NerdAxe – Stuck Falling Back to AP Mode

Log into your router admin (usually `192.168.1.1` / `192.168.0.1` / `10.0.0.1`). Find WiFi / Wireless Settings. Disable Smart Connect, Band Steering, AiMesh Smart Connect, or Dual-Band Combined SSID - whichever your vendor calls the feature. Create a separate SSID for the `2.4 GHz` radio, e.g. `HomeNet-IoT-2.4G`, with `WPA2-Personal (AES)` and a simple ASCII password. Save, wait 60 s, then reconnect to `NerdAxe_XXXX` at `http://192.168.4.1` and provision against the new SSID. Leave this SSID in place permanently - every ESP32 device you add later (NerdAxe, Bitaxe, Nerdminer, NerdQAxe) will use it. This single change resolves roughly 60% of NerdAxe AP-fallback tickets.

Verify SSID and password on a second phone before entering them on the NerdAxe. Type the exact SSID and password into the phone's WiFi settings. If the phone fails to join, credentials are wrong at the router - fix there first. If the phone joins cleanly, copy the credentials character-by-character into the NerdAxe portal. Mind case: `Smith-Home` and `smith-home` are different SSIDs. Watch for trailing whitespace from password-manager paste - the single biggest silent AUTH_FAIL in the D-Central NerdAxe queue. Avoid smart-quotes and non-ASCII characters. Type manually if in any doubt.

Reset NVS by holding `BOOT` for 10+ seconds during power-up. Disconnect USB-C. Press and hold the `BOOT` button on the NerdAxe PCB (small tactile near the USB-C port - see your board silkscreen). Reconnect USB-C while still holding. Continue holding a full 10 seconds after power is applied. Release. The device now emits a completely fresh `NerdAxe_XXXX` AP with no stored credentials. Reconnect, provision from scratch. Clears any corrupted NVS entries from prior failed attempts - particularly valuable after an interrupted OTA or Web Flasher session left NVS half-written.

Re-provision against a `2.4 GHz` phone hotspot to prove the hardware is fine. iPhone: Settings > Personal Hotspot > Maximize Compatibility = ON (forces `2.4 GHz` + WPA2). Android: hotspot settings > band > `2.4 GHz only`, security WPA2. Simple SSID, simple password, ASCII only. Provision the NerdAxe against the hotspot. If it joins cleanly, the ESP32-S3 radio is fine - the problem is your home network configuration. If it fails here too, advance to Tier 3 firmware reflash.

Move the NerdAxe within 3 m of the router during provisioning. ESP32-S3 is not a distance champion - first-boot association needs clean RSSI. Provision close, let it join, then move to the permanent location. After it joins, check RSSI in the NerdAxe web UI - target `-60 dBm` or better at the permanent location. Below `-75 dBm` is the margin where intermittent `AUTH_TIMEOUT` (reason `202`) will kick the device back to AP mode sporadically.

Switch the target SSID security to `WPA2-Personal (AES/CCMP)` or `WPA2/WPA3 Transition Mode`. Avoid `WPA3-Personal Only`. Save, wait 60 s, re-provision. WPA3-only interop with ESP-IDF WiFi on ESP32-S3 is still inconsistent across router firmwares (ASUS RT-AX, UniFi 7.x, Eero v6.x, Bell / Videotron ISP routers). WPA2 is bulletproof for an open-source hobby miner and is the Mining Hacker default for any IoT SSID.

Disable AP isolation, client isolation, guest-network mode on the target SSID. Look for `AP Isolation`, `Client Isolation`, `Wireless Isolation`, `Prevent LAN Access`, or `Guest Network Mode` in router admin. Turn them off on the SSID the NerdAxe uses. Save, re-provision. These features block the NerdAxe's frames at the AP before DHCP can complete. If your network segregates IoT to a separate VLAN, pick the SSID where isolation is off - you will need explicit firewall rules to reach the NerdAxe web UI from other VLANs.

Unhide the target SSID for provisioning, re-hide after. If your `2.4 GHz` SSID is hidden (non-broadcasting), unhide it in router admin, provision the NerdAxe, re-hide after it has joined. Older ESP-Miner-NerdAxe builds return `NO_AP_FOUND` (reason `201`) on hidden SSIDs even when credentials are correct. Upgrade to the current ESP-Miner-NerdAxe stable first if you want to stay on a hidden SSID long-term - hidden-SSID handling improved in recent builds.

Check for MAC filtering or device-approval on the router. On UniFi, Bell Gigahub, Videotron Helix, Rogers Ignite / Xfinity xFi, find `Device Approval` or `MAC Address Filter` in security. Look up the NerdAxe MAC (printed on the device, or in the serial-console boot log - Espressif OUIs like `24:0A:C4`, `7C:DF:A1`, `EC:DA:3B`). Add to allow-list. Save, re-provision. Without this step, the AP associates then immediately de-authenticates - serial log shows `wifi_disconnect reason: 8` (`ASSOC_LEAVE`).

