How to Setup OpenVPN Server on the TP-Link Omada ER605 Router with the OC200 Hardware Controller
ฝัง
- เผยแพร่เมื่อ 16 พ.ย. 2021
- Yes that's right. In Firmware versions of 1.9.1 (OC200) and 1.1.11 (ER605), internet traffic is not routed through to your OpenVPN Server. Currently you can only access you Omada hardware and no other local services. This could be a bug or the OpenVPN feature is not fully flushed out yet.
Featured Products
ER605 - amzn.to/3HvT1Zs
OC200 - amzn.to/3qIuRoM
TP-Link TL-SG2210P V3 - amzn.to/3DqftAT
Support the channel
www.amazon.com/shop/spxlabs
spxlabs.com/links
spxlabs.com/shop
ts.la/stefano66335
Visit
spxlabs.com
Chat
/ spxlabs
/ discord
#openvpn #omada #networking @TPLINKTECH @TPLinkdoBrasil @tpsupport - วิทยาศาสตร์และเทคโนโลยี
![[LIVE] : ONE ลุมพินี 73 | คู่เอก "วรพล vs พันฤทธิ์"](http://i.ytimg.com/vi/rrOljlqse3A/mqdefault.jpg)
Thanks for the video. It's helpful to learn that the hardware isn't actually a vpn server, but a remote admin access to the controller only. Too bad it says 'VPN router' on the box.
Well the sort of fixed it in newer updates but they also made it worse at the same time. It’s still very Beta hardwarw
What about cert auth? Does it have an option to select key length and ciphers ?
i can connect to a server on a VLAN just fine, once they are on the LAN like my pi-hole i can not, but can connect to the controller this is kinda weird. one thing i dont understand is why instead of assigning an ip range they dont just allow you to select a VLAN for your openvpn clients to belong to, allowing a much more fine grained security for your vpn including things like access to VLANS and blocking malicious domains or otherwise limit access right through your routers security settings. the not tunneling through your VPN seem to only apply to openvpn, L2TP seems to tunnel just fine.
Please let us know when you figure this out. Thanks
I'm really thinking of trying TP-LINK hardware next time I buy anything network related. Their product seem to be decent for the price. Been with ASUS for my WIFI AP and they always, ALWAYS end up burning up on me. But for VPN stuff, I think I'll stick with my OPNSense firewall / router. I think, hands down, if you have a machine or VM where you can put OPNSense or PFSense, it beats most products out there. And the VPN configuration in OPNSense is quite good, you can even automate let's encrypt certs which you need for the VPN.
I think TPLink Omada will be better as time goes on. I’m still going to stick with Ubiquiti for the time being.
I don’t blame you for sticking with opnsense. I’m sticking with WireGuard for now myself.
You must configure the firewall to accept inbound/outbound connections from the VPN subnet to the DMZ subnet (where the UnRAID server is connected).
There is no firewall options available with the hardware I have.
There should be a firewall option under security to allow or deny traffic to different ports etc
On current software this is true. Not back then
@@SPXLabs would you kindly do a follow up video? Especially since they have release 5.4.7 oc200 recently with new UI which supposed to fix a ton of bugs (no doubt introducing more)
Does the configuration of inbound/outbound traffic should be done on ISP router? I’m trying to configure it also 😅
Very Useful! Help me a lot. Thanks... ;)
Just a heads up. In future releases of the Omada Controller Software, OpenVPN has been removed. So you may want to update your firmware and controller to the latest and then use WireGuard instead.
Just got the L2tp setup on the omada hardware i installed, and its pretty rock solid
Interesting. I can’t connect to it at all. There is probably something wrong with my config but I can’t see where.
@@SPXLabs i used L2TP and it took a while but realized i needed to create a user then assign that VPN to that user....then it worked like a charm.
But i also made sure I turned off the ISP's router functionality and ran it in passthrough/bridge mode first
I’m thinking it’s my ISPs router. Because I’m not in Passthrough mode. I’m guessing that the L2TP service is locking into that local IP and I currently can’t force it to use my WAN IP or domain name.
Just like OpenVPN is doing by default.
@@SPXLabs because you are on a 'new' subnet and have not setup any rules on your home router what-to-do with that traffic once it comes in ... usually when i setup VPN i have the home router assign a local IP to the new remote client (via a set DHCP range for VPN clients), inside the same subnet - then all devices 'look' local to the remote client and everything can be accessed
I tried creating a route between subnets and it didn’t work / aka I didn’t set it up right. Also played with ACL and NAT. I really am not sure what’s wrong. Traditionally with OpenVPN I know that I need to setup the routing tables from the VPN subnet to the local subnet and it’s all hunky dory. So idk man. I’d love more ideas if you got them!
Awesome! I really love the concept of Omada and i am looking to get this one for my business and the omada network switch as well. But i have one question that the Internet doesn't seem to have a clear answer on. Can i use both omada devices without an Omada router? It's necessary for me to have a router with a failover switch so i can't upgrade to the omada router.
You can piece mill everything as you see fit. I’m not sure which features you may lose though
if not already answered, I would propose that your unraid server doesn't have the ER605 as default gateway, so it doesn't know way back to your openvpn client pool address range, you may set the correct default gateway or add a static route (192.168.50.0/24) to your ER605 ip on the unraid server
Hey thanks for the video. Can the ER605 with the OC200 be setup to have all traffic use a NORDVPN account to encrypt all outbound network traffic? If so do you have a video on that setup?
