IoT Guest network issue (anyway script to create guest network?)

[Noodle05]

Hi Team,

I have a RT-AX86U Pro main router with 3 AC-68U as Mesh nodes. All running latest asuswrt-merlin firmware.
RT-AX86U Pro: 3006.102.5
RT-AC-68U: 3004.386.14_2

I have two guest networks, one for IoT, one for Guests.
IoT guest network was created as IoT from WebUI but with different subnet.
IoT guest network is 2.4G only and replicate to all mesh nodes.
Guest network using different subnet, 2.4G/5G, but not replicate to any mesh nodes.

Start from day one, I'm facing issue with Guest network. After just create guest network, everything was working, all my IoT devices can connect to IoT guest network without problem. But after few days or weeks, new IoT devices cannot connect to IoT network anymore. For example if I got a power outage, some of IoT devices will not able to connect (even after reboot the device of cause).
I tried to reboot router, reduce DHCP lease time to 7200 seconds (from 86400 seconds), but that not helping. I also tried to disable and re-enable all guest network every week, not helping either.
I did some research, the suggestions are either schedule a reboot router weekly, disable/enable guest network weekly, reduce DHCP lease time, but so far none of them helped.

So far the only way I found that helps is: Remove all Guest network, reboot router, re-create all Guest network.

Anybody having similar issue? How do you fix it?

I'm also considering to automate my solution (delete guest network, reboot router, re-create guest network) weekly. Is there any script that I can use to create guest network?

Thank

 

[jksmurf]

Specifically for my wireless IoT devices, Amazon Echos, Shelly Switches, Sensibo Sky devices, ESP32 BT Proxy devices, LG Fridge, Samsung Dryer etc, what works for me for connecting, staying connected or reconnecting without issue when they fall off the Wi-Fi, are these settings:

• Use WPA2 Personal for Security; quite often my older devices cannot connect to WPA2/WPA3, even though the WPA2 part should work. Not ideal from a security perspective but I couldn’t get the reliability I wanted any other way.
• Use 2.4GHz only.
• Do NOT hide the IoT SSID; this has helped with reconnects.

For Amazon Echos, go to your Amazon account and delete all but your IoT network as the remembered SSID.

Rarely but possible, I understand that very old IoT devices might not be able to handle complex passwords, so you could try a simple one on one of those first, to see if that helps, before changing all your devices. I do not personally have devices with this issue.

 

[Noodle05]

I have all those settings. WPA2 Personal security, 2.4G only and not hide IoT SSID.

I have reasonable complex password, but if the password is an issue here, it shouldn't be able to to connect to IoT wifi at first place, isn't it?

 

[jksmurf]

I have all those settings. WPA2 Personal security, 2.4G only and not hide IoT SSID.

Hmm OK. Was posting what works for me as an IoT device user, with my router setups (sig) on what IoT devices, in my specific environment. Unfortunately it seems like those recommended settings do not work for you, but it’s good to rule them out.

One of my two systems uses Ethernet backhaul so the 2.4GHz and 5GHz channels are both free. The other uses 5GHz wireless backhaul, meaning the 2.4GHz is free. I’m not sure what the RT-AC68U capabilities are but apparently:

“The Asus RT-AC68U has one 2.4 GHz radio band and one 5 GHz radio band, operating simultaneously as a dual-band router. It uses a single physical radio for the 2.4 GHz frequency.

While it only has one 2.4 GHz band, the router supports up to three separate guest networks over that same 2.4 GHz band, each with its own SSID (network name), security settings, and access limits. These guest networks all run through the single physical 2.4 GHz radio. “

I would need someone more knowledgeable and experienced than I to comment further but intuitively, if the IoT devices are falling off nodes connected via 2.4GHz and the backhaul is 2.4GHz and primary (and the second guest network) also uses 2.4GHz, perhaps there’s simply too high a demand on that one band?

Maybe post logs and System Log, Wireless Log screens (blank personal info) so others can check what your setup looks like? Also the AiMesh devices list in the GNP setup, see pic below.

I assume you are using GNP? Are you using 5GHz as backhaul?

I have reasonable complex password, but if the password is an issue here, it shouldn't be able to to connect to IoT wifi at first place, isn't it?

Sounds a fair conclusion, yes.

 

[jksmurf]

btw perhaps try putting stock on all the nodes and see if that helps? You don’t really need Merlin on them, although it doesn’t hurt.

Release - ASUS RT-AC68U / RT-AC66U B1 / RT-AC1900(P/U) Firmware version 3.0.0.4.386_52062 (2025/10/27)

Version 3.0.0.4.386_52062 99.39 MB 2025/10/27 - Enhanced system stability. - Enhanced input validation and refactored legacy string handling routines to ensure robust memory management. - Mitigated security risks in AiCloud service by enforcing strict credential verification, implementing...

www.snbforums.com

 

[CaptainSTX]

Hi Team,

I have a RT-AX86U Pro main router with 3 AC-68U as Mesh nodes. All running latest asuswrt-merlin firmware.
RT-AX86U Pro: 3006.102.5
RT-AC-68U: 3004.386.14_2

I have two guest networks, one for IoT, one for Guests.
IoT guest network was created as IoT from WebUI but with different subnet.
IoT guest network is 2.4G only and replicate to all mesh nodes.
Guest network using different subnet, 2.4G/5G, but not replicate to any mesh nodes.

