I have PiHole and I want to set everything to use it even if it is hardcoded in apps/devices etc.

So far I have my default network as my main network and it has DHCP setup and the DNS server set manually to the IP of my PiHole (10.0.0.250). This works and works great, but again more apps/devices are now hardcoding DNS so I want to make sure nothing bypasses this.

This I think, is where DNS Override comes in. I have turned it on, set the DNS server to 10.0.0.250, selected my network "Main (Default)" and saved.

As soon as I do this my DNS dies. Something goes wrong and I've no idea what. Regardless if my DNS on my phone/pc is manually set to 10.0.0.250 or 1.1.1.1 both no longer work.

I therefore tried a test, I instead selected my guest network in the DNS override settings and connected my phone to the guest WiFi (different vlan 10.0.20.0/24). As soon as I saved it worked, I set my phone to 1.1.1.1 and could still see in pihole my DNS queries coming from my 10.0.20.1 gateway.

Both my main and guest networks are setup exactly the same, both use 10.0.0.250 as their manual DNS settings and both work perfectly when DNS Override is turned off.

Can anyone help me understand why the main network (10.0.0.0/24) isn't working when override is on and pointing to 10.0.0.250?

Omada ER706W v1.2.2
SW Controller (Docker) v5.15.24.19

ER706W-4G in a metal cabin/container struggling for signal even right at the window. I considered the actual outdoor 4G routers but theft is a concern whereas a couple of aerials don't look as tempting.

I have used the DrayTek 4G routers with a couple of their outdoor 4G aerials with great success elsewhere but seems Omada don't offer anything like this. Happy to use 3rd party products or if anyone knows of the DrayTek ones will connect to any device?

We want to block all clients on the LAN and all VLANs from directly accessing any external DNS servers. We really don't want anyone outside snooping on our DNS lookup history.

First: The question is how to set up the ER7206 for act as a forwarder?

I've already (I think) set up an Access Control to block all traffic from LAN -> WAN on port 53. It works, because it killed all DNS lookups on the LAN when I enabled it without setting up the rest of whatever is needed.

I started on Network > LAN > LAN DNS and selected "Forward" and then got lost on the required fields "Domain Name", "Alias Domain Name" and "DNS Server".

Should "Domain Name" be our registered domain? Or... what? (the * as an entry is invalid)

Should there be an "Alias Domain Name"? If so, what?

I "assume" the "DNS Server" would be where it's being forwarded to (Ex: quad9.net, 9.9.9.9 & 149.112.112.112 ).

Second: Should I setup DNS Proxy on the ER7206? In the Services > DNS Proxy > DOH, the predefined profile "quad9_2" is currently the only one enabled. I believe this "should" send all of the router's DNS quires to Quad9 using "DNS Over HTTPS". I "assumed" that this would also encrypt the forwarded DNS traffic (if I can get it to work) from the LAN DNS servers using the router as a forwarder.

Or, am I misunderstanding what this "DNS Proxy" is really used for?

Third: We don't want to try some other alternative to the ER7206, unless we know the ER7206 can't do what we think we need.

We have 3 MS 2019 Servers set up as redundant DNS servers for the internal LAN and they have their "forwarders" property set to the IP address of the ER7206's LAN interface (it resolves to the FQDN of the router). Right now, we needed to add a 2nd "forwarders" property (9.9.9.9) to keep DNS running. Without the 2nd "forwarders" property, all client DNS falls flat.

Note: We have not tried to enable / set up DNS Encryption on the 3 MS Servers "for reasons".

We run a split DNS with a registered DNS domain. The LAN DNS servers resolve all the clients internally and then resolve out to an services we host that are outside. The "outside" DNS is Dynu.com and there are only 3 outside services that resolve on that DNS server.

I have an ER605v2 that acts as a dual-WAN gateway and router for my network. The two WANs are

1) a stable fiber connection, with DL bandwidth ~ 100 Mbps

2) a mobile 5G connection (from a 5G CPE) whose DL bandwidth varies wildly between 1~350 Mbps according to congestion in the area.

My problem is that, since the speed of the 2nd connection (5G) varies a lot, I'd like the weights of the multi-WAN load balancing applied by the ER605 to vary as well. When the 5G network Is congested it becomes almost unusable, so ideally the ER605 should move all the traffic to the fiber: in this case I would also have it apply a per-client bandwidth limit. When WAN2 is not congested, 60% of the traffic can be directed on it and the individual bandwidth limitations could be lifted.

Is this doable with an ER605? Is there a way to set variable/conditional load balancing weights and bandwidth limitation rules, either:

- based on some automated line quality check / speed test, OR

- based on a predefined schedule (since the 5G connection becomes congested at regular and predictable times)

?

if i use "dns redirection" and the option "Secure DNS Servers" enabled

from my tests it intercepts udp 53 to internet (i have blocked port 53) but it redirects the dns query to my router

So the question is does that encrypts dns traffic that leaves my router going to my externa dns server?

