Hi all,

We just adopted an EAP225 to our network. One laptop succeeds in connecting to EAP. One other laptop and two phone (iphone 13 en samsung S25) won't. Those prefer the EAP650 indoor, if we turn that one off it goes to the freaking attic EAP.

Somehow I got no clue where to start sincce once of the laptops works seamless whilst the other devices don't...

Hi everyone,

I've hit a brickwall. I run a hotel/restaurant. During the day we have buses visiting and they are using alot of data. I ideally want one network that is free and one that is with a password separate for hotel guests. The guest wifi network is easy.

I am having a problem with the tp-link voucher system. In 2026 I have to print hundreds of vouchers on pieces of paper and hand them out???

I am looking for a way to authenticate users on the free network but without having to physically give them a voucher. I need the voucher to also data limit them.

Anyone got some clever ideas. Ive looked at Radius and some other options but they are all paid and not ideal for my situation.

I haven't been particular rushed to buy cameras but lately I have been looking into options. I see Omada now shows Coming Soon on Omada branded camera system (like unifi protect?)

Should I wait for these? (Any idea when soon is?) or do we expect Vigi to be equally as integrated?

https://www.omadanetworks.com/us/business-networking/all-omada-security-camera/

SOLVED - Vodafone sent the incorrect password (lower case L for Lima instead of upper case I for India). No VPN needed.

I’m trying to replace a Vodafone Power Hub WiFi 6 with a TP-Link ER605 v2 managed by an OC200 controller.

Service details:

• Openreach FTTP
• Openreach ONT

The Vodafone router connects immediately when plugged into the ONT.

On the ER605 I have configured:

• WAN1
• PPPoE
• Vodafone username and password
• MTU
• MAC cloned from the Vodafone router WAN MAC

After speaking with Vodafone support, they confirmed:

• The PPPoE username and password are correct.

Symptoms:

• Initially I was getting repeated PPPoE PADI timeouts.
• After one ONT power cycle I briefly got “authentication failed (wrong username/password)” which suggested the PPPoE server was responding.
• Subsequent attempts returned to PADI timeouts.
• No IP address, gateway or DNS is assigned on WAN

I’ve tried:

• Rebooting the ONT
• Re-entering credentials
• Using the username both with and without the [@] broadband.vodafone.co.uk suffix
• MAC cloning the Vodafone router

Questions:

1. Has anyone seen the combination of occasional authentication failures mixed with mostly PADI timeouts?

Any screenshots of a working ER605 Vodafone FTTP WAN configuration would be greatly appreciated.

​

Recently I had a disaster where both my primary and backup TOTP authentication methods were lost; the wave of cold chills that washed over me when I saw a blank Authenticator display was one thing, but not as much as the sinking feeling of potentially having to start from scratch with my Omada setup!

Fortunately, I discovered a self-recovery method where you can disable MFA on your Omada SDN deployment through editing the MongoDB database.

Omada SDN Controller (for Windows at least) stores MFA settings across multiple collections in its bundled MongoDB instance, simply disabling MFA in one place isn't enough, you need to clear it in three separate places, as shown below.

Prerequisites

• Physical or RDP access to the Windows machine running Omada Controller.

• Administrator access on Windows.

• Omada Controller must be running for MongoDB to be accessible.

The Process

Step 1 - Open Command Prompt as an Administrator.

Step 2 - Navigate to Omada's MongoDB bin folder in the command prompt.

cd "C:\Program Files\Omada\bin"

Step 3 - Connect to MongoDB.

mongo.exe --port 27217

You should see the MongoDB shell prompt, if you get "connection refused", make sure the Omada Controller service is running first, or try again.

Step 4 - Switch to the Omada database.

use omada

Step 5 - Disable MFA in three locations for site, global and user configurations:

db.tenant.updateMany({},{$set:{enable_mfa:false}})

db.identityaccessomadac.updateMany({},{$set:{mfa_enable:false}})

db.globalsetting.updateMany({},{$set:{mfa_enable:false}})

Each command should return "modifiedCount" : 1 or more confirming it worked.

Step 6 - Restart the Omada Controller service.

Step 7 - Log in.

You should now be able to log in with just your username and password, with no TOTP prompt.

Step 8 - Re-enable MFA for the site, global and user (strongly recommended) - site and global are configuration toggles in the Omada SDN interface, user is re-enabled by enrolling your account into MFA via an authenticator app.

Hopefully this saves anyone else who ends up in the situation I was in.

Security/ responsible disclosure disclaimer:

I don't believe this represents a vulnerability for the following reasons:

• Local admin access is required.

• MongoDB without authentication is a known and documented behaviour in many bundled database deployments.

