Home Network Upgrade – GPON Stick + 802.11k/v/r Roaming

The beginning of the article explains the process of configuring a GPON stick and BE10000 PPPoE. If you only need information about 802.11k/v/r, you can jump to the "Configuring 802.11k/v/r" section.

The reason for this project goes back to the Labour Day holiday, when I picked up a Xiaomi BE10000 locally in Harbin. I wanted to try a GPON stick to see if I could push my home gigabit broadband beyond 1 Gbps (ref: Zhejiang Mobile FiberHome GPON super admin password + G-010S-A GPON stick internet access – Milu’s Blog (Chinese)). Because I use mesh-like tools such as EasyTier and need features like Wake-on-LAN, and my existing Xiaomi AX3600 already runs ImmortalWRT, I hoped to flash a WRT-based system and then use 802.11k/v/r to achieve automatic handover, essentially building a manual mesh. After searching, it seemed only the BE10000 met my requirements: it has an SFP+ cage and can be flashed with QWRT. I brought it home during the summer break – time to tinker!

I already fixed its one imperfection – the NFC tap-to-connect – while I was at university (ref: Adapting NFC for Xiaomi BE10000 on QWRT – Yousheng's Dev Diary (Chinese)), so the device is now complete (nod)

Glossary

1. Broadband & Optical Communication (Fiber & PON)

2. Wireless LAN & Roaming (Wi-Fi & Roaming)

3. Network Protocols & System Settings

Preparation

• Xiaomi BE10000 Router
• Xiaomi AX3600 Router
• G-010S-A NOKIA GPON Stick
  • Heatsinks
  • SC/APC to SC/UPC fiber patch cable
  • SC/UPC fiber adapter
• Flashing resources (find them yourself – redistributing others’ work isn’t ideal. You can refer to the firmware mentioned in the flashing tutorial below.)

Regarding that SC/APC to SC/UPC fiber cable, it describes the connector specifications. Typical residential FTTH usually uses UPC (blue connector), whereas the GPON sticks we buy almost always have an APC (green) connector. The main difference is the end-face shape: UPC is slightly domed outwards, APC is cut at an angle. If the ISP's OLT downstream optical power is strong enough, you could connect UPC directly to the stick, but you’d get about 3 dB of extra loss. So I decided to play it safe.

Image source: Differences between PC, UPC and APC fiber connectors – Zhihu (Chinese)

GPON sticks are notorious for running hot, so remember to attach heatsinks:

After attaching them, I saw temperatures of around 60 °C in the stick’s management console.

Flashing the BE10000

No need to elaborate here – just follow Flashing OpenWrt on Xiaomi 10G Router | Xiaomi BE10000 | SSH Unlock | UBoot | iStore | Multi-WAN – Right.com.cn Forum (Chinese).

The firmware has some known bugs. For example, Wi-Fi settings configured through the front-end may fail to write correctly, causing the entire network subsystem to crash, the router to become unreachable, and eventually triggering an automatic fallback. That’s why some of the modifications below are done using UCI commands.

Obtaining ISP ONU Configuration

There is no universal guide for this step… Buy a super admin password from Xianyu or Taobao, and record the LOID, SN, LOID CheckCode (Password), PLOAM Password, and the VLAN ID of the Internet connection. Some regions may also require you to record the upstream MAC address.

LOID and LOID CheckCode:

PLOAM Password:

VLAN ID:

Generally, ISPs use LOID together with a possible LOID CheckCode (Password), or they might use PLOAM Password. Decide based on your situation.

In my case (Anhui Unicom), I only needed to record SN, VLAN ID, and LOID and everything worked. (I couldn’t log into the Unicom ONT, so I used a Mobile one for these screenshots, lol.)
Sometimes you don’t even need the super admin password; some ONTs (e.g., Skyworth models for Heilongjiang Unicom) display this information even for a regular user.

Also, record your PPPoE username and password:

Generally the username is visible. On some ONTs you can reveal the password by using F12 to remove the password attribute; others send back meaningless placeholders. In that case, call your ISP to reset the password.

