Setup Your Own Site to Site VPN with the Omada Network Controller - TP-Link

In this video we show you how to configure your own site to site VPN connection using two TP-Link routers Omada compatible. Here the configuration done in a ER605 but it also applies to the ER7200 for example.

One of them is configured in Standalone mode and the other one is configured through the Omada unified network management the Omada Network Controller, so you can see how similar procedures are.

We will use the Network Controller installed in Windows, but it also applies to hardware controllers like the OC200 and OC300.

This type of configuration is very important nowadays not only if you want to link a branch office to your head office, but also if as a network administrator you need to have permanent access to your Infrastructure servers, NAS, multimedia servers, or just a Remote Desktop Connection.

We hope this video helps you setup your LAN to LAN VPN and continue implementing secure ways of telecommuting. Thanks for watching!

Video Chapters
0:00 - Intro & Explanation
0:46 - Part 1: Creating the Responder
4:56 - Part 2: Adopting your Router at the Branch Office
9:10 - Testing Results
10:00 - Part 3: Increasing the Security of Your Tunnel
11:19 - Thanks for Watching!

[Jonathan-L]

Thanks for a good presentation on this topic.

[thomastommy]

Isn't L2TP/IPSec very insecure these days? I've read somewhere that the encryption can easily be broken?

[darekamekaze]

Thanks! Great video! Could you please create with port forwarding with this Site to Site VPN? TIA.🙏

[oriola]

Hi, thank your for this super video!

I hvae two questions:

1/ Do I need to have my ISP router as bridge mode to make this configuration work?

2/ In case that I do not need to have the ISP router in bridge mode, then the R605 will work as a secondary router. How to set up the tplink so it takes the same IP range as the ISP router? Is this needed to create a site to site VPN?
Do you have any video about this?

Also, with this configuration, is all the trafic from the remote network goings throuh the main network?

In a nutshell,
- I have a remote device that I need to control from my office
- I want to connect the remote metwork to my office network so I can see it
- I bought 2 R605

Thank you in advance for your help.
Best,

[gusmarasli]

Never mind. windows was blocking all ping requests. everything is working fine. :)

[creepto]

great vid! Just to clarify, do you need the OC200 on both ends or is it optional? Can I set the VPN settings on both ER605 as a standalone without the OC200?

[Chris-sotn]

I really loved this tutorial! Can you create a how to video showing how to set up an Omada Managed redundant Inter VLAN setup with redundant connections between 2-3 Switches (or one router and two switches if possible)? If possible, will you show how to do it using a Layer 2 and/or Layer 3 approach? I tried to do it with layer 2 by enabling RSTP on the two switches, but that caused the switches, and the router to loose management and hang on adopting. However, the configuration seemed to work, I just lost management of the router and swithches. I had to remove the redundant connections and factory reset them and then adopt them again to get them back. I'm using two TL-SG2210MP POE switches and an ER7206 Router. I want to set up LAN1 and LAN2 ports on the ER7206 to go to each of the two switches, with a redundant physical line between the two switches. I can then setup two cameras and two wifi access points on each switch for a total of four cameras and four access points.

I set up my home and cabin with three wired cameras and two Omada short stacks. I have a control vlan and a dedicated video camera vlan at my cabin and two site2site VPN's sending data to my home. One manages the networking equipment with the controller at home, and the other sends video surveillance data to an NVR at my home. It worked great for six months until I lost the link between the Router and my POE Switch running the cameras and wifi access points. I am guessing my switch needs to be rebooted, but if I had a redundant setup, I may have only lost one switch and been able to maintain connection to another with half or even all my cameras. I'll be going down and snowmobiling in over New Years with a replacement switch (incase the other switch went bad), a few heat pads connected to redundant wifi temperature controllers (to keep the temps above 0 in the weather proof cabinet with the networking equipment), and a web power switch to auto reboot equipment if they lose a ping for more than an hour (long enough to allow for a remote firmware upgrade).

[VladanRadakovic]

Great video, thank you. One question: is it possible using this configuration to have branch office use head office's internet connection instead of it's local one? Thanks.

[rigaro]

Great video. Is there a way to implement a kill switch so that any client will not be able to access the internet if the VPN drops?
This is important because for some applications the moment the VPN drops, all devices will access the local internet and show the actual location.

[JonGo-nk]

I was able to create the tunnel and both routers show the active tunnel but I cannot ping anthing on either side. Any advice?

[RigobertoContrerasCastillo]

Hello at the moment i have my Comcast business router which has a static IP address after that i have my TP Omada VPN router I been trying so setup an IPSEC VPN ( site to site) but I am not able to do it , what settings do i need to change on the VPN router i have tried setting the Wired network IP to the one of the static IP on the Comcast router but no luck

OI have successfully done this on other sites but the differecences there is that I only have one router on the other ones

[ferasawwad]

Greetings to you. I have a simple question: is it possible to create a vpn network with the same head office device? And not with a branch office

[zuriel]

Hello! I am setting this for two offices, at the main office i have pubic ip and at the second office the ip is under CGNAT. It works well with Open VPN but i'd like to connect to both sides of the networks as shown in this video. Is this possible? ty

[vijaypaladugu]

HI Alan, I have done exactly what you did with 2 X ER7206 at both ends. I am able to access the internet through the ER7206 locally from each device, but no luck connecting between the sites. Only difference is that I have a 4G connection at the branch end. .Does these have to have Static IP addresses provided by ISP? Can I test with Dynamic ISP provided IP addresses until I get Static IP addresses provided? or it does not work with out the static IP address? Are there any other settings I need to configure such as routing on the ER7206s?

[sajeersalim]

It required static public IP for each Head office and Branch or it can be configured dynamic IP like broadband connection?

[SourabhBelekar]

I have 2 vpn routers (er605). I have configured one (at office) as L2TP server. I can connect to it from phone / iPad . I want to route all traffic(including internet access) from one vlan on second router(at home) via my office router. How can I configure this ?

[jhonnyhernandez]

hola estimado consulta, en una conexion cliente -lan con protocolo PPTP, en el ordenador me sale un error de encapsulacion GRE .. sabras que debo habilitar o deshabilitar en router ??? agradecido tu aporte referente a este tema

[michele.dimarino]

Hello, but if I made this configuration
The router B thats connect to router A, will be geolocate with Router A public IP address?

[carlsiy]

Hello! Is it possible to test this without leaving 1 site? Like, have the 2 omada routers plugged into the same ISP modem (same global IP address)

[questionableEQ]

Great Video! I am looking at a use case where 100% of the Branch office internet traffic is routed through the Head office router with HO public IP natting. Does this setup force 100% of the branch office internet traffic through head office router with HO public IP natting?