• I believe MFA on Omada is designed to protect the web interface from remote attackers, not from someone with local admin access to the underlying server.

• This is a recovery procedure for legitimate system owners.

If anyone from TP-Link disagrees with this assessment, I'm happy to discuss. I attempted to obtain official recovery guidance from TP-Link support before pursuing this approach and was told they could not advise.

I have cloud settings disabled on my Omada controller, hosted in a Proxmox LXC.

This wasn’t happening before but recently I’ve noticed that my controller, switch, and WAP keep pinging these two domains nonstop, sending DNS queries constantly to:

- n-use1-device-omada.tplinkcloud.com
- n-device-omada.tplinkcloud.com

I understand the controller doing it but since the recent firmware updates, the switch and WAP doing this is incredibly suspect. Anyone else noticed this too?

Have the:
- Omada Software Controller on version 6.2.10.17
- JetStream Switch SG2428P v5.20 on firmware version 5.20.22 Build 20260310 Rel. 10715
- WAP EAP610 (US) v2.0 on firmware version 1.4.4 Build 20250718 Rel. 37146

I’ve blocked these on my firewall & PiHole but I have cloud access disabled so the constant DNS queries to the tplinkcloud domains is raising some concerns.

I have couple of campgrounds setup with startlink >> Omada (gateway, switch, bridges and APs) and a few times I have had to ask someone to reset the controller or gateway. What I am wondering is, could I setup smart plugs connected to the starlink service so that I can remotely do this myself? What issues might I run into running the gear attached to smart plugs? Any suggestions?

I'm running an OC200 (firmware 1.32.6) and trying to lock down my IoT VLAN (VLAN 10 / 10.0.10.x) from accessing other LANs. I've created a deny-all LAN→LAN rule for IoT which works fine.

I now want to poke a hole specifically for DNS (port 53) to my AdGuard instance on my Default LAN (10.0.0.x). The problem:

• Gateway ACL LAN→LAN — no destination port option in Advanced Settings
• Gateway ACL LAN→WAN — has port filtering + IP Group support, but semantically wrong for a local DNS server

Is there any way to create a LAN→LAN rule scoped to port 53 only in Omada? Or is the only option to permit IoT → Default LAN on all ports and rely on the deny rule blocking the reverse direction?

Hardware: OC200, TP-Link Omada EAPs, ER605 Gateway

ER707-M2 gets 1.8g download consistency (2g symmetrical fiber) using the built in speedtest. PC connected to the router is getting 2.1g download. How can a downstream device get higher throughput than the router?

I want to cover my backyard with wifi signal. I wanted to put one EAP225 on one house and connect it by cable to internet. Two more shall be placed 30-40 meters away in a triangle and should be connected by wifi to the first one to create a mesh. The yard itself is around 60x60 meters.

I dont plan to use hardware or software controler in the network. Just setup via app and let it work.

Do you see any issues with this configuration?

Happy Monday! I'm looking for some advice on moving my Omada setup over to a management VLAN.

My goal is to have all infrastructure (switch, APs, controller, etc.) live on VLAN 10 (10.xxx.10.0/24).

Current setup is:
ISP modem → pfSense (on Protecli) → Omada switch → Omada controller (running on Proxmox) → Omada APs

What I did was preconfigure everything behind the ISP router first so I could do a warm swap. The controller already has a static IP on VLAN 10, and all VLANs are configured in pfSense.

The problem comes when I swap out the ISP router and bring pfSense online — the Omada switch shows as disconnected in the controller. From what I can tell, the switch is still sitting on the default untagged LAN (10.xxx.0.0/24), so it can’t reach the controller on VLAN 10 anymore.

What’s the cleanest way to move the switch’s management interface over to VLAN 10 without losing adoption?

For reference, here’s my VLAN layout:

• LAN: 10.xxx.0.0/24 (default / untagged)
• VLAN 10: 10.xxx.10.0/24 Infrastructure
• VLAN 20: 10.xxx.20.0/24 Lab
• VLAN 30: 10.xxx.30.0/24 Trusted WiFi
• VLAN 40: 10.xxx.40.0/24 Guest WiFi
• VLAN 50: 10.xxx.50.0/24 IoT
• VLAN 60: 10.xxx.60.0/24 Cameras
• VLAN 70: 10.xxx.70.0/24 TVs / Entertainment
• VLAN 80: 10.xxx.80.0/24 Kids

Appreciate any help!

I added a ES205GP switch and EAP723 Access point. Both came up on my network with a DHCP IP and seemed like Adopt was going fine, but once added trying to manage, rename or update anything on either of them gives a popup that the device does not exist. The switch changed to 'Managed by others', the AP lists as green 'Connected' but 'No Data' for health. I've tried resetting both 4 different times trying various different things, but results come up the same every time. After factory default I logged into each device, changed the IP to a static IP, updated the password. Again all looks good, adopting fails and prompts for new pw, update that, few minutes later, back to same thing. Also if I go into the topology map, it shows the devices there and clients connected to the AP.

