[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: WANTED: Testers for kirkwood, omap and tegra targets on Linux 5.15

In preparation for the upcoming OpenWrt 23.04 release the development team is urgently looking for users willing to do testing on OpenWrt-supported hardware based on
Marvell Kirkwood
Texas Instruments OMAP
nVidia Tegra
Those targets have not yet received any feedback when running Linux 5.15.
If you have such hardware and want to help out, please try current development snapshots based on Linux 5.15 and provide feedback here or on Github:
#12063 kirkwood: switch to Kernel 5.15 by default
#11564 omap: switch default kernel to 5.15
#12069 tegra: switch to Kernel 5.15 by default
Thank you!

12

[Assistant]
Hostname OpenWrt
Model Linksys WRT1900ACS v2
Architecture ARMv7 Processor rev 1 (v7l)
Target Platform mvebu/cortexa9
Firmware Version OpenWrt SNAPSHOT r22511-c3cb2d48da / LuCI Master git-23.093.56957-2145121
Kernel Version 5.15.105
Local Time 2023-04-08 06:44:42
Uptime 0h 21m 19s
Load Average 0.14, 0.04, 0.01
6in4
adblock
ath10k-board-qca988x
ath10k-firmware-qca988x-ct
attendedsysupgrade-common
auc
base-files
block-mount
busybox
ca-bundle
ca-certificates
cgi-io
collectd
collectd-mod-conntrack
collectd-mod-contextswitch
collectd-mod-cpu
collectd-mod-cpufreq
collectd-mod-df
collectd-mod-disk
collectd-mod-dns
collectd-mod-filecount
collectd-mod-interface
collectd-mod-iptables
collectd-mod-irq
collectd-mod-iwinfo
collectd-mod-load
collectd-mod-memory
collectd-mod-netlink
collectd-mod-network
collectd-mod-openvpn
collectd-mod-ping
collectd-mod-processes
collectd-mod-protocols
collectd-mod-rrdtool
collectd-mod-tcpconns
collectd-mod-thermal
collectd-mod-uptime
collectd-mod-vmem
collectd-mod-wireless
confuse
coreutils
coreutils-sort
curl
ddns-scripts
ddns-scripts-services
dnsmasq-full
drill
dropbear
e2fsprogs
firewall4
fstools
fwtool
getrandom
hostapd-common
htop
ip-tiny
ip6tables-nft
iperf3
ipset
iptables-mod-conntrack-extra
iptables-mod-ipopt
irqbalance
iw
iwinfo
jshn
jsonfilter
kernel
kmod-ata-core
kmod-ath
kmod-ath10k-ct
kmod-ath9k
kmod-ath9k-common
kmod-bluetooth
kmod-btmrvl
kmod-cfg80211
kmod-crypto-acompress
kmod-crypto-aead
kmod-crypto-authenc
kmod-crypto-ccm
kmod-crypto-cmac
kmod-crypto-crc32c
kmod-crypto-ctr
kmod-crypto-ecb
kmod-crypto-ecdh
kmod-crypto-gcm
kmod-crypto-gf128
kmod-crypto-ghash
kmod-crypto-hash
kmod-crypto-hmac
kmod-crypto-kpp
kmod-crypto-lib-chacha20
kmod-crypto-lib-chacha20poly1305
kmod-crypto-lib-curve25519
kmod-crypto-lib-poly1305
kmod-crypto-manager
kmod-crypto-null
kmod-crypto-rng
kmod-crypto-seqiv
kmod-crypto-sha256
kmod-cryptodev
kmod-fs-exportfs
kmod-fs-ext4
kmod-fs-vfat
kmod-fs-xfs
kmod-gpio-button-hotplug
kmod-hid
kmod-hwmon-core
kmod-hwmon-drivetemp
kmod-hwmon-gpiofan
kmod-hwmon-nct7802
kmod-i2c-core
kmod-i2c-mux
kmod-i2c-mux-pca954x
kmod-ifb
kmod-input-core
kmod-input-evdev
kmod-ip6tables
kmod-ipt-conntrack
kmod-ipt-conntrack-extra
kmod-ipt-core
kmod-ipt-ipopt
kmod-ipt-ipset
kmod-ipt-nat
kmod-ipt-offload
kmod-ipt-raw
kmod-leds-turris-omnia
kmod-lib-crc-ccitt
kmod-lib-crc16
kmod-lib-crc32c
kmod-lib-lzo
kmod-linkstation-poweroff
kmod-mac80211
kmod-md-mod
kmod-md-raid0
kmod-md-raid1
kmod-mii
kmod-mmc
kmod-mt7663-firmware-sta
kmod-mwifiex-sdio
kmod-mwlwifi
kmod-nf-conntrack
kmod-nf-conntrack-netlink
kmod-nf-conntrack6
kmod-nf-flow
kmod-nf-ipt
kmod-nf-ipt6
kmod-nf-log
kmod-nf-log6
kmod-nf-nat
kmod-nf-reject
kmod-nf-reject6
kmod-nfnetlink
kmod-nft-compat
kmod-nft-core
kmod-nft-fib
kmod-nft-nat
kmod-nft-offload
kmod-nls-base
kmod-nls-cp437
kmod-nls-iso8859-1
kmod-nls-utf8
kmod-ppp
kmod-pppoe
kmod-pppox
kmod-regmap-core
kmod-regmap-i2c
kmod-rtc-rs5c372a
kmod-rtc-s35390a
kmod-sched-cake
kmod-sched-core
kmod-scsi-core
kmod-slhc
kmod-tun
kmod-udptunnel4
kmod-udptunnel6
kmod-usb-core
kmod-usb-ledtrig-usbport
kmod-usb-net
kmod-usb-storage
kmod-usb-xhci-hcd
kmod-usb-xhci-pci-renesas
kmod-usb2
kmod-usb3
kmod-wireguard
libblkid
libblobmsg-json
libc
libcap-ng
libcomerr
libcurl
libelf
libext2fs
libf2fs
libip4tc
libip6tc
libiperf3
libipset
libiptext
libiptext-nft
libiptext6
libiwinfo
libiwinfo-data
libiwinfo-lua
libjson-c
libjson-script
libldns
liblua
liblucihttp
liblucihttp-lua
liblucihttp-ucode
libmnl
libncurses
libnftnl
libnl-core
libnl-route
libnl-tiny
libopenssl
libopenssl-conf
libopenssl-devcrypto
libpcap
libpcre
libpthread
libqrencode
librt
libsmartcols
libss
libubox
libubus
libubus-lua
libuci
libuci-lua
libuclient
libucode
libustream-mbedtls
libuuid
libuv
libwolfssl
libxtables
logd
lua
luci
luci-app-adblock
luci-app-advanced-reboot
luci-app-attendedsysupgrade
luci-app-ddns
luci-app-firewall
luci-app-nlbwmon
luci-app-openvpn
luci-app-opkg
luci-app-sqm
luci-app-statistics
luci-app-upnp
luci-app-wifischedule
luci-base
luci-compat
luci-lib-base
luci-lib-ip
luci-lib-ipkg
luci-lib-json
luci-lib-jsonc
luci-lib-nixio
luci-mod-admin-full
luci-mod-dashboard
luci-mod-network
luci-mod-rpc
luci-mod-status
luci-mod-system
luci-proto-ipv6
luci-proto-ppp
luci-proto-wireguard
luci-theme-bootstrap
luci-theme-material
luci-theme-openwrt-2020
miniupnpd-nftables
mkf2fs
mtd
mtr-json
mwifiex-sdio-firmware
mwlwifi-firmware-88w8864
mwlwifi-firmware-88w8964
nano
netifd
nftables-json
odhcp6c
odhcpd-ipv6only
openssl-util
openvpn-mbedtls
openwrt-keyring
opkg
partx-utils
ppp
ppp-mod-pppoe
ppp-mod-pptp
procd
procd-seccomp
procd-ujail
px5g-wolfssl
qrencode
rpcd
rpcd-mod-file
rpcd-mod-iwinfo
rpcd-mod-luci
rpcd-mod-rpcsys
rpcd-mod-rrdns
rpcd-mod-ucode
screen
sqm-scripts
tc-mod-iptables
tc-tiny
tcpdump
terminfo
ubi-utils
uboot-envtools
ubox
ubus
ubusd
ucert
uci
uclient-fetch
ucode
ucode-mod-fs
ucode-mod-html
ucode-mod-math
ucode-mod-ubus
ucode-mod-uci
uhttpd
uhttpd-mod-ubus
urandom-seed
urngd
usign
wget-ssl
wifischedule
wireguard-tools
wireless-regdb
wpad-basic-mbedtls
xtables-nft
zlib
BusyBox v1.36.0 (2023-04-06 10:21:29 UTC) built-in shell (ash)
 OpenWrt SNAPSHOT, r22511-c3cb2d48da
 -----------------------------------------------------
root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'soc/soc:pcie/pci0000:00/0000:00:01.0/0000:01:00.0'
        option channel '36'
        option band '5g'
        option htmode 'VHT80'
        option country 'RO'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid ''
        option encryption 'psk2'
        option macaddr ''
        option key ''

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'soc/soc:pcie/pci0000:00/0000:00:02.0/0000:02:00.0'
        option channel '11'
        option band '2g'
        option htmode 'HT40'
        option country 'RO'
        option legacy_rates '1'
        option cell_density '0'
        option noscan '1'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid ''
        option encryption 'psk2'
        option macaddr ''
        option key ''

root@OpenWrt:~# cat /sys/kernel/debug/ieee80211/phy1/mwlwifi/info

driver name: mwlwifi
chip type: 88W8864
hw version: 7
driver version: 10.3.8.0-20181210
firmware version: 0x0702091a
power table loaded from dts: no
firmware region code: 0x30
mac address:
2g: enable
5g: disable
antenna: 4 4
irq number: 82
ap macid support: 0000ffff
sta macid support: 00010000
macid used: 00000001
radio: enable
iobase0: c6b93555
iobase1: bd381268
tx limit: 768
rx limit: 64
qe trigger number: 21168