Configuring the GPON Stick

Insert the GPON Stick into the SFP+ port. If the port LED doesn’t light up, try going to QWRT → Network → ECM Hardware Acceleration Settings and force the SFP1 and SFP2 interface speeds to Force 2.5Gbps. (I couldn’t be sure which one corresponds to the active SFP port, so I changed both.) Save & apply, and you may need to reboot the router.

The default br-lan IP prefix should be 192.168.1.0/24. Keep it unchanged and access 192.168.1.10 to open the stick’s management console:

Find GPON ONU Settings and fill in the information you recorded earlier: LOID and SN

Also enable VLAN configuration: Tick Interoperability Compatible Mode, and fill in the VLAN ID under PVID.

You may need to reboot the stick after saving. Then go to the status page. If you see the PON authentication status / signal status as O5, the stick has successfully registered and is working.

Configuring Dial-Up (PPPoE)

On the BE10000, the default WAN port is eth4, while the SFP port is eth5. You need to switch the WAN from eth4 to eth5. Go to Network → Interfaces → Devices, locate br-lan, and add eth4 to it while removing eth5. Then go to the Interfaces page, change the WAN device to eth5, and enter your PPPoE username and password:

After saving, you should see that PPPoE has dialled successfully and you can access the internet: (I changed the entire br-lan subnet to 192.168.3.0/24 – this step is not mandatory.)

Modifying Basic Wi-Fi Settings

As I discovered, modifying Wi-Fi settings directly through LuCI on the main router fails to write correctly (as mentioned above). Therefore, modify them via SSH using UCI:

# Set main router Wi-Fi info
uci set wireless.ath0.ssid='[CENSORED]'
uci set wireless.ath0.encryption='psk2+ccmp'
uci set wireless.ath0.sae='1'
uci set wireless.ath0.key='[CENSORED]'

uci set wireless.ath1.ssid='[CENSORED]'
uci set wireless.ath1.encryption='psk2+ccmp'
uci set wireless.ath1.sae='1'
uci set wireless.ath1.key='[CENSORED]'

uci set wireless.ath2.ssid='[CENSORED]'
uci set wireless.ath2.encryption='psk2+ccmp'
uci set wireless.ath2.sae='1'
uci set wireless.ath2.key='[CENSORED]'

uci commit wireless
wifi reload

Here SSID is the Wi-Fi name, and encryption value psk2+ccmp represents WPA2-PSK/WPA3-SAE Mixed Mode.

For the secondary router, because we are setting up roaming, both Wi-Fi networks must be on the same L2 segment. Thus, you must disable its DHCP server and configure the secondary router as a device under the main router. The steps for the secondary router are:

• Delete all other interfaces under Network → Interfaces → Interfaces, keeping only br-lan:
• Under Network → Interfaces → Devices, add the wan port to the br-lan device:
• Assign an IP address to br-lan under Network → Interfaces → Devices:

Remember to include the netmask for the IPv4 address, and set the IPv4 gateway to the main router’s IP.

• Under Network → Firewall → General Settings, adjust the firewall rules accordingly. (btw, I was too lazy to configure detailed rules and assumed the internal network devices aren’t a huge risk, so I allowed everything. Don’t copy this if you have specific security needs, lol.)

After saving and applying, you should be able to connect to the main router and access the secondary router using the IP you just set.

On the secondary router, go to Network → Wireless and configure each SSID interface to match the main router’s settings:

At this point, both Wi-Fi radios should be working (even with the same SSID) and they will be on the same channel.

