OpenWrt Wi‑Fi Repeater with relayd: LuCI, CLI, IPv6, and Recovery

relayd is a last-resort way to turn an OpenWrt router into a Wi‑Fi extender when the main router does not run OpenWrt or does not support WDS/802.11s as needed. One radio provides a wireless uplink and another radio provides an AP for local clients; the relayd package provides bridge-like forwarding between the two sides.¹

The source's example topology is:

• The main router is 192.168.1.1/24, with LAN serving clients and WAN reaching the Internet.
• The extender has a separate management subnet, 192.168.2.0/24, for example LAN 192.168.2.1.
• The wwan interface connects wirelessly to the main router.
• Clients behind the relay receive DHCP from the main network, while 192.168.2.1 is used only to manage the extender.

Important: The two subnets must be different. relayd is not a complete Layer 2 bridge and usually handles IPv4 only; DHCP, mDNS, and upstream performance may not behave like a wired bridge. When I control both devices, WDS or 802.11s remains the preferred choice.¹

The source links a video showing substantially this procedure and notes that it was tested with OpenWrt 23.05.3 in June 2024.²

1. LuCI setup: change LAN first

During this procedure, keep the PC connected by Ethernet to a LAN port on the extender and temporarily remove any cable between the extender and the main router.

1. Open LuCI at the default 192.168.1.1.
2. If needed, update the firmware in System → Backup/Flash Firmware, then choose Perform reset for a clean OpenWrt configuration.
3. Open Network → Interfaces and click Edit for LAN.
4. Change LAN protocol to static address, then click Change protocol.
5. Assign an address in the extender's separate subnet, for example 192.168.2.1.
6. Click Save, then Save and Apply.
7. Reconnect to 192.168.2.1.
8. In LAN, open the DHCP Server tab and disable DHCP with Ignore interface.
9. In IPv6 Settings, set RA-Service and DHCPv6 Service to disabled.
10. Click Save and Save and Apply.
11. If LuCI is needed again, give the PC a static address such as 192.168.2.10/24 with gateway 192.168.2.1.

Do not connect the uplink to the main router while changing the LAN address. If LuCI disappears, return to Ethernet and the static PC address; this is the extender's important management backdoor.

2. Create the Wi‑Fi uplink

Choose a radio based on the environment: 5 GHz is usually faster, while 2.4 GHz usually reaches farther.

1. Keep the PC connected to the extender over Ethernet.
2. Open Network → Wireless.
3. Choose the radio that will provide the uplink and click Scan.
4. Select the main router's SSID and click Join Network.
5. In Joining Network, set Name of new network to wwan.
6. Enter the main router's WPA passphrase.
7. Select the lan firewall zone as in the source relay procedure.
8. Click Save, then Save & Apply.
9. In the client Wi‑Fi settings, set Mode to match the uplink: Legacy for Wi‑Fi g, N for Wi‑Fi n, and the corresponding mode for newer standards.
10. Set Width to the main router's channel width and keep the channel found by the scan.
11. Click Save and Save & Apply.

Remove redundant WAN and optionally reuse the WAN port

Removing WAN is optional but the source recommends it for a cleaner configuration:

1. Open Network → Interfaces and delete WAN and WAN6.
2. Open Network → Firewall and delete the wan rule/zone.
3. Click Save & Apply.

This also removes redundant firewall traffic and port-forward rules, but it does not turn the WAN port into LAN automatically. To reuse it, open Network → Interfaces → Devices, click Unconfigure for device wan, click Configure... for br-lan, add wan to Bridge ports, and click Save & Apply.

3. Give wwan a static address and test it

Assign an address in the main router's subnet, for example 192.168.1.30, so it can manage the extender and later be used by the Relay bridge:

1. Open Network → Interfaces and click Edit for wwan.
2. In General Settings, change the protocol to Static Address.
3. Enter IP 192.168.1.30, subnet mask 255.255.255.0, and gateway 192.168.1.1.
4. In Advanced Settings, enable Use custom DNS Servers and enter 192.168.1.1.
5. Click Save, then Save & Apply.

