NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
RS600 Shows false negative (Blocked) Devices
For years we have had a network that comprises of a gateway on the ground floor and an Access Point on the 3rd level that connected to the ground floor by cable - we control the access to the Interne...
Just to make sure that the problem does not come from the Access Point, we put the RAX40 back as Access Point and got the same behaviour
The first Access Point you talk of is the Wi-Fi of the RS600?
If I am understanding your symptoms correctly, then the problem devices are all connected via the AP (whether RAX50 or RAX40). Is that correct?
It looks to me the OP Jacob_of-Aus has re-added RAX40 in AP mode to isolate the RS600 Wi-Fi part - operating as a kind of Access Point - direct on the router.
And the issue is the same in my reading: The RS600 router appears not working correctly, regardless of the wireless devices are connecting direct to the RS600 Wi-Fi or the RS600 LAN.
It looks to me the OP Jacob_of-Aus has re-added RAX40 in AP mode to isolate the RS600 Wi-Fi part - operating as a kind of Access Point - direct on the router.
Agree the RS600 is the router. The way I understand the first post is that Jacob_of-Aus has always had a router+AP setup. That was RAX50 (router) and RAX40 (AP).
Then he upgraded to the RS600, so the configurations that aren't working are the RS600 (router) + RAX50 (AP) and also RS600 (router) + RAX40 (AP).
I am thinking he went back to the RAX40 as the AP to rule out the RAX50 as the problem. I don't see anything about the RS600 wifi - whether that the RS600 wifi is turned off, or whether the AP network has the same name as the router wifi or not.
I agree that the RS600 router appears to be the problem, but thinking that connecting the problem devices directly to the router would be a useful test. From the first post, it looks to me like the problem devices are all connected to the AP. But I am not certain of that, so wanted to confirm.
My apology if I did not explain my problem the properly.
Firstly, we are a small, 30 Suites on 3 levels private hotel with about 40 devices (give or take) connected to the Internet at any one time. As residents (guests) pay for Internet connection by device. We use ACL to control access in addition to password for obvious reasons.
On the ground floor we have is RS600 as gateway router (connected by cable to the modem that receives Internet from the ISP).
On the 3rd level we have RAX50 configured as Access Point (AP) and connected by cable to the RS600.
(Please forget about the RAX40, it was put in temporarily just ensure that problem does not come from RAX50. Once we established that indeed the problem comes from RS600, the RAX50 was reinstated. In other words, our?network comprises of 2 routers only, RS600 and RAX50.)
The RAX50 is configured as Access Point (AP) to avoid maintaining 2 ACLs. The only ACL we have resides in the RS600.
We have only one password for both routers for convenience reason.
Due to the topography of the building approximately 1/3 of the devices connect only to RS600, 1/3 connected only to the RAX50 and the balance 1/3 can connect to either of them. All connections are wirelessly.
The firmware on the RS600 is V1.0.6.22
The Problem
The problem manifests itself mainly with latest devices or better said with device that have the latest WiFi cards such as iPhone 16 and newer, iPad 11 generation and later, latest Android and Windows devices.
1. Devices that connect to the Access Point (RAX50) shows on ACL as Blocked and connected to the RS600 on both 2.4G and 5G channels. Repeated amount of trying to change their status to Allowed, come back as Blocked.
2. Looking at the Attached Devices list of the RS600 shows those blocked devices as connected to the RAX50 (as a wired connection) and Allowed.
3. Some, but not all do have Internet connection (hence the caption False Negative), others do not have Internet.
4. Sometimes we can overcome the problem by turning off affected devices, remove them from ACL manually add their respective MAC addresses to List of allowed devices not currently connected to the network. Whilst such workaround produces the intended result, some devices still get blocked by the system after a while, which is extremely frustrating.
We also noted that the reponse of the Access List has been slowed down dramatically in recent times. In the past any change to access list was instantly reflected on screen which is no longer the case:
When we add an allowed device manually, we no longer see the changes reflected the allowed devices not currently connected to the network list, when we try to enter it again, we get message to the effect that This MAC address is already on list, or words to that effect.
When we delete one or more devices from the Blocked Devices Not Currently Connected to the network list the access list come back with all the deleted devices still on it. We must repeat the deletion or to refresh the ACL a few times before changes are reflected in the list.
Whilst originally, we took it as a behaviour of the RS600. today we discovered the same behaviour in our other much smaller private hotel, with only one router, RAX50, that cover the whole house. Such behaviour is consistent with updating a distant database, such across the Pacific Ocean, as it is from where we are, in Sydney, Australia, to somewhere in USA.
What gave you done, Netgear?
Go n Figure that :-(
My apology (again) for the question marks, they are the result of conversion from Word, I don't know how to edit it or if kit is possible.
J
My apology (again) for the question marks, they are the result of conversion from Word
I removed them for you. I think they are coming from formatted text. When you paste into the forum text box, try right-clicking and pasting as plain text.