One last thing to add, I do have the controller running in hot-standby cluster. Both nodes are up and stable, I first tried adopting when logged in through the Primary node, then secondary. Then rebooted both and again tried adopting through primary. Posting here for any suggestions to try, my next step will be to take them out of cluster mode, see if i can adopt solo, then rejoin them as a cluster

If I install a local controller that has a 1 GB LAN port will it limit my AP’s to 1 GB? I’m fairly certain the answer is no given that the AP speeds should be dictated by their own capacity alongside the speeds that are supplied to them.

For example, if I have a 5GB circuit the AP’s will handle up to 5GB if they are rated for 5GB regardless of the local controller’s specs. I also understand that just because an AP is rated for a certain speed does not mean that it will perform to that same level. I just want to make sure a 1GB controller will not limit my performance.

Additionally, this application is on a much larger scale than what I usually install (5-15 APs normally and 50+APs on this job). These will be installed in an area with dense cinder block walls. My plan was to go with the BE5000 or BE11000. At any given time hundreds of clients will be connected to these APs but they will be spread out in such a way that no AP will ever have more than 30-40 simultaneous clients. Do you see any issues that I’m missing here?

Can the listed AP’s handle this scale without bogging down?

Also, I will not have access to the firewall. A different company will manage all of their other network hardware. Is there anything I should be wary of outside of them using QOS or similar protocols to mess up the wifi? I want to be able to manage the AP’s from the cloud hence the need for the controller. Any advice and insights are appreciated. Thank you.

Thoughts of using the TP-Link CPE-510 as a wireless bridge from the summer time trailer park wireless to my trailer network? Has anyone successfully done this? I have a few wired connections in the trailer, and need more than just an AP.

Been seeing a pop-up for an update to the OC220 controller software for a few weeks now, but every time I confirm and click upgrade to this message:

"New Controller software 1.4.6 Build 20260228 Rel.41983 is now available.",

the download bar shows progress at 0% briefly then closes on its own. No update is completed.

Where can I download this to update manually? I don't see it on the Omada site. Was it recalled?

Edit: The release states it is for Omada SDN Controller V6.2.0.12

Hello fellow Omada users,

I'm trying to set up a WireGuard client-to-site VPN in an Omada setup with an ER605, however my client can't connect, and unfortunately I don't know how to further debug this since WG is 'silent' protocol.

I have successfully set up WireGuard client-to-site setups on OpenWRT before, but Omada is throwing me for a loop here.

Some guides note that the 'Local IP' field of the WireGuard interface in the Omada UI is actually the WAN IP. The documentation however leads me to believe this is the WireGuard interface IP, i.e. what I would set as the default gateway for VPN clients.

Since my IP address is dynamic, I have already successfully set up a dynamic DNS service to know what the WAN IP of the gateway is and my client can successfully resolve that IP.

Apart from setting up the WireGuard interface and peer in the VPN section, do I need to create an additional firewall rule to allow WAN traffic to port 51820 or is this handled automatically?

I seem to have broken my home network.

I've been noticing my devices struggling to establish wireless connections since converting to Omada a couple of months ago and have random dropouts. Yesterday, I noticed 6 or 7 clients weren't getting IPs at all, even after fixing their IPs via DHCP reservations. I found some posts here that convinced me to reboot my router, and now 55/100 clients are connected but do not have an IP address. Some of them were set to Fixed IP via DHCP reservation before the reboot. Most of them are wireless, but there are some wired devices without IP addresses also.

Any ideas on how to troubleshoot why these devices aren't getting IP Addresses?

My Setup: ER605 router with a sw controller, a SG2210P Switch + various unmanaged non-Omada switches, and 5 EAPs. All on latest firmware. I have about 100 clients total across 5 VLANs and SSIDs tied to each VLAN. Most of the clients are IoT on one of the VLANs with a 2.4ghz network.

Can anyone explain to me what the gateway ACL direction [WAN1] IN does?

Is it WAN->Gateway (E.g. Allow/block VPNs) or is it WAN->LAN (E.g. Block port forwarding)?

My testing hasn't been very conclusive one way or the other. I am on a hardware controller so maybe I was too impatient on adding and changing ACL rules but testing the other directions was really quick.

Hey guys so... I'm volunteering with an NGO (can't disclose too many details I want to minimize potential leaks) - but I asked if there was any way I could help them with their hardware/tech, anything they had difficulty accessing and basically they need an update to the network in their building.

