Interesting issue on Asus RT-AX88U & RT-AC86U

[TechKrot]

Hi,
I would like to share my experience with issue, I am facing on various firmwares and on the following models: AX88U; AC86U.
The latest firmware I've tested is Asus 3.0.0.4.384.7968 & Merlin 384.14_0
Looks like the bug is migrating with Asus firmware from device to device.
The same setup is perfectly working only on AC68U but the hardware of this device is too poor for my 300Mbit L2TP connection and I am trying to migrate on new device.

So, the issue appears when using Internet on device connected via the WiFi. Internet disappearing for 1-2 minutes and then comming back.
At the same time Internet from wired device is working perfectly.
At the same time connections to other local hosts through WiFi are working perfectly.
And even connection from problematic WiFi client through OpenVpn connection at other site is also working.

So it is not the issue of WiFi or Internet provider.
It's something between WAN & WiFi
For better understanding, I am attaching diagramm.
Any advice or suggestions on how to fix it is strongly appreciated.

 

[TechKrot]

BTW, if somebody is interested, the issue could be easealy reproduced in current config within 5mins by loading the router with simple speedtests.
For me it looks like some service is simply hanging and then restarting after some timeout because the length of the issue is of the same time.
But unfortunately I am not deep expert in this.

Below are the errors from event log:

Dec 27 19:38:09 vpnserver1[26127]: client/188.191.165.205:33659 AEAD Decrypt error: bad packet ID (may be a replay): [ #4210164 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Dec 27 19:38:09 vpnserver1[26127]: client/188.191.165.205:33659 AEAD Decrypt error: bad packet ID (may be a replay): [ #4210165 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Dec 27 19:38:09 vpnserver1[26127]: client/188.191.165.205:33659 AEAD Decrypt error: bad packet ID (may be a replay): [ #4210166 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Dec 27 19:38:09 vpnserver1[26127]: client/188.191.165.205:33659 AEAD Decrypt error: bad packet ID (may be a replay): [ #4210167 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Dec 27 19:38:09 vpnserver1[26127]: client/188.191.165.205:33659 AEAD Decrypt error: bad packet ID (may be a replay): [ #4210168 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Dec 27 19:38:09 vpnserver1[26127]: client/188.191.165.205:33659 AEAD Decrypt error: bad packet ID (may be a replay): [ #4210169 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Dec 27 19:38:09 vpnserver1[26127]: client/188.191.165.205:33659 AEAD Decrypt error: bad packet ID (may be a replay): [ #4210170 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings


For me the most strange thing that access through OPEN VPN tunnel which is built through the same WiFi and L2TP connection to internet is working perfectly during the issue. Only direct traffic to internet is affected.

 

[TechKrot]

tested randomly previous versions of official firmware (3.0.0.4_384_6436) - the bug is there as well.
The finding is that after firmware upgrade, device is working quite stable for first 20-30mins but then the issue starting to appear quite often.
Looks like something is overflowing.. hard to say
Hope here we have the people who can look into it and fix in next versions of firmware. Would be disapointing to refuse from Asus devices and recently purchased AX88U only because of this issue. While purchasing, I was thinking that at least in new device it's solved but looks like not..
Unfortunately, official Asus support ignored all my tickets which I raised for the same bug in AC86U
Now, I've submitted new ticket for last firmware on AX88U but honestly, not sure that they are going to look into this.

 

[TechKrot]

Anybody here who faced something similar? I could assume that this is appearing when using a combination of openvpn tunnel to other site and l2tp method of internet connection. (but not sure 100%)
@RMerlin in case at some point of time you will be looking into this, please keep in mind that the same setup is working perfectly on any firmware for AC68U. Probably you know better, what fundamentali changed since that time..

 

[RMerlin]

The RT-AX88U is currently based on a different code base, generally lagging behind the codebase used by more mainstream models such as the RT-AC68U. Not all fixes done to the mainstream code is being applied to the AX code.