Configuring 802.11k/v/r

Main Router

# Main router 802.11k/v/r configuration

# ath0 (2.4 GHz)
uci set wireless.ath0.ieee80211k='1'
uci set wireless.ath0.rrm_neighbor_report='1'
uci set wireless.ath0.rrm_beacon_report='1'
uci set wireless.ath0.ieee80211v='1'
uci set wireless.ath0.time_advertisement='0'
uci set wireless.ath0.wnm_sleep_mode='0'
uci set wireless.ath0.bss_transition='1'
uci set wireless.ath0.ieee80211r='1'
uci set wireless.ath0.nasid='Master_2_4G'
uci set wireless.ath0.mobility_domain='cafe'
uci set wireless.ath0.reassociation_deadline='1000'
uci set wireless.ath0.ft_over_ds='0'
uci set wireless.ath0.ft_psk_generate_local='1'

# ath1 (5G-1)
uci set wireless.ath1.ieee80211k='1'
uci set wireless.ath1.rrm_neighbor_report='1'
uci set wireless.ath1.rrm_beacon_report='1'
uci set wireless.ath1.ieee80211v='1'
uci set wireless.ath1.time_advertisement='0'
uci set wireless.ath1.wnm_sleep_mode='0'
uci set wireless.ath1.bss_transition='1'
uci set wireless.ath1.ieee80211r='1'
uci set wireless.ath1.nasid='Master_5G'
uci set wireless.ath1.mobility_domain='cafe'
uci set wireless.ath1.reassociation_deadline='1000'
uci set wireless.ath1.ft_over_ds='0'
uci set wireless.ath1.ft_psk_generate_local='1'

# ath2 (5G-2)
uci set wireless.ath2.ieee80211k='1'
uci set wireless.ath2.rrm_neighbor_report='1'
uci set wireless.ath2.rrm_beacon_report='1'
uci set wireless.ath2.ieee80211v='1'
uci set wireless.ath2.time_advertisement='0'
uci set wireless.ath2.wnm_sleep_mode='0'
uci set wireless.ath2.bss_transition='1'
uci set wireless.ath2.ieee80211r='1'
uci set wireless.ath2.nasid='Master_5G2'
uci set wireless.ath2.mobility_domain='cafe'
uci set wireless.ath2.reassociation_deadline='1000'
uci set wireless.ath2.ft_over_ds='0'
uci set wireless.ath2.ft_psk_generate_local='1'

uci commit wireless
wifi reload

Note: 802.11k/v/r does not force clients to roam proactively; the client still makes the final decision. The AP only provides neighbor information, roaming suggestions, and fast re-association capabilities using these protocols. Support varies across different phones, PCs, and IoT devices.

The configuration above covers three wireless interfaces:

• ath0: Main router 2.4 GHz
• ath1: Main router 5 GHz-1
• ath2: Main router 5 GHz-2

All three follow the same logic, differing only in nasid.

1. 802.11k: Radio Resource Measurement / Neighbor Report

Relevant settings:

uci set wireless.ath0.ieee80211k='1'
uci set wireless.ath0.rrm_neighbor_report='1'
uci set wireless.ath0.rrm_beacon_report='1'

1.1 ieee80211k='1'

Enables 802.11k Radio Resource Management.
802.11k allows the AP to provide clients with information about neighboring APs, so they don't need to blindly scan all channels. Clients can use the neighbor list to quickly find a suitable target for roaming.

In short:

802.11k lets the client know "which APs with the same SSID are nearby and available to switch to".

Without 802.11k, a client typically scans channels by itself, which takes time and can cause brief lag. When enabled, compatible clients can obtain candidate AP information much faster.

1.2 rrm_neighbor_report='1'

Enables Neighbor Report.
This is the most common and critical capability of 802.11k. The AP provides the client with details about neighboring BSSs, such as:

• BSSID of the neighboring AP
• Operating channel
• PHY type
• Whether it belongs to the current ESS
• Supported roaming capabilities

In short:

This parameter lets the AP tell the client: "Here are the other APs nearby, and they are on these channels."

This is crucial for multi-AP roaming because the client can scan only the suggested channels instead of sweeping from channel 1 to 165.

1.3 rrm_beacon_report='1'

Enables Beacon Report support.
Beacon Report allows the AP to request that the client report back the beacons it has observed. In other words, the client can tell the AP:

• Which APs it sees
• Their signal strengths
• Their channels
• A rough picture of the current wireless environment

In short:

Neighbor Report is the AP telling the client what’s nearby; Beacon Report is the client telling the AP what it sees.

In a typical home network, rrm_neighbor_report is more directly useful; rrm_beacon_report is a supplementary capability – just enable it.