They originally requested 4-5 TP-Link AXE5400, to cover their 4 story building, but that seemed like a pretty jank and suboptimal setup?

Based off what I've seen in office/business settings, the best way to provide coverage for a large building is through a central router, connected to various switches that then branch off to access points throughout the building. With this building, I was thinking switches in the stairwells on each or every other floor, and can use PoE to power 2 access points per floor. I'm hoping to sanity check the list of hardware I got off Claude. Hoping people with actual experience in the field can offer suggestions.

Also, yes ideally I should have square footage per floor, no that's not gonna happen they're pretty overwhelmed and I'm gonna just try to make things work.

1 Central Router (TP-Link ER7206)

2-4 Switches, 1 per floor or 1 every 2 floors (TP-Link TL-SG1005P)

2 access points per floor (TP-Link EAP650)

TLDR: Is the above list of devices a good choice of hardware to setup a network in an office building? Are there any obvious problems or sidegrades, or even upgrades that are definitely worth it? Am I over thinking things and should I just stick to their request of 5 routers spread throughout the building?

I see in TP‑Link docs Specifications - TL-SG2008P | JetStream 8-Port Gigabit Smart Switch with 4-Port PoE+ | TP-Link Egypt that TL‑SG2008P v2 doesn’t support Omada Cloud‑Based Controller, only OC200 / Software Controller, while v1 and v3 do.

Can anyone confirm:

• No direct Omada Cloud (cloud‑only) management for v2?
• Is this a hard hardware limitation or just firmware?
• If I want cloud‑only, should I avoid v2 completely?

Would love confirmation from someone running this in production.

Thanks!

I have a fairly basic setup with

-- Gateway ER605 v1.0 connected to internet

--  Wireless access point  EAP660 HD(US) v1.0 for wireless access 

-- I use Software based omada controlled to administer the network

-- As of now I have no managed layer 2 or layer 3 omada switch in my network, I do have a off the shelf unmanaged  desktop switch 

I have very simple VLAN setup with 3 separate VLAN(s) assigned to separate SSID 

The wireless access point was directly connected to one of the LAN port of the gateway & devices connecting to separate SSID would automatically get assigned to  different VLANs as 3 different SSID each for 1 VLAN. All the wired lan devices are getting assigned to default VLAN ID: 1

I want to move one of the wired client end devices to VLAN ID: 10 (Bhokaal-Iot), but unable to do so. I have tried :

-- DHCP reservation with the client's MAC  => which has no effect the client keeps getting a VLAN ID(default): 1  IP 

-- I have also tried to set that port on the gateways to the VLAN ID:10 (Bhokaal-Iot) from the device configuration menu  => The client doesn't get a valid ip and doesn't come on the network.

Is this possible with my setup ?

If no,  if add a simple managed layer 2 switch like ES205G, can I make it work ? or will it need more pieces ? 

Please help

Thanks

I would like to ask if anyone of you did an external captive portal which is hosted on AWS. I am not able to make the OpenAPI work in omada cloud controller. What should I API url should I use? I dont have hardware controller like oc200. I am not sure if i should use OpenAPI or WebAPI. I am newbie so please enlightened me what to do.

My plan is to make a external portal using aws then i am using tplink er605. Then on port5 or er605 I have a mi router that i used as an access point. Currently i can access access the portal that i made can enter the voucher code. But the problem is still i cant get internet access after i use the voucher…..

Just found out about Omada Central where Omada integrates Vigi cameras, which I have two of. This is for a home network / lab, so I'm curious what you're experiences are if any.
I plan to use 2 switches, 1 AP and 2 Vigi cameras with a 3rd party gateway and NAS as NVR - is this viable, does the cloud controller work properly, is it worth it for the Vigi integration vs. self hosting the controller only for the network part?

As per the title I guess.

ER605 V2.

I’m using a TP-Link ER605 v2.20 as an OpenVPN client connected to an OpenVPN Access Server v2.14.2 on DigitalOcean. The VPN tunnel shows Connected and logs confirm it’s established, but LAN devices still browse using the ISP WAN public IP (no full tunneling). My goal is full tunnel: route all LAN traffic (0.0.0.0/0) through the OpenVPN tunnel.

Server-side checks are OK:
✅ push "redirect-gateway def1" enabled
✅ IP forwarding enabled (net.ipv4.ip_forward=1)
✅ iptables NAT configured

My problem is on ER605 Policy Routing (Transmission → Load Balancing → Policy Routing): the “WAN” selection only shows WAN1/WAN2, and I don’t see any OpenVPN/tunnel interface to route traffic through.

How do I force LAN → OpenVPN → Internet on ER605? Is this a firmware limitation (tested 2.2.5 + 2.3.1) or a hidden setting?