Skip to content
Search

Iptime:EasyMesh

lastmod 2026-08-20created 2026-08-202 edits

Notes on how to connect three IPTime routers (A, B, C) by wire, run them unified under a single SSID, and maintain security without tedious MAC address registration.

Overview

Current situation

  • Router A is connected to the WAN (Internet)
  • B and C are blocked by walls, so they cannot pick up each other's wireless signal → connected by wire
  • Currently A, B, and C each broadcast Wi-Fi under a different SSID
  • Connections use both a WPA password and MAC address registration, which is a heavy management burden

Goals

  • Unify all three under the same SSID so devices switch automatically (roam) when moving
  • Drop MAC address registration while maintaining or strengthening the level of security

Core principle

For roaming under the same SSID to work, the three routers must belong to the same network (L2 broadcast domain). That is, B and C must act as APs (access points) rather than routers, and only if a single IP range is kept will the IP stay the same when moving, so sessions are not dropped.

Wiring

Always connect LAN port to LAN port. 

인터넷 ──[WAN] A [LAN] ──랜선──> [LAN] B     (B의 WAN 포트는 비워둠)
                [LAN] ──랜선──> [LAN] C     (C의 WAN 포트는 비워둠)

Connection type

Result

LAN → LAN

Unified into one network. Roaming works normally

LAN → WAN

Double NAT occurs. Even with the same SSID, the IP is reassigned when moving and the connection drops

Setup method 1: manual AP mode configuration

A general-purpose method that works on all IPTime models.

Switch B and C to AP mode

Configure each router by connecting to it individually (192.168.0.1) before connecting it to A.

  • Models with a hardware switch: set the AP / Router switch on the back to AP
  • Software settings: Admin tools → Advanced settings → Network management → Internal network settings
    • Assign the internal IP a static IP in the same range as A (an address outside A's DHCP allocation range is recommended)
    • DHCP server → Stop (most important)
    • Gateway / DNS → 192.168.0.1 (A's address)

Device

Role

Management IP

DHCP server

A

Router (gateway)

192.168.0.1

On

B

AP

192.168.0.2

Stopped

C

AP

192.168.0.3

Stopped

WARNING

After the settings change, B's admin page address changes to 192.168.0.2. Be sure to write it down before making the change.

Make wireless settings identical

Set the following items exactly the same on all three.

Item

Setting

SSID

Exactly identical (including case and spaces)

Encryption method

Identical (WPA2-PSK / AES or higher)

Password

Identical

If you use separate SSIDs for 2.4GHz and 5GHz (e.g. home / home_5G), apply the same separation rule on all three.

Channel placement

Turn off automatic selection and assign fixed channels. If left on auto, they pick the same channel and interfere with each other.

Band

A

B

C

Notes

2.4GHz

1

6

11

Mutually non-overlapping combination

5GHz

36

149

100

Spaced well apart. The 100s are the DFS band

Improving roaming

It is common for a device to stay attached to an AP whose signal has weakened (sticky client).

  • Lower each router's wireless transmit power to 70–80%. Cell boundaries become clearer and handoff becomes smoother.
  • In layouts where spaces are divided by walls, this adjustment is especially effective.

Setup method 2: EasyMesh (supported models)

Wired backhaul

Mesh does not require a wireless connection. The EasyMesh standard includes Ethernet backhaul, and wired is actually the superior option.

  • With wireless backhaul, inter-node traffic and client traffic share bandwidth, so effective speed drops to about half
  • With wired backhaul, the LAN cable carries inter-node traffic and Wi-Fi is dedicated entirely to clients
  • An environment blocked by walls where LAN cables are already laid is the ideal condition for a mesh setup

Node pairing

The pairing procedure varies by model and firmware.

  • Automatic registration via LAN cable: reset the agent and connect it to A's LAN, and the controller recognizes it automatically (in most cases)
  • Only WPS button pairing supported: temporarily move B and C near A to complete pairing, then install them back in their original locations and connect the LAN cables, and they switch to wired backhaul automatically

Method comparison

Item

Wired mesh

Manual AP mode configuration

Speed / stability

Same

Same

SSID · channel management

Automatic sync

Manual setup on each of the three

Roaming handoff

Smooth thanks to 802.11k/v support

Depends on the client's decision

Supported models

Limited to EasyMesh-capable models

All models

With wired backhaul, there is no difference in real-world speed. The differences are limited to ease of management and roaming handoff quality.

Wireless security: dropping MAC filtering

Effectiveness of MAC filtering

It is fine to drop MAC address registration, and no replacement measure is needed.

  • MAC addresses are transmitted in plaintext outside the encrypted portion
  • An attacker can sniff for a few seconds to find an allowed MAC, then forge (spoof) their own MAC to bypass it outright
  • In other words, there is effectively no technical barrier to bypassing it

Factors increasing management burden

  • On iOS, Android, and Windows, a random MAC per SSID is the default behavior. You have to set "don't use a random MAC on this network" individually on each device
  • With three routers, the registration work triples as well

Listed in order of effectiveness.

Measure

Reason

WPA3-SAE (or WPA2/WPA3 mixed)

Blocks offline dictionary attacks and provides forward secrecy. Real protection that MAC filtering cannot compare to

Passphrase of 20+ characters

A PSK is ultimately a target for offline cracking, so length is effectively the only defensive variable. A combination of 4–5 words is enough

Disable WPS

An item that can actually be compromised, e.g. via Pixie Dust. Many IPTime models have it enabled by default

Enable PMF (802.11w)

Blocks the technique of dropping connections with deauth attacks and capturing the reconnection handshake

Disable remote management + change the administrator password

If the router itself is compromised, the other measures become meaningless

Keep firmware up to date

Addresses known vulnerabilities

INFORMATION

WPA3-SAE can block older devices from connecting. It is safer to start with WPA2/WPA3 mixed (transition mode) and check whether any devices have problems.

Not only does it have no security benefit, it is counterproductive. A hidden SSID makes clients actively search for that SSID by broadcast (probe request), which ends up with devices exposing the SSID wherever they go.

Alternatives for device control

If you used MAC registration to control which devices connect, replace it with the following.

  • Separate guest network: put visitors and IoT devices on a guest SSID and block access to the internal network. Separating trust boundaries is the standard approach
  • Monitor the connected device list: switch from up-front control to after-the-fact checking. If an unknown device is found, change the password at that point

The combination of long passphrase + WPA3 + WPS disabled actually provides a higher level of security than the previous setup that kept MAC filtering.

Task checklist

  1. Before connecting B and C to A, connect to each individually and switch them to AP mode
  2. Stop the DHCP server on B and C and assign static IPs (write down the changed management IPs)
  3. Connect A's LAN port to the LAN ports of B and C with LAN cables (do not use the WAN port)
  4. Set the same SSID, encryption method, and password on all three
  5. Fix channels to 1 / 6 / 11 for 2.4GHz and 36 / 149 / 100 for 5GHz
  6. Apply WPA2/WPA3 mixed mode and set a passphrase of 20+ characters
  7. On all three, disable WPS, enable PMF, and disable remote management
  8. Turn off MAC address filtering
  9. If roaming is not smooth, adjust wireless transmit power to 70–80%

See also

author Zer0 sitemap