2. 802.11v: BSS Transition / Roaming Guidance

Relevant settings:

uci set wireless.ath0.ieee80211v='1'
uci set wireless.ath0.time_advertisement='0'
uci set wireless.ath0.wnm_sleep_mode='0'
uci set wireless.ath0.bss_transition='1'

2.1 ieee80211v='1'

Enables 802.11v Wireless Network Management.
The most relevant part for home Wi-Fi roaming is BSS Transition Management.

In short:

802.11v lets the AP suggest to a client: "I recommend you switch to another AP."

This is only a suggestion, not an order. The client can accept or refuse. For example, if the client is still attached to the main router but is already physically near the secondary router, the AP can use 802.11v to inform it: "Your signal to this AP is now mediocre; consider moving to the other one."

Enabling 802.11v helps with the "sticky client" problem, but there’s no guarantee all devices will obey.

2.2 bss_transition='1'

Enables BSS Transition Management. This is the key roaming-related feature of 802.11v. When enabled, the AP can send a BSS Transition Management Request to the client, typically containing a list of recommended target APs.

In short:

ieee80211v is the master switch for 802.11v; bss_transition turns on the actual roaming suggestion function.

If you enable ieee80211v but not bss_transition, the roaming guidance effect may be incomplete.

2.3 time_advertisement='0'

Disables Time Advertisement. 802.11v includes a Time Advertisement feature where the AP can broadcast time information. For home roaming, you generally don't need the AP to provide time sync, so set it to 0.

2.4 wnm_sleep_mode='0'

Disables WNM Sleep Mode. WNM Sleep Mode is part of 802.11v, mainly used for client power saving. The client can enter a special sleep state while the AP retains some context. Home routers and multi-AP roaming generally don’t rely on this, and some devices have compatibility issues, so it’s turned off.

3. 802.11r: Fast Transition / Fast Roaming

Relevant settings:

uci set wireless.ath0.ieee80211r='1'
uci set wireless.ath0.mobility_domain='cafe'
uci set wireless.ath0.reassociation_deadline='1000'
uci set wireless.ath0.ft_over_ds='0'
uci set wireless.ath0.ft_psk_generate_local='1'

3.1 ieee80211r='1'

Enables 802.11r Fast BSS Transition.
802.11r shortens the authentication and re-association time when a client moves from one AP to another. Without it, the client may need to complete a full authentication cycle. 802.11r pre-derives some key material so the handover is faster.

It does not decide when to roam, but once the client decides to roam, it makes the process quicker.

Suitable for:

• Moving between rooms with a phone
• Voice calls
• Video conferences
• Gaming
• Multi-AP environments with the same SSID

Be aware:

• Most new devices support 802.11r
• Some older or less compatible IoT devices may dislike 802.11r
• If a device fails to connect, suspect 802.11r compatibility first

3.2 mobility_domain='cafe'

Sets the Mobility Domain, an 802.11r roaming domain identifier. Only APs sharing the same Mobility Domain are considered part of the same fast-roaming group by clients.

All APs participating in 802.11r fast roaming under the same SSID must use the same mobility_domain.

Here we use:

uci set wireless.ath0.mobility_domain='cafe'

cafe is a 16-bit hexadecimal value (4 hex characters), similar to magic numbers like DEADBEEF.
You can customize it, for example:

mobility_domain='1234'
mobility_domain='abcd'
mobility_domain='beef'

But remember:

• Must be consistent within the same roaming network
• Different independent networks can differ
• Must be exactly 4 hex characters

3.3 reassociation_deadline='1000'

Sets the Reassociation Deadline. This parameter indicates the maximum time window allowed for a client to complete Fast Transition re-association. The unit is usually TU (1 TU ≈ 1.024 ms), so 1000 is roughly 1 second.

In short:

After a client initiates fast roaming, it must complete re-association within this window.

For home networks, 1000 is a common, generous, and safe choice. Too short may prevent some devices from finishing the switch; too long generally has no real benefit.

