Best Of
Re: arp reply restricted
Hi @crispy
Please help to use this command to reach your goal in current firmware:
system network-stack ipv4 arp-ignore check-interface-and-subnet
Here is the configure steps:
usgflex700h> edit running usgflex700h running config# system network-stack arpseal enabled false usgflex700h running config# system network-stack ipv4 arp-ignore check-interface-and-subnet usgflex700h running config# commit usgflex700h running config# copy running startup Overwrite startup configuration? [y/N] y
P.S. We will update the CLI reference guide in the future. You may follow Security Gateway New Release - Zyxel Community category to receive the news.
Re: arp reply restricted
Hi @p4_greg
edit running
system network-stack arp-seal enabled false
system network-stack ipv4 arp-ignore check-interface-and-subnet
commit
Captive Portal – External Portal
USG FLEX H Series Firewall has introduced support for External Captive Portals in its latest firmware updates, giving administrators the freedom to design and host their own custom login pages. This feature is especially valuable for businesses, hotels, schools, and public venues seeking a branded, flexible authentication experience.
This article walks through how the External Portal option works, how to configure it, and how traffic flows between clients and the firewall during authentication.
1. What Is an External Captive Portal?
By default, Captive Portal uses internal hosting, where the login page is served directly by the firewall. With the new External Portal option, administrators can redirect users to a custom web server for authentication.
2. How to Configure an External Portal
To configure the firewall for external portal redirection:
- Go to Captive Portal > Authentication Policy > Policy
- Under Portal Type, select External
- Enter the URL of your external web server (e.g., https://yourwebserver.com/portal.html)
Note: The external portal must be designed to handle HTTP requests and relay successful authentication responses back to the firewall.
3. External Portal Template Files
Zyxel provides sample HTML templates for building your own external login pages.
- It is not available for download directly from the firewall.
- Planned future support to download templates from Nebula Cloud
4. Traffic Flow: How External Portal Redirection Works
Here's how traffic flows when Click to Continue is used with an External Portal:
- Client access the internet via a browser
- The firewall redirects HTTP requests to a default IP (typically 6.6.6.6)
- Firewall then forwards the request to the external portal URL
- The external page loads in the client’s browser
- User clicks the “Agree” button on the custom page
- The page sends a confirmation request back to the firewall
- Firewall validates the request, authenticates the client
- Client is allowed internet access
This flow ensures that user traffic is authenticated and still processed through the firewall, even though the login page is hosted externally.
5. Understanding the External Portal URL Structure
When redirected to the external portal, the URL seen in the browser has several components:
Example URL Structure: http://192.168.169.33:1180/?url=https%3A%2F%2F6.6.6.6%3A1443/CP_agree.cgi&mp_idx=cp1
- http://192.168.169.33:1180: IP or domain of your external portal
- 6.6.6.6: IP of the firewall's redirect server, it is the callback URL.
- CP_agree.cgi: Script used to communicate back to the firewall for authentication
- cp1, cp2, etc.: Identifier for the Captive Portal policy rule being used
These components allow the firewall to track the session and apply the correct Captive Portal rules during and after authentication
Re: XGS1930 and MAC filtering on a port
Hi @Venta
We do have a topic for this, but we currently don't have an ETA.
Additionally, I have created an idea post to monitor the requirements on this function:
Restrict access on this special switch port to only some MAC-Addresses on Nebula — Zyxel Community
We will monitor the comments and votes of this link the evaluate it.
Re: GS1900-24EP get MAC of device connected to switch port
The connecting device is a Laser Line Triangulation scanner 'scanCONTROL 2900' manufactured by company microepsilon
And you are right again, it is related to the traffic (the scanner had no traffic for quite a long period)
When I connect to the device and produce some traffic, I am able to see it in the MAC table of the GS1900
It disappears after a while, but is coming back when I produce traffic again
Sorry, I had no knowledge of the aging time
But now I know how to handle and have everything I need
Thanks a lot for your help
Kalli
Re: GS1900 - Enable Port PoE not working with v2.9
Hi @michiba
Yes, this is working for v1 hardware.
Additionally, this will be included in future firmware release.
Best Practices for Optimizing Wireless Network Performance
This article aims to provide a comprehensive guide on optimizing your Access Point WiFi setup in Nebula, ensuring a seamless wireless experience while minimizing interruptions, internet disconnections, and slow connectivity issues.