root@OpenWrt:~# cat /sys/kernel/debug/ieee80211/phy1/mwlwifi/sta

mac address:
aid: 1
ampdu: true
amsdu: false
wds: false
ba_hist: disable
ht_cap: 0x002d, ampdu: 03, 05
rx_mask: 0xff, 00, 00, 00
rx_bw: 0, rx_nss: 1
tdls: 0, tdls_init: 0
wme: 1, mfp: 0
IV: 000000000051
 OpenWrt SNAPSHOT, r22511-c3cb2d48da
 -----------------------------------------------------
root@OpenWrt:~# fw_printenv
CASset=max
MALLOC_len=5
MPmode=SMP
altFwSize=0x2800000
altKernAddr=0x3200000
altKernSize=0x0600000
altnandboot=setenv bootargs console=ttyS0,115200 root=/dev/mtdblock7 ro rootdela                                                                                y=1 rootfstype=jffs2 earlyprintk $mtdparts;nand read $defaultLoadAddr $altKernAd                                                                                dr $altKernSize; bootm $defaultLoadAddr
auto_recovery=yes
autoload=no
baudrate=115200
boot_order=hd_scr usb_scr mmc_scr hd_img usb_img mmc_img pxe net_img net_scr
boot_partfw_setenv=boot_partfw_setenv boot_part 2
bootargs_dflt=$console $nandEcc $mtdparts $bootargs_root nfsroot=$serverip:$root                                                                                path ip=$ipaddr:$serverip$bootargs_end $mvNetConfig video=dovefb:lcd0:$lcd0_para                                                                                ms clcd.lcd0_enable=$lcd0_enable clcd.lcd_panel=$lcd_panel
bootargs_end=::255.255.255.0:Armada38x:eth0:none
bootargs_root=root=/dev/nfs rw
bootcmd_auto=stage_boot $boot_order
bootcmd_fdt=tftpboot 0x2000000 $image_name;tftpboot $fdtaddr $fdtfile;setenv boo                                                                                targs $console $nandEcc $mtdparts $bootargs_root nfsroot=$serverip:$rootpath ip=                                                                                $ipaddr:$serverip$bootargs_end $mvNetConfig video=dovefb:lcd0:$lcd0_params clcd.                                                                                lcd0_enable=$lcd0_enable clcd.lcd_panel=$lcd_panel; bootz 0x2000000 - $fdtaddr;
bootcmd_fdt_boot=tftpboot 0x2000000 $image_name; setenv bootargs $console $nandE                                                                                cc $mtdparts $bootargs_root nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip$boo                                                                                targs_end $mvNetConfig video=dovefb:lcd0:$lcd0_params clcd.lcd0_enable=$lcd0_ena                                                                                ble clcd.lcd_panel=$lcd_panel; bootz 0x2000000 - $fdtaddr;
bootcmd_fdt_edit=tftpboot $fdtaddr $fdtfile; fdt addr $fdtaddr; setenv bootcmd $                                                                                bootcmd_fdt_boot
bootcmd_lgcy=tftpboot 0x2000000 $image_name; setenv bootargs $bootargs_dflt; boo                                                                                tm 0x2000000;
bootdelay=3
cacheShare=no
console=console=ttyS0,115200
defaultLoadAddr=0x2000000
device_partition=0:1
disaMvPnp=no
eeeEnable=no
enaClockGating=no
enaCpuStream=no
enaFPU=yes
enaMonExt=no
enaWrAllo=no
eth1addr=
eth1mtu=1500
eth2addr=
eth2mtu=1500
eth3addr=
eth3mtu=1500
ethact=egiga0
ethaddr=
ethmtu=1500
ethprime=egiga0
fdt_addr=2040000
fdt_skip_update=no
fdtaddr=0x1000000
fdtfile=armada-38x-modular.dtb
firmwareName=cobra.img
flash_alt_image=tftpboot $defaultLoadAddr $firmwareName && nand erase $altKernAd                                                                                dr $altFwSize && nand write $defaultLoadAddr $altKernAddr $filesize
flash_pri_image=tftpboot $defaultLoadAddr $firmwareName && nand erase $priKernAd                                                                                dr $priFwSize && nand write $defaultLoadAddr $priKernAddr $filesize
ide_path=/
image_name=uImage
initrd_name=uInitrd
ipaddr=192.168.1.1
kernel_addr_r=2080000
lcd0_enable=0
lcd0_params=640x480-16@60
lcd_panel=0
loadaddr=0x02000000
loads_echo=0
mtddevname=uboot
mtddevnum=0
mtdids=nand0=armada-nand
mtdparts=mtdparts=armada-nand:2048K(uboot)ro,256K(u_env),256K(s_env),1m@9m(devin                                                                                fo),40m@10m(kernel),34m@16m(rootfs),40m@50m(alt_kernel),34m@56m(alt_rootfs),80m@                                                                                10m(ubifs),-@90m(syscfg)
mvNetConfig=mv_net_config=4,(00:50:43:11:11:11,0:1:2:3),mtu=1500
mv_pon_addr=
nandEcc=nfcConfig=4bitecc
nandboot=setenv bootargs console=ttyS0,115200 root=/dev/mtdblock5 ro rootdelay=1                                                                                rootfstype=jffs2 earlyprintk $mtdparts;nand read $defaultLoadAddr $priKernAddr                                                                                $priKernSize; bootm $defaultLoadAddr
netbsd_en=no
netmask=255.255.255.0
netretry=no
partition=nand0,0
pcieTune=no
pexMode=RC
priFwSize=0x2800000
priKernAddr=0x0a00000
priKernSize=0x0600000
pxe_files_load=:default.arm-armadaxp-db:default.arm-armadaxp:default.arm
pxefile_addr_r=3100000
ramdisk_addr_r=2880000
rootpath=/srv/nfs/
sata_delay_reset=0
sata_dma_mode=yes
script_addr_r=3000000
script_name=boot.scr
serverip=192.168.1.254
standalone=fsload 0x2000000 $image_name;setenv bootargs $console $nandEcc $mtdpa                                                                                rts root=/dev/mtdblock0 rw ip=$ipaddr:$serverip$bootargs_end; bootm 0x2000000;
stderr=serial
stdin=serial
stdout=serial
update_both_images=tftpboot $defaultLoadAddr $firmwareName && nand erase $priKer                                                                                nAddr $priFwSize && nand erase $altKernAddr $altFwSize && nand write $defaultLoa                                                                                dAddr $priKernAddr $filesize && nand write $defaultLoadAddr $altKernAddr $filesi                                                                                ze
usb0Mode=host
usbActive=0
usbType=2
vxworks_en=no
yuk_ethaddr=
boot_part_ready=3
boot_part=1
bootcmd="run nandboot"
root@OpenWrt:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00200000 00020000 "u-boot"
mtd1: 00040000 00020000 "u_env"
mtd2: 00040000 00020000 "s_env"
mtd3: 00100000 00020000 "devinfo"
mtd4: 02800000 00020000 "kernel1"
mtd5: 02200000 00020000 "ubi"
mtd6: 02800000 00020000 "kernel2"
mtd7: 02200000 00020000 "rootfs2"
mtd8: 02600000 00020000 "syscfg"
mtd9: 00680000 00020000 "unused_area"
Anything to change after install:
-Change 'enabled' from '0' to '1' in '/etc/config/irqbalance' for improved Wi-Fi performance.
-Software flow offloading-Enable
-/etc/sysctl.d
net.core.rmem_default=16777216
net.core.wmem_default=16777216
net.core.rmem_max=16777216
net.core.wmem_max=16777216
The first time I created and ran the r21843-539b52068a image for a week without problems and now through Attended Sysupgrade I run the current version with the settings preserved without problems!
System Log
Kernel Log
storage.rcs-rds.ro
OpenWrt 5.15.105
Shared folder OpenWrt 5.15.105

2 Replies
1

That says the hardware you tested on is part of the mvebu target. The title for this topic says the devs are specifically seeking feedback for kirkwood, omap, and tegra targets. Click those links to see listings of what hardware falls under those targets.
Someone correct me if I'm wrong, but my non-developer understanding is that OpenWrt targets and sub-targets are basically groupings of routers and boards that share common (or closely related) internal components, so that they can be developed and maintained more or less together, with devices of the same subtarget being the most similar to each other.

2

Thank you for testing, but this is Target Platform mvebu/cortexa9. the Marvell platform we need to be testing is Target Platform kirkwood/generic.

1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: OpenWrt 23.05.0-rc4 - Fourth Release Candidate

Hi,
The OpenWrt community is proud to announce the fourth release candidate of the upcoming OpenWrt 23.05 stable series.
OpenWrt 23.05.0-rc4 incorporates over 4200 commits since branching the previous OpenWrt 22.03 release and has been under development for over one year.
This is just a release candidate and not the final release yet.
Download firmware images using the OpenWrt Firmware Selector:
https://firmware-selector.openwrt.org/?version=23.05.0-rc4
Download firmware images directly from our download servers:
https://downloads.openwrt.org/releases/23.05.0-rc4/targets/
Changes between OpenWrt 23.05.0-rc3 and 23.05.0-rc4
Changes in this release candidate since the previous 23.05.0-rc3 release candidate are:
New devices
ipq4019: ZTE MF287 Pro aka DreiNeo Pro
mediatek: Ubiquiti UniFi 6 LR v3
ramips: ALFA Network AX1800RM
Updated components:
kernel: Update from 5.15.127 to 5.15.132
mt76: Updated from 2023-07-26 to 2023-08-14
hostapd: Update from 2023-06-22 to 2023-09-08
ucode: Update from 2023-04-03 to 2023-06-06
ubus: Update from 2022-06-15 to 2023-06-05
netifd: Update from 2023-06-04 to 2023-09-19
wireless-regdb: update from 2023.05.03 to 2023.09.01
openssl: Update from 3.0.10 to 3.0.11
mediatek: lots of backports from master
ipq806x: Fix traffic speed regression
mac80211: rework MT7620 PA/LNA RF calibration
kernel: enable vfio and vfio-pci for armsr-armv8
ath11k: Revert back ath11k firmware to fix IPv6 multicast problems
kernel: allow adding devices without hw offload to a hw flowtable
kernel: backport support for renaming netdevs while up
hostapd: backport from master, including ucode based reload support
packages: Add many PKG_CPE_ID attributes
Many other changes in all parts of OpenWrt, see Changelog for details.
Highlights in OpenWrt 23.05.0:
Many new devices added
OpenWrt 23.05 supports over 1794 devices. Support for over 200 new devices was added in addition to the device support by OpenWrt 22.03.
The ipq807x target for the Qualcomm IPQ807x Wifi 6 SoCs was added
The mediatek/filogic subtarget for the Mediatek Filogic 830 and 630 SoCs was added
The sifiveu target for the HiFive RISC-V Unleashed and Unmatched boards
Highlights of device support
Switched ipq40xx target to DSA
VDSL support on AVM FRITZ!Box 7530
Support for devices with 2.5G PHYs
Acer Predator W6 (MT7986A)
Mercusys MR90X v1 (MT7986BLA)
Netgear WAX206 (MT7622)
Netgear WAX220 (MT7986)
ZyXEL NWA50AX Pro (MT7981)
Asus (TUF Gaming) AX4200 (MT7986A)
Netgear WAX218 (IPQ8074)
Xiaomi AX9000 (IPQ8074)
Dynalink DL-WRX36 (IPQ8074)
2 Gbps WAN/LAN NAT Routing on ramips MT7621 devices
Improved DSL statistics on ubus and in LuCI
Switch from wolfssl to mbedtls as default
OpenWrt switched the default cryptographic library from wolfssl to mbedtls. This library is used for HTTPS/TLS in the Webserver providing LuCI and for the cryptographic operations in hostapd. mbedtls provides security updates in their LTS branch without changing the application binary interface (ABI) of the library. wolfssl provides a stable ABI only for a very limited subset of functions. mbedtls allows us to update only mbedtls without the need to recompile and upgrade all users of mbedtls.
Core components update
Core components have the following versions in 23.05.0-rc4:
Updated toolchain:
musl libc 1.2.4
glibc 2.37
gcc 12.3.0
binutils 2.40
Updated Linux kernel
5.15.132 for all targets
Network:
hostapd master snapshot from September 2023
dnsmasq 2.89
dropbear 2022.82
cfg80211/mac80211 from kernel 6.1.24
System userland:
busybox 1.36.1
Full release notes and upgrade instructions are available at
https://openwrt.org/releases/23.05/notes-23.05.0-rc4
In particular, make sure to read the regressions and known issues before upgrading:
https://openwrt.org/releases/23.05/notes-23.05.0-rc4#known_issues
For a detailed list of all changes since 23.05.0-rc3, refer to
https://openwrt.org/releases/23.05/changelog-23.05.0-rc4
To download the 23.05.0-rc4 images, navigate to:
https://downloads.openwrt.org/releases/23.05.0-rc4/targets/
Use OpenWrt Firmware Selector to download:
https://firmware-selector.openwrt.org/?version=23.05.0-rc4
As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.
Have fun!
The OpenWrt Community

1 Reply
20

[Assistant]
After ~40 day uptime from rc3 I flashed rc4 on my WRT32X. Added lots of typical packages. It's running great so far thanks devs!

2

Gave 23.05.0-rc4 a try on a pi zero W, configured as a wifi station (not AP).
The default gateway route did NOT get set up after a reboot ! So, the pi was accessible from its immediate subnet, but not from the rest of my homelab.
Few things I tried:
setting up explicit IPv4 routes did not work either - the routes were not set up after a reboot
running /etc/init.d/network restart did set up the gateway route as expected, so the /etc/config/network seems fine - but the route still does not get set up on its own after a reboot.
guess I'm back on 22.03 until the next 23 rc

1 Reply

Running on WRT3200ACM for 24hrs. So far so good. Many thanks to the Devs!!!