Test the uplink before installing the relay protocol:

1. Open Network → Diagnostics.
2. Choose IPv4 Ping.
3. Run the ping and wait for the result.

If the ping fails, fix the uplink first; do not create the bridge while wwan cannot reach the main router.

4. Install the relayd package

1. Open System → Software.
2. Click Update List and wait for a successful update.
3. Enter luci-proto-relay in Filter.
4. Click Install.
5. Reboot from System → Reboot after installation.

5. Add the Relay bridge

relayd joins the extender's lan and wwan interfaces.

1. Open Network → Interfaces.
2. Click Add New Interface.
3. Name it, for example, repeater_bridge.
4. Select Relay bridge as the protocol. If the option is missing, reboot and reopen LuCI.
5. Click Create Interface.
6. Click Edit for the new repeater_bridge interface.
7. Confirm that Protocol is Relay bridge.
8. Enter the IP assigned to wwan as Local IPv4 address, for example 192.168.1.30.
9. Select both lan and wwan under Relay between networks.
10. Click Save, then Save & Apply.
11. Reboot the extender.

6. Enable the AP for clients

1. Open Network → Wireless.
2. Click Edit for an SSID with Mode: Master; do not edit the Mode: Client uplink.
3. In Interface Configuration, set the SSID, encryption, and password. The source allows reusing the main router's values for simpler roaming, or using a distinct SSID to identify the extender.
4. If AP and uplink share a radio, keep the same Operating frequency.
5. Click Save.
6. Enable the wireless network.
7. Other radios, such as b/g/n or n/ac/ax, can be enabled as well.
8. Click Save & Apply.

Return the PC to DHCP and connect to the new SSID. The client should receive DHCP from the main router; Status → Overview shows the uplink and AP, while the wwan address is best checked under Network → Interfaces.

7. Equivalent CLI configuration

Enable wireless before scanning:

1
2
3

uci set wireless.@wifi-device[0].disabled="0"
uci commit wireless
wifi

Scan with the actual interface; the source uses wlan0 as its example:

1

iw dev wlan0 scan

If the name differs, use ifconfig to identify the wireless interface. Scan output includes SSID, BSSID, frequency, signal, HT information, and encryption. In the source example, Violetta is the Wi‑Fi g network and the BSSID is C8:D5:FE:C8:61:B0.

The source shows this UCI state after configuration:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

network.lan.ipaddr='192.168.2.1'
network.repeater_bridge=interface
network.repeater_bridge.proto='relay'
network.repeater_bridge.network='lan wwan'
network.wwan=interface
network.wwan.proto='dhcp'
firewall.@zone[0].network='lan repeater_bridge wwan'
dhcp.lan.ignore='1'
wireless.radio0.hwmode='11g'
wireless.radio0.country='00'
wireless.radio0.channel='1'
wireless.radio0.disabled='0'
wireless.@wifi-iface[0]=wifi-iface
wireless.@wifi-iface[0].device='radio0'
wireless.@wifi-iface[0].mode='ap'
wireless.@wifi-iface[0].encryption='none'
wireless.@wifi-iface[0].ssid='OpenWrt'
wireless.@wifi-iface[0].network='lan'
wireless.@wifi-iface[1]=wifi-iface
wireless.@wifi-iface[1].network='wwan'
wireless.@wifi-iface[1].ssid='Violetta'
wireless.@wifi-iface[1].encryption='psk2'
wireless.@wifi-iface[1].device='radio0'
wireless.@wifi-iface[1].mode='sta'
wireless.@wifi-iface[1].bssid='C8:D5:FE:C8:61:B0'
wireless.@wifi-iface[1].key='myWifiPasswordHere'

The OpenWrt SSID in this sample has no encryption, solely to demonstrate the relay bridge. A real deployment must use WPA and replace the SSID, BSSID, and passphrase with the local values.

8. Networking details and the alternative wireless client

Even though clients behind the extender receive DHCP from the main router, the extender's LAN must remain on another subnet because relayd is routing traffic. The extender's Ethernet ports and AP are both on LAN, and relayd forwards them into the main network. The separate LAN subnet (192.168.2.0/24) is then only a management path.