Firstly, we are a small, 30 Suites on 3 levels private hotel with about 40 devices (give or take) connected to the Internet at any one time. As residents (guests) pay for Internet connection by device.
Thx for the expanded explanation. This of course is hard to troubleshoot, since the devices belong to your guests, and are always changing. I am thinking you could probably live with the "false negatives", since the guest is connected. But of course the actual blocks are going to be frustrating for the guests.
I am guessing that you use a single wifi network name and password for both the RS600 and the RAX50 - is that the case? If so, one complication in the troubleshooting is that many of these devices might connect to both the RS600 and RAX50. For instance a guest walks into the lobby and their phone automatically connects to the RS600. Then they proceed to the third floor, and their devices switch to the RAX50. Also, some rooms might get a decent wifi signal from both the RS600 and the RAX50, and their devices might switch between the two networks.
The way the ACL kicks in is slightly different for the two networks. On the RS600, the ACL is directly applied when the guest connects. Normally the user wouldn't be able to connect at all. On the RAX50, the guest will be able connect to the wifi, but shouldn't get an IP address. Keep in mind that I don't have either of these routers...
Does this ever happen with your own phone (or another device you own) at the hotel? Even if it doesn't, you might try setting up your own phone or laptop, and double-check exactly what happens when you connect to the RAX50 and the RS600.
Another (burdensome) test would be to set up the ACL on the RAX50 and the RS600 when a guest's device runs into the blocked connection. Then see if that resolves it.
Longer term, an easier to manage approach would be to set up a captive portal, so guests would need to enter their name and room number to access the network. But that would require new equipment (commercial APs), since consumer routers don't have the feature. Though it might be possible to put a ethernet-only router in front to the RS600, and set up the captive portal on that. MicroTik has one (likely others do also).
So you might look into that - I think schumaku has some experience with such portals.
Such behaviour is consistent with updating a distant database, such across the Pacific Ocean,
The ACL should be stored locally on the RS600, so that wouldn't be the root cause.
where we are, in Sydney, Australia
I've only visited Sydney once for a few days. Wonderful city!
Thanks StephenB
StephenB Wrote:
I am guessing that you use a single wifi network name and password for both the RS600 and the RAX50 - is that the case? If so, one complication in the troubleshooting is that many of these devices might connect to both the RS600 and RAX50. For instance a guest walks into the lobby and their phone automatically connects to the RS600. Then they proceed to the third floor, and their devices switch to the RAX50. Also, some rooms might get a decent wifi signal from both the RS600 and the RAX50, and their devices might switch between the two networks.
I tried something similar, one SSID for all speeds for each router (to let the router decide which speed to use) which turn out to be a disaster as I couldn't tell which SSID is causing the problem. I now have Each SSID in each router (RS600 and RAX50) has its own name but all SSIDs have the same password.
Mobile devices (Phones and Tablets) usually connect (and disable randomisation (when applicable) to at at least one SSID of each Router if they want to have WiFi within the building
StephenB Wrote:
The way the ACL kicks in is slightly different for the two networks. On the RS600, the ACL is directly applied when the guest connects. Normally the user wouldn't be able to connect at all. On the RAX50, the guest will be able connect to the wifi, but shouldn't get an IP address. Keep in mind that I don't have either of these routers...
As an Access point the RAX50 just passes data from devices connected to it to the RS600 which checks the MAC address against the "Allowed" devices list in ACL and if the device is allowed, it receive IP address from the RS600
StephenB Wrote:
Does this ever happen with your own phone (or another device you own) at the hotel? Even if it doesn't, you might try setting up your own phone or laptop, and double-check exactly what happens when you connect to the RAX50 and the RS600.
I have all my devices (iPhone, iPad and MacBook) connected to all SSIDs and my iMac to RS600 only. In addition I have m MacBook allowed to both routers on the ethernet MAC address for network maintenance work (mainly after factory reset on the RS600 and any work on the RAX50 because WiFi signal would take me to the RS600 whilst it is setup as Access Point)
I have both the MacBook and the iMac automatically connect to the RS600 Wifi mail to monitor the system. I have no connection problems as my devices are not affected by the problems we have (Their WiFi cards are not "young" enough.
StephenB wrote:
The ACL should be stored locally on the RS600, so that wouldn't be the root cause.
That what I had thought I until we got the RS600. I now don't know the facts (that why I said "Consistent with", but in ay case something is very wrong.
The firmware on the RS600 is V1.0.6.22
Aware StephenB mentioned the availability of the RS600 1.2.7.2 release candidate firmware already on the 10th in a reply.
Meanwhile, since the 11 June, RS600 Firmware Version 1.2.7.2 is officially out. Interestingly, the included firmware image is dating back from 24. April 2026 in the ZIP archive(?!) Might happen the live update was not enabled for this version yet - as usual, there is an intended delay, so a manual firmware is due.
Thanks schumaku,
I just did a manual update to the router firmware, it is now Ver 1.2.7.2
I will have to wait a bit a see how the updated firmware affect my problem and if I can accept it as solution to my problem (fingers crossed).