Connect USB-C and read the serial console at `115200 baud`. PuTTY on Windows, Tera Term, Arduino IDE serial monitor, `screen /dev/tty.usbmodem* 115200` on macOS / Linux, or `minicom`. Power-cycle the NerdAxe and watch the boot log. The key line is `wifi_disconnect reason: N`: `15 = AUTH_FAIL` (wrong password), `201 = NO_AP_FOUND` (SSID not visible to radio - band or hidden), `8 = ASSOC_LEAVE` (AP kicked the client - isolation / MAC filter), `202 = AUTH_TIMEOUT` (weak signal / WPA3 neg fail), `6 = NOT_AUTHED` (rare). Match the code to a root cause and target your fix - stop shotgunning firmware reflashes.

Set router DNS to `1.1.1.1` (Cloudflare) or `8.8.8.8` (Google). Not strictly AP-fallback but a NerdAxe that joins WiFi with broken DNS presents symptoms that look similar - long `CONNECTING...` state, eventual fallback to AP in some ESP-Miner builds. Setting known-good public DNS at the router level eliminates DNS as a diagnostic variable, and also fixes `solo.ckpool.org` resolution flakes on IPv6-only segments of some ISPs.

Reflash the exact correct ESP-Miner-NerdAxe image for your board revision via USB-C Web Flasher. Hold `BOOT`, tap `RESET`, release `BOOT` to enter ESP32-S3 bootloader mode. Go to `https://github.com/BitMaker-hub/ESP-Miner-NerdAxe/releases` and pick the firmware for your NerdAxe board revision. Flash via a WebSerial-capable browser (Chrome, Edge, Opera - not Firefox, not Safari) using the NerdAxe Web Flasher. CRITICAL: do not flash a standard Bitaxe Supra / Ultra / Gamma firmware on the NerdAxe. The NerdAxe uses `BM1366` and Gamma firmware targets `BM1368`, which will brick chip communication. If chip enumeration fails after flashing, see the sibling error `nerdaxe-bm1366-not-bm1368-firmware-mismatch`.

Roll back or forward the firmware if you are on a beta and WiFi provisioning is broken. Check your ESP-Miner-NerdAxe version in the web UI or serial boot log. If you are on a pre-release tag (often suffixed `-b1`, `-rc`, `-nightly`), roll back to the most recent tagged stable release at `https://github.com/BitMaker-hub/ESP-Miner-NerdAxe/releases`. Betas occasionally ship WiFi stack regressions - stable tags are the baseline for production miners. Flash via Web Flasher to the stable image for your board revision.

Capture a full boot log and file / reference a GitHub issue. With serial console running at `115200 baud`, capture the entire boot log from power-on through the AP-fallback loop. Include firmware version, board revision, router model, router firmware version. Search open and closed issues at `https://github.com/BitMaker-hub/ESP-Miner-NerdAxe/issues` for your reason code + router family - frequent matches. If no match, file an issue with your capture attached. NerdAxe maintainers respond and D-Central contributes reproducers to the tracker.

PSU sanity-check: swap to a known-good USB-C supply and cable. NerdAxe runs on USB-C at `5 V / 3 A`. A marginal or charge-only cable / PSU that sags under ESP32-S3 WiFi TX bursts causes association to fail exactly at the WiFi handshake - radio browns out mid-authentication, AP drops client, ESP-IDF falls back to AP mode. Swap to a known-good data-capable USB-C cable and a proper wall brick rated for `5 V / 3 A` sustained. Avoid laptop / hub USB-C ports for provisioning - they frequently under-deliver and mimic AP-fallback symptoms.

When to stop DIY. If you have walked Tier 1-3 (dedicated `2.4 GHz` WPA2 SSID, verified credentials on a second phone, NVS wipe, Web Flasher reflash of current stable ESP-Miner-NerdAxe, known-good USB-C PSU, phone-hotspot test, serial-console reason-code capture) and the NerdAxe still loops in AP mode on your home network, open a D-Central support ticket with your serial log attached or drop into the D-Central Discord `#nerd-family` / `#bitaxe-help` channel. If provisioning fails on every network including a fresh phone hotspot with Maximize Compatibility on, you are likely looking at ESP32-S3 radio damage - warranty / bench territory.

D-Central bench process for NerdAxe-class work: intake log review, known-good network test on the bench, Web Flasher baseline reflash of current stable ESP-Miner-NerdAxe, serial-console reason-code capture, NVS dump and corruption check, ESP32-S3 radio sanity check via controlled association sweep, burn-in on a stable pool for 12-24 h before return. Flat bench-diagnostic fee applied to any repair cost if hardware turns out to be the issue. D-Central stocks and supports the full Nerd family - units purchased through our store get warranty honoured, units from elsewhere we diagnose for a modest bench fee.

Ship safely if the NerdAxe is heading to the bench. Anti-static bag, 5 cm of foam on every side of the outer box. Include a note with board revision (printed on the PCB), current ESP-Miner-NerdAxe version, your router model and firmware version, observed symptoms, and contact info. Context saves triage time and triage time saves your bench dollar. Canada-wide turnaround on NerdAxe-class work is typically 3-7 business days. US / international welcomed - D-Central ships worldwide from Canada.