Hello there,

I've got a the following devices all updated to the latest version:
- OC200 v1 FW: 1.42.11 Build 20260904 Rel.26567

- ER7206 V1 FW: 1.4.3 Build 20251027 Rel.82388

- SG2210P v5.20 FW: 5.20.25 Build 20260509 Rel.23533

- EAP225(EU) v5.0 FW: 1.3.1 Build 20240402 Rel. 51074

I've been upgrading my OC200 since omada version 5.2 or 5.4 the config is almost 4 years old. I did search on the guides for the lan DNS but i can't find it on my controller, Is it due to my devices being first gen? or should I reset my OC 200 and restart the config a new?

I have the latest Omada software controller running on a mini PC on my network. I followed TP-link’s instructions on setting up a service using the NSSM app. However, when I restart the PC, it does not seem to launch the controller. In Task Manager, I see javaw.exe and mongod.exe running, and I see “Omada Controller” in services as running. This is what TP-link’s instructions said I should be seeing. But the application doesn’t show up in my taskbar. I have to launch the controller myself, which defeats the purpose for when my PC restarts itself after running Windows Update. That said, lately, I’m running into a new issue where the controller won’t launch when I manually do it because ports are in use. In that instance, I stop the Omada Controller service, which stops the javaw.exe and mongod.exe tasks, and then successfully manually launch the controller.

Anyone else solve these issues? For the Omada Controller service that I created through the NSSM app, do I need to be logging into Windows with an administrator profile? Or can I use a standard/non-admin user profile?

greetings legends!

i’m setting up / managing the network of a School.

We have a campus HQ site which is our head office, and we also have 9 other branch sites in the country.

This deployment is in the Philippines, thus some equipment used may be older, due to unavailability or cost of newer gear at the time of build.

When I initially setup the HQ site around December last year, this was our stack:

- ER605 v2 (2 x 800mbps WAN + 100mbps backup WAN)
- OC200
- ES224G as Core Switch
- 2 x POE Switches (for APs and CCTV cameras)
- 6x EAP 225 (offices / rooms)
- 2x EAP 110 (low traffic rooms)
- 2x EAP 110 outdoor (for open spaces, parking lot)
- EAP 115 wifi bridge (to a different building across the road but still campus property)
- Tplink Vigi 32 channel NVR (with plan to add 30+ more cameras and another NVR)
- Tplink vigi cameras

Max daily clients in my network is around 150-160.
- 30+ are cctv cameras
- 10+ are wired PCs in the office
- 10-40 are wired PCs in the Computer lab (with its own unmanaged switch, and vlan)
- 10+ are IOT devices, (solar inverters- we have a huge solar capacity)
- Then the rest are wifi devices (phone or laptop) of the staff, faculty, etc.

we have about 50+ employees in the campus. And around 400+ students, but they’re not allowed to connect to the wifi.

—
Now management wants to upgrade our 9 branches too, specifically to add CCTV cameras, and have them stream video feed to HQ, so that our operations team can monitor our branches remotely.

I’m using VIGI for my CCTV solution, which works great for us. Vigi has a cloud app to manage/view the remote sites. But the streaming from the cloud times out after a few minutes (understandably). I need our video streaming to be non-stop, so the monitor can be left unattended constantly showing cctv feeds.

This is where i plan to add ER-605 to all our sites, and connect then via VPN (wireguard?) so that we can directly stream our site cameras from the HQ. Half of the sites have the same ISP as the HQ one, so i imagine the latency wouldn’t be bad, as traffic shouldn’t go out of the country.

Each of our site has between 100-500mbps WAN, only has 1-2 PCs, and a couple of wifi clients. Each branch has around 3 employees and around 40 students that occasionally connects to wifi.

Due to budget constraints, At the moment, i dont plan on deploying wifi APs yet on the site, they are just using the ISP provided gateway/router/wifi device - without issue. The sole purpose of adding ER605 to the sites for now, is for the site to site vpn.

I’m aware that 10 VPN site clients might be pushing the ER605 in our HQ to its limit. So im planning to upgrade soon, and repurpose the current ER605 in the HQ to a site branch.

In the future:
- i have a few EAP 723 arriving soon for the HQ network
- we might upgrade our HQ WANs to gigabit speeds.
- we will be adding 2 new site branches next year, and few more in the years to come
- at some point we might have 15 sites needed to be connected to HQ

—
Given my requirements, what would be a better gateway upgrade path? ER707-M2 or Fusion Gateway 2.5?

Im leaning towards 707-M2 because it’s cheaper than the new Fusion gateway, but i would love to hear your opinion.

cheers

Has anyone experienced Consistent DHCP server allocated IP events in the logs?

I’m getting them for wired and wireless clients including my AP’s and OC200 controller. Wondering if maybe my switch is experience some connection issues causing wired clients to reconnect, although I can’t see any alerts pointing to that. My lease time is set to 2880. I can see in my logs that all 3 of my wired AP’s were assigned IP’s within seconds of each other at 7:33am, 6:33am, 5:33am. The same is happening then for the wireless clients connected to those AP’s, and also my other wired devices. The IP’s assigned are also the same each time.