 

[TechKrot]

Thanks for explanation Merlin.
I really hope that it will be fixed at some point of time in some version of your firmware.
I was waiting for more than one year when it will be fixed on AC86U but gave up at the end and was hoping that it is working on new AX88U, so decided to purchase this device and faced the same issue on it
As this configuration is unvoidable for me, I will revert to my old AC68U and will be waiting for good news.
In case you will be looking into this and need some help with testing ot any logs/config files for analysis, I will be happy to help.

 

[RMerlin]

Based on your symptoms, I'd say the problem is with your setup, not with the firmware. I have an RT-AX88U, and have zero Internet stability issues.

 

[TechKrot]

Maybe I am wrong but I would not say that it is issue of internet stability. It's something in routing between WAN and WiFI.
Wired hosts of AX88U are working stable with this l2tp internet conection
WIFI clients of AX88U are also working stable with wired hosts of AX88U
Even connection from WiFi client to remote OPENVPN host is stable. (OPENVPN is established through the same internet connection)
Only public internet resources become unavailable quite often on WiFI clients.
And as I've mentioned, 100% similar config is working perfectly on AC68U.

P.S.
So for example, if I switch off RADIO module on AX88U and connect AC68U to AX88U as a client, I can work with internet perfectly by connecting to AC68U through WiFI.
Because in this case AC68U is wired client for AX88U.

 

[RMerlin]

The first thing I would check is if those clients still have access to the router while the issue occurs. If yes, then next thing to check would be the DNS setup, or your routing.

If access is also lost to the router itself, then troubleshoot the wifi settings - there are a number of recommendations posted on the forums.

 

[TechKrot]

Access to the router is working from problematic WiFi client during the issue.
Access to the local hosts is also working from problematc WiFi client during the issue.

In regards of DNS, I am attaching the screens with DNS settings (both for WAN and DHCP)
Not sure what to provide. (please specify)

However, the same public internet host could be reached from any wired clent of AX88U without the problem during the issue on wireless client. So AX88U is able to resolve the name of the host I am pinging during the issue on wired clients. The packets are lost only on all WiFI clients.

 

[RMerlin]

No other idea, sorry. I do know that Asus has been making a number of fixes to L2TP support these past few months, so maybe one of the fixes also introduced a new issue on the WAN side. I just can't think of any logical explanation why it would only affect wifi clients however.

 

[TechKrot]

Ok, anyway thanks for your support and happy new year!
I've logged one more ticket to Asus support - let's see what will be the outcome

 

[deepworm]

Anybody here who faced something similar? I could assume that this is appearing when using a combination of openvpn tunnel to other site and l2tp method of internet connection. (but not sure 100%)

Hello,@TechKrot! I have the same issue with ASUS RT-AX88U.
I have already returned two routers back to the store. Unfortunately, the ASUS support service could not help me. Wireless packets get lost inside the ASUS RT-AX88U
Have a look at here

and here - SSH terminal has no issues, but wireless ICMP packets are lost

WAN Connection type: L2TP

Firmware versions:
3.0.0.4.384 6210 (by ASUS)
3.0.0.4.384 7968 (by ASUS)
384.14 14-Dec-2019 (by Merlin)

Hardware revision:
HW Ver: A1.1

 

[podkaracz]

Hello,@TechKrot! I have the same issue with ASUS RT-AX88U.
I have already returned two routers back to the store. Unfortunately, the ASUS support service could not help me. Wireless packets get lost inside the ASUS RT-AX88U
Have a look at here

and here - SSH terminal has no issues, but wireless ICMP packets are lost

WAN Connection type: L2TP

Firmware versions:
3.0.0.4.384 6210 (by ASUS)
3.0.0.4.384 7968 (by ASUS)
384.14 14-Dec-2019 (by Merlin)

Hardware revision:
HW Ver: A1.1

Keep digging once you find solution people like you maybe make asus treat their products/customers serously where half of the features and router performance is working like crap on latest firmwares.