GUEST network internet connectivity issues - ASUS RT-AX86U Pro

[JG46]

My GUEST network loses internet connectivity after a period of time (most recently, it failed after three days of working fine.) In the guest network settings, I have “Time Remaining” set to “unlimited.”

Once the guest network loses internet connectivity, I can still connect to its SSID, but there is no internet access. Rebooting the router restores internet connectivity on the guest network, but eventually the same issue appears again.

More info:

• Router is ASUS RT-AX86U Pro running the latest firmware (ending 24198, released Nov 8, 2023).
• I am using guest network index #2, because guest network guest network index #1 does not provide internet access at all. (There are various posts on this forum discussing issues with guest network #1 – the issue seems related to routers that are not on the default factory subnet – this is the case with mine. This appears to be long-standing and well-documented bug, so I don’t know why the issue has not been corrected by ASUS firmware update.)
• A phone conversation with ASUS Level 2 tech support provided no resolution. They requested that I submit my syslog, which I did not do, because I don’t have a good understanding of what information within that syslog should be kept private for security/privacy reasons. Is it safe to share syslog with ASUS?
• ASUS now has a feature called “Guest Network Pro.” I’d like to check this out, because it may contain a setting I can tweak etc. However, I cannot figure out how to access “Guest Network Pro” while logged into my router.
• I am NOT presently running Aimesh, though I would like to, once I get this GUEST network issue figured out!

Thanks for any help!

 

[pjd50]

Some folks think this fix helps/works (it only worked temporarily for me), but you might make more sense of it:

SSH into your router and run the following command:
robocfg vlan 501 ports "1t 2t 3t 4t 7t 8t"

(see: https://www.snbforums.com/threads/rt-ac68p-fios-wan-dropouts-on-386-x.73214/page-2#post-727742 and https://www.snbforums.com/threads/asuswrt-merlin-386-2_6-is-now-available.72962/page-10#post-696360 for an explanation on why this fix is required)

"I can confirm that without removing VLAN 501/502, a DHCP query on the guest network may steal the WAN IP. After removing those VLANs, guest network 1 functions properly. Yes, this bug makes the leaked traffic on the WAN port tagged, but my Fios ONT doesn’t care, and cable modems probably don’t either. They will respond to a DHCP broadcast."

EDIT: you may have to modify since you use Guest Network 2 instead of 1

 

[pjd50]

Also, you will only be able to use AiMesh if you use Guest Network 1.

You also can't use YazFi if you plan to enable AiMesh in later. Otherwise, if you have no strong desire to use AiMesh, check out YazFi script for Guest Network (VLAN-like) management.

Also, I think Guest Network Pro is still in beta, but it is more feature rich: https://www.asus.com/support/FAQ/1049414/

 

[bbunge]

My GUEST network loses internet connectivity after a period of time (most recently, it failed after three days of working fine.) In the guest network settings, I have “Time Remaining” set to “unlimited.”

Once the guest network loses internet connectivity, I can still connect to its SSID, but there is no internet access. Rebooting the router restores internet connectivity on the guest network, but eventually the same issue appears again.

More info:

• Router is ASUS RT-AX86U Pro running the latest firmware (ending 24198, released Nov 8, 2023).
• I am using guest network index #2, because guest network guest network index #1 does not provide internet access at all. (There are various posts on this forum discussing issues with guest network #1 – the issue seems related to routers that are not on the default factory subnet – this is the case with mine. This appears to be long-standing and well-documented bug, so I don’t know why the issue has not been corrected by ASUS firmware update.)
• A phone conversation with ASUS Level 2 tech support provided no resolution. They requested that I submit my syslog, which I did not do, because I don’t have a good understanding of what information within that syslog should be kept private for security/privacy reasons. Is it safe to share syslog with ASUS?
• ASUS now has a feature called “Guest Network Pro.” I’d like to check this out, because it may contain a setting I can tweak etc. However, I cannot figure out how to access “Guest Network Pro” while logged into my router.
• I am NOT presently running Aimesh, though I would like to, once I get this GUEST network issue figured out!

Thanks for any help!

current version of Asus firmware for the AX86U Pro has a bug with Guest Network 1 in that the clients do not get to a DNS server. Enable Intranet access for a temp fix.