3.4 ft_over_ds='0'

Sets the 802.11r Fast Transition method. There are two common approaches:

1. FT over the Air
2. FT over DS Here we use FT over the Air by setting it to 0 (disabling ft_over_ds).

FT over the Air: The client performs the fast handover directly with the target AP. This is more common and intuitive in non-enterprise environments.
FT over DS: The client communicates with the target AP through the currently connected AP via the distribution system. The device contacts the new AP via the old one before switching. In real home OpenWrt/QWRT multi-AP setups, this doesn’t bring a clear advantage and can sometimes cause device compatibility issues.

3.5 ft_psk_generate_local='1'

Lets the local AP generate 802.11r keys from the PSK. In home networks using WPA-PSK / SAE Mixed mode, the AP can locally derive the key material needed for Fast Transition from the Wi-Fi password.

Home networks usually lack an enterprise authentication server, so just enable this. Suitable for:

• WPA2-PSK
• WPA2/WPA3 Mixed
• SAE mixed (depends on firmware support)
• Typical home networks without RADIUS

4. NAS ID: Unique Identity for Each BSS

uci set wireless.ath0.nasid='Master_2_4G'
uci set wireless.ath1.nasid='Master_5G'
uci set wireless.ath2.nasid='Master_5G2'

4.1 nasid='Master_2_4G'

nasid is the NAS Identifier, the identity of the current BSS. In 802.11r scenarios, it’s used to distinguish different APs / BSSs. Every wireless interface participating in roaming should have a unique nasid.

For the main router:

ath0 -> Master_2_4G
ath1 -> Master_5G
ath2 -> Master_5G2

For the secondary router, set correspondingly:

2.4G -> Slave_2_4G
5G-1 -> Slave_5G
5G-2 -> Slave_5G2

5. Why configure the same set of parameters for all three ath interfaces?

Because ath0, ath1, and ath2 are three different wireless BSSs. Even if they broadcast the same SSID, they remain independent wireless interfaces at the system level, so 802.11k/v/r parameters must be written to each interface individually.

This part can be summarized as:

Secondary Router

Just enable the corresponding settings directly in LuCI. You can refer to my configuration:

Apply the same settings to all three wireless interfaces, while ensuring the NAS ID is different.

Band Analysis

My home network layout is somewhat complex. The main router sits in the center of the living room, which opens directly onto the kitchen and balcony, so its signal covers those areas well. The secondary router is in the study, flanked by two bedrooms. The study and living room are linked by a short corridor, and Bedroom A is separated from the living room by a bathroom:

The two stars mark the main router (living room) and the secondary router (study).

Signal collection results in each room:

Master Bedroom

Study (the tall red peak is from the secondary router)

Second Bedroom

It's clear: the master bedroom’s channels are relatively clean; the study has a strong signal because the secondary router is right there; but the second bedroom suffers from heavy interference, a weaker signal, and both our APs (the two strongest red Wi-Fi signals) are crowded on the same channel. As a result, actual speed tests in the second bedroom only reached about 80 Mbps.

So, we need to adjust channels and power, and also configure 802.11k/v/r.

Tuning Power and Channels

The main goal is to separate the channels and prevent clients from sticking to one specific access point.
Honestly, I can’t fully explain the “why” behind all of this; I also consulted AI for many settings. I’ll let the AI explain here too (lol).

1. Channel Strategy: Completely non-overlapping, avoiding co-channel interference

The main and secondary routers use non-overlapping channels across all bands – the most critical step in multi-AP setups.

• 2.4 GHz band (Main 1 / Secondary 11): In 2.4 GHz, only channels 1, 6, and 11 are fully non-overlapping. Assigning 1 and 11 ensures the two devices don’t “collide” (co-channel interference), which guarantees stability for IoT devices that rely on 2.4 GHz.
• 5 GHz-1 band (Main 36 / Secondary 52): The main router uses the low channel 36; the secondary uses DFS channel 52. These are completely independent at 80 MHz bandwidth.
• 5 GHz-2 band (Main 149 / Secondary 157): The two routers’ high-band 5 GHz channels are also separated.

Summary: This spatial channel isolation minimizes background noise and maximizes network throughput as devices move between the routers.

