TP-Link Omada Setup/Walkthrough - GUI, Firewall, VPN, and more

Links for the Omada "short stack" hardware:
Controller - amzn.to/3SwdoeI
Firewall - amzn.to/3bEF9Bg
Switch - amzn.to/3Q68DXJ
AP - amzn.to/3Q7OqRn
-------------------------------------------------------------------------------------------
🛒 Amazon Shop - www.amazon.com/shop/raidowl
👕 Merch - / raidowl
-------------------------------------------------------------------------------------------
🔥 Check out this week's BEST DEALS in PC Gaming from Best Buy: shop-links.co/cgDzeydlH34
💰 Premium storage solutions from Samsung: shop-links.co/cgDzWiEKhB8
⚡ Keep your devices powered up with charging solutions from Anker: shop-links.co/cgDzZ755mwl
-------------------------------------------------------------------------------------------
Join the Discord: / discord
Become a Channel Member!
/ @raidowl
Support the channel on:
Patreon - / raidowl
Discord - bit.ly/3J53xYs
Paypal - bit.ly/3Fcrs5V
Affiliate Links:
Ryzen 9 5950x - amzn.to/3z29yko
Samsung 980 2TB - amzn.to/3myEa85
Logitech G513 - amzn.to/3sPS6yv
Logitech G703 - shop-links.co/cgVV8GQizYq
WD Ultrastar 12TB - amzn.to/3EvOPXc
My Studio Equipment:
Sony FX3 - shop-links.co/cgVV8HHF3mX / amzn.to/3qq4Jxl
Sony 24mm 1.4 GM -
Tascam DR-40x Audio Recorder - shop-links.co/cgVV8G3Xt0e
Rode NTG4+ Mic - amzn.to/3JuElLs
Atmos NinjaV - amzn.to/3Hi0ue1
Godox SL150 Light - amzn.to/3Es0Qg3
links.hostowl.net/
0:00 Intro
0:53 Adopt Devices
1:47 Dashboard
2:40 Stats
3:40 Map/Topology
4:46 Devices
7:45 Clients
8:30 Insight
9:13 Logs/Notifications
9:51 Settings
10:10 Site
11:22 WAN
12:59 LAN Interfaces & VLANs
15:35 Wireless Setup
18:53 Security/Firewall
22:11 NAT/Routing
23:04 VPN
25:54 Profiles
28:04 Captive Portal
29:50 DDNS/Services
31:09 Controller Settings
31:59 Backup and Restore
32:44 Conclusion

[@thekentmk]

I started with an ER605 just because I have 2 ISP and needed a failover. Found your Omada shortstack video and now starting to build my own as well. Videos like this are really helpful!

[@RaidOwl]

Heck yeah man!

[@thekentmk]

@@RaidOwl I'm subbed now and watching more of your content! Great job! Learning a lot here.

[@perryuploads776]

You convinced me to buy TP-Link instead of Unify XD. Thanks for the video. I hope Cisco will open up to normal household consumers with Meraki. They cost a lot. Omada is a real competitor with Unify that had reasonable pricing. But I see TP-Link is gaing traction in the market. Hope they market this stuff more and always improve. The household and small business market really will enjoy with these experiences. Thanks again!

[@mwparker1969]

Loved the video. I could not help myself. Just ordered your setup. Thx!

[@TheMubashar99]

Almost used Unifi to deploy a 45 access point enterprise wifi network, I have switched to Omada 100% after binging on your videos, except for the core router which is a Meraki CCR. Thank You Raid Owl.

[@MichaelBurko]

Great video! Since you have mixed feelings about network security and vpn, would be great to see similar walk through using Omada controller/switch/AP, but with pfsense router: configuring vlans, vpn, etc.

[@zadekeys2194]

Agreed :) Personally PFSense+Mikrotik as an AP. Some Mikrotik's have quite high WiFi Tx/Rx power. For what you are getting at the price, I don't think anything currently beats what you can get from the right Mikrotik for your needs.