 

[pjd50]

You might also try this fix:

The fix is to add the following to your firewall-start script to remove those VLANs from the bridges and switch
Code:
robocfg vlan 501 ports ""
robocfg vlan 502 ports ""
brctl delif br1 eth0.501
brctl delif br1 eth1.501
brctl delif br1 eth2.501
brctl delif br2 eth0.502
brctl delif br2 eth1.502
brctl delif br2 eth2.502

 

[pjd50]

current version of Asus firmware for the AX86U Pro has a bug with Guest Network 1 in that the clients do not get to a DNS server. Enable Intranet access for a temp fix.

Only issue with this - is it entirely defeats a major purpose of the guest network... any guest connecting to guest WiFi will then be able to "see" all his connected devices - it's practically no different than handing out the password to the main WiFi network, right?

 

[JG46]

Some folks think this fix helps/works (it only worked temporarily for me), but you might make more sense of it:


(see: https://www.snbforums.com/threads/rt-ac68p-fios-wan-dropouts-on-386-x.73214/page-2#post-727742 and https://www.snbforums.com/threads/asuswrt-merlin-386-2_6-is-now-available.72962/page-10#post-696360 for an explanation on why this fix is required)





EDIT: you may have to modify since you use Guest Network 2 instead of 1

thanks, but I'm on factory firmware, so I don't think I can do this

 

[JG46]

Only issue with this - is it entirely defeats a major purpose of the guest network... any guest connecting to guest WiFi will then be able to "see" all his connected devices - it's practically no different than handing out the password to the main WiFi network, right?

agree

 

[JG46]

current version of Asus firmware for the AX86U Pro has a bug with Guest Network 1 in that the clients do not get to a DNS server. Enable Intranet access for a temp fix.

a good "temp" fix for sure. If I'm not mistaken this issue is not limited to the newest AX86U Pro firmware. I seem to recall mention of the same issue with other ASUS routers and firmware.

 

[JG46]

That ASUS support link says:

How to setup Guest network pro:​

1. Login to ASUS router settings page(WebGUI) and go to Guest Network Pro page: http://www.asusrouter.com/SDN.asp
2. Click [Add a network]or [Guest Network Quickly build a guest network] to create a Guest network pro.

But, when I type <router_IP_address>/SDN.asp into my browser I get a "404 Not Found" error.

I'd really like to figure out how to access Guest Network Pro, because there may be settings within that would be helpful in fixing my issue.

 

[bennor]

My GUEST network loses internet connectivity after a period of time (most recently, it failed after three days of working fine.) In the guest network settings, I have “Time Remaining” set to “unlimited.”

I'm using Asus-Merlin 3004.388.5 with YazFi and don't experience the loss of Guest Network internet access so long as I (obviously) don't configure the settings to block internet access in the YazFi settings.
Note under the Asus-Merlin firmware I don't see a Time Remaining option under Guest Network, rather I see an Access Time option that is set to Unlimited.

• ASUS now has a feature called “Guest Network Pro.” I’d like to check this out, because it may contain a setting I can tweak etc. However, I cannot figure out how to access “Guest Network Pro” while logged into my router.

Currently for the RT-AX86U Pro the Guest Network Pro feature is only found in the Asus Beta 3.0.0.6.x firmware. It is not in the 3.0.0.4 firmware. If you want Guest Network Pro then see the following firmware:
ASUS RT-AX86U Pro Firmware version 9.0.0.6.102.4856
Version 9.0.0.6.102.4856 Beta Version 55.14 MB 2023/03/21

RT-AX86U Pro｜WiFi Routers｜ASUS Global

AX5700 Dual Band WiFi 6 Gaming Router, Mobile Game Mode, AiProtection Pro, WPA3, Parental Control, Mesh WiFi support, 2.5G Port, Gaming Port, Adaptive QoS, Port Forwarding

www.asus.com

 

[JG46]

Currently for the RT-AX86U Pro the Guest Network Pro feature is only found in the Asus Beta 3.0.0.6.x firmware. It is not in the 3.0.0.4 firmware. If you want Guest Network Pro then see the following firmware:
ASUS RT-AX86U Pro Firmware version 9.0.0.6.102.4856
Version 9.0.0.6.102.4856 Beta Version 55.14 MB 2023/03/21

RT-AX86U Pro｜WiFi Routers｜ASUS Global

AX5700 Dual Band WiFi 6 Gaming Router, Mobile Game Mode, AiProtection Pro, WPA3, Parental Control, Mesh WiFi support, 2.5G Port, Gaming Port, Adaptive QoS, Port Forwarding

www.asus.com

Thanks, seems odd that a "beta" firmware that is 9 months old contains Guest Network Pro, whereas the one-month-old firmware I'm running does not.