This article explains: Roaming, Smart Steering, Interference (Channel Utilization), Speed issues, Channel Width, Output power, Band Select, WLAN Rate Control Setting, Connectivity issues, Dynamic Channel Selection, Intra-BSS traffic blocking, Layer 2 isolation, Load Balancing, Chromecast not connecting.
Disclaimer! This is an article that explains the best practices to increase performance for general WiFi environments. These suggestions might not be applicable to your specific environment if it differs from the "normal" conditions of a WiFi environment. Most of these parameters will therefore be a trial-and-error practice to find the optimal parameters for your environment.
Roaming
If you are experiencing that your connection at some points "freezes", if you have a hard time getting a good signal strength even though you are connected near to the Access Point (AP), or if clients start off with a good connection, but after going to the next AP, the connection is unstable before it is lost. These symptoms, generally speaking, are what we refer to as Roaming Issues.
Note that a smooth roaming experience is mostly because of a good deployment and not the setting itself. However, the configuration might help with the roaming experience. A client should be roaming when the signal strength goes below -75 dBm and the signal of a Wifi client should ideally be higher than -65 dBm wherever the clients move in the WiFi environment.
Smart Steering
The best way how Improve WiFi roaming on my Nebula Access Points is to enable Smart steering. Smart Steering is used when you have more than 1 AP. This prevents "Sticky clients", which is a term used for WiFi clients that are connected to an AP (AP1), and when they move to the next AP (AP2), they do not connect to the AP2, even though the signal is better on AP2. This is because they still have a signal on AP1 (even though it's bad), the client determines that the signal is enough for an internet connection.
Here we can enable Smart Steering, which forwards a client to the next available AP when the signal reaches a certain "low" level. This ensures that you have the best possible signal wherever you are in the environment. If the client gets too low a signal, and there is no AP around that can give a better signal, they will kick the client out of the WiFi completely. The client needs to go closer to the AP again to be able to connect.
Best Practice values
Optimization aggressiveness option that supported on specific models provides different traffic rate threshold levels when the Nebula Device takes action to improve the access point’s WiFi network performance. The Nebula Device will postpone the actions implemented on access points until your network is less busy if the threshold is exceeded.
You can select a suitable traffic rate threshold level for your network.
High: Select this if you want the Nebula Device to postpone the action set when the access point network traffic is heavy.
Standard: Select this if you want the Nebula Device to postpone the action set when the access point network traffic is medium.
Low: Select this if you want the Nebula Device to postpone the action set when the access point network traffic is low.
Disassociate Station Threshold: -88 dBm
When the signal reaches below -88 dBm, kick the client out of the WiFi and don't let it be able to connect until the signal gets better than -88 dBm
- How to configure?
Go to Site-wide -> Configure -> Access points -> Radio settings
Roaming protocols
- 802.11r - IEEE 802.11r is a standard for fast roaming in a wireless network, also referred to as Fast BSS Transition (or Fast Roaming). Without support for 802.11r, this would require the client to re-authenticate causing issues for users (source). If you're having RADIUS / Active Directory authentication, this should be enabled.
- Best Practice values
Disable 802.11r, if you're not using 802.11x (RADIUS or AD authentication) on WiFi
- 802.11k/v - The 802.11k standard helps devices search quickly for nearby APs that are available as roaming targets by creating an optimized list of channels. When the signal strength of the current AP weakens, your device will scan for target APs from this list (source). However, the protocol isn't supported on all devices, which can lead to problems.
- The 802.11v standard can direct devices to roam and can accept and respond to these Basic Service Set (BSS) Transition Management frames, leading to improved WLAN quality when connected to a network that supports 802.11v (source). However, the protocol isn't supported on all devices, which can lead to problems.
Best Practice values
Disable 802.11k/v, if you have roaming issues. This might be because of unsupported devices, or other issues related to the protocol.
- How to configure?
Go to Site-wide -> Configure -> Access points -> SSID advanced settings
Interference (Channel Utilization)
- What is interference?
WiFi Interference is a problem that occurs when two signals in the same frequency is used near each other. Think of co-channel interference (WiFi interference) as waves in the ocean when it comes from two different directions, instead of being "smooth" waves traveling, they will bump into each other and cause "collisions". In our devices, the interference level is labeled as "channel utilization".
- When does interference occur?
Some cases might include equipment (and/or other WiFi) nearby
If you have a microwave, or any other equipment that sends out signals on the same frequency, this will cause interference. It could also be that you are in an office building where there are a lot of companies that has their own WiFi. Their WiFi environment will reach your WiFi environment, and it will create a collision.