1 Reply
3


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: OpenWrt 22.03.3 third service release

Hi,
The OpenWrt community is proud to announce the newest stable release of the OpenWrt 22.03 stable version series. It fixes security issues, improves device support, and brings a few bug fixes.
Download firmware images using the OpenWrt Firmware Selector:
https://firmware-selector.openwrt.org/?version=22.03.3
Download firmware images directly from our download servers:
https://downloads.openwrt.org/releases/22.03.3/targets/
Main changes between OpenWrt 22.03.2 and OpenWrt 22.03.3:
Security fixes
CVE-2022-30065: busybox: Fix a use-after-free in Busybox 1.35-x's awk applet
CVE-2022-0934: dnsmasq: Fixes single-byte, non-arbitrary write/use-after-free flaw in dnsmasq DHCPv6 server
CVE-2022-1304: e2fsprogs: An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5
CVE-2022-47939: kmod-ksmbd: ZDI-22-1690: Linux Kernel ksmbd Use-After-Free Remote Code Execution Vulnerability
CVE-2022-46393: mbedtls: Fix potential heap buffer overread and overwrite
CVE-2022-46392: mbedtls: An adversary with access to precise enough information about memory accesses can recover an RSA private key
CVE 2022-42905: wolfssl: In the case that the WOLFSSL_CALLBACKS macro is set when building wolfSSL, there is a potential heap over read of 5 bytes when handling TLS 1.3 client connections.
Device support
Support for the following devices was added:
Ruckus ZoneFlex 7372
Ruckus ZoneFlex 7321
ZTE MF289F
TrendNet TEW-673GRU
Linksys EA4500 v3
Wavlink WS-WN572HP3 4G
Fix reboot loop by using LZMA loader. This affects the following devices:
NETGEAR EX6150
HiWiFi HC5962
ASUS RT-N56U B1
Belkin F9K1109v1
D-Link DIR-645
D-Link DIR-860L B1
NETIS WF2881
ZyXEL WAP6805
Fix WAN mac address assignment. This affects the following devices:
UniElec U7621-01
UniElec U7621-06
TP-Link AR7241
TP-Link TL-WR740N
TP-Link TL-WR741ND v4
Teltonika RUT230
Luma Home WRTQ-329ACN
mvebu: Disable devices using broken mv88e6176 switch. This affects the following devices (See mvebubroken_mv88e6176_switch, and #11077):
CZ.NIC Turris Omnia
Linksys WRT1200AC
Linksys WRT1900ACS
Linksys WRT1900AC v1
Linksys WRT1900AC v2
Linksys WRT3200ACM
Linksys WRT32X
Linksys WRT3200ACM
SolidRun ClearFog Pro
lantiq/xrx200: Enable interrupts on second VPE
layerscape: Fix SPI-NOR issues with vendor patches
RouterBoard 912UAG: Fix reference clock
TP-Link RE200 v3/v4: Fix LED configuration
GL.iNet GL-MT1300: Fix flash access by reducing SPI clock
Youku YK-L2 and YK-L1: Allow installing initramfs-kernel.bin over vendor web UI
D-Link DIR-825 B1: Add factory image recipe
D-Link DIR-825-B1: Expand rootfs
D-Link DGS-1210-10P: Add support for extra buttons and LEDs
Asus RT-AC88U: Include Broadcom 4366b1 firmware by default
AVM FRITZ!Box 7430: Include USB driver by default
HAOYU Electronics MarsBoard A10: Include sound driver by default
Linksys EA6350v3, EA8300, MR8300 and WHW01: Allow flashing Linksys factory firmware
Various fixes and improvements
firewall4: Fix boot hang with firewall4 and loadfile
Added the following kernel packages:
kmod-sched-prio (extracted from kmod-sched)
kmod-sched-red (extracted from kmod-sched)
kmod-sched-act-police (extracted from kmod-sched)
kmod-sched-act-ipt (extracted from kmod-sched)
kmod-sched-pie (extracted from kmod-sched)
kmod-sched-drr
kmod-sched-fq-pie
kmod-sched-act-sample
kmod-nvme
kmod-phy-marvell
kmod-hwmon-sht3x
kmod-netconsole
kmod-btsdio
Added firmware files for mt7916 and mt7921 devices
ucode: lexer: Fixes for regex literal parsing
hostapd: Remove dtim_period option from device, it is already a BSS property
procd: Service: pass all arguments to service
ustream-openssl: Disable renegotiation in TLSv1.2 and earlier
comgt-ncm: Add support for quectel modem EC200T-EU
umbim: Allow roaming and partner connections
kernel: Add support for EON EN25QX128A spi nor flash
iwinfo: Many bugfixes and improvements:
improvements in showing the used band, ht mode and hw mode
Added support for HE (Wifi 6) modes
Added support for new devices (MT7921AU, MT7986 WiSoC)
Add support for CCMP-256 and GCMP-256 ciphers
uhttpd: Fix incorrectly emitting HTTP 413 for certain content lengths
gcc: Import patch fixing asm machine directive for powerpc
Core components update
Update Linux kernel from 5.10.146 to 5.10.161
Update mac80211 backports from 5.15.58-1 to 5.15.81-1
Update strace from 5.16 to 5.19
Update mbedtls from 2.28.1 to 2.28.2
Update openssl from 1.1.1q to 1.1.1s
Update wolfssl from 5.5.1 to 5.5.4
Update util-linux from 2.37.3 to 2.37.4
Update firewall4 from 2022-10-14 to 2022-10-18
Update odhcpd from 2022-03-22 to 2023-01-02
Update uhttpd from 2022-08-12 to 2022-10-31
Update iwinfo from 2022-08-19 to 2022-12-15
Update ucode from 2022-10-07 to 2022-12-02
Full release notes and upgrade instructions are available at
https://openwrt.org/releases/22.03/notes-22.03.3
In particular, make sure to read the regressions and known issues before upgrading:
https://openwrt.org/releases/22.03/notes-22.03.3#known_issues
For a detailed list of all changes since 22.03.2, refer to
https://openwrt.org/releases/22.03/changelog-22.03.3
To download the 22.03.3 images, navigate to:
https://downloads.openwrt.org/releases/22.03.3/targets/
Use OpenWrt Firmware Selector to download:
https://firmware-selector.openwrt.org/?version=22.03.3
As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.
Have fun!
The OpenWrt Community
To stay informed of new OpenWrt releases and security advisories, there are new channels available:
a low-volume mailing list for important announcements:
https://lists.openwrt.org/mailman/listinfo/openwrt-announce
a dedicated "announcements" section in the forum:
https://forum.openwrt.org/c/announcements/14
other announcement channels (such as RSS feeds) might be added in the
future, they will be listed at https://openwrt.org/contact

1 Reply
33

[Assistant]
hauke:
Linksys EA6350v3, EA8300, MR8300 and WHW01: Allow flashing Linksys factory firmware
Do we have details on this? Looking at the MR8300 page (https://openwrt.org/toh/linksys/mr8300), it doesn't say specifically how to do this. Perhaps it's just uploading the factory firmware image to sysupgrade?

1 Reply
1

Regarding "mvebu: Disable devices using broken mv88e6176 switch. This affects the following devices", what issue is occuring? I have an WRT1900ACS running 22.03.2. I haven't noticed anything and it appears to be functioning correctly. As it stands I can't upgrade for the security issues.

3 Replies
4

commit where disabled, working on 5.15 though (master).

2


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: OpenWrt 24.10.0-rc1 - First release candidate

Hi,
The OpenWrt community is proud to announce the first release candidate of the upcoming OpenWrt 24.10 stable series.
OpenWrt 24.10.0-rc1 incorporates over 5100 commits since branching the previous OpenWrt 23.05 release and has been under development for over one year.
This is just a release candidate and not the final release yet.
Download firmware images using the OpenWrt Firmware Selector:
https://openwrt.github.io/firmware-selector-openwrt-org?version=24.10.0-rc1
Download firmware images directly from our download servers:
https://downloads.openwrt.org/releases/24.10.0-rc1/targets/
Please test this version
This is not the final version, this is a test version. Please report problems and bugs in our issue tracker. https://github.com/openwrt/openwrt/issues
Highlights in OpenWrt 24.10:
General changes
TLS 1.3 support in default images
mbedtls was updated to version 3.6 which includes support for TLS 1.3
Activate POSIX Access Control Lists and file system security attributes for all file systems on devices with big flash sizes. This is needed by docker nowadays.
Activate kernel support for Multipath TCP on devices with big flash sizes.
Many new devices added
OpenWrt 24.10 supports over 1950 devices. Support for over 100 new devices was added in addition to the device support by OpenWrt 23.05.
Added d1 target for AllWinner D1 RISC-V SoC
Added ixp4xx target for Intel XScale IXP4xx SoCs.
Added loongarch64 target for SoCs with Loongson LoongArch CPUs.
Added starfive target for StarFive JH71x0 (7100/7110) SoCs.
Added stm32 target for STMicroelectronics STM32 SoCs.
Renamed ipq807x target to qualcommax.
Removed ath25 target. It supported Atheros ieee80211g devices with maximum 16MB RAM
Removed bcm63xx target. It supported some Boardcom DSL MIPS SoCs and was replaced by the bmips target. The Boardcom DSL itself was never supported.
Removed octeontx target. It supported the Octeon-TX CN80XX/CN81XX based boards.
Removed oxnas target. It supported the PLXTECH/Oxford NAS782x/OX8xx.
Core components update
Core components have the following versions in 24.10.0-rc1:
Updated toolchain:
musl libc 1.2.5
glibc 2.38
gcc 13.3.0
binutils 2.42
Updated Linux kernel
6.6.63 for all targets
Network:
hostapd master snapshot from September 2024, dnsmasq 2.90, dropbear 2024.86
cfg80211/mac80211 from kernel 6.11.2
Upgrading to 24.10
Sysupgrade can be used to upgrade a device from 23.05 to 24.10, and configuration will be preserved in most cases.
Sysupgrade from 22.03 to 24.10 is not officially supported.
User of the Linksys E8450 aka. Belkin RT3200 running OpenWrt 23.05 or earlier will need to run installer version v1.1.3 or later in order to reorganize the UBI layout for the 24.10 release.
Full release notes and upgrade instructions are available at
https://openwrt.org/releases/24.10/notes-24.10.0-rc1
In particular, make sure to read the regressions and known issues before upgrading:
https://openwrt.org/releases/24.10/notes-24.10.0-rc1#known_issues
For a detailed list of all changes since 23.05.0, refer to
https://openwrt.org/releases/24.10/changelog-24.10.0-rc1
To download the 24.10.0-rc1 images, navigate to:
https://downloads.openwrt.org/releases/24.10.0-rc1/targets/
Use OpenWrt Firmware Selector to download:
https://openwrt.github.io/firmware-selector-openwrt-org?version=24.10.0-rc1
As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.
Have fun!
The OpenWrt Community
To stay informed of new OpenWrt releases and security advisories, there
are new channels available:
a low-volume mailing list for important announcements:
https://lists.openwrt.org/mailman/listinfo/openwrt-announce
a dedicated "announcements" section in the forum:
https://forum.openwrt.org/c/announcements/14
other announcement channels (such as RSS feeds) might be added in the
future, they will be listed at https://openwrt.org/contact

4 Replies
18

[Assistant]
Flashed on GL-MT6000 clean config without a hitch...
But is it still building packages? I'm getting lots of opkg install package kmod errors. Edit: ok I'm not alone: https://github.com/openwrt/openwrt/issues/17146

1 Reply
2

Fan control on JG922A i believe is broken as the GPIO numbering changed.

hauke:
on devices with big flash sizes
Would it be helpful to state what the threshold for "big flash size" is?
hauke:
Upgrading to 24.10
Suggest adding a bullet similiar to this....
"User's of Edgerouter X: 24.10 introduces a new layout allowing kernels up to 6MB. Direct sysupgrade to new snapshots will fail due to bumped compat version. Initial migration scripts and documentation can be found here: https://openwrt.org/toh/ubiquiti/edgerouter_x_er-x_ka#migrating_to_linux_66_for_24xx .

2 Replies
1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: OpenWrt 22.03.0 first stable release

Hi,
The OpenWrt community is proud to announce the first stable release of the OpenWrt 22.03 stable version series. It incorporates over 3800 commits since branching the previous OpenWrt 21.02 release and has been under development for about one year.
Download firmware image for your device (firmware selector):
https://firmware-selector.openwrt.org/?version=22.03.0
Download firmware images directly from OpenWrt download servers:
https://downloads.openwrt.org/releases/22.03.0/targets/
Highlights in OpenWrt 22.03.0
Firewall4 based on nftables
Firewall4 is used by default, superseding the iptables-based firewall3 implementation in the OpenWrt default images. Firewall4 uses nftables instead of iptables to configure the Linux netfilter ruleset.
Firewall4 keeps the same UCI firewall configuration syntax and should work as a drop-in replacement for fw3 with most common setups, emitting nftables rules instead of iptables ones.
Including custom firewall rules through /etc/firewall.user still works, but requires marking the file as compatible first, otherwise it is ignored. Firewall4 additionally allows to include nftables snippets. The firewall documentation explains how to include custom firewall rules with firewall4. Some community packages that add firewall rules might not work for now, and will need to be adapted to fw4: this will happen gradually throughout the lifetime of the 22.03 release series.
The legacy iptables utilities are not included in the default images anymore, but can be added back using opkg or the Image Builder if needed. The transitional packages iptables-nft, arptables-nft, ebtables-nft and xtables-nft can be used to create nftables rules using the old iptables command line syntax.
Many new devices added
OpenWrt 22.03 supports over 1580 devices. Support for over 180 new devices was added in addition to the device support by OpenWrt 21.02. OpenWrt 22.03 supports more than 15 devices capable of Wifi 6 (IEEE 802.11ax) using the MediaTek MT7915 wifi chip.
More targets converted to DSA
The following targets or boards were migrated from swconfig to DSA with OpenWrt 22.03 in addition to the systems already migrated with OpenWrt 21.02:
bcm53xx: All board using this target were converted to DSA
lantiq: All boards using the xrx200 / vr9 SoC
sunxi: Bananapi Lamobo R1 (only sunxi board with switch)
Dark mode in LuCI
The LuCI bootstrap design supports a dark mode. The default design activates dark mode depending on the browser settings. Change it manually at “System” -> “System” -> “Language and Style”.
Year 2038 problem handled
OpenWrt 22.03 uses musl 1.2.x, which changed the time_t type from 32 bit to 64 bit on 32 bit systems, on 64 bit system it was always 64 bit long. When a Unix time stamp is stored in a signed 32 bit integer it will overflow on 19 January 2038. With the change to 64 bit this will happen 292 billion years later. This is a change of the musl libc ABI and needs a recompilation of all user space applications linked against musl libc. For 64 bit systems this was done when the ABI was defined many years ago, the glibc ARC ABI already has a 64 bit time_t.
Core components update
Core components have the following versions in 22.03.0:
Updated toolchain:
musl libc 1.2.3
glibc 2.34
gcc 11.2.0
binutils 2.37
Updated Linux kernel
5.10.138 for all targets
Network:
hostapd 2.10, dnsmasq 2.86, dropbear 2022.82
cfg80211/mac80211 from kernel 5.15.58
System userland:
busybox 1.35.0
In addition to the listed applications, many others were also updated see the detailed Changelog for more information.
https://openwrt.org/releases/22.03/changelog-22.03.0
Upgrading to 22.03.0
Sysupgrade can be used to upgrade a device from OpenWrt 21.02 to 22.03, and configuration will be preserved in most cases. Upgrades from a previous 22.03.0 release candidate are also supported.
Sysupgrade from 19.07 to 22.03 is not supported.
There is no migration path for targets that switched from swconfig to DSA. In that case, sysupgrade will refuse to proceed with an appropriate error message:
Image version mismatch. image 1.1 device 1.0 Please wipe config during upgrade (force required) or reinstall. Config cannot be migrated from swconfig to DSA Image check failed
Full release notes and upgrade instructions are available at
https://openwrt.org/releases/22.03/notes-22.03.0
In particular, make sure to read the regressions and known issues before upgrading:
https://openwrt.org/releases/22.03/notes-22.03.0#known_issues
For a detailed list of all changes since 21.02, refer to
https://openwrt.org/releases/22.03/changelog-22.03.0
To download the 22.03.0 images, navigate to:
https://downloads.openwrt.org/releases/22.03.0/
Use OpenWrt Firmware Selector to download:
https://firmware-selector.openwrt.org/?version=22.03.0
As always, a big thank you goes to all our active package maintainers, testers, documenters, and supporters.
Have fun!
The OpenWrt Community
To stay informed of new OpenWrt releases and security advisories, there are new channels available:
a low-volume mailing list for important announcements:
https://lists.openwrt.org/mailman/listinfo/openwrt-announce
a dedicated "announcements" section in the forum:
https://forum.openwrt.org/c/announcements/14
other announcement channels (such as RSS feeds) might be added in the future, they will be listed at https://openwrt.org/contact