 

[bennor]

Thanks, seems odd that a "beta" firmware that is 9 months old contains Guest Network Pro, whereas the one-month-old firmware I'm running does not.

It is expected behavior with Beta firmware. Asus has not moved the RT-AX86U Pro to the 3.0.0.6.x release version firmware like they have with the RT-AX88U Pro. Hopefully they will move the RT-AX86U Pro to the 3.0.0.6.x release firmware line sometime soon.

 

[JG46]

I'm using Asus-Merlin 3004.388.5 with YazFi and don't experience the loss of Guest Network internet access so long as I (obviously) don't configure the settings to block internet access in the YazFi settings.
Note under the Asus-Merlin firmware I don't see a Time Remaining option under Guest Network, rather I see an Access Time option that is set to Unlimited.

Also, you will only be able to use AiMesh if you use Guest Network 1.

You also can't use YazFi if you plan to enable AiMesh in later. Otherwise, if you have no strong desire to use AiMesh, check out YazFi script for Guest Network (VLAN-like) management.

So, it seems I can only get YazFi if I run Merlin. And it further seems that I can not run AiMesh, if I am running YazFi. Am I understanding correctly? If so, it's a bummer because Merlin/Yazri sounds like a good solution, but I really want to eventually run AiMesh so that my guest network will be available through an access point in a remote location.

 

[JG46]

What about GN2 or 3?

I am using GN2, see OP

 

[bennor]

And it further seems that I can not run AiMesh, if I am running YazFi. Am I understanding correctly?

Yes. YazFi does not support AiMesh.

 

[pjd50]

I'm using Asus-Merlin 3004.388.5 with YazFi and don't experience the loss of Guest Network internet access so long as I (obviously) don't configure the settings to block internet access in the YazFi settings.
Note under the Asus-Merlin firmware I don't see a Time Remaining option under Guest Network, rather I see an Access Time option that is set to Unlimited.

Yes, I think there is no issue with YazFi - YazFi works. BUT it won't work if you are utilizing AiMesh.

 

[pjd50]

So, it seems I can only get YazFi if I run Merlin. And it further seems that I can not run AiMesh, if I am running YazFi. Am I understanding correctly? If so, it's a bummer because Merlin/Yazri sounds like a good solution, but I really want to eventually run AiMesh so that my guest network will be available through an access point in a remote location.

Yes that is correct. I just assume everyone is running Merlin, so I forget that some people use stock! I see no reason to use stock and have stuck with Merlin for years.

YazFi would be perfect if AiMesh could be implemented - but I think the underlying code makes that too difficult.

Apparently, also, YazFi is no longer in active development.

I am not sure, but I think Guest WiFi PRO *does* work on AiMesh.

 

[JG46]

I just checked my router syslog and learned that a wireless printer was CONSTANTLY going through a cycle of Auth, ReAssoc, Deauth. I don't know why the printer was doing this, and I don't know if this contributed to my GUEST network internet connectivity issues. The printer was on the main (not guest) network, BUT it was on the 2.4GHz WiFi band, which happens to be the only band that I activated for GUEST. Coincidence, perhaps? At any rate, I've removed the printer from the network.

More generally, this thread has got me thinking about how to have a GUEST network that has its own printer. When I configure GUEST, I always set it to disallow INTRAnet access. However, if I want to a device on the guest network to "see" a printer, then I cannot simply categorically deny INTRAnet access. Connected devices would all need to be able to see the printer. Maybe the ability to print in this manner lies in the beta Guest Network Pro feature? If not, then how else could I achieve this goal?

 

[pjd50]

If you enable intranet access on the guest network, then it’s no different from the guest having access to your main WiFi network/LAN. The only functional difference is they connect to a different SSID with its own password (maybe you don’t want to share the password of your main WiFi network SSID?)

Ideally you need a printer connected to the guest network AND disable client isolation on the guest network.

A normal guest network not only separates devices connected to it from your main network, but also isolates EACH client connected to the guest network from every other client connected to the guest network.

I think what you really want to accomplish is having two LANs - you should explore creating VLANs.