When you have your two access points too close to each other
If you have two access points near each other that are operating on the same channel, it will cause a collision
When you install the WiFi on the floor above, and the signal "spills" onto the floor under
- How to check your interference level
Go to Site-wide -> Devices -> Access points
Click on the "document/list" icon and select the channel interference on 2.4GHz & 5GHz & 6GHz
Speed issues
- Channel Width
Whenever you experience a slow WiFi, this could be because of interference. To reduce the interference level (channel utilization), you can turn down the channel width. This will decrease the WiFi throughput overall, but if you have high interference levels, you will increase the throughput (speed). Channel width operates on a frequency spectrum from 20 MHz up to 320 MHz channels(320 MHz channel width is supported only on Wi-Fi 7 APs operating in the 6 GHz band), higher channel width means increased maximum speeds, but also increased risk of interference.
- Best Practice values
If you're experiencing inconsistent speeds, WiFi disconnections, etc., turn down the channel width to 20 MHz on both 2.4 GHz and 5 GHz, and consider decrease the bandwidth to 80MHz for 6Ghz.
- How to configure Channel Width?
Go to Site-wide -> Configure -> Access points -> Radio settings
- Output power
A common problem will be that in order to avoid interference, you turn down the output power of the APs. However, this will create "grey areas" in your WiFi environment where there is no WiFi connection.
However, sometimes it is necessary to turn down the output power, because of an incorrect WiFi installation.
- Best Practice values
Start with decreasing the output power with 3-5 dBm to the radio that has high interference (e.g. 2.4GHz) to see if this helps the interference level (See section 2.1.2 How to check your interference level). If channel utilization goes down, try to decrease it again with 2 dBm. If channel utilization stays the same, there could be other issues such as "DCS" settings (see 2.2.1 Dynamic Channel Selection (DCS) Settings).
- How to configure Output Power
Go to Site-wide -> Configure -> Access points -> Radio settings
- Band Select
Band select is a function that forces clients to connect to the 5GHz band. This is because 5GHz, generally has lower interference levels, and it's also faster. The access point will try to force the clients to connect to the 5 GHz network 3 times before it will accept the client to connect to the 2.4GHz.
- Best Practice Values
If you're having a high interference level (channel utilization) on 2.4GHz but good channel utilization on 5GHz, Band Select might be a good option. However, some devices is not supporting band selection and it might cause more problems in your network environment. Therefore, the best practice is to leave this feature disabled.
- How to Configure Band Select
Go to Site-wide -> Configure -> Access points -> SSID advanced settings
WLAN Rate Control Setting
WLAN Rate Control is the feature to let users set up the basic transmission rate of AP.
Since the management frame, broadcast, and multicast packets use the basic rate to transmit, this would impact the network performance due to the low speed.
If the network environment is well deployed (such as the signal of clients around -50 dBm to -60 dBm), configuring the higher basic rate has benefits to the network performance which include reduction of management overhead, better airtime utilization, and enhanced throughput, especially in high-AP-density scenarios.
In other words, the WLAN rate control feature is used to modify the basic transmission rate of the AP, and the rate limit feature is used to limit the transmit rate of clients connected to it (source).
- Best Practice Values
If you have interference issues, WLAN rate control will probably not help you with this. However, if you have a dense WiFi environment (many clients connected to the APs) and you want to increase throughput (speed) in your WiFi environment, you might change the WLAN rate control value to 6 Mbit/s for 2.4 GHz and 11 Mbit/s for 5Ghz and 6GHz. However, increasing the WLAN rate control might create outages and disconnections for your WiFi clients if you .
- How to configure WLAN rate control
Go to Site-wide -> Configure -> Access points -> Radio settings: WLAN Rate Control Setting
Drag the line to change the values
Connectivity issues
- Dynamic Channel Selection (DCS) Settings
Dynamic Channel Selection (DCS) is among the most important wireless communication elements in dynamically changing electromagnetic environments wherein, a user can experience improved communication quality by choosing a better channel (source). In lay terms, this element is dynamically choosing the proper channel to use in the environment, by scanning the environment for the least occupied channels in that area.
- Best Practice values
If you're having problems with interference, make sure that you have enabled DCS and that it is scheduled every night. If it's scheduled in the middle of the day, this "channel selection" will be happening during office hours, which will disrupt and disconnect all users at that time of channel selection. Also, if the DCS time interval is set, you have no control over the time when the DCS is happening, thus, it can disrupt the WiFi in the middle of the day.