Start from day one, I'm facing issue with Guest network. After just create guest network, everything was working, all my IoT devices can connect to IoT guest network without problem. But after few days or weeks, new IoT devices cannot connect to IoT network anymore. For example if I got a power outage, some of IoT devices will not able to connect (even after reboot the device of cause).
I tried to reboot router, reduce DHCP lease time to 7200 seconds (from 86400 seconds), but that not helping. I also tried to disable and re-enable all guest network every week, not helping either.
I did some research, the suggestions are either schedule a reboot router weekly, disable/enable guest network weekly, reduce DHCP lease time, but so far none of them helped.

So far the only way I found that helps is: Remove all Guest network, reboot router, re-create all Guest network.

Anybody having similar issue? How do you fix it?

I'm also considering to automate my solution (delete guest network, reboot router, re-create guest network) weekly. Is there any script that I can use to create guest network?

Thank

Some very old IoT devices seem to only able to connect or maintain connections if in addition to WPA you enable TKIP-AES encryption which unfortunately doesn't seem to be supported anymore on ASUS routers running Merlin but I'm not sure about stock firmware. While you can select TKIP the firmware doesn't actually enable TKIP.

If you are worried about the depreciated security from running WPA/WPA2 then you might want to consider using an older router with older firmware as an AP and use this AP just for some of your IoT using the older depreciated security protocols, while running the more secure protocols on your main network for newer devices that support enhanced security.

Wi-Fi security is only a problem if you live someplace where you have reason to believe someone is going to hack into your system or mooch free Internet service. Running the older degraded security on my IoT AP I protect my AP's network with a strong passwords both for both the AP and its Wi-Fi. In addition I restrict the IP pool on the AP to two addresses. Finally the AP is on a VLAN on my main router which protects my primary router.

 

[Tech9]

RT-AC68U have much newer stock firmware than the last Asuswrt-Merlin. Suggesting the use of latest stock firmware on the nodes. It may contain updates/changes to AiMesh closed source components. The old routers can propagate single GN per band. Suggesting replacement with RT-AX57 Go down the road. It's cheap, compact, AX-class, runs 3.0.0.6 firmware and supports Guest Network Pro.

 

[Noodle05]

Thank you guys for your reply. I will give stock firmware on RT-AC68Us a try. Will report back.

BTW, the backhaul to all three RT-AC68Us are ethernet.

 

[Tech9]

Your issue with device connection may go beyond available settings in AiMesh. Four routers with high-power 2.4GHz radios on the same channel may cause the connection issues you are experiencing. Signal too strong from a near AP with increased interference from distant APs may be seen as not good connection option. I have 4x APs on my home network and they run 2.4GHz radios at 13dBm (16dBm EIRP) or 20mW. Asus routers are set default at minimum of 100mW for 2.4GHz radio. You have 400mW or more on this band on relatively small area. This is a lot of Wi-Fi noise around. AiMesh doesn't scale well and if you really need 4x APs or more - explore better options.

 

[Noodle05]

Good point @Tech9. One question, if too much wifi noise is the issue, will it be the issue when first create guest network?

 

[Tech9]

I don't know when exactly the propagation to nodes happens. You may have a short period of time when your main router only is broadcasting the GN and then the nodes follow. This script with deleting, re-creating, rebooting etc. is not a solution. Rebooting the system to keep it going is a band-aid solution already. You have to find a permanent solution. I would start with removing nodes first. You perhaps have too much Wi-Fi and it doesn't make your network better. Don't re-use old routers just because you have them.

 

[Noodle05]

I think you are right, let me remove one of two nodes and give it a try.

 

[Tech9]

Your next step is to break this love/hate relationship with IoTs, convert your AiMesh Nodes to routers in AP Mode, run different channels on reduced power (available in AP Mode), connect the IoTs to your main network. You lose the Guest Networks, but gain stability and more time in your life. The IoTs won't hack your bank account. Just don't bring home random no-name ones.

 

[bennor]

The following Asus support document may, or may not, be relevant to the discussion. Of note is the quoted section below.
[Wireless Router] How to set up Guest Network features to Sync to AiMesh node?

Guest network is currently designed to allow the first set of each band (2.4G, 5G, 5G-1) available to the AiMesh node. Only one set is available for each band.

 

[CaptnDanLKW]

@Noodle05 IDENTICAL problem.
See my post

Story Time! Made the jump to 3006 - Everything good until...

I feel like every time I post something, its a looong story. Previous config - AX86UPro - 388.8_4 AC86U - 386.14_2. Stable for year(s) (before AX86U Pro, I was 2x AC86U in the identical setup) Environment: I live in a very low-density area 5-6 other networks seen, all on the fringe of range...

www.snbforums.com

This oddity started when I made the jump to 3006.102.5. I assumed it had something to do with the big version differences and when a node would go offline the code that keeps things 'in sync' has issues. (FWIW, when my AX86Pro was on 388.x code absolutely zero issues.)

(comment on your statement): "So far the only way I found that helps is: Remove all Guest network, reboot router, re-create all Guest network."
The other way I could force thing back to normal would be to go into GNP, de-select the option to remove the nodes from the AI Mesh section, then reenable them)

That said, about 20 minutes ago I finished installing a new BE86U, moving my AX86UPro over to a node and removing 1 of my old AC86Us.. still had to leave 1 remaining AC86U for a remote building that on the fringe of overlapping with the house.

It's too soon but I hope this solves my issues.