# OWE silently broken on Flint3

**URL:** <https://forum.gl-inet.com/t/owe-silently-broken-on-flint3/67660>\
**Category:** Router\
**Created:** [March 16, 2026, 4:58pm UTC](https://forum.gl-inet.com/t/owe-silently-broken-on-flint3/67660 "2026-03-16T16:58:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![klaaspieter](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/k/e99b99/32.png) [@klaaspieter](https://forum.gl-inet.com/u/klaaspieter)\
**Post date:** [March 16, 2026, 4:58pm UTC](https://forum.gl-inet.com/t/owe-silently-broken-on-flint3/67660/1 "2026-03-16T16:58:56Z")

</div>

Device: GL-BE9300 (Flint3)  
Firmware: 4.8.4 (OpenWrt 23.05-SNAPSHOT)

Setting `encryption='owe'` on a wifi-iface produces an open network with `wpa=0` in the generated hostapd config. The network appears to work but has no encryption.

The issue is in `/lib/wifi/hostapd.sh.` The fix\_iface function handles `sae`, `sae-mixed`, `psk-mixed`, and `psk2`, but has no case for `owe`. The `encryption='owe'` value passes through unrecognized and the script falls through to generating an open network config.

Upstream [OpenWrt's hostapd.sh](https://github.com/openwrt/openwrt/blob/598c4b7fde1240d8d64386e4162a41270f865c30/package/network/config/wifi-scripts/files/lib/netifd/hostapd.sh) handles `encryption='owe'` as a first-class option. It sets `wpa=2`, `wpa_key_mgmt=OWE`, `ieee80211w=2`, and `rsn_pairwise=CCMP` automatically. The fork is missing this.

Workaround:  
Instead of `encryption='owe'`, use:

```auto

uci set wireless..encryption='ccmp'
uci set wireless..owe='1'
uci commit wireless
wifi

```

This uses the existing `owe` boolean flag that the script already supports (line 330 / line 980 in hostapd.sh) and correctly generates a hostapd config with `wpa=2`, `wpa_key_mgmt=OWE`, and `ieee80211w=2`.

Proper fix:  
Add an `owe)` case to the `fix_iface` function in `/lib/wifi/hostapd.sh`, similar to how `sae` is handled:

```auto
owe)
    config_set "$section" encryption "ccmp"
    config_set "$section" 
    owe "1";;

```

Or sync the encryption handling with upstream OpenWrt which has full native OWE support.

---

<div class="post-metadata">

**Author:** ![will.qiu](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/w/b38774/32.png) [@will.qiu](https://forum.gl-inet.com/u/will.qiu)\
**Post date:** [March 17, 2026, 9:22am UTC](https://forum.gl-inet.com/t/owe-silently-broken-on-flint3/67660/2 "2026-03-17T09:22:08Z")

</div>

Hi

Thank you for your report.

We’ll check with our development team to see if this can be addressed in a future release.

---

<div class="post-metadata">

**Author:** ![system](https://forum-static.gl-inet.com/original/3X/7/7/77e28f6cb342ac4bd641bd9a6254595d61b2812a.png) [@system](https://forum.gl-inet.com/u/system)\
**Post date:** [July 22, 2026, 10:23am UTC](https://forum.gl-inet.com/t/owe-silently-broken-on-flint3/67660/5 "2026-07-22T10:23:49Z")

</div>

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.