The best practice for DCS is therefore to enable DCS schedule to the middle of the night, disable DCS client aware, disable Avoid 5F DFS channel (if there's no airport/seaport/military base/weather stations, etc. nearby the WiFi environment) and set 2.4Ghz channel deployment to "All available channels" - if you're having high interference level (channel utilization).
- Intra-BSS traffic blocking - Cannot reach devices in my network
Intra-BSS Traffic Blocking makes sure that the wireless clients cannot talk to each other and is an important part of the Layer 2 isolation. When this is enabled, the device (e.g. Chromecast) won't be able to talk to the mobile phone, laptop or any other clients in the network which will prevent the connection to be established. Best practice for Intra-BSS Traffic Blocking is to only enable this for Guest WiFi's that is for clients that you don't trust.
- How to disable Intra-BSS Traffic Blocking?
Make sure SSID is enabled and Guest Network is disabled
Go to Site-wide -> Configure -> WiFi SSID settings
Make sure that Intra-BSS traffic blocking and Layer 2 isolation are disabled
Go to Site-wide -> Configure -> Access points -> SSID advanced settings:
- Unsecure network - WPA2/WPA3 standard
If you're having problems with devices not trusting WiFi, you might want to increase the WPA standard to WPA3, or change the password of a WPA2 encryption to a strong password.
A strong password consists of:
at least 12 lengths of the password, at least one upper case letter, at least one lower case letter, at least one number, at least one special character
- Load Balancing
If you're having users kicked out from the WiFi, when there's a little higher load than usual. It could be useful to configure Load Balancing to balance out the clients when the load gets too high.
Utilize the Load Balancing function to control the number of devices connected.
- Choose “Enable by client device number mode".
- Input Maximum client devices number. For a more stable and efficient WiFi connection, we recommend limiting the number of connected wireless clients to 15-20 per AP at the same time.
- Toggle “Disassociate client device when overloaded”. When the station number is greater than the max station number, AP disassociates clients with the longest idle time and the poorest signal strength.
Go to Site-wide -> Configure -> Access points -> AP & port settings
VoLTE not working
I have just purchsed a LTE5398-M904 from Amazon UK. It has veen confirmed the Modem has the latest firmware.
It is found that the VoLTE simply does not work !. I only have 4G in my area and the modem is setup for VoLTE, the modem confirms VoLTE is resistered. Outgoing calls are registered in the Modem Call Log bit call are never connected. Incoming calls receive a mesage saying the call cannot be accepted. The SIM card has been tested in a mobile phone which can make calls using VoLTE with no problems
Looking on the forum there are many with the same problem which has been ongoing for some time.
Has anyone got VoLTE working ?
Zyxel Networks Access Points Now Support OpenWrt-based Customized Software
Zyxel Networks understands that advanced users—such as ISPs, system integrators, and networking professionals—often require greater flexibility to tailor network behavior to their specific needs. In the past, developing custom firmware such as OpenWrt-based software for Zyxel Networks access points often required users to rely on unofficial workarounds or bypass the original firmware—an approach that could be complex, inconsistent, and potentially risky.
With this new approach, developers can now create and develop OpenWrt-based software directly on Zyxel Networks hardware through a standardized and secure method, eliminating the need to search for firmware vulnerabilities or rely on unofficial modification paths.
OpenWrt-based Customized Software Supported Models
The following Zyxel Networks access point models support OpenWrt-based customized software. After upgrading to the supported firmware versions, users can enable the capability to replace the factory-installed firmware with their own customized software.
Model Name | Supported Firmware |
|---|---|
NWA130BE | V7.30 |
NWA50BE | V7.30 |
NWA55BE | V7.30 |
NWA240BE | V7.30 |
NWA210BE | V7.30 |
NWA30BE | V7.30 |
NWA55AX PRO | V7.10 |
NWA55AX PTP | V7.10 |
If you would like to learn more about Zyxel Networks’ OpenWrt support and how to get started with OpenWrt development, please click here.
Important Notice on Warranty
Please note that installing customized or third-party firmware is not covered under Zyxel Networks’ product warranty. Once the original firmware is replaced, Zyxel Networks will not provide warranty service, technical support, or liability for any issues arising from the use of customized firmware.
This initiative reflects Zyxel Networks’ commitment to openness and flexibility—empowering advanced users with more control, while maintaining clear boundaries on support and warranty responsibilities.
Re: [Mobile Router] Per-Client Bandwidth Usage Statistics
Hi Zyxel
This is actually a tool i thought the mobile devices had, please could we add this in a firmware update?
Thank you :)
