packets to IoT A shouldn't be received by Router A's CPU but they should be forwarded to Router B on hardware level. When I tried to ping Router B from Wired Client A, none of the packets was received by Router A's CPU.

6

If everything else fails remove the wan port from the lan bridge and do not use it, some routers do not play nice with that e.g R7800.
Might be related to wan port on a second cpu port and/or switch configuration and/or dsa drivers.

1 Like
7

It seems the issue is caused by incorrect FDB entries and can be fixed by enabling vlan_filtering.

8

I was still seeing packet loss after enabling vlan_filtering, so I finally moved to snapshot. The issue didn't occur again in last two days. Hope it's really gone.