2. Bandwidth Strategy: Balancing stability and peak speed

• 2.4 GHz set to 20 MHz: A very wise move. Although 40 MHz is theoretically faster, the extremely crowded 2.4 GHz band (microwaves, Bluetooth) would experience multiplied interference with 40 MHz, causing frequent dropouts. Locking to 20 MHz sacrifices peak speed but maximizes wall-penetration stability and coverage, ideal for speed-insensitive IoT devices.
• 5 GHz-1 set to 80 MHz: 80 MHz is the mainstream sweet spot for most phones and laptops, offering very high LAN throughput and WAN download speeds – the primary high-speed band.
• 5 GHz-2 set to 40 MHz: An interesting strategy. Limiting the second 5 GHz radio to 40 MHz saves valuable wireless spectrum (reducing interference to neighbors) and serves as a high-stability backup high-speed network, suitable for older devices that don’t support 80 MHz or for isolating specific devices.

3. Power Strategy: “Weak 2.4 GHz, Strong 5 GHz”

This power configuration is the most brilliant part; it perfectly solves the “sticky client” problem in multi-AP environments.

• 2.4 GHz power lowered (18 dBm / 20 dBm): 2.4 GHz signals have long wavelengths and penetrate walls extremely well. Without reducing power, a phone moving around the house will stubbornly “cling” to a distant 2.4 GHz signal, resulting in terrible speeds. Lowering the 2.4 GHz power on both routers artificially shrinks the 2.4 GHz coverage circles, encouraging devices to disconnect earlier when the signal weakens and search for a better one.
• 5 GHz power maxed out (23 dBm / 24 dBm): 5 GHz signals penetrate poorly and attenuate quickly. Keeping high power compensates for this weakness and expands the high-speed 5 GHz coverage area.

Summary: This power differential creates a natural band steering effect at the physical layer. When a phone sees both 2.4 GHz and 5 GHz signals, the strong 5 GHz signal can easily exceed the weak 2.4 GHz signal, making the phone “happily” prefer the faster 5 GHz network.

4. Roaming Coordination

With the physical-layer channels, bandwidth, and power properly tuned, the 802.11k/v/r protocols complete the seamless roaming loop:

• 11k (Neighbor Report) + 11v (BSS Transition Management): The router actively tells the phone “which nearby node has a better signal” and suggests a switch. Because the 2.4 GHz power is suppressed, the phone easily triggers the 11v threshold when moving.
• 11r (Fast Transition): Combined with a unified SSID (PINer) and matching encryption, this eliminates the hundreds of milliseconds otherwise needed to re-authenticate when switching APs, achieving a truly “seamless” experience (e.g., WeChat voice calls don’t drop). The identical mobility_domain and unique nasid are also standard 11r requirements.

Ref: Gemini

The final channel, bandwidth, and power configuration:

• Main Router 192.168.3.1
  • 2.4G: channel 1 / 20 MHz / 18 dBm
  • 5G-1: channel 36 / 80 MHz / 24 dBm
  • 5G-2: channel 149 / 40 MHz / 24 dBm
• Secondary Router 192.168.3.2
  • 2.4G: channel 11 / 20 MHz / 20 dBm
  • 5G-1: channel 52 / 80 MHz / 23 dBm
  • 5G-2: channel 157 / 40 MHz / 24 dBm

Results & Follow-up

Testing shows: in the living room, balcony, kitchen, and bathroom, devices default to the main router. In the second bedroom, they automatically switch to the secondary router. In the study, closing the door also triggers a switch from main to secondary. From signal degradation to actual handover takes about 5 seconds. The master bedroom is less deterministic – sometimes it switches, sometimes not; in 5 tests, it switched 3 times.

Speed test after connecting to the 5 Gbps port:

The actual downstream speed reached 1336.31 Mbps, and upstream 158.16 Mbps. Looks like a success?
However, the real-world experience isn’t dramatically different, because few servers can saturate such speeds, plus ISP policies like QoS make it hard to reach the limit. But a multi-threaded download tool like IDM might make better use of it?