1 Reply
50

[Assistant]
Upnp nftables not working in this release.

1 Reply
1

https://firmware-selector.openwrt.org/?version=22.03.0
Building 22.03.0 does not work:
Unsupported version: 22.03.0

1

It needs to be added to the list manually, so just wait a few hours/ days for it to be listed there.

4


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Ultimate SQM settings: Layer_cake + DSCP marks (New Script!)

Hello.
The original thread is reference only now, you will also find the setup steps!
Please remove old script and use this one, port based script is not accurated and can cause more load on CPU.
Here is the latest DSCP marking script, you can name it DSCP.sh place it in /root then mark it as executable using Winscp or via terminal chmod 755 /root/DSCP.sh .
#!/bin/bash -x
IPT="iptables"
##########
#Veth start
##########
WANIF="pppoe-wan" #wan interface

tc qdisc add dev wlan0 root mq #setup multi queue for wifi device
## set up veth devices to handle inbound and outbound traffic
ip link show | grep veth0 || ip link add type veth

## get new veth interfaces up
ip link set veth0 up
ip link set veth1 up

## trun on promisc mode,sometimes it's needed to make bridge work
ip link set veth1 promisc on

## add veth1 to bridge
brctl addif br-lan veth1

## just to make sure there's nothing inside this table
ip rule del priority 100
ip route flush table 100

## add routing for veth0 this will handle all traffic
ip route add default dev veth0 table 100
ip rule add iif $WANIF table 100 priority 100
#########
#Veth end
#########
##ipset for streaming sites.they are being filled by dnsmasq
ipset create streaming hash:ip
ipset create usrcdn hash:ip
ipset create bulk hash:ip
ipset create latsens hash:ip

$IPT -t mangle -N dscp_mark > /dev/null 2>&1
$IPT -t mangle -F dscp_mark
## check if POSTROUTING already exits then jumps to our tables if not, add them

$IPT -t mangle -L POSTROUTING -n | grep dscp_mark || $IPT -t mangle -A POSTROUTING -j dscp_mark

iptmark(){
    $IPT -t mangle -A dscp_mark "$@"
}

## start by washing the dscp to CS0

iptmark -j DSCP --set-dscp 0

#A robust 2 rules to detect realtime traffic

# mark connections that go over 115 packets per second, not prioritized
iptmark -p udp -m hashlimit --hashlimit-name udp_high_prio --hashlimit-above 115/sec --hashlimit-burst 50 --hashlimit-mode srcip,srcport,dstip,dstport -j CONNMARK --set-mark 0x55 -m comment --comment "connmark for udp"

# unmarked UDP streams with small packets get CS6
iptmark -p udp -m connmark ! --mark 0x55 -m multiport ! --ports 22,25,53,67,68,123,143,161,162,514,5353,80,443,8080,60001 -m connbytes --connbytes 0:940 --connbytes-dir both --connbytes-mode avgpkt -j DSCP --set-dscp-class CS6 -m comment --comment "small udp connection gets CS6"

#large udp streams like video call get AF41
iptmark -p udp -m connmark ! --mark 0x55 -m multiport ! --ports 22,25,53,67,68,123,143,161,162,514,5353,80,443,8080,60001 -m connbytes --connbytes 940:1500 --connbytes-dir both --connbytes-mode avgpkt -j DSCP --set-dscp-class AF41 -m comment --comment "large udp connection gets AF41"

########################################
# Latency Sensitive (gaming/voip)
########################################
##ICMP, to prioritize pings
iptmark -p icmp -j DSCP --set-dscp-class CS5 -m comment --comment "ICMP-pings"

#DNS traffic both udp and tcp
iptmark -p udp -m multiport --port 53,5353,8888 -j DSCP --set-dscp-class CS5 -m comment --comment "DNS udp"
iptmark -p tcp -m multiport --port 53,5353,8888 -j DSCP --set-dscp-class CS5 -m comment --comment "DNS tcp"

#NTP
iptmark -p udp -m multiport --port 123 -j DSCP --set-dscp-class CS6 -m comment --comment "NTP udp"

#High priority ipset, i use for pubgM
iptmark ! -p tcp -m set --match-set latsens src,dst -j DSCP --set-dscp-class CS6 -m comment --comment "latency sensitive ipset" ## set dscp tag for Latency Sensitive (latsens) ipset,udp

iptmark -p tcp -m set --match-set latsens src,dst -j DSCP --set-dscp-class CS5 -m comment --comment "latency sensitive ipset" ## set dscp tag for Latency Sensitive (latsens) ipset

########
##Browsing
########
## medium priority for browsing
iptmark -p tcp -m multiport --ports 80,443,8080 -j DSCP --set-dscp-class CS3 -m comment --comment "Browsing at CS3"

##################
#TCP SYN,ACK flows
##################
#Make sure ACK,SYN packets get priority (to avoid upload speed limiting our download speed)
iptmark -p tcp --tcp-flags ALL ACK -m length --length :128 -j DSCP --set-dscp-class CS3
iptmark -p tcp --tcp-flags ALL SYN -m length --length :666 -j DSCP --set-dscp-class CS3

#Small packet is probably interactive or flow control
iptmark -m dscp ! --dscp  24 -m dscp ! --dscp  18 -m dscp ! --dscp  34 -m dscp ! --dscp  40 -m dscp ! --dscp  48 -m length --length 0:500 -j DSCP --set-dscp-class CS3

#Small packet connections: multi purpose (don't harm since not maxed out)
iptmark -m dscp ! --dscp  24 -m dscp ! --dscp  18 -m dscp ! --dscp  34 -m dscp ! --dscp  40 -m dscp ! --dscp  48 -m connbytes --connbytes 0:250 --connbytes-dir both --connbytes-mode avgpkt -j DSCP --set-dscp-class CS3

########################################
# Streaming Media (videos/audios)
########################################
#Known video streams sites like netflix
iptmark -m set --match-set streaming src,dst -j DSCP --set-dscp-class AF41 -m comment --comment "video audio stream ipset"

# some iptv provider's use this port
iptmark -p tcp -m multiport --ports 1935,9982 -j DSCP --set-dscp-class AF41 -m comment --comment "some iptv streaming service"

#known usrcdn like google or akamai

iptmark -m set --match-set usrcdn src,dst -j DSCP --set-dscp-class AF21 -m comment --comment "usrcdn ipset"

#########################################
# Background Traffic (Bulk/file transfer)
#########################################
#bulk traffic ipset, like windows udates and steam updates/downloads
iptmark -p tcp -m set --match-set bulk src,dst -j DSCP --set-dscp-class CS1 -m comment --comment "bulk traffic ipset"
iptmark -p udp -m set --match-set bulk src,dst -j DSCP --set-dscp-class CS1 -m comment --comment "bulk traffic ipset"
iptmark -p tcp -m connbytes --connbytes 350000: --connbytes-dir both --connbytes-mode bytes -m dscp --dscp-class CS0 -j DSCP --set-dscp-class CS1 -m comment --comment "Downgrade CS0 to CS1 for bulk tcp traffic"
iptmark -p tcp -m connbytes --connbytes 350000: --connbytes-dir both --connbytes-mode bytes -m dscp --dscp-class CS3 -j DSCP --set-dscp-class CS1 -m comment --comment "Downgrade CS3 to CS1 for bulk tcp traffic"
iptmark -p udp -m multiport --port 60001 -j DSCP --set-dscp-class CS1 -m comment --comment "bulk torrent port UDP"

#tcpdump rule, copy and paste this rule into terminal, this rule is used to capture realtime traffic, you can change ip to what you like
#tcpdump -i br-lan host 192.168.1.126 and udp and portrange 1-65535 and !port 53 and ! port 80 and ! port 443 -vv -X -w /root/cap-name.pcap
Add the following lines at the end of
/etc/dnsmasq.conf :
##Latency Sensitive (gaming/voip)
ipset=/igamecj.com/gcloudcs.com/qos.gcloud.qq.com/latsens

##video/audio streams
# Youtube is also isolated by my isp
ipset=/googlevideo.com/*.googlevideo.com/streaming
# NetFlix
ipset=/nflxvideo.net/streaming
# AmazonVideo
ipset=/s3.ll.dash.row.aiv-cdn.net/d25xi40x97liuc.cloudfront.net/aiv-delivery.net/streaming
# Facebook
ipset=/fbcdn.net/streaming
# Twitch
ipset=/ttvnw.net/streaming
# VeVo
ipset=/vevo.com/streaming
# Spotify
ipset=/audio-fa.scdn.cot/streaming
# Deezer
ipset=/deezer.com/streaming
# SoundCloud
ipset=/sndcdn.com/streaming
# last.fm
ipset=/last.fm/streaming
#reddit videos
ipset=/v.redd.it/streaming
#twitch.tv
ipset=/ttvnw.net/streaming

##i have isolated speed for those cdn's
ipset=/googletagmanager.com/googleusercontent.com/*.googleusercontent.com/google.com/fbcdn.net/*.fbcdn.net/akamaihd.net/*.akamaihd.net/whatsapp.net/*.whatsapp.net/whatsapp.com/*.whatsapp.com/www-cdn.whatsapp.net/googleapis.com/*.googleapis.com/ucy.ac.cy/1e100.net/hwcdn.net/usrcdn

## Bulk downloads
#qq download
ipset=/download.qq.com/bulk
# Steam Download
ipset=/steamcontent.com/bulk
# PSN Download
ipset=/gs2.ww.prod.dl.playstation.net/bulk
# DropBox
ipset=/dropbox.com/dropboxstatic.com/dropbox-dns.com/log.getdropbox.com/bulk
# Google Drive
ipset=/drive.google.com/drive-thirdparty.googleusercontent.com/bulk
# Google Docs
ipset=/docs.google.com/docs.googleusercontent.com/bulk
# PlayStore Download
ipset=/gvt1.com/bulk
# WhatsApp Files
ipset=/mmg-fna.whatsapp.net/bulk
# Youtube Upload
ipset=/upload.youtube.com/upload.video.google.com/bulk
# WindowsUpdate
ipset=/windowsupdate.com/update.microsoft.com/bulk
This script can work with both DIFFSERV4 and DIFFSERV8.
Further updates will be only on github: https://github.com/hisham2630/Ultimate-SQM-settings-Layer_cake-DSCP-marks-New-Script

1 Reply
13

[Assistant]
Here's the script with ipv6 support, need testing cause i don't have ipv6!
#!/bin/bash -x
IPT="iptables"
IPT6="ip6tables"
###########
#Veth start
###########
WANIF="pppoe-wan" #wan interface name

tc qdisc add dev wlan0 root mq #setup multi queue for wifi device
## set up veth devices to handle inbound and outbound traffic
ip link show | grep veth0 || ip link add type veth