When a shared broadcast domain is not required, a simple wireless client is easier to reason about: wwan receives DHCP, LAN uses a separate subnet, and NAT handles the boundary. That is a different design from relayd; do not merge the two procedures.

9. IPv6 support

The source has a separate IPv6 branch that needs a public prefix from the main router:

1. Open Network → Interfaces, create wwan6 with protocol DHCPv6, covering wwan.
2. In Common Configuration, set Request IPv6 address to disabled; select the lan / repeater bridge... firewall line; leave Custom delegated IPv6-prefix empty.
3. In Interfaces overview, verify that wwan receives a public IPv6 address.
4. Edit LAN. Under DHCP Server → IPv6 Settings, set RA-Service: relay mode, DHCPv6-Service: disabled, and NDP-Proxy: relay mode.
5. Edit wwan and click Setup DHCP Server. Under General Settings enable Ignore interface; under IPv6 Settings set Designated master: checked, RA-Service: relay mode, DHCPv6-Service: disabled, and NDP-Proxy: relay mode.
6. Click Save, then Save & Apply.

IPv6-enabled clients may receive public addresses derived from the main router's prefix and route through the extender. If IPv6 is not required, keep the services explicitly disabled rather than allowing unintended DHCPv6 behavior.

10. Troubleshooting and known limits

Lost access to the extender

If the extender cannot be reached from the main network, connect a PC by Ethernet to LAN, assign 192.168.2.10/24, and open 192.168.2.1. If a host on 192.168.1.0/24 cannot reach the extender, check that the Relay bridge's Local IPv4 address matches the wwan address.

Check firewall zones

The source says that LuCI normally adjusts the firewall. If behavior is wrong, check that LAN covers lan, repeater_bridge, and wwan, and that redundant WAN/port-forward rules were handled. Do not expand a zone merely to hide a configuration error.

Reported issues

• The AP may not forward DHCP/BOOTP correctly; the source links an issue about relayd not forwarding broadcasts.
• Some MT762x devices have extremely poor upstream transfer speed.
• Clients behind relayd may be unreachable from the other side even while outbound traffic works, due to double-NAT/bridge behavior.
• Not every driver permits AP and STA on the same radio; use another radio or a routed client when this occurs.
• If the upstream SSID, channel, or security changes, the extender may lose its uplink; use the static management path to repair it.
• VLAN-dependent designs may need a Layer 2 GRE (gretap) tunnel instead of relayd.
• relayd is an IPv4 bridge-like mechanism, not a guaranteed replacement for WDS/802.11s.
• The source mentions kmod-trelay as another possibility but provides only a source-code link, not a complete installation/configuration procedure; I do not invent one.

11. NAT instead of Relay bridge

For a router-cascade repeater, the source gives a NAT branch whose prerequisite is a router with two initial interfaces, LAN and WAN:

1. Open Network → Interfaces, edit LAN, and set a static IPv4 address 192.168.x.1, where x differs from the upstream Wi‑Fi subnet.
2. Open Network → Wi-Fi, scan, select the network, and click Join Network.
3. Enter the Wi‑Fi password, leave Name of new network as WWAN, choose the WWAN or WAN firewall zone, and click Save.
4. Open Network → Interfaces and edit wwan.
5. Open the Firewall tab and click Save and Apply.
6. Open Network → Firewall, edit the wan zone, select both WAN and WWAN under covered networks, then click Save and Apply.

This binds WWAN to WAN and lets LAN reach the Internet. Clients are behind double NAT; do not use this branch when the goal is one subnet or broadcast domain with the main router.

Conclusion

Relayd handles networks where WDS or 802.11s cannot be used, but the trade-offs are a separate management subnet, broadcast/IPv6 limits, and many compatibility conditions. I change LAN to 192.168.2.1, test wwan at 192.168.1.30, install luci-proto-relay, create repeater_bridge, and enable the AP only after the uplink pings successfully. When I control the main router, I prefer WDS or 802.11s; relayd is a last resort with a clear Ethernet recovery path.

Sources