[@saharmesri1810]

Thanks for the video, this certainly helped me understand this system more. It would be nice to go over some of the features that could be for parental controls, like blocking internet access to specific devices on demand and with a schedule.

[@ahmedatm]

very very useful video 👍 ...thanks a lot mate

[@BrentLeVasseur]

Fantastic overview! thank you! Please do a deep dive video on Vlan access rules and Firewall rules for Omada.

[@DavidBradyTSP]

Great video! Would love to see how you approach the dual WAN setup with Omada.

[@DoCLov]

I think primary and back up are straightforward. I had a 3 way wan with 2 providers and 4g back up. That was a bit tricky and I had to add a policy on ip group to prefer main wan

[@bbgr33dy8]

Man these videos are helping me a lot, i committed and went full omada for my main house, i was wondering do you tested site-to-site vpn? I want to add Omada to my other house in order to access the ip cameras there via onvif and consolidate everything on my server but no idea if that might work haha. Anyways thank you 👌🏼👌🏼 great video

[@cme9241]

Excellent video

[@51TomasLopez50]

Total noob here, but i had a problem with setting up a portal for my guest network with this setup followed step by step. If you have your guest network with a "manual" VLAN and you use the ACL to block all from your guest vlan to your main lan, the portal will not show up as the AP should be able to reach your controller in your main lan. This is when the "Guest Network" check mark comes in handy. This allows your guest network to reach your controller BUT denies all IPs to access any config on your main lan. Hope this helps somebody!

[@mattlewis4810]

dual WAN setup would be fantastic

[@l0gic23]

Good overview. Ty

[@alaincarpentier8002]

Great video. Any ideas how to put in place some sort of geo IP filtering. With pfsense it’s an add on 😢

[@brianflanders6543]

Did you ever figure out the PIA vpn issues you described in this video ?

[@jaygreentree4394]

I dont own any Omada gear but the controller is pretty much like unifi from the little bit of playing I was doing on it.

[@patricknelson]

22:03 - Presumably that still worked because their UI mislabels that as "URLs" when in reality that's just a DNS block. And since you had just visited the site, the DNS was cached locally for a little bit of time. But after a little while, that'll go away. But part of why it's a bad idea to call it URLs (I mean, this *is* "prosumer") is because it would block all types of traffic by domain, not just web but SSH, FTP and other goodies.

[@emandagangon197]

Hi Sir great video its big help to me.. but can possible to change switch mode port into trunk in omada controller?

[@Truav8r]

Wondering about going into the setup on Omada for meshing 2 access points on the same SSID, maybe one for 2.4 and another for 5ghz network? Also, pros and cons of hooking up “dumb” (unmanaged) switches downstream of the smart switch, and how we might want to configure those? Thanks for the videos on Omada, I’m going with a new Omada setup soon.

[@DoCLov]

You should get Omada AP which support seamless roaming. Don’t go for older or cheaper ap. it works pretty well on the same ssid. At least with ,y iPhone. You can also see in the logs when roaming happens.running dumb switches downstream work. Omada just treats all devices like connected to the same port on the smart switch. Is it painless - no, there a few bugs I discovered in my hacks setup. I also had to introduce weekly reboot of all devices. Previously after 70 days of up time it might decide to re provision a gatway in the middle of the day and l would loose a connection during a video call. But after weekly reboot it hasn’t happen since.

[@kchimusaru]

Thank you

[@j.j.a.7908]

Could you do a self hosted omada controller video, especially if there're major differences? I'm thinking about deploying an omada based network at my dad's office/workshop site, would there be anything you'd like to know if I did, like any specific problems or how the portal works, etc.?

[@zadekeys2194]

I'd like to see how the firewall / general security of similar devices would compare EG Ubiquiti, TP Link, Asus, Mikrotik etc when setup with Vlan's, inter vlan firewall rules, IoT , Guest Etc

[@vinkomsolutions5956]

Thanks..really helpful. i have a question. I am not very tech savvy. But can we use a normal router (provided by the ISP) instead if TP-Link ER605?

[@philiproberts5740]

You can indeed use a standard ISP router if you wish, however you will lose a lot of the functionality that was mentioned in the video as it requires the Omada router. Things like VLANs, bandwidth controls, gateway ACLs etc wont be available. However if you are just after basic wireless and a nice controller interface to manage it, then it will work for you!

[@RichWestJr]

Thanks!

[@RaidOwl]

Anytime!

[@zero7dd]

I love your content. I had a question is there any video on setting up TP-Link EAP multiple mash access points together to work as one and use one central access point ACL to work across all Access points throughout the home? also don't have to sign extra VLAN and I can work off that one central access point VLAN. I hope this question makes sense

[@z8ty]

I tried to figure out what you are asking, but fell short. Perhaps rephrase the question. The mesh option works great. Your ACL can be assigned the port to which you have your wired AP connected. Do you have something specific in mind for the ACL?

[@goblinphreak2132]

does it do packet sniffing? IDS/IPS? how is the QoS? the one reason I bought a dream machine pro was the insane quality QoS it has. I had an asus gaming router before, and with 3 power users I would end up getting a F rating for buffer bloat. turning on QoS on the ASUS moved that score to a D. getting the dream machine pro with the initial setting of QoS OFF, I got a B rating, and then turning it on it went to an A+ rating. which is great. basically 0 buffer bloat now. which was a huge point for me in gaming.

[@aaassistec]

Do you have any video about how to setup the link backup (load balance) in omada, thanks mate.

[@Neo198431]

The Poe switch seems pretty appealing but I already have a good router I have openwrt on. is it pointless to use the controller with only the switch. I also have vlans set up on my router I just need a managed switch. Would the Omada switch still be a good option?

[@angrynerd2103]

How was your experience with bufferbloat on this omada setup? I cant find much documentation about qos or sqm for this environment so im curious how it handles with just bandwidth limits.

[@Mitchkp]

Do you have any videos on how to configure an unraid server and omada switch ?

[@brucebondi6104]

Hi, I think you have done an amazing job explaining the programming of the GUI and all the offerings that Omanda has with their new platform. I have installed several systems already. The problem is, No one tells us how to separate the devices to the V-lans that you teach us how to set up. If I want to put all my IOT devices in a V-lan, I’m clueless. It seems it would be easy for a hard wired device, but not so easy with wireless.. Please advise. BRB

[@angrynerd2103]

Iv been looking into that issue a lot myself recently and it seems for wifi vlan options boil down to two ways. Either mutiple ssids or a radius server and wpa enterprise. The multiple ssids are probably easier to setup but I dont particularly like having an ssid like "name-iot".

[@z8ty]

I just did an install and setup 6 vlans including 2 IoT vlans. Setup wired networks for each of your wireless networks (this will give you the DHCP that you will need) and give them each the desired vlan #. I suggest that you use the vlan # as the 3rd octet in the DHCP settings. Then setup a wireless network for each wired network you created. For example: Staff, Guest and IoT. At this point you should have 3 wired network with vlans and DHCP and 3 wireless networks with the same vlans. All of your wired networks should be trunking down the appropriate port from your router to your switch. Connect your APs to the switch and they will broadcast the SSIDs of your wireless networks. When you connect to a particular one, check your IP address. It will be from the range you set for your network. And if you setup the 3 octet to be the vlan number you will have confirmation that it is working. Now you have to set up an ACL to keep your IoT vlan from being able to access your main network. You may want to make sure your ACL allows your main (Staff as the example) network to access your IoT network so you can reach your IoT devices without having to join the IoT wireless network. There are other videos out there that probably will be easier to understand than my diatribe above. Best wishes.

[@ourkid2000]

Great video! Why not try to set up the Omada controller on a Raspberry Pi through a Docker container as well? That would make a great video I think.

[@DoCLov]

I thought about the same at first but dedicated hardware is only 60£ vs rasberry pie 30£ for the base board and if you add a case and storage you get the same 60£. Also folks were reporting issues setting it up like this

[@yomomsfather5483]

doing a firewall for a school project. could i just virtualize the controller and buy the router alone to get a firewall going?

[@Noxspecter]

How to set up different SSIDs and Passwords for each EAP through EAP Controller

[@marksep5294]

Can I use my CISCO 140ac as WAP in TPLink system and Omada controller?

[@jrabbott34]

For some reason I've never had any luck with the auto backup recognizing any USB drive that I plugged in. I've tried various formats, but it just never sees the USB drive. So I just end up doing FTP, which I'd rather not...but it works fine. I just had to open it up on my Synology. Anyone had any luck with USB drives? Or have a suggestion on format ? Also, SOLID video sir. I like the breakdown and I've been using the Omada setup for a bit, but still learned several things here, so thank you kindly. I have a decent Omada setup (3 APs, ER605 FW, one 16 port managed switch, on 8 port managed switch...and the OC200 SDN) and it works well. One dig I have at TP-Link... I wish their log screen for event dropped pings would provide more information. I just end up marking them all as archived. I mean, I run various docker images and the "detected large ping attack and dropped xx packets" might very well just be normal. BUT... I have now way to tell and it provides zero value other than...it occurred.

[@coraedread1655]

Hi, Could you do a demonstration setup of VLANs on TP-Link Omada and a Synology NAS?

[@MerlKorvin]

Hi is it posible to set up Omada ER605 router with multiple public IP addreses from provider? PE-CE connection to upstream ISP router and directly NATed addreses for use?

[@DoCLov]

Version 5.4.7 of the controller disabled speed test option due issue getting the right results for wan above 500 mbps

[@haxxorsheep]

Have you figured out the PIA VPN issues you were having. I want to set that up.

[@alexmand8003]

I have the ER706W and was hoping you can clarify one piece of the router admin interface - i have section for Network Statistics - if i select the tab for IP statistics i see a huge amount of IPS most of them which seem to be external (500 at this time) - can you explain what these IPs are that im seeing?

[@manuelryan04]

Good day, I have a switch SG105PE connected in my omada network but it was detected as client not as a switch device in omada controller.

[@ianmertens4221]

I would love to se more regarding cloud access. My wife works at home. If something is not working properly, I want to troubleshoot remotely. I have the hardware OC-200 controller, but it appears that I need to have the software controller running continuously (hardwired to the system) to see anything remotely.

[@mategombas771]

Just bind cloud access function to a tplink account. It is free and provides remote access to oc200 via internet.

[@Lyunpaw]

The fixed Ip was an issue on tp-link for a while

[@andrew7396]

Is there a way to set up the switch rules to allow access from your LAN to IOT so I can control my smart lights without switching networks but block IOT to LAN for better network security? Kind of like a one way street.

[@RaidOwl]

Yep it’ll be open by default so just create a Dent rule with IoT as the source and LAN as the destination. Pretty much the example I showed in the video.

[@andrew7396]

@@RaidOwl Damn I completely missed you replied to my comment. That's awesome!. Thank you. Quick question, what's a Dent rule?

[@anthropicPanda]

@@andrew7396he meant deny in case you never figured that one out lol

[@louisbertini]

Another great Omada video.

[@DjMrMors]

i am kind of confused here. I have home server running truenas scale and i want to be able to have access to the web gui without exposing it on the internet. currently i am having access via ddns and domain site. I can also install openVPN on my server direct and possible to have safe access between the devices through Internet. So i came accross tp-link ER605 and i was hoping buy purchasing it i will be able to connect to my home network and access my server and possible to have it as WOL (wake on lan) in case my server will shutdown so i can switch on again. Can you help me understand better? I am about to buy the tp-link, or if u have any better alternative. thank yo

[@sujith-dev]

Do we now have the VPN as a WAN listing in omada?

[@SteveBPiercy]

I use a Firewalla on my network then a TP-Link switch. The firewall is expensive but the dog nuts if you're not brill on config.

[@yuema6621]

Is there a way to create a firewall rule to allow devices to print from a network printer on a different vlan? Thanks

[@RaidOwl]

Yes. Allow connections from your client vlan to the printer vlan in only that direction.

[@thesupremesonicsupport3292]

💙

[@Anonymous-lr6jt]

I have a question regarding double NAT when using the TL-R605 router. I plan to use a similar setup as your friend's in the video titled, "Home Network Upgrade - TP-Link Omada Setup". Though I have two ISPs and would be connecting them to the router. A thing to note is, both ISP, have provided me with their OEM routers (similar to the one in the video, i.e. a modem, router, and access point combo) and I can't get rid of them or bypass them. Though I can disable their DHCP server or turn on their DMZ feature in both routers. I cannot find a solution to get rid of the double NAT problem I will face when playing online video games. Any tips or suggestions?

[@RaidOwl]

Putting the R605 in the DMZ should avoid any real firewall conflicts from your ISP. It’s not quite “passthrough” mode but it should be fine.

[@Anonymous-lr6jt]

@@RaidOwl But my main concern is the Double NAT issue. Anyway to sort/clear it out?

[@aftabshaikh-jy4sv]

does it supports IPSec VPN with Azure and AWS

[@user-zd3fy4lf8z]

Trying to set up a complete Omada system with 14 outdoor AP's (158 acre Trailer Park). I would like to issue separate passwords that expire for each site. (Like a hotel does). Is this possible? Tks for any help you can share.

[@RaidOwl]

Yep, you’d use the Captive Portal feature

[@AmericanPatriots87]

Anyone actually have any experience using this in an enterprise evironment? What are your experiences with it? Would you use this over Ubiquiti?

[@z8ty]

I have and use a similar setup. I have the OC300 controller and the MP version of the switch. I just installed (July 2023) a system like this one for a building contractor that has a tenant in his building. He wanted to have separate networks from the tenant, but only use one ISP. The system is working great. He and the tenant have 3 VLANS each. No access to the other's network. As for a large enterprise environment, you have to be careful of the number of devices. The OC200 can handle 100 devices and the OC300 can handle 500 devices. Enterprise means different things to different people. For me it means a full time Cisco Certified network staff and a very large budget. I have co-workers that went with Ubiquiti and of the 3 one is our Network Architect and he sold it all. He did not like the interface and did not like the cost. 1 other gave it up and went with his own hybrid system. He also did not like the cost and the complexity.

[@bigturbob7356]

Hey @Raid Owl, any update on whether we can access a PIA like VPN service and use it as a separate Wan interface?

[@maichaelthejoe8213]

Based on the video, I wonder if the way to do this could be to create a seperate SSID network as a vlan, and then only list this as the interface for the VPN (PIA, NordVpn). So for any device you want in your home to use this vpn connection, switch to this different Wifi network. Not a great option for wired devices though

[@gus.medrano]

I used this guide and it seems to work. The only issue is DNS leaks :( Manually setting the VPN DNS servers for the vlan interface doesn't seem to do anything

[@Dalewhlr]

So if I wanted to use pfsense I would use the Vlan option instead of interface?

[@z8ty]

You could as long as you setup Pfsense to be your DCHP server.

[@TheKrnGl]

Did VPN client get any better yet?

[@MoneyMaverics]

Bro can you make a 1pc of OC200 1 ER605 and 1 switch 2008sp but multiple sites/location ?

[@firecloud77]

When you're a total newbie at this stuff the endless inconsistent terminology usage is so damned frustrating. I finally figured out that Ethernet and LAN are the SAME THING. My router isn't labeled LAN, it's labeled Ethernet.

[@kuandaful]

Can you add an Orbi router as an AP in this setup?

[@RaidOwl]

It will work but it won’t show up or be configurable via the Omada UI

[@karmakanic475]

Actually using the WAP IP address doesn't bring you to the Omada GUI. It takes you to the Omada basic settings page.

[@MysticStar_Blue_Swordsman]

I am having a lot of trouble getting port forwarding working on my new TP-Link ER707-M2 i have tried both Omada cloud and the standard web interface for port forwarding and neither are working i am trying to host a minecraft bedrock server and every time i try to port forward both the local IP for the computer and the Public IP for WAN it gives me this error "The external port has already been assigned to other rules." My other problem is to fix this i would assume i would need a second interface (It is only showing WAN in options for port forwarding) to show up to allow me to add that but i either don't know how to do that or it is simply not giving me the option to

[@patpalmer2353]

I just logged into my controller and don't see any devices? I have a infinity router, that runs to a tp link 16 port switch, then off that have a 4 port poe switch, and have a cable going to my oc200 controller and a tp WAP. HELP!

[@spiritvateme]

Can i set this up to work from home and assign an ip address and keep mines off m

[@alexandervankevich4937]

Why omada software controller resets adopted switch ip to default?

[@mhpreach]

Mr. Owl is there a way to setup devices w/o buying the controller and not having internet available. I have a Ubiquiti U6 access point I need to adopt in.

[@RaidOwl]

The devices will work with each other but without the controller you’ll have to configure everything in each of their own web guis.

[@mhpreach]

Ok I have an Omada controller coming. Will I be able to adopt the existing U6 pro AP into the Omada system?

[@RaidOwl]

@@mhpreach Unfortunately not :/

[@mhpreach]

Ok let me ask this. Can I bring my Ubiquiti key Gen from home system and plug into the office router adopt the U6 access pint into either the router or Omada switch?

[@RaidOwl]

@@mhpreach Unifi Cloud Key will only be able to 'see' Unifi gear and the Omada Controller will only 'see' Omada gear. You can plug a Unifi AP into an Omada switch but it won't be configurable via the Omada Controller.

[@mvpbrawl5536]

why did you skip attack defense one of the important in er605

[@sohailaslam2057]

You had blocked *tacobell website snd were still able yo access it from pc, it was because pc was showing you cached page of the website. Pressing ctrl+F5 would force browser to ignore locally cached page and download page again. This way blocked site should not appear.

[@l0gic23]

Ctrl+shift+R also works for this

[@feralshad0w]

I am having trouble finding a guide to properly setting up the IoT network with Omada. I have read it was not possible before, but it is now, but I am too nooby to work through it myself. Any help!!!

[@RaidOwl]

Feel free to join the discord. We can try to get you going over there.

[@jaysnz]

Can you help.with mdns

[@magic.marmot]

N00b here. What is the default IP address of the controller?

[@donny_bahama]

You lost me at adopting devices. What do I do if I plug in a WAP and it doesn’t show up in Devices?

[@juodagalvesniegena714]

Ever since I started using tp-link router I can't get any access to ANY services that need internet,internet/wifi is working perfectly,but Windows update,any launcher that needs updates through services even my antivirus is saying you have no internet. TP Link is blocking any connection to any service to download those updates,wtf I must do? I tried turning off everything I could,firewall turn off didn't work. A lot of sites I used to use are getting 304 error,even windowscom is blocked thats why I can't update my windows.

[@NokeMediaIndonesia]

Check dns setup

[@juniornunes]

so i just started with this system cause eero was trash and i started with a single access point and firewall (ran my own controller in unraid im cheap) THEN bought the poe switch cause i hate cables THEN bought another access point to fill a dead zone i had ya i blame you for the rabbit hole i feel down but oh well my network is amazing tho haha

[@TMoneyJones]

Waterburger

[@am7-p]

tp-link is a Chinese company that is aggressively investing social influencers marketing. Should that be a concern?

[@andreaconfalonieri6512]

Nice Unifi Copy

[@MarcelodeSouzaSilva]

Is the VPN client situation still the same? Does anyone know if it's possible to use the VPN as a "wan" in the current version? Thanks!

[@anthonydelagarde3990]

Thank you