## get new veth interfaces up
ip link set veth0 up
ip link set veth1 up

## trun on promisc mode,sometimes it's needed to make bridge work
ip link set veth1 promisc on

## add veth1 to bridge
brctl addif br-lan veth1

## just to make sure there's nothing inside this table
ip rule del priority 100
ip route flush table 100
## add routing for veth0 this will handle all traffic
ip route add default dev veth0 table 100
ip rule add iif $WANIF table 100 priority 100

#########
#Veth end
#########

##ipset for streaming sites.they are being filled by dnsmasq
ipset create streaming hash:ip
ipset create streaming6 hash:ip family inet6

ipset create usrcdn hash:ip
ipset create usrcdn6 hash:ip family inet6

ipset create bulk hash:ip
ipset create bulk6 hash:ip family inet6

ipset create latsens hash:ip
ipset create latsens6 hash:ip family inet6

$IPT -t mangle -N dscp_mark > /dev/null 2>&1
$IPT6 -t mangle -N dscp_mark > /dev/null 2>&1

$IPT -t mangle -F dscp_mark
$IPT6 -t mangle -F dscp_mark

## check if POSTROUTING already exits then jumps to our tables if not, add them

$IPT -t mangle -L POSTROUTING -n | grep dscp_mark || $IPT -t mangle -A POSTROUTING -j dscp_mark

$IPT6 -t mangle -L POSTROUTING -n | grep dscp_mark || $IPT6 -t mangle -A POSTROUTING -j dscp_mark

iptmark() {
    $IPT -t mangle -A dscp_mark "$@"
}

ipt6mark() {
    $IPT6 -t mangle -A dscp_mark "$@"
}

## start by washing the dscp to CS0

iptmark -j DSCP --set-dscp 0
ipt6mark -j DSCP --set-dscp 0

#A robust 2 rules to detect realtime traffic

# mark connections that go over 115 packets per second, not prioritized
iptmark -p udp -m hashlimit --hashlimit-name udp_high_prio --hashlimit-above 115/sec --hashlimit-burst 50 --hashlimit-mode srcip,srcport,dstip,dstport -j CONNMARK --set-mark 0x55 -m comment --comment "connmark for udp"

ipt6mark -p udp -m hashlimit --hashlimit-name udp_high_prio --hashlimit-above 115/sec --hashlimit-burst 50 --hashlimit-mode srcip,srcport,dstip,dstport -j CONNMARK --set-mark 0x55 -m comment --comment "connmark for udp6"

# unmarked UDP streams with small packets get CS6
iptmark -p udp -m connmark ! --mark 0x55 -m multiport ! --ports 22,25,53,67,68,123,143,161,162,514,5353,80,443,8080,60001 -m connbytes --connbytes 0:940 --connbytes-dir both --connbytes-mode avgpkt -j DSCP --set-dscp-class CS6 -m comment --comment "small udp connection gets CS6"

ipt6mark -p udp -m connmark ! --mark 0x55 -m multiport ! --ports 22,25,53,67,68,123,143,161,162,514,5353,80,443,8080,60001 -m connbytes --connbytes 0:940 --connbytes-dir both --connbytes-mode avgpkt -j DSCP --set-dscp-class CS6 -m comment --comment "small udp6 connection gets CS6"

#large udp streams like video call get AF41
iptmark -p udp -m connmark ! --mark 0x55 -m multiport ! --ports 22,25,53,67,68,123,143,161,162,514,5353,80,443,8080,60001 -m connbytes --connbytes 940:1500 --connbytes-dir both --connbytes-mode avgpkt -j DSCP --set-dscp-class AF41 -m comment --comment "large udp connection gets AF41"

ipt6mark -p udp -m connmark ! --mark 0x55 -m multiport ! --ports 22,25,53,67,68,123,143,161,162,514,5353,80,443,8080,60001 -m connbytes --connbytes 940:1500 --connbytes-dir both --connbytes-mode avgpkt -j DSCP --set-dscp-class AF41 -m comment --comment "large udp6 connection gets AF41"

########################################
# Latency Sensitive (gaming/voip)
########################################
##ICMP, to prioritize pings
iptmark -p icmp -j DSCP --set-dscp-class CS5 -m comment --comment "ICMP-pings"
ipt6mark -p icmp -j DSCP --set-dscp-class CS5 -m comment --comment "ICMP6-pings"

#DNS traffic both udp and tcp
iptmark -p udp -m multiport --port 53,5353,8888 -j DSCP --set-dscp-class CS5 -m comment --comment "DNS udp"
ipt6mark -p udp -m multiport --port 53,5353,8888 -j DSCP --set-dscp-class CS5 -m comment --comment "DNS udp6"

iptmark -p tcp -m multiport --port 53,5353,8888 -j DSCP --set-dscp-class CS5 -m comment --comment "DNS tcp"
ipt6mark -p tcp -m multiport --port 53,5353,8888 -j DSCP --set-dscp-class CS5 -m comment --comment "DNS tcp6"

#NTP
iptmark -p udp -m multiport --port 123 -j DSCP --set-dscp-class CS6 -m comment --comment "NTP udp"
ipt6mark -p udp -m multiport --port 123 -j DSCP --set-dscp-class CS6 -m comment --comment "NTP6 udp"

#High priority ipset, i use for pubgM
iptmark ! -p tcp -m set --match-set latsens src,dst -j DSCP --set-dscp-class CS6 -m comment --comment "latency sensitive ipset" ## set dscp tag for Latency Sensitive (latsens) ipset,udp
ipt6mark ! -p tcp -m set --match-set latsens6 src,dst -j DSCP --set-dscp-class CS6 -m comment --comment "latency sensitive ipset6" ## set dscp tag for Latency Sensitive (latsens) ipset,udp

iptmark -p tcp -m set --match-set latsens src,dst -j DSCP --set-dscp-class CS5 -m comment --comment "latency sensitive ipset" ## set dscp tag for Latency Sensitive (latsens) ipset
ipt6mark -p tcp -m set --match-set latsens6 src,dst -j DSCP --set-dscp-class CS5 -m comment --comment "latency sensitive ipset6" ## set dscp tag for Latency Sensitive (latsens) ipset

###########
##Browsing
###########
## medium priority for browsing
iptmark -p tcp -m multiport --ports 80,443,8080 -j DSCP --set-dscp-class CS3 -m comment --comment "Browsing at CS3"

ipt6mark -p tcp -m multiport --ports 80,443,8080 -j DSCP --set-dscp-class CS3 -m comment --comment "Browsing6 at CS3"
##################
#TCP SYN,ACK flows
##################
#Make sure ACK,SYN packets get priority (to avoid upload speed limiting our download speed)
iptmark -p tcp --tcp-flags ALL ACK -m length --length :128 -j DSCP --set-dscp-class CS3
ipt6mark -p tcp --tcp-flags ALL ACK -m length --length :128 -j DSCP --set-dscp-class CS3

iptmark -p tcp --tcp-flags ALL SYN -m length --length :666 -j DSCP --set-dscp-class CS3
ipt6mark -p tcp --tcp-flags ALL SYN -m length --length :666 -j DSCP --set-dscp-class CS3

#Small packet is probably interactive or flow control
iptmark -m dscp ! --dscp  24 -m dscp ! --dscp  18 -m dscp ! --dscp  34 -m dscp ! --dscp  40 -m dscp ! --dscp  48 -m length --length 0:500 -j DSCP --set-dscp-class CS3
ipt6mark -m dscp ! --dscp  24 -m dscp ! --dscp  18 -m dscp ! --dscp  34 -m dscp ! --dscp  40 -m dscp ! --dscp  48 -m length --length 0:500 -j DSCP --set-dscp-class CS3

#Small packet connections: multi purpose (don't harm since not maxed out)
iptmark -m dscp ! --dscp  24 -m dscp ! --dscp  18 -m dscp ! --dscp  34 -m dscp ! --dscp  40 -m dscp ! --dscp  48 -m connbytes --connbytes 0:250 --connbytes-dir both --connbytes-mode avgpkt -j DSCP --set-dscp-class CS3
ipt6mark -m dscp ! --dscp  24 -m dscp ! --dscp  18 -m dscp ! --dscp  34 -m dscp ! --dscp  40 -m dscp ! --dscp  48 -m connbytes --connbytes 0:250 --connbytes-dir both --connbytes-mode avgpkt -j DSCP --set-dscp-class CS3

########################################
# Streaming Media (videos/audios)
########################################
#Known video streams sites like netflix
iptmark -m set --match-set streaming src,dst -j DSCP --set-dscp-class AF41 -m comment --comment "video audio stream ipset"
ipt6mark -m set --match-set streaming6 src,dst -j DSCP --set-dscp-class AF41 -m comment --comment "video audio stream ipset6"

# some iptv provider's use this port
iptmark -p tcp -m multiport --ports 1935,9982 -j DSCP --set-dscp-class AF41 -m comment --comment "some iptv streaming service"
ipt6mark -p tcp -m multiport --ports 1935,9982 -j DSCP --set-dscp-class AF41 -m comment --comment "some iptv streaming service6"

#known usrcdn like google or akamai
iptmark -m set --match-set usrcdn src,dst -j DSCP --set-dscp-class AF21 -m comment --comment "usrcdn ipset"
ipt6mark -m set --match-set usrcdn6 src,dst -j DSCP --set-dscp-class AF21 -m comment --comment "usrcdn ipset6"

#########################################
# Background Traffic (Bulk/file transfer)
#########################################
#bulk traffic ipset, like windows udates and steam updates/downloads
iptmark -p tcp -m set --match-set bulk src,dst -j DSCP --set-dscp-class CS1 -m comment --comment "bulk traffic ipset"
ipt6mark -p tcp -m set --match-set bulk6 src,dst -j DSCP --set-dscp-class CS1 -m comment --comment "bulk traffic ipset6"

iptmark -p udp -m set --match-set bulk src,dst -j DSCP --set-dscp-class CS1 -m comment --comment "bulk traffic ipset"
ipt6mark -p udp -m set --match-set bulk6 src,dst -j DSCP --set-dscp-class CS1 -m comment --comment "bulk traffic ipset6"

iptmark -p tcp -m connbytes --connbytes 350000: --connbytes-dir both --connbytes-mode bytes -m dscp --dscp-class CS0 -j DSCP --set-dscp-class CS1 -m comment --comment "Downgrade CS0 to CS1 for bulk tcp traffic"
ipt6mark -p tcp -m connbytes --connbytes 350000: --connbytes-dir both --connbytes-mode bytes -m dscp --dscp-class CS0 -j DSCP --set-dscp-class CS1 -m comment --comment "Downgrade CS0 to CS1 for bulk tcp traffic6"

iptmark -p tcp -m connbytes --connbytes 350000: --connbytes-dir both --connbytes-mode bytes -m dscp --dscp-class CS3 -j DSCP --set-dscp-class CS1 -m comment --comment "Downgrade CS3 to CS1 for bulk tcp traffic"
ipt6mark -p tcp -m connbytes --connbytes 350000: --connbytes-dir both --connbytes-mode bytes -m dscp --dscp-class CS3 -j DSCP --set-dscp-class CS1 -m comment --comment "Downgrade CS3 to CS1 for bulk tcp traffic6"

iptmark -p udp -m multiport --port 60001 -j DSCP --set-dscp-class CS1 -m comment --comment "bulk torrent port UDP"
ipt6mark -p udp -m multiport --port 60001 -j DSCP --set-dscp-class CS1 -m comment --comment "bulk torrent port UDP6"

#tcpdump rule, copy and paste this rule into terminal, this rule is used to capture realtime traffic, you can change ip to what you like
#tcpdump -i br-lan host 192.168.1.126 and udp and portrange 1-65535 and !port 53
dnsmasq.conf with IPV6 support
Add the following lines at the end of
/etc/dnsmasq.conf :
##Latency Sensitive (gaming/voip)
ipset=/igamecj.com/gcloudcs.com/qos.gcloud.qq.com/latsens,latsens6

##video/audio streams
# Youtube is also isolated by my isp
ipset=/googlevideo.com/*.googlevideo.com/streaming,streaming6
# NetFlix
ipset=/nflxvideo.net/streaming,streaming6
# AmazonVideo
ipset=/s3.ll.dash.row.aiv-cdn.net/d25xi40x97liuc.cloudfront.net/aiv-delivery.net/streaming,streaming6
# Facebook
ipset=/fbcdn.net/streaming,streaming6
# Twitch
ipset=/ttvnw.net/streaming,streaming6
# VeVo
ipset=/vevo.com/streaming,streaming6
# Spotify
ipset=/audio-fa.scdn.cot/streaming,streaming6
# Deezer
ipset=/deezer.com/streaming,streaming6
# SoundCloud
ipset=/sndcdn.com/streaming,streaming6
# last.fm
ipset=/last.fm/streaming,streaming6
#reddit videos
ipset=/v.redd.it/streaming,streaming6
#twitch.tv
ipset=/ttvnw.net/streaming,streaming6

##i have isolated speed for those cdn's
ipset=/googletagmanager.com/googleusercontent.com/*.googleusercontent.com/google.com/fbcdn.net/*.fbcdn.net/akamaihd.net/*.akamaihd.net/whatsapp.net/*.whatsapp.net/whatsapp.com/*.whatsapp.com/www-cdn.whatsapp.net/googleapis.com/*.googleapis.com/ucy.ac.cy/1e100.net/hwcdn.net/usrcdn,usrcdn6

## Bulk downloads
#qq download
ipset=/download.qq.com/bulk,bulk6
# Steam Download
ipset=/steamcontent.com/bulk,bulk6
# PSN Download
ipset=/gs2.ww.prod.dl.playstation.net/bulk,bulk6
# DropBox
ipset=/dropbox.com/dropboxstatic.com/dropbox-dns.com/log.getdropbox.com/bulk,bulk6
# Google Drive
ipset=/drive.google.com/drive-thirdparty.googleusercontent.com/bulk,bulk6
# Google Docs
ipset=/docs.google.com/docs.googleusercontent.com/bulk,bulk6
# PlayStore Download
ipset=/gvt1.com/bulk,bulk6
# WhatsApp Files
ipset=/mmg-fna.whatsapp.net/bulk,bulk6
# Youtube Upload
ipset=/upload.youtube.com/upload.video.google.com/bulk,bulk6
# WindowsUpdate
ipset=/windowsupdate.com/update.microsoft.com/bulk,bulk6
Still under development!