Idk, I’ve only tried with Mullvad VPN and it didn’t work. In theory it should work with any service that uses OpenVPN. I did get it to work by hosting my own VPN remotely but it’s not exactly what you are askingfor.
th-cam.com/video/HEioCfyP2lc/w-d-xo.html
Were you able to connect to the server via VPN?
Around 4:20, you mention changing the IP in the .ovpn file to be a domain name or your public IP address. I did this and was never able to get the VPN to connect. Eventually, I left the configuration as-is from the export (leaving the private IP in the file), and it connected right away with. This is also with my TP-Link router behind an AT&T gateway (which is not in IP-Passthrough mode).
Domain A record needs to be pointed at where the server is being hosted. Also, ensure either port forwarding is setup from ATT to your router or IP passthrough.
Hi! Open VPN is quite easy to setup from ER-605 to another ER-605 (Server x Client), it turns out in one of the testes we were running, we deleted the user from server side and tunnel kept connected... Weird.
So we deleted the Open VPN server, the connection was interrupted... Once we created another OVPN Server informing the same IP range, the tunnel reconnected withou any configuraton in the other end... It seems like the client side has memorized the certificate or, its a very strange bug...
Have you faced such issue? Thx.
Very nice video indeed!! :-)
Thank you very much!
Is it possible that the Ethernet cable may need to have to utilize a crossover ethernet cable to access your server? I hope you were able to troubleshoot and find the problem with the connection.
Are there any ports being blocked on the server? I am sure you have already check this, but just trying to help. Was there ever a followup video done for this segment?
I don't believe so. I think it was definitely something with OpenVPN. Everything works better with L2TP.
Thanks.
Hey man. What is the RSA key length for the ca and key cert which are generated in OpenVPN server ? Is it legacy 1024 or 2048? Can you modify it? I see you have aes-128-CBC cipher in the client config, does this router supports GCM ciphers ?
Sorry I have no idea.
Do you have fixed public IP ? How to remotely connect to a Linux PC which is on home network , which VPN gateway is being the ISP modem-router?
I do not have a fixed IP but it hasn't changed in 4 years. Currently I recommened using L2TP with any of the vpn routers from Omada. But wiregaurd is best.
i noticed there is "VPN User" tab, would that allow to create username and passwords so that anyone remoting into the LAN is authenticated? or anyone with the .ovpn file can freely remote into the LAN without being authenticated?
During the time of filming I believe it was only anyone with the .ovpn file
I can connect to internal servers and LAN machines but can't connect to internet on VPN machine? ANy suggestions how can be on my Office public IP in same setup you have done?
Use L2TP vpn instead of OpenVPN.
Thanks mate, very helpful. But I have a question, I'm trying to use the same DNS server as my work network. Because when I access through VPN I can't use my network DNS. For example: access my server using his name (Server-01). But when I'm connected locally this work properly. Can you help me? (:
Um you may need to manual add a DNS entry into the .ovpn configuration file. A Google search should yield what line of “code” you need to place inside the file. Probably something like DNS=ip.ad.dr.ess
So there's a VPN tab in the ER605 is the OC200 required to make use of a VPN?
Nope
I'm surprised you don't run PFSense, OPNSense or Sophos these are real enterprise firewalls. Most of those smaller appliances all have garbage VPN throughput. However, this was still a good review.
Yeah people tell me to all the time. I’m just lazy AF. I setup Wire Guard forever ago and was done with it. I don’t even use Ubiquitis VPN options. I’d like to think folks who are concerned about throughput wouldn’t be using this stuff. But maybe one day I’ll try pfsense
You go girl!
Been a long time since you last commented on a video.
@@SPXLabs why you have to call me out?
I didn’t mean too. You are just so memorable
@@SPXLabs i doubt that is a good thing
It is whatever you make of it
Trying to set up a complete Omada system with 14 outdoor AP's (158 acre Trailer Park). I would like to issue separate passwords that expire for each site. (Like a hotel does). Is this possible? Tks for any help you can share.
Just a guess but you would probably use the RADIUS functionality to accomplish this.
Tks, It has also been suggested Hotel Management Software. I will look into both.
Great stuff! Is it possible for me to use Express VPN with OC200 and ER605?
Not sure. Does express Vpn use OpenVPN or L2TP?
Regarding not being able to access a server on your local (home) network via the VPN connection: is it possible that you have NAT translation from the public IP that your ISP is providing to the local NAT, via the modem, and then your VPN is creating another layer for the subnet that the virtual connection sees?
I'm using FreshTomato firmware on a WiFi router and running into similar issues. It's starting to look to me like I might be able to avoid the "double NAT" if I was only able to set the cable modem to "passthrough" mode and have FreshTomato create the LAN address range from the WAN directly. Unfortunately my modem isn't capable of doing that (via PPPoE?)... so I have no way of testing this theory.
No it was ( or is) the way TP-Link implemented OpenVPN. Which I also believe they have removed in the newer firmware versions, so in my opinion it was the way they implemented that was causing issues.
I don't follow what you are saying. Have they removed OpenVPN support in the latest firmware?? Or are you saying that it is now fixed and with the current firmware one is able to access all devices/servers on the local network remotely as if you were "there"?
On my ER8411 + Omada Controller Software, there is no OpenVPN option anymore. It was removed in the newest firmware update. I don't believe it was ever fixed.
Is it possible to connect this VPN router as a client to one of those VPN services like VPNUnlimited, NordVPN, ExpressVPN, etc?
I’ve only tried with Mullvad and it didn’t work.
I think I’ve seen that done before in Untangle. I can’t provide advice on it as I wasn’t managing it, it was a friend.
open port 1194 on the main gateway
I think the reason you don't have Internet through the VPN is because @3:19 you placed the IