TP-Link Omada Setup/Walkthrough - GUI, Firewall, VPN, and more

[@MichaelBurko]

Great video! Since you have mixed feelings about network security and vpn, would be great to see similar walk through using Omada controller/switch/AP, but with pfsense router: configuring vlans, vpn, etc.

[@zadekeys2194]

Agreed :) Personally PFSense+Mikrotik as an AP. Some Mikrotik's have quite high WiFi Tx/Rx power. For what you are getting at the price, I don't think anything currently beats what you can get from the right Mikrotik for your needs.

[@51TomasLopez50]

Total noob here, but i had a problem with setting up a portal for my guest network with this setup followed step by step. If you have your guest network with a "manual" VLAN and you use the ACL to block all from your guest vlan to your main lan, the portal will not show up as the AP should be able to reach your controller in your main lan. This is when the "Guest Network" check mark comes in handy. This allows your guest network to reach your controller BUT denies all IPs to access any config on your main lan. Hope this helps somebody!

[@BrentLeVasseur]

Fantastic overview! thank you! Please do a deep dive video on Vlan access rules and Firewall rules for Omada.

[@patricknelson]

22:03 - Presumably that still worked because their UI mislabels that as "URLs" when in reality that's just a DNS block. And since you had just visited the site, the DNS was cached locally for a little bit of time. But after a little while, that'll go away. But part of why it's a bad idea to call it URLs (I mean, this *is* "prosumer") is because it would block all types of traffic by domain, not just web but SSH, FTP and other goodies.

[@perryuploads776]

You convinced me to buy TP-Link instead of Unify XD. Thanks for the video. I hope Cisco will open up to normal household consumers with Meraki. They cost a lot. Omada is a real competitor with Unify that had reasonable pricing. But I see TP-Link is gaing traction in the market. Hope they market this stuff more and always improve. The household and small business market really will enjoy with these experiences. Thanks again!

[@brianflanders6543]

Did you ever figure out the PIA vpn issues you described in this video ?

[@bbgr33dy8]

Man these videos are helping me a lot, i committed and went full omada for my main house, i was wondering do you tested site-to-site vpn? I want to add Omada to my other house in order to access the ip cameras there via onvif and consolidate everything on my server but no idea if that might work haha. Anyways thank you 👌🏼👌🏼 great video

[@thekentmk]

I started with an ER605 just because I have 2 ISP and needed a failover. Found your Omada shortstack video and now starting to build my own as well. Videos like this are really helpful!

[@RaidOwl]

Heck yeah man!

[@thekentmk]

@@RaidOwl I'm subbed now and watching more of your content! Great job! Learning a lot here.

[@ThisIsTeslaTrippin]

Wondering about going into the setup on Omada for meshing 2 access points on the same SSID, maybe one for 2.4 and another for 5ghz network? Also, pros and cons of hooking up “dumb” (unmanaged) switches downstream of the smart switch, and how we might want to configure those? Thanks for the videos on Omada, I’m going with a new Omada setup soon.

[@DoCLov]

You should get Omada AP which support seamless roaming. Don’t go for older or cheaper ap. it works pretty well on the same ssid. At least with ,y iPhone. You can also see in the logs when roaming happens.running dumb switches downstream work. Omada just treats all devices like connected to the same port on the smart switch. Is it painless - no, there a few bugs I discovered in my hacks setup. I also had to introduce weekly reboot of all devices. Previously after 70 days of up time it might decide to re provision a gatway in the middle of the day and l would loose a connection during a video call. But after weekly reboot it hasn’t happen since.

[@zadekeys2194]

I'd like to see how the firewall / general security of similar devices would compare EG Ubiquiti, TP Link, Asus, Mikrotik etc when setup with Vlan's, inter vlan firewall rules, IoT , Guest Etc

[@mattlewis4810]

dual WAN setup would be fantastic

[@AmericanPatriots87]

Anyone actually have any experience using this in an enterprise evironment? What are your experiences with it? Would you use this over Ubiquiti?

[@z8ty]

I have and use a similar setup. I have the OC300 controller and the MP version of the switch. I just installed (July 2023) a system like this one for a building contractor that has a tenant in his building. He wanted to have separate networks from the tenant, but only use one ISP. The system is working great. He and the tenant have 3 VLANS each. No access to the other's network. As for a large enterprise environment, you have to be careful of the number of devices. The OC200 can handle 100 devices and the OC300 can handle 500 devices. Enterprise means different things to different people. For me it means a full time Cisco Certified network staff and a very large budget. I have co-workers that went with Ubiquiti and of the 3 one is our Network Architect and he sold it all. He did not like the interface and did not like the cost. 1 other gave it up and went with his own hybrid system. He also did not like the cost and the complexity.

[@sohailaslam2057]

You had blocked *tacobell website snd were still able yo access it from pc, it was because pc was showing you cached page of the website. Pressing ctrl+F5 would force browser to ignore locally cached page and download page again. This way blocked site should not appear.

[@l0gic23]

Ctrl+shift+R also works for this

[@Noxspecter]

How to set up different SSIDs and Passwords for each EAP through EAP Controller

[@brucebondi6104]

Hi, I think you have done an amazing job explaining the programming of the GUI and all the offerings that Omanda has with their new platform. I have installed several systems already. The problem is, No one tells us how to separate the devices to the V-lans that you teach us how to set up. If I want to put all my IOT devices in a V-lan, I’m clueless. It seems it would be easy for a hard wired device, but not so easy with wireless.. Please advise. BRB

[@angrynerd2103]

Iv been looking into that issue a lot myself recently and it seems for wifi vlan options boil down to two ways. Either mutiple ssids or a radius server and wpa enterprise. The multiple ssids are probably easier to setup but I dont particularly like having an ssid like "name-iot".

[@z8ty]

I just did an install and setup 6 vlans including 2 IoT vlans. Setup wired networks for each of your wireless networks (this will give you the DHCP that you will need) and give them each the desired vlan #. I suggest that you use the vlan # as the 3rd octet in the DHCP settings. Then setup a wireless network for each wired network you created. For example: Staff, Guest and IoT. At this point you should have 3 wired network with vlans and DHCP and 3 wireless networks with the same vlans. All of your wired networks should be trunking down the appropriate port from your router to your switch. Connect your APs to the switch and they will broadcast the SSIDs of your wireless networks. When you connect to a particular one, check your IP address. It will be from the range you set for your network. And if you setup the 3 octet to be the vlan number you will have confirmation that it is working. Now you have to set up an ACL to keep your IoT vlan from being able to access your main network. You may want to make sure your ACL allows your main (Staff as the example) network to access your IoT network so you can reach your IoT devices without having to join the IoT wireless network. There are other videos out there that probably will be easier to understand than my diatribe above. Best wishes.

[@DoCLov]

Version 5.4.7 of the controller disabled speed test option due issue getting the right results for wan above 500 mbps

[@j.j.a.7908]

Could you do a self hosted omada controller video, especially if there're major differences? I'm thinking about deploying an omada based network at my dad's office/workshop site, would there be anything you'd like to know if I did, like any specific problems or how the portal works, etc.?

[@ercanyilmaz8108]

In the video you, advise to use Switch ACL. I have tried that at my own network and this didn't work very well. Since the rules are stateless the traffic to WAN from inside the Lan is also rejected. Therefore we need stateful rules and they can be created under Gateway ACL. Here you can choose LAN->LAN and then like at Switch ACL the network where the traffic needs to be permit or rejected. Keep also in mind that we must position the Permit-rules at the top and Reject-rules below. That is because of the fact that Omada processes the rules from top to down.

[@ianmertens4221]

I would love to se more regarding cloud access. My wife works at home. If something is not working properly, I want to troubleshoot remotely. I have the hardware OC-200 controller, but it appears that I need to have the software controller running continuously (hardwired to the system) to see anything remotely.

[@mategombas771]

Just bind cloud access function to a tplink account. It is free and provides remote access to oc200 via internet.

[@vinkomsolutions5956]

Thanks..really helpful. i have a question. I am not very tech savvy. But can we use a normal router (provided by the ISP) instead if TP-Link ER605?

[@philiproberts5740]

You can indeed use a standard ISP router if you wish, however you will lose a lot of the functionality that was mentioned in the video as it requires the Omada router. Things like VLANs, bandwidth controls, gateway ACLs etc wont be available. However if you are just after basic wireless and a nice controller interface to manage it, then it will work for you!

[@karmakanic475]

Actually using the WAP IP address doesn't bring you to the Omada GUI. It takes you to the Omada basic settings page.

[@alexmand8003]

I have the ER706W and was hoping you can clarify one piece of the router admin interface - i have section for Network Statistics - if i select the tab for IP statistics i see a huge amount of IPS most of them which seem to be external (500 at this time) - can you explain what these IPs are that im seeing?

[@DavidBradyTSP]

Great video! Would love to see how you approach the dual WAN setup with Omada.

[@DoCLov]

I think primary and back up are straightforward. I had a 3 way wan with 2 providers and 4g back up. That was a bit tricky and I had to add a policy on ip group to prefer main wan

[@goblinphreak2132]

does it do packet sniffing? IDS/IPS? how is the QoS? the one reason I bought a dream machine pro was the insane quality QoS it has. I had an asus gaming router before, and with 3 power users I would end up getting a F rating for buffer bloat. turning on QoS on the ASUS moved that score to a D. getting the dream machine pro with the initial setting of QoS OFF, I got a B rating, and then turning it on it went to an A+ rating. which is great. basically 0 buffer bloat now. which was a huge point for me in gaming.

[@jaygreentree4394]

I dont own any Omada gear but the controller is pretty much like unifi from the little bit of playing I was doing on it.

[@firecloud77]

When you're a total newbie at this stuff the endless inconsistent terminology usage is so damned frustrating. I finally figured out that Ethernet and LAN are the SAME THING. My router isn't labeled LAN, it's labeled Ethernet.

[@DanielBusse-g2x]

Trying to set up a complete Omada system with 14 outdoor AP's (158 acre Trailer Park). I would like to issue separate passwords that expire for each site. (Like a hotel does). Is this possible? Tks for any help you can share.

[@RaidOwl]

Yep, you’d use the Captive Portal feature

[@donny_bahama]

You lost me at adopting devices. What do I do if I plug in a WAP and it doesn’t show up in Devices?

[@magic.marmot]

N00b here. What is the default IP address of the controller?

[@RichWestJr]

Thanks!

[@RaidOwl]

Anytime!

[@alaincarpentier8002]

Great video. Any ideas how to put in place some sort of geo IP filtering. With pfsense it’s an add on 😢

[@spiritvateme]

Can i set this up to work from home and assign an ip address and keep mines off m

[@dino.hurricane978]

Is there a way to set up the switch rules to allow access from your LAN to IOT so I can control my smart lights without switching networks but block IOT to LAN for better network security? Kind of like a one way street.

[@RaidOwl]

Yep it’ll be open by default so just create a Dent rule with IoT as the source and LAN as the destination. Pretty much the example I showed in the video.

[@dino.hurricane978]

@@RaidOwl Damn I completely missed you replied to my comment. That's awesome!. Thank you. Quick question, what's a Dent rule?

[@anthropicPanda]

@@dino.hurricane978he meant deny in case you never figured that one out lol

[@mwparker1969]

Loved the video. I could not help myself. Just ordered your setup. Thx!

[@MoneyMaverics]

Bro can you make a 1pc of OC200 1 ER605 and 1 switch 2008sp but multiple sites/location ?

[@sujith-dev]

Do we now have the VPN as a WAN listing in omada?

[@patpalmer2353]

I just logged into my controller and don't see any devices? I have a infinity router, that runs to a tp link 16 port switch, then off that have a 4 port poe switch, and have a cable going to my oc200 controller and a tp WAP. HELP!

[@MerlKorvin]

Hi is it posible to set up Omada ER605 router with multiple public IP addreses from provider? PE-CE connection to upstream ISP router and directly NATed addreses for use?

[@MysticStar_Blue_Swordsman]

I am having a lot of trouble getting port forwarding working on my new TP-Link ER707-M2 i have tried both Omada cloud and the standard web interface for port forwarding and neither are working i am trying to host a minecraft bedrock server and every time i try to port forward both the local IP for the computer and the Public IP for WAN it gives me this error "The external port has already been assigned to other rules." My other problem is to fix this i would assume i would need a second interface (It is only showing WAN in options for port forwarding) to show up to allow me to add that but i either don't know how to do that or it is simply not giving me the option to

[@jrabbott34]

For some reason I've never had any luck with the auto backup recognizing any USB drive that I plugged in. I've tried various formats, but it just never sees the USB drive. So I just end up doing FTP, which I'd rather not...but it works fine. I just had to open it up on my Synology. Anyone had any luck with USB drives? Or have a suggestion on format ? Also, SOLID video sir. I like the breakdown and I've been using the Omada setup for a bit, but still learned several things here, so thank you kindly. I have a decent Omada setup (3 APs, ER605 FW, one 16 port managed switch, on 8 port managed switch...and the OC200 SDN) and it works well. One dig I have at TP-Link... I wish their log screen for event dropped pings would provide more information. I just end up marking them all as archived. I mean, I run various docker images and the "detected large ping attack and dropped xx packets" might very well just be normal. BUT... I have now way to tell and it provides zero value other than...it occurred.

[@ourkid2000]

Great video! Why not try to set up the Omada controller on a Raspberry Pi through a Docker container as well? That would make a great video I think.

[@DoCLov]

I thought about the same at first but dedicated hardware is only 60£ vs rasberry pie 30£ for the base board and if you add a case and storage you get the same 60£. Also folks were reporting issues setting it up like this

[@coraedread1655]

Hi, Could you do a demonstration setup of VLANs on TP-Link Omada and a Synology NAS?

[@SteveBPiercy]

I use a Firewalla on my network then a TP-Link switch. The firewall is expensive but the dog nuts if you're not brill on config.

[@DjMrMors]

i am kind of confused here. I have home server running truenas scale and i want to be able to have access to the web gui without exposing it on the internet. currently i am having access via ddns and domain site. I can also install openVPN on my server direct and possible to have safe access between the devices through Internet. So i came accross tp-link ER605 and i was hoping buy purchasing it i will be able to connect to my home network and access my server and possible to have it as WOL (wake on lan) in case my server will shutdown so i can switch on again. Can you help me understand better? I am about to buy the tp-link, or if u have any better alternative. thank yo

[@Neo198431]

The Poe switch seems pretty appealing but I already have a good router I have openwrt on. is it pointless to use the controller with only the switch. I also have vlans set up on my router I just need a managed switch. Would the Omada switch still be a good option?

[@manuelryan04]

Good day, I have a switch SG105PE connected in my omada network but it was detected as client not as a switch device in omada controller.

[@yomomsfather5483]

doing a firewall for a school project. could i just virtualize the controller and buy the router alone to get a firewall going?

[@angrynerd2103]

How was your experience with bufferbloat on this omada setup? I cant find much documentation about qos or sqm for this environment so im curious how it handles with just bandwidth limits.

[@haxxorsheep]

Have you figured out the PIA VPN issues you were having. I want to set that up.

[@TheMubashar99]

Almost used Unifi to deploy a 45 access point enterprise wifi network, I have switched to Omada 100% after binging on your videos, except for the core router which is a Meraki CCR. Thank You Raid Owl.

[@alexandervankevich4937]

Why omada software controller resets adopted switch ip to default?

[@marksep5294]

Can I use my CISCO 140ac as WAP in TPLink system and Omada controller?

[@mvpbrawl5536]

why did you skip attack defense one of the important in er605

[@cme9241]

Excellent video

[@juodagalvesniegena714]

Ever since I started using tp-link router I can't get any access to ANY services that need internet,internet/wifi is working perfectly,but Windows update,any launcher that needs updates through services even my antivirus is saying you have no internet. TP Link is blocking any connection to any service to download those updates,wtf I must do? I tried turning off everything I could,firewall turn off didn't work. A lot of sites I used to use are getting 304 error,even windowscom is blocked thats why I can't update my windows.

[@NokeMediaIndonesia]

Check dns setup

[@am7-p]

tp-link is a Chinese company that is aggressively investing social influencers marketing. Should that be a concern?

[@Mitchkp]

Do you have any videos on how to configure an unraid server and omada switch ?

[@anthonydelagarde3990]

Thank you

[@yuema6621]

Is there a way to create a firewall rule to allow devices to print from a network printer on a different vlan? Thanks

[@RaidOwl]

Yes. Allow connections from your client vlan to the printer vlan in only that direction.

[@kchimusaru]

Thank you

[@ahmedatm]

very very useful video 👍 ...thanks a lot mate

[@aftabshaikh-jy4sv]

does it supports IPSec VPN with Azure and AWS

[@aaassistec]

Do you have any video about how to setup the link backup (load balance) in omada, thanks mate.

[@emandagangon197]

Hi Sir great video its big help to me.. but can possible to change switch mode port into trunk in omada controller?

[@thesupremesonicsupport3292]

💙

[@feralshad0w]

I am having trouble finding a guide to properly setting up the IoT network with Omada. I have read it was not possible before, but it is now, but I am too nooby to work through it myself. Any help!!!

[@RaidOwl]

Feel free to join the discord. We can try to get you going over there.

[@zero7dd]

I love your content. I had a question is there any video on setting up TP-Link EAP multiple mash access points together to work as one and use one central access point ACL to work across all Access points throughout the home? also don't have to sign extra VLAN and I can work off that one central access point VLAN. I hope this question makes sense

[@z8ty]

I tried to figure out what you are asking, but fell short. Perhaps rephrase the question. The mesh option works great. Your ACL can be assigned the port to which you have your wired AP connected. Do you have something specific in mind for the ACL?

[@TheKrnGl]

Did VPN client get any better yet?

[@saharmesri1810]

Thanks for the video, this certainly helped me understand this system more. It would be nice to go over some of the features that could be for parental controls, like blocking internet access to specific devices on demand and with a schedule.

[@Dalewhlr]

So if I wanted to use pfsense I would use the Vlan option instead of interface?

[@z8ty]

You could as long as you setup Pfsense to be your DCHP server.

[@juniornunes]

so i just started with this system cause eero was trash and i started with a single access point and firewall (ran my own controller in unraid im cheap) THEN bought the poe switch cause i hate cables THEN bought another access point to fill a dead zone i had ya i blame you for the rabbit hole i feel down but oh well my network is amazing tho haha

[@Lyunpaw]

The fixed Ip was an issue on tp-link for a while

[@jaysnz]

Can you help.with mdns

[@Anonymous-lr6jt]

I have a question regarding double NAT when using the TL-R605 router. I plan to use a similar setup as your friend's in the video titled, "Home Network Upgrade - TP-Link Omada Setup". Though I have two ISPs and would be connecting them to the router. A thing to note is, both ISP, have provided me with their OEM routers (similar to the one in the video, i.e. a modem, router, and access point combo) and I can't get rid of them or bypass them. Though I can disable their DHCP server or turn on their DMZ feature in both routers. I cannot find a solution to get rid of the double NAT problem I will face when playing online video games. Any tips or suggestions?

[@RaidOwl]

Putting the R605 in the DMZ should avoid any real firewall conflicts from your ISP. It’s not quite “passthrough” mode but it should be fine.

[@Anonymous-lr6jt]

@@RaidOwl But my main concern is the Double NAT issue. Anyway to sort/clear it out?

[@kuandaful]

Can you add an Orbi router as an AP in this setup?

[@RaidOwl]

It will work but it won’t show up or be configurable via the Omada UI

[@TMoneyJones]

Waterburger

[@bigturbob7356]

Hey @Raid Owl, any update on whether we can access a PIA like VPN service and use it as a separate Wan interface?

[@maichaelthejoe8213]

Based on the video, I wonder if the way to do this could be to create a seperate SSID network as a vlan, and then only list this as the interface for the VPN (PIA, NordVpn). So for any device you want in your home to use this vpn connection, switch to this different Wifi network. Not a great option for wired devices though

[@gus.medrano]

I used this guide and it seems to work. The only issue is DNS leaks :( Manually setting the VPN DNS servers for the vlan interface doesn't seem to do anything

[@l0gic23]

Good overview. Ty

[@mhpreach]

Mr. Owl is there a way to setup devices w/o buying the controller and not having internet available. I have a Ubiquiti U6 access point I need to adopt in.

[@RaidOwl]

The devices will work with each other but without the controller you’ll have to configure everything in each of their own web guis.

[@mhpreach]

Ok I have an Omada controller coming. Will I be able to adopt the existing U6 pro AP into the Omada system?

[@RaidOwl]

@@mhpreach Unfortunately not :/

[@mhpreach]

Ok let me ask this. Can I bring my Ubiquiti key Gen from home system and plug into the office router adopt the U6 access pint into either the router or Omada switch?

[@RaidOwl]

@@mhpreach Unifi Cloud Key will only be able to 'see' Unifi gear and the Omada Controller will only 'see' Omada gear. You can plug a Unifi AP into an Omada switch but it won't be configurable via the Omada Controller.

[@louisbertini]

Another great Omada video.

[@andreaconfalonieri6512]

Nice Unifi Copy

[@MarcelodeSouzaSilva]

Is the VPN client situation still the same? Does anyone know if it's possible to use the VPN as a "wan" in the current version? Thanks!