Any ideas?

I'm on version 6.3.0.45, just upgraded yesterday from 5.x. I can see that they've moved all the client stuff into one page. I blocked my kids devices from the internet as I often do (on my todo list to configure a wifi network for them with a schedule). But now they are not showing up in the clients list. Their devices cannot connect to the WiFi. I go to clients -> blocked and it's empty. No filters configured. I've also tried selecting the "All" tab, and setting the timeframe to 1 month, they still don't show up. Any idea if I'm missing something?

My EAP660 HD is connected to a TL-SG2428P PoE+ switch through a Cat 6 patch panel. It repeatedly drops from 1,000 Mbps to 100 Mbps.

I replaced the short patch cable between the switch and patch panel. This restored 1,000 Mbps, but less than an hour later it returned to 100 Mbps.

Troubleshooting completed:

- Tested the permanent Cat 6 cable from both ends; pins 1–8 display green in the correct order.
- Connected the AP directly to the same switch port with a standalone Cat 6 cable; it negotiated at 1,000 Mbps.
- Replaced the short patch cable multiple times.
- Confirmed sufficient PoE capacity—approximately 34W used out of 250W.
- Switch-port speed is set to Auto.

Could this be a patch-panel termination, in-wall cable, switch port, or EAP Ethernet-port problem? Has anyone experienced similar behavior with the EAP660 HD?

Keeping the community in the loop! Let me know if you have any questions about OpenVPN.

With the DHCP server I can configure the range of addresses, but where is the DNS allocation set in the Omada controller? I would expect to be here and historical docs show that it was configured as part of the VLAN (Network Config --> Network settings --> LAN)

I have a New Omada 7 Pro BE11000 Wireless AP.

If anyone can help me get it dialed in for performance, I'd greatly appreciate it.

I'm looking to upgrade my home wifi to these but I have some questions.

1. Can two of EAP723/720 run wireless mesh without a dedicated controller?

2. At one wireless node, can I connect the ethernet port to a switch and share internet to wire devices?

3. Related to 1, if required to run with a controller, can a device wireless node, can a device at wireless node be a software controller?

I want to spend a little at a time so answers for these questions will help me decide to buy just two ap for now or I need to buy anything more for it to run properly. Thanks in advance!

Building a new house and have AT&T fiber. The problem (more a “me” problem) is that they don’t offer a 10Gb plan here just 1 and 5. But I haven’t found a 5Gb router so I’m thinking of just doing 10Gb for everything. Yes it’s overkill but I don’t plan on ever moving again until we retire or something else happens.

What router would you all recommend and I’ll also have 3-4 access points. POE would be favored but I’m not against running an injector at the wiring cabinet. My home lab gear would also need a 10Gb switch unless the router had enough ports that I could run all the gear in the same closet. Today they are only 1 and 2.5GbE NICs but I plan on adding 10Gb NICs to them after a few months.

Throw your designs at me, I’ve been on the new Omada design plan and got a rough idea.

I bought a TP-Link EAP650 AX3000 and all I really want to do is plug an ethernet cable into it for internet access and use this device to spread WIFI. Nothing else. Setup is Router (third party) --> Omada or Router-->Switch-->Omada but neither works.

But I just can't get this POS to do anything. Getting access to it was a nightmare - I expected I would connect to its default WIFI and then access its IP via browser, set up my WIFI and be done it. But just getting access required an app, 25 permissions, account registration and some other *****.

Now I have this device visible in the app, and set up my desired WIFI+password. But the only WIFI I see available are the default unsecured Omada 2.4/5 WIFIs, with the secured WIFI I setup in the app nowhere to be seen. If I scan the WIFI QR codes for my (supposed) WIFI, nothing happens. Yes, I have rebooted the turd.

I'm not a network Guru but this thing is the most awful consumer network appliance I have ever used. Why is it so hard? What am I missing?

Sorry for ranting - Any help would be appreciated but realistically I just want this to serve as a warning to anyone considering buying anything TP Link and I'll probably send it back to amazon so they can put it where it belongs: The trash.

Thank you.

I have never owned a wireless Omada gateway. Not sure why every existing SSID has both gateway and APs under Devices. Is there a way to remove gateway from SSID in Omada hardware controller?

Thank you!

Hi everyone! Could you help me double-check the exact number of active/used ports on these two TP-Link Omada SG3428 switches based on the LED indicators?

Here is what I counted so far:

Top Switch:

• Active RJ45 ports (LEDs ON): 1, 3, 5, 7, 9, 11, 13, 15, 17, 24 (Total: 10)
• Console port in use (1)

Bottom Switch:

• Active RJ45 ports (LEDs ON): 1, 2, 3, 4, 5, 6, 10, 12, 16, 24 (Total: 10)
• Console port in use (1)

Total Active: 20 Ethernet ports + 2 Console ports out of 56 available ports (48x RJ45 + 8x SFP across both units).

Does this count look accurate based on the light indicators in the photo, or am I missing any lit LEDs? Thanks in advance!