Can't Connect to Wifi when VPN Enabled

Using Flint2 MT-6000. Having a weird issue that came up where if I have a VPN enabled, devices can not connect to wifi. Devices already connected to the wifi when the VPN is enabled are unaffected.

I have to connect via ethernet and turn off the VPN for my wifi devices to connect, the re-enable the VPN.

Any ideas whats causing this? It didn’t always happen. I was on 4.8.3 and just updated to 4.9.0 in hopes it would fix this issue, but still happening. When I updated I did keep the existing settings so that may be a hint.

Hi

That sounds a bit unusual. In theory, the VPN should not affect the Wi-Fi functionality.

Could you please help clarify or provide the following information?

  1. When the issue occurs, what exactly happens on the Wi-Fi client when it tries to connect to the MT6000?

    • Is it unable to connect to the Wi-Fi network at all?
    • Or does it connect successfully but have no Internet access, or disconnect again shortly afterward?
  2. Could you please provide the following Admin Panel screenshots so that we can better understand your current configuration?

    • VPN → VPN Dashboard
    • Wireless
  3. When the issue occurs, please try connecting the Wi-Fi client to the MT6000 several times, then export the router logs and send them to us via private message so that we can investigate further.

    How to export logs:

    How to send private messages:

Wifi. I dont use 2.4G

It’s intermittent so i’ll post that log data when I can.

When the issue occurs, what exactly happens on the Wi-Fi client when it tries to connect to the MT6000?

Hi

Thank you for the update.

We'll investigate further once we receive your logs.

Also, based on your description, it sounds like the affected devices are able to connect to the Wi-Fi, but fail to obtain an IP address.

If so, it would also be helpful to SSH into the router and run the following command to check whether the DHCP service is still operating correctly:

netstat -napl | grep dnsmasq

sent logs to you. I also ran that command but im not sure wat im looking for. seems nornal

Thank you for providing the logs.

We found that the ports used by dnsmasq are being occupied by another process, which prevents dnsmasq from starting properly.

Could you please SSH into the router, run the following command, and share the output with us so we can identify which process is using those ports?

netstat -anpl | grep ':67\|:53'

Solved the issue

**
Issue:**
After updating/running GL-MT6000 on firmware 4.9.1, devices were failing to connect properly to Wi-Fi. The SSID was visible, but clients were not getting a valid DHCP lease.

Relevant log errors:

dnsmasq: failed to bind DHCP server socket: Address in use
dnsmasq: FAILED to start up

I also saw repeated Wi-Fi interface/path messages like:

del path: ra0(DN)->apcli0(UP), active path:0
add new: ra0(UP)->apcli0(UP), active path:1

Root cause found:
The router had multiple dnsmasq instances running for WireGuard client interfaces:

ps w | grep '[d]nsmasq'

Output showed wgclient1 and wgclient2 dnsmasq instances. Checking DHCP port usage confirmed that the WireGuard client dnsmasq processes were binding to UDP port 67 globally:

netstat -lunp | grep ':67'

Problem output looked like:

udp 0 0 0.0.0.0:67 0.0.0.0:* 28443/dnsmasq
udp 0 0 0.0.0.0:67 0.0.0.0:* 28442/dnsmasq

Because those VPN-related dnsmasq instances were already holding DHCP port 67, the normal LAN DHCP server could not start. That caused clients to fail when connecting because they could not receive DHCP leases.

Fix:
I set the WireGuard client dnsmasq instances to use nonwildcard=1, then restarted dnsmasq cleanly:

uci set dhcp.wgclient1.nonwildcard='1'
uci set dhcp.wgclient2.nonwildcard='1'
uci commit dhcp

/etc/init.d/dnsmasq stop
killall dnsmasq
rm -f /var/run/dnsmasq/*.pid
sleep 2
/etc/init.d/dnsmasq start

Then I verified DHCP port 67:

netstat -lunp | grep ':67'

After the fix, only one normal dnsmasq process was listening on DHCP:

udp 0 0 0.0.0.0:67 0.0.0.0:* 9701/dnsmasq

Devices immediately started connecting again and receiving DHCP leases.

Summary:
The issue was not the client devices. On GL-MT6000 firmware 4.9.1, the WireGuard client dnsmasq instances were binding to DHCP port 67 on 0.0.0.0, preventing the main LAN DHCP server from starting. Setting nonwildcard='1' on the wgclient1 and wgclient2 dnsmasq sections fixed the conflict.

1 Like

Hi,

We’re glad to hear that the issue has been resolved, and thank you for sharing the troubleshooting process and the solution.

We also checked this locally. By default, the dnsmasq instance configuration used for VPN does not enable nonwildcard, so this may have been caused by a previous configuration or another program modifying it by mistake.

In any case, we’re glad to hear that the issue has been resolved.

1 Like