1 Reply
2

what is your router setup
@hisham2630
? is it pc-->switch-->router-->modem-->internet? Do you use bridge in your setup?

Now i don't use openwrt as router anymore, just access point.
laptop/phones(via wifi)-->openwrt- access point -->Edgerouter-x-sfp (router)--> ONT-EPON(fiber optic)-->internet
LeTran:
Do you use bridge in your setup?
No, Edge router have DSA architecture switch, Veth method is not needed!

3 Replies
1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: [Solved] OpenWrt on MT7621/MT7615N devices with 5GHz problems

̶W̶o̶u̶l̶d̶ ̶̶̶n̶o̶t̶̶̶ ̶r̶e̶c̶o̶m̶m̶e̶n̶d̶ ̶i̶n̶s̶t̶a̶l̶l̶i̶n̶g̶ ̶O̶p̶e̶n̶W̶r̶t̶ ̶o̶n̶ ̶a̶n̶y̶ ̶r̶o̶u̶t̶e̶r̶s̶ ̶w̶i̶t̶h̶ ̶t̶h̶e̶ ̶M̶T̶7̶6̶2̶1̶/̶M̶T̶7̶6̶1̶5̶N̶ ̶c̶o̶m̶b̶i̶n̶a̶t̶i̶o̶n̶,̶ ̶d̶u̶e̶ ̶t̶o̶ ̶k̶n̶o̶w̶n̶ ̶5̶ ̶G̶H̶z̶ ̶W̶i̶f̶i̶ ̶p̶r̶o̶b̶l̶e̶m̶.̶ ̶
e.g. DIR-878, DIR-882, DIR-2640...
Not uncommon for devices connecting to above routers via 5 GHz WiFi to display the following error:
Connected, no internet.
or
Connection to the router is fine/excellent but trying to open a webpage resulting the following error:
Address Not Found
According to lukasz92:
This problem is as old as mt76 driver; will not be fixed.
Problem was definitely present in all the recent 22.03.0 RC releases, except RC6?
and
Problem is definitely still present in the Stable 21.02.3, 21.02.5 releases.
For those who do not have time/interest going through this entire thread,
Currently,
The release - *now deleted by arinc9 appears to avoid the 5 GHz WiFi problems and increases routing performance.
EDIT: With the removal of arinc9 releases, Snapshots appear to have least amount of problems.
Note: As of August 21, 2022, hauke has applied arinc9's patch into master = Snapshots as of that date should include the patch.
With that said,
arinc9 deleted the mt7621-dts-work branch August 24, 2022.
The current 22.03.x stable releases do not include all of arinc9's patches.
A quick summary as of September 2022,
Click HERE
For those who prefer stable releases
The 22.03.3 Stable release appears to have least amount of problems as of January 2023. But, expect a loss in routing performance since it does not include arinc9's patches.
Update: Update August 24, 2023:
re: OpenWrt 23.05.0-rc3
D-Link DIR-882 rev.A1
No abnormal delays in device handshake to router with 5 GHz WiFi.
and
Both the 2.4 GHz and 5 GHz WiFi appear to be working.

2 Replies
6

[Assistant]
anon72830772:
Would not recommend installing OpenWrt on any routers with the MT7621/MT7615N combination, due to known 5 GHz Wifi problem.
Well, I've got the thing and can't return it, as I've soldered a header to the serial pads on the board. So I'm likely to continue banging my head against the wall for a while, trying to get the firmware loaded. If there is a 5 Ghz problem with my unit (I understand the problem is not universal) I'll cross that bridge when I come to it.
Meanwhile, I'd like to hear from anyone who has succeeded in loading the firmware, via any method, from a Linux machine, just to give me some confidence that at least it's been done before.

2 Replies

anon72830772:
Would not recommend installing OpenWrt on any routers with the MT7621/MT7615N combination, due to known 5 GHz Wifi problem.
I was just following your link to the other thread.
Are you referring to the issue that some WiFi clients experience a broken WiFi connection after a few hours?
Unfortunately some WiFi client devices have a low quality WiFi stack implementation, which causes issues with 2 default setting of OpenWRT (and its on other routers as well, not just MT76).
It depends on the client, whether you will experience this after a few minutes, hours or days.
So its a client issue, but you can improve the situation, by loosening some OpenWRT settings:
one is: option disassoc_low_ack '1' (default on)
the other „ Disable Inactivity Polling“ (default off)
both are available as checkmarks in LuCi in the WiFi advanced section. Try inverting the 2, to see if that helps. (milage with your clients may vary)

2 Replies

Thanks Pico but it's only the 5 GHz WiFi that has the problem.
The 2.4 GHz is perfectly fine so not sure if inactivity polling will make a difference...
I'll give it a try anyways.


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: NFtables and QoS in 2021

A few years back we tried to get nftables to work for QoS marking QoS and nftables … some findings to share at the time, there were problems with OpenWrt not quite supporting nftables correctly.
Then last year, there was some more effort... Nftables custom QoS, round 2 and the thing that people complained about the most was DNSmasq not having support for adding ip addresses to an nftables set based on lookups (so for example you couldn't easily downprioritize googlevideo.com to force YouTube to not bork your interactive video calls). But at the end of that thread the patches to dnsmasq landed, and I believe this should work now.
Meanwhile, Nftables migration maturity in OpenWrt 21.02 we have reports that nftables comes up reliably on OpenWrt 21 and that
@jow
has put together fw4 which allows you to use nftables as the backend and still configure a firewall through uci (though I much prefer the nftables firewall syntax).
Also there's some effort to create an eBPF based solution to tagging in Qosify: new package for DSCP marking + cake which is an alternative to using nftables.
So, show of hands, how many people want to take yet another stab at building an nftables firewall example with QoS tagging and Dnsmasq support and such?
Git Repo:
GitHub
GitHub - dlakelan/OpenWrtNFTables: An NFTables firewall for OpenWrt with DSCP...
An NFTables firewall for OpenWrt with DSCP tagging - GitHub - dlakelan/OpenWrtNFTables: An NFTables firewall for OpenWrt with DSCP tagging

16

[Assistant]
Hi there. I've got some time in my hands lately and I might be able to help as during round 1. Two questions tho':
Is fw4 usable at all?
In your opinion, why nft and not eBPF?

2 Replies

amteza:
Is fw4 usable at all?
I don't know. If I were going to use nftables on OpenWrt I'd do it using the nftables scripting language. The existence of fw4 though makes it so that getting nftables to work on OpenWrt is more of a priority. this ultimately means that these days it's reported that you can switch to nftables and there are no hitches.
amteza:
why nft and not eBPF
This is like asking why Python and not x86 Assembler. nftables is a high level language for describing packet rules, and eBPF is a bytecode for injecting verifiable instruction sequences into the linux kernel. It's entirely possible for nftables to compile its rules to eBPF (though at the moment it doesn't). They're not really separate.
eBPF by itself is useless without something human usable to describe the computations of interest that compiles to eBPF. at the moment this is mostly low level languages like C, though Julia does have an eBPF compiler as well... but in general you don't want to program packet filters in C or even Julia. eBPF is literally a machine language for a virtual machine so it does things like "Load into register" "add 1 to contents of register" "divide register by other register" etc.
QoSify is basically a high level language for doing packet tagging which compiles to eBPF. I have nothing against it but have found that in general nftables is comprehensive language for packet manipulation and extremely powerful and useful, with a much broader applicability domain.

2 Replies
1

good evening daniel I have a lot of availability at the moment, I had followed pres nftables round 2, if I do the test I would do it on a test router if you are up and running, we can start when you want;)
several questions come to mind
1 would using nftables increase the throughput and the processor capacity, in my case dual core 1.4 ghz armv8 for larger connections which in the future will be present in homes
2: can we convert our iptables into nftables what seems possible to me
thank you

1 Reply


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Community question: What do you want to see in OpenWrt?

Hi,
based on yesterdays developer meeting I'm curious what people would like to see around OpenWrt. I'm specifically NOT asking for specific devices, but stuff in general. This can be something like a mobile friendly web interface, an automatic update service or whatever you can think of. I'll add a poll, too, so if you see your topic already no additional answer is required.
Rust in OpenWrt core
LLVM integration in core
Notification System. See https://github.com/openwrt/openwrt/pull/13137
Replace usign/ucert with px5g based tooling
Replace more ucode with init scripts
Automatic firmware upgrades
mobile focused web interface
280 voters
Results
I didn't know but I can't extent the poll anymore, sorry! I collect ideas below, please like the linked posts.
none of the above aka stabilise existing features
common settings in web interface (i.e. guest wifi)
rolling release
automatic language suggestions for web interface
combined network stats over multiple APs
FIDO2 support for login

1 Reply
10

[Assistant]
Pleasd add "none of the above" or "stabilise existing features"

2 Replies
35

I'm not sure what is meant by "mobile focused web interface." The Luci theme "OpenWrt 2020" already works very well for that, in my experience. It's not installed by default, but it's easy enough to install from the repo.

1 Reply
8

I'd like to see an easier way to add useful configurations like guest wifi. The kind of this for example gl.inet firmware adds on top of openwrt.
I enjoyed setting it up on vanilla openwrt from scratch as you also learn things but it was also really handy setting it up on my travel router using gl.inets interface. That's why I am thinking on keeping one device on the vendor firmware and one on vanilla openwrt.

1 Reply
26


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: OpenWrt/LEDE v17.01.5 service release

The OpenWrt Community is proud to announce the Fifth service release of
stable OpenWrt/LEDE 17.01 series, which is the first service release
after the remerger of the LEDE and OpenWrt projects.
OpenWrt/LEDE 17.01.5 “Reboot” incorporates a fair number of fixes back
ported from the development branch during the last 9 months.
Some selected highlights of the service release are:
Linux kernel updated to version 4.4.140 (from 4.4.92 in v17.01.4)
Security fixes to openssl, mbedtls, wolfssl, samba, dnsmasq, openvpn,
libunwind and the Linux kernel
Update cake scheduler to version from 7. January 2018
Update Wireguard VPN software to 0.0.20180519
Enable SSL cache in ustream-ssl to improve TLS performance
Fixes for building with host glibc 2.27 (Used in Ubuntu 18.04)
lantiq: Make ADSL and VDSL SNR configurable
x86: Added Spectre and Meltdown mitigations as well as microcode
loading support
Assorted platform fixes for apm821xx, ar71xx, bcm53xx, brcm47xx,
ipq806x, lantiq, mvebu, ramips, rb532, sunxi, x86 and xburst
For a detailed list of changes since 17.01.4 refer to
https://openwrt.org/releases/17.01/changelog-17.01.5
For latest information about the 17.01 series, refer to the wiki at:
https://openwrt.org/releases/17.01/
To download the v17.01.5 images, navigate to:
https://downloads.lede-project.org/releases/17.01.5/
Have fun!
The OpenWrt Community

11

[Assistant]
imagebuilder 17.01.5 return error on Manjaro 17.1.11.
imagebuilder 17.01.4 works fine.
Cleaning up

Activating init scripts

Building images...
Parallel mksquashfs: Using 1 processor
Creating 4.0 filesystem on /home/cy/workspace/lede/imagebuilder/lede-imagebuilder-17.01.5-x86-64.Linux-x86_64/build_dir/target-x86_64_musl-1.1.16/linux-x86_64/root.squashfs, block size 262144.
Pseudo file "/dev" exists in source filesystem "/home/cy/workspace/lede/imagebuilder/lede-imagebuilder-17.01.5-x86-64.Linux-x86_64/build_dir/target-x86_64_musl-1.1.16/root-x86/dev".
Ignoring, exclude it (-e/-ef) to override.
[===============================================================================================================================================================================================================\] 570/570 100%
Exportable Squashfs 4.0 filesystem, xz compressed, data block size 262144
 compressed data, compressed metadata, compressed fragments, no xattrs
 duplicates are removed
Filesystem size 1999.98 Kbytes (1.95 Mbytes)
 35.32% of uncompressed filesystem size (5661.80 Kbytes)
Inode table size 6248 bytes (6.10 Kbytes)
 22.63% of uncompressed inode table size (27613 bytes)
Directory table size 7906 bytes (7.72 Kbytes)
 47.37% of uncompressed directory table size (16689 bytes)
Number of duplicate files found 81
Number of inodes 828
Number of files 571
Number of fragments 21
Number of symbolic links  197
Number of device nodes 1
Number of fifo nodes 0
Number of socket nodes 0
Number of directories 59
Number of ids (unique uids + gids) 1
Number of uids 1
Inconsistency detected by ld.so: dl-open.c: 689: _dl_open: Assertion `_dl_debug_initialize (0, args.nsid)->r_state == RT_CONSISTENT' failed!
make[3]: *** [/home/cy/workspace/lede/imagebuilder/lede-imagebuilder-17.01.5-x86-64.Linux-x86_64/include/image.mk:310: /home/cy/workspace/lede/imagebuilder/lede-imagebuilder-17.01.5-x86-64.Linux-x86_64/build_dir/target-x86_64_musl-1.1.16/linux-x86_64/root.squashfs] Error 127
make[2]: *** [Makefile:178: build_image] Error 2
make[1]: *** [Makefile:118: _call_image] Error 2
make: *** [Makefile:203: image] Error 2

1 Reply

I just updated my TP-Link WDR4300 to 17.01.5 and SQM QoS with cake is broken. I'm using the same configuration I used in 17.01.4 but it does nothing, selecting cake as qdisc is the same as having SQM QoS completely disabled. If I switch to fq_codel, however, SQM works fine. I've set the logs to trace level but there's nothing wrong with SQM, the required modules are properly loaded and the SQM instance is successfully started without any error, but if cake is selected as the qdisc I'll get the same bufferbloat as I would get with SQM disabled...
Has anyone else experienced this issue? SQM QoS with cake is a must for me and I'm seriously considering downgrading back to 17.01.4 where it worked flawlessly if there's no solution for this...

2 Replies

Cye3s:
imagebuilder 17.01.5 return error on Manjaro 17.1.11.
As a workaround, run the following command once within the IB/SDK directory:
sed -i -e 's,/\(usr\|lib\|etc\)/,/###/,g' ./staging_dir/host/lib/libc.so.6

1 Reply


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: LEDE v17.01.0 final

Hi,
The LEDE Community is proud to announce the first stable version of the
LEDE 17.01 version series.
LEDE 17.01.0 "Reboot" incorporates thousands of commits over the last
nine months of effort. With this release, the LEDE development team
closes out an intense effort to modernize many parts of OpenWrt and
incorporate many new modules, packages, and technologies.
Some selected highlights of this release are:
Linux kernel updated to version 4.4.50 (from 3.18 in Chaos Calmer)
Update of essential software:
dnsmasq updated to 2.76 (from 2.73 in Chaos Calmer)
busybox updated to 1.25.1 (from 1.23.2 in Chaos Calmer)
mbedtls version 2.4.0 (from polarssl 1.3.14 in Chaos Calmer)
openssl updated to 1.0.2k
Improved Security Features
Use SHA256 instead of MD5 to validate source code for packages
mbedtls: disable SSLv3 support
OpenSSL: disable support for compression, heartbeats, NPN,
Whirlpool, and J-PAKE
Memory Corruption Mitigation Methods
gcc -Wformat -Wformat-security
User space Stack-Smashing Protection (Regular)
Kernel space Stack-Smashing Protection (Regular)
buffer-overflows detection (FORTIFY_SOURCE) (Conservative)
RELRO protection (Full)
Improved Networking Support
Smart Queue Management (SQM) minimizes bufferbloat by using the
cake and fq_codel qdisc's.
Improvements to the WiFi stack eliminating bufferbloat on ath9k,
mt76 and some ath10k chipsets
Airtime fairness scheduler for ath9k to prevent slow stations
from hogging too much airtime
Various stability and regression fixes to the Linux wireless
stack and ath9k in particular
Provide alternative Candela-Tech ath10k-ct driver
IPv6 hardening
Updated toolchain
musl 1.1.16
gcc 5.4.0
binutils 2.25.1
Platform and Driver Support
Lantiq
Added redistributable DSL firmware
Updated DSL phy drivers
Added new targets:
apm821xx (AppliedMicro APM821xx)
arc770 (Synopsys DesignWare ARC 770D)
archs38 (Synopsys DesignWare ARC HS38)
armvirt (QEMU ARM Virtual Machine)
ipq806x (Qualcomm Atheros IPQ806X)
layerscape (NXP Layerscape)
zynq (Xilinx Zynq 7000 SoCs)
Reorganized x86 target:
Drop dedicated Xen DomU target, merged with x86/generic
Enable AES-NI support
Removed targets:
realview, replaced by armvirt
ppc44x, disabled due to code brokeness
netlogic, dropped due to no available hardware
Build system improvements
Separation of base system and community feeds to simplify
distribution of binary package updates
Fixes and enhancements in package dependency handling, better
support for virtual provides
Per-device rootfs images to better tune package selection to each
individual device profile
New image build code improving compilation times and simplifying
device profile declarations
New package/.../check make target to run a series of standard
diagnostics on Makefiles
Support for fetching sources using Curl
Generate reproducible source tarballs when packing SCM checkouts
Image Builder / SDK
Rework library bundling to allow for better portability between
different Linux distributions
Add support for building kernel modules using the SDK
Added support for a many new routers and boards
For a detailed list of changes since 17.01.0-rc2 refer to
https://lede-project.org/releases/17.01/changelog-17.01.0-final
For a complete list of changes since the start of the LEDE project, see
https://lede-project.org/releases/17.01/changelog-17.01.0
Known issues:
Available space on devices with only 4MB flash is very low,
users requiring extra packages might want to consider using the
image builder to repack custom images
The available memory on devices with 32MB RAM might be too low to
reliably run opkg or sysupgrade operations, especially in
conjunction with LuCI
Any outstanding issues reported at https://bugs.lede-project.org/
For latest information about the 17.01 series, refer to the wiki at:
https://lede-project.org/releases/17.01/
To download the v17.01.0 images, navigate to:
https://downloads.lede-project.org/releases/17.01.0/
A big thank you goes to all our active package maintainers, testers,
documenters and supporters.
Have fun!
The LEDE Community

1 Reply
16

[Assistant]
Sysupgrade for TP-Link wdr4900v1.3 from 17.01RC2 went fine. Only one thing as a former ddwrt user is new: My installed packages are vanished, but I asume this is standard behavior so I only have to re-install packages.
For the OPKGs is there a shortcut for reinstallation or only one by one?
Ok, found this. No fancy GUI but it will do and it already found it's way into the wiki :- )

Does the patch fix full tx queue problem ? I still suffer from it
[13648.650119] ieee80211 phy1: rt2x00queue_write_tx_frame: Error - Dropping frame due to full tx queue 2
[13648.659621] ieee80211 phy1: rt2x00queue_write_tx_frame: Error - Dropping frame due to full tx queue 2
[13648.669097] ieee80211 phy1: rt2x00queue_write_tx_frame: Error - Dropping frame due to full tx queue 2

2 Replies

I saw new option added in wifi section: 802.11w. Is it good to enable it ?
Btw, i tested on mt7612 (ac) 802.11w run but not with mt7620 (bgn) (hostapd: fail to init ....)


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Qosify: new package for DSCP marking + cake

Hi,
I've made a new package for OpenWrt called qosify, which implements many features also found in this script. Instead of using iptables and ipset, it implements classification as a single configurable eBPF module. It supports port based rules and DNS hostname wildcard/regex matching for classification.
You can find some details about it in this readme: https://git.openwrt.org/?p=project/qosify.git;a=blob;f=README
The package is in OpenWrt master (EDIT: and in 22.03.0 and newer releases)

4 Replies
35

[Assistant]
thanks for your work
for the moment i has configurate like this
config defaults
 list defaults /etc/qosify/*.conf
 option dscp_prio CS5
 option dscp_icmp CS6
 option dscp_bulk CS0
 option dscp_default_udp CS4
 option bulk_trigger_timeout 5
 option bulk_trigger_pps 100
 option prio_max_avg_pkt_len 500

config interface wan
 option name wan
 option disabled 0
 option bandwidth_up 16mbit
 option bandwidth_down 56mbit
 # defaults:
 option ingress 1
 option egress 1
 option mode diffserv4
 option nat 1
 option host_isolate 1
 option autorate_ingress 1
 option ingress_options ""
 option egress_options ""
 option options ""

config device wandev
 option disabled 1
 option name wan
 option bandwidth 100mbit
maybe open the new thread for configurate qosify

Working nicely so far, but took a little bit to read between the lines of the README.
I made some changes to the defaults. I changed dscp_bulk from CS0 to CS1, and I added dscp_default_tcp CS0 (since my ISP marks all my ingress traffic as CS1). I also added docsis to the options parameter to account for my desired overhead.
I added a 01-dns.conf file in /etc/qosify with all my former dnsmasq ipset configs. Is it required to put a wildcard on a domain if you want all sub-domains included (e.g. googlevideo.com or *.googlevideo.com)?
It's not obvious, but you can dump your config with ubus call qosify dump
Very cool so far! Thanks
@nbd
/etc/qosify/01-dns.conf
/etc/qosify/00-defaults.conf

2 Replies
3

Cool ,
You have add option overhead how
Option overhead "docsis" ?


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: OpenWrt 18.06.1 Service Release

The OpenWrt Community is proud to announce the first service release of stable OpenWrt 18.06 series, which marks the first major version after the remerger of the LEDE and OpenWrt projects.
OpenWrt 18.06.1 incorporates a number of mostly security oriented fixes backported from the development branch during the last two weeks.
Some selected highlights of the service release are:
Linux kernel updated to versions 4.9.120/4.14.63 (from 4.9.111/4.14.52 in v18.06.0)
Security fixes for Curl, Mbedtls, OpenSSL and the Linux kernel
Binary builds for the at91 and ath25 targets
Updated mwlwifi driver
Improved input validation for rpcd uci ubus calls
Crash fixes in libuci
Assorted bug fixes in netifd
For a detailed list of changes since 18.06.0 refer to https://openwrt.org/releases/18.06/changelog-18.06.1
For latest information about the 18.06 series, refer to the wiki at:
https://openwrt.org/releases/18.06/
To download the v18.06.1 images, navigate to:
https://downloads.openwrt.org/releases/18.06.1/
Have fun!
The OpenWrt Community

12

[Assistant]
Can't find this anywhere, 18.06.1 tiny for ar71xx, does it include Luci?
Specifically for wa801nd V2
Thanks a bunch

Has anyone tried to install 18.06.1 on a "archer c7 v2"?
I wasn't able to upgrade from 18.06.0 via the gui with a sysupgrade-image.

2 Replies

pseudodamaging:
Has anyone tried to install 18.06.1 on a "archer c7 v2"?
I wasn't able to upgrade from 18.06.0 via the gui with a sysupgrade-image.
Zero problem here...


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: LEDE v17.01.0-rc1

Hi,
The LEDE Community is proud to announce the first release candidate of
the upcoming LEDE 17.01 stable version series. It incorporates thousands
of commits made during the course of the last months and allows us to
refine the code base for the final v17.01.0 version.
With this release, the LEDE development team closes out an intense
effort to modernize many parts of OpenWrt and incorporate many new
modules, packages, and technologies.
Some selected highlights since the OpenWrt Chaos Calmer release are:
Linux kernel updated to version 4.4.42 (from 3.18 in Chaos Calmer)
Update of essential software:
dnsmasq updated to 2.76 (from 2.73 in Chaos Calmer)
busybox updated to 1.25.1 (from 1.23.2 in Chaos Calmer)
mbedtls version 2.4.0 (updated from polarssl 1.3.14 in Chaos
Calmer)
openssl updated to 1.0.2k
Improved Security Features
Use SHA256 instead of MD5 to validate source code for upstream
packages
mbedtls: disable SSLv3 support
OpenSSL: disable support for compression, heartbeats, NPN,
Whirlpool, and J-PAKE
Memory Corruption Mitigation Methods
gcc -Wformat -Wformat-security
User space Stack-Smashing Protection (Regular)
Kernel space Stack-Smashing Protection (Regular)
buffer-overflows detection (FORTIFY_SOURCE) (Conservative)
RELRO protection (Full)
Improved Networking Support
Smart Queue Management (SQM) minimizes bufferbloat by using the
cake and fq_codel qdisc's. //[[:docs:howto:sqm|More...]]//
Improvements to the WiFi stack eliminating bufferbloat on ath9k,
mt76 and some ath10k chipsets
Airtime fairness scheduler for ath9k to prevent slow stations
from hogging too much airtime
Various stability and regression fixes to the Linux wireless
stack and ath9k in particular
Provide alternative Candela-Tech ath10k-ct driver
Updated toolchain
musl 1.1.15
gcc 5.4.0
binutils 2.25.1
Platform and Driver Support
Lantiq
Added redistributable DSL firmware
Updated DSL phy drivers
Added new targets:tickets
apm821xx (AppliedMicro APM821xx)
arc770 (Synopsys DesignWare ARC 770D)
archs38 (Synopsys DesignWare ARC HS38)
armvirt (QEMU ARM Virtual Machine)
ipq806x (Qualcomm Atheros IPQ806X)
layerscape (NXP Layerscape)
zynq (Xilinx Zynq 7000 SoCs)
Reorganized x86 target:
Drop dedicated Xen DomU target, merged with x86/generic
Enable AES-NI support
Removed targets:
realview, replaced by armvirt
ppc44x, disabled due to code brokeness
netlogic, dropped due to no available hardware
Build system improvements
Separation of base system and community feeds to simplify
distribution of binary package updates
Fixes and enhancements in package dependency handling, better
support for virtual provides
Per-device rootfs images to better tune package selection to each
individual device profile
New image build code improving compilation times and simplifying
device profile declarations
New package/.../check make target to run a series of standard
diagnostics on Makefiles
Support for fetching sources using Curl
Generate reproducible source tarballs when packing SCM checkouts
Image Builder / SDK
Rework library bundling to allow for better portability between
different Linux distributions
Add support for building kernel modules using the SDK
Added support for a many new routers and boards
Known issues:
Available space on devices with only 4MB flash is very low,
users requiring extra packages might want to consider using the
image builder to repack custom images
The available memory on devices with 16MB RAM might be too low to
reliably run opkg or sysupgrade operations, especially in
conjunction with LuCI
The source snapshot tarballs produced by Github do not correctly
compile all packages due to missing Git history information, this
will be fixed with the next RC
The SDK tarballs embed a wrong revision and might report "r0+3043"
instead of "r3042", this is a cosmetic issue which will get fixed
with the next RC
Any outstanding issues reported at https://bugs.lede-project.org/
For the latest information about the 17.01 release and for detailed
change logs, refer to the wiki page at:
https://lede-project.org/releases/17.01/
To download the v17.01.0-rc1 images, navigate to:
https://downloads.lede-project.org/releases/17.01.0-rc1/
A big thank you goes to all our active package maintainers, testers,
documenters and supporters.
Have fun!
The LEDE Community

1 Reply
13

[Assistant]
Running RC1 for several days now on an Archer C7 v2 and everything has been absolutely flawless thus far. Both Wifi working great from the beginning, Luci on by default, etc. Great experience, in my opinion.

jow:
To download the v17.01.0-rc1 images, navigate to:
Jo, would you guys consider taking the Linksys WRT3200ACM off the list for 17.01.0 release? The biggest issues (I've tried the pure rc1 build) are: flaky/non-working WiFi, undefined LEDs, LEDs that when enabled kill WiFi. It's just not up to a level of what you'd call a "release".

Fantastic work! I just want to thank everyone that have been working on this and initiated the LEDE project for all their hard work.


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Feedback Request: New Channel Analysis Feature in webui

Here we can collect Feedback about the new Channel Analysis Feature.
Post here any feedback, suggestion or issue with this new feature.
Screens are welcome.
The new feature is accessible by the Status menu in The LuCi webui
Some example of the Feature.

(thx hnyman)

12

[Assistant]
Can't test the luci component, but definitely happy to steal the ubus component to make the Gargoyle plugin more robust

1

Credit where it is due haha
When I saw your mailing list post I had hoped you might come up with something. I've never had the time to look at it. Has always been something else more important.

1

Anyway i wonder if all the scan feature can be implemented using directly mac80211... But i think that is problematic for some special driver

1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Finally got 802.11v working (FULLY) - Few pointers

So before I begin, I am doing this on my mini PC running Debian up stairs... Not my OpenWRT boxes (living room floor x 1, downstairs entrance x 1). Those will be next.
But it all applies, since I have checked and assuming you are running hostapd full on OpenWRT, it will all work. Im running hostapd-ct upstairs (google search hostapd-ct, reason for this below). Note, I am no wifi expert... Although I have close to two decades of linux experience, so it all went quite quickly...
It's going to be a bit scattered, but it works... I am able to jump from 2.4ghz to 5ghz, and from 5ghz to 2.4ghz at will.
Pointers:
A) Hostapd-ct... The only reason for this is because hostapd-ct's version of hostapd_cli has a command to pull the neighbour report (long string) for your current adapter(s).
show_neighbor = show neighbor database entries
Super helpful, but openwrt's ubus has rrm_nr_get_own which will give you the string so this is not needed on an openwrt + openwrt setup.
B) Populate the neighbor report list fully. Both adapters (5 and 2.4) should contain ALL of the neighbors you wish to jump between. This was the first issue I ran into... Like I said, I don't know much about 802.11 internals... For whatever reason, initially I just populated my 5ghz on my 5ghz adapters, and my 2.4ghz on all my 2.4ghz adapters... Nope, fill them all fully. Essentially on all your adapters, the neighbour list should be the same (full). UNLESS you do not want (like me) the downstairs access point to roam to the upstairs router since there is a router in between. That should make sense.
C) If you are using 802.11r, which you probably are since thats usually everyones first step into 'better roaming', you need to make sure to use ft_over_ds and have rsn_preauth=1 rsn_preauth_interfaces set correctly. Just a pointer for those who dont know, hostapd will use rsn_preauth_interfaces as a 'back channel' to authenticate. So yes, not only does 802.11v work, I am about to FT between 2.4 and 5ghz. This was another issue... Since my mobile devices sit on 5ghz 99% of the time, I didn't bother setting up 802.11r on my 2.4ghz adapters... I could see the BSS working when sending the 802.11v requests, but it would NOT authenticate to the opposite frequency (2.4 to 5, 5 to 2.4)... I couldnt figure out why... Some debugging logging showed that hostapd was failing to authenticate because it was trying to FT and unable to do so... After I enabled 802.11r on my 2.4ghz band, presto.. Works!
D) The commands I am using to force a jump from one freq to the other are:
hostapd_cli -i XXXX bss_tm_req AA:AA:AA:AA:AA:AA neighbor=-BB:BB:BB:BB:BB:BB abridged=1
XXXX = The adapter you wish to switch FROM.
AA:AA... = The MAC of the client you want to transfer over.
BB:BB... = The MAC of the access point you want to EXCLUDE from possible access points where it will roam to.
NOTE: For samsung mobile devices (possibly all of android?) abridged=1 is a STRONG hint that the roam should happen. It states that the access points are part of the same network and gives it 'higher weight'. Note to developers, maybe it would be helpful to expose this via ubus?
NOTE : There is a way to pass a target AP via the neighbour= parameter... But I am thus far unable to figure out how to do so for the 2.4 to 5ghz band... The syntax is (as best I can tell, from the hostapd source):
[TARGET AP MAC],[OP CLASS, as far as I can tell, 2.4ghz=81, 5ghz=122],[CHANNEL],[PHY TYPE, as far as I can tell 7=2.4ghz,9=5ghz],[NEIGHBOUR REPORT LONG STRING]
But like I said, this works for my 5 to 2.4, but not the other way around... Still unsure why...
That's about it, I have this running on my dated Samsung S7 Edge BTW... Switching bands is nearly instant and I don't even notice it on the mobile... Really fast band steering pretty much like one would expect it to be.
Feel free to ask questions sorry for the scattered post, but I'm quite excited about this... Going to bang out a little bash script now to check rssi's and do this on the fly for me... We have a wifi baby monitor and I find it annoying that when I watch it as I move floors it pauses for about 5-10 seconds sometimes requiring an app restart... First world problems

Solved by anom3 in post #17
Just a short update... I have it working pretty much flawlessly. To make it work 100% one needs to use req_beacon (hostapd_cli, there is a ubus hook for it though), mode 1, and it will send back a beacon report to the AP. Once you have captured the beacon report and fed it back into your infinite …
3 Replies
16

[Assistant]
anom3:
I am able to jump from 2.4ghz to 5ghz, and from 5ghz to 2.4ghz at will.
Is it fully automatic or user action required?

anom3:
But like I said, this works for my 5 to 2.4, but not the other way around... Still unsure why...
Sorry, have you got this working both ways or not? You've contradicted yourself in a few places. Just trying to understand.
A very interesting post nonetheless, and bookmarked for me to come back to.

1

@lantis1008
Hi, I'll summarize what I got working so far:
Working:
Populate the 802.11k neighbor list with possible roam locations (both 2.4 and 5ghz bands). Note: So on a single router, dual adapter setup each adapter should have a neighbor list that contains 2 neighbors. It self, and the opposite band.
Be close enough to the AP where a connection to the 5ghz band will be possible.
Use the hostapd_cli command in the original post to tell the client to roam to "any AP in the 802.11k neighbor list EXCEPT FOR ____ (notice the minus in front of the neighbor= mac)".
This way the device will roam from 2.4 to 5. Works the other way too, 5 to 2.4.
Working:
For 5 to 2.4ghz, use the hostapd_cli command to specify a specific AP (neighbor=MAC,OP_CLASS,CHANNEL,PHY_TYPE) to roam to. Note, so in this case you will be specifying a 2.4ghz AP (OP_CLASS=81, PHY_TYPE=7).
Not Working:
For 5ghz, use the hostapd_cli command to specify a specific AP (neighbor=MAC,OP_CLASS,CHANNEL,PHY_TYPE) to roam to. Note, this is probably because there is an issue wit the OP_CLASS / PHY_TYPE. I pulled those from a post here:
How does rrm work?
Network and Wireless Configuration
Thanks
@PolynomialDivision
- that was quite helpful in that it prompted me to come up with a way to easily test the neighbour reports. First set up a wpa_supplicant hanging off the AP with the neighbour reports active. Then use the wpa_cli command "neighbor_rep_request" to trigger a request. The mac addresses have been modified. It appears to be working. >neighbor_rep_request OK <3>RRM-NEIGHBOR-REP-RECEIVED bssid=14:xx:xx:xx:xx:c9 info=0x9ef op_class=81 chan=11 phy_type=7 <3>RRM-NEIGHBOR-REP-R…
(OP_CLASS=122, PHY_TYPE=9).
But in my case, the client device does not respond to the roam beacon at all when doing 2.4 to 5. I checked this by running hostapd with the -dd flags and watching the output. When done successfully hostapd will report (among the huge stream of debug info) that the roam request was successful. When I try it with 2.4 to 5ghz, the client doesn't respond to the roam request at all. Silence. Stays connected as is.
Things I have noticed
I got my script banged out for the most part last night, and I noticed a few things.
a) RSSI is a so-so indicator to determine how far the device is from the AP. When the device is in sleep mode (my S7 Edge for example), after a few seconds the wifi will sleep for 10-15 seconds so the RSSI will remain static (for example, -50, right next to my router) even though I have walked away from the AP. Once again, not a wifi internals expert here but I believe there is a way to send a beacon via hostapd and get the client to update their state. ( req_beacon [req_mode=] = send a Beacon report request to a station ). I will look into this later on.
b) The client device (once again, S7 edge in my case) does not like being asked to roam TOO often. Running the hostapd_cli command too many times in sequence causes my S7 to disconnect and switch to LTE.
c) Important, both of the above ONLY APPLY to a sleeping (screen off) device. Screen on? RSSI is updated every second and I can fire off as many roam requests as I wish and the device remains connected.
d) For now what I have up and running... And I understand people want to steer 2.4 to 5ghz, so its not quite that... But what I have setup and running via 2 scripts (one running on the OpenWRT in the living room, one running on my Hytsou H5 mini PC upstairs) is basically when RSSI reaches 70 or less, trigger a roam. For my use case this is perfect. I am able to watch my baby monitor now without any hicups. I get to the bottom of the stairs and RSSI will hit over 70, it'll trigger a roam, and connect to our living room AP. All transparently, without any stop in video or having to restart the (slightly buggy) baby monitor app.
I'm going to figure out the syntax for the "steer to a specific neighbor" and will post here... Thats pretty much the missing piece...
If anyone knows this please post
Also if anyone knows how to use hostapd_cli to send a beacon to the client device (and get an updated RSSI in return) please post

2