fix(openwrt): surface the same-channel requirement in fips-mesh-setup and the backhaul guide

Field-tested on real hardware: two routers with default channel
settings silently never peer, because mesh points only peer on the
same channel and 'auto' lets each radio pick its own. The script now
prints the radio's band/channel, warns loudly on 'auto' with the
exact uci command to pin one, and the how-to gains an ordered no-peers
triage (channel mismatch first, then an on-air scan check, DFS CAC
wait, and regdomain).
This commit is contained in:
Arjen
2026-07-02 15:19:28 +02:00
parent 413cb8216a
commit e5c484b990
2 changed files with 50 additions and 6 deletions

View File

@@ -70,9 +70,21 @@ fips-mesh-setup radio1
This creates an open 802.11s interface named `fips-mesh0` with mesh ID
`fips-mesh` and HWMP forwarding off, attaches it to an unmanaged
netifd interface (no IP configuration — none is needed), and reloads
the radio. Pass a second argument to use a different mesh ID; all
routers in one backhaul must share the same mesh ID and be on the
same channel (which follows the radio's existing channel setting).
the radio. Pass a second argument to use a different mesh ID.
**Pin the same channel on every backhaul router.** Mesh points only
peer on the same channel, and the mesh inherits whatever the radio is
set to — with `channel 'auto'` (the default on many devices) each
router picks its own and the mesh silently never forms. The script
prints the radio's current band and channel and warns on `auto`:
```sh
uci set wireless.radio1.channel='36'
uci commit wireless && wifi reload
```
Prefer a non-DFS channel (3648 on 5 GHz): on DFS channels the radio
must wait ~60 s in CAC before transmitting after every reload.
Equivalent manual UCI, if you prefer to see what it does:
@@ -133,8 +145,25 @@ iw dev fips-mesh0 station dump
```
You should see one station entry per neighbor router, with signal
levels. No entries means a radio problem (channel mismatch, mesh ID
mismatch, range), not a FIPS problem.
levels. No entries means a radio problem, not a FIPS problem — triage
in this order:
1. **Channel mismatch** (the most common cause): compare
`iw dev fips-mesh0 info` on both routers — mesh ID *and* channel
must match exactly.
2. **Is the other router transmitting at all?**
```sh
iw dev fips-mesh0 scan | grep -i -B4 "MESH ID"
```
Its mesh ID visible → transmission works, peering is failing
(mesh ID typo, or one side has encryption set). Nothing visible →
check `wifi status` on the other router, remember the ~60 s DFS
CAC wait, and confirm the country code is set
(`uci get wireless.radio1.country`) — an unset regdomain can
block channels entirely.
3. `logread | grep -iE "mesh|fips-mesh0"` on both sides.
Then the FIPS layer on top:

View File

@@ -94,6 +94,18 @@ if [ "$(uci -q get "wireless.$RADIO.disabled")" = "1" ]; then
uci -q delete "wireless.$RADIO.disabled"
fi
# The mesh inherits the radio's channel, and mesh points only peer on the
# same channel. 'auto' lets each router pick its own — the classic silent
# non-peering cause — so surface the setting loudly.
CHANNEL="$(uci -q get "wireless.$RADIO.channel")"
BAND="$(uci -q get "wireless.$RADIO.band")"
if [ -z "$CHANNEL" ] || [ "$CHANNEL" = "auto" ]; then
echo "Warning: $RADIO channel is '${CHANNEL:-unset}' — each router may" >&2
echo "auto-select a different channel and mesh points only peer on the" >&2
echo "same one. Pin the same channel on every backhaul router, e.g.:" >&2
echo " uci set wireless.$RADIO.channel='36' && uci commit wireless && wifi reload" >&2
fi
# ---------------------------------------------------------------------------
# Network: unmanaged interface so netifd brings the netdev up. No IP config —
# the FIPS Ethernet transport speaks raw frames on it.
@@ -108,7 +120,10 @@ uci commit network
wifi reload
cat <<EOF
Created open 802.11s mesh '$MESH_ID' as $MESH_IFNAME on $RADIO.
Created open 802.11s mesh '$MESH_ID' as $MESH_IFNAME on $RADIO \
(band ${BAND:-?}, channel ${CHANNEL:-auto}).
ALL routers in this backhaul must share this mesh ID AND channel.
Next steps:
1. Restart the daemon (the shipped /etc/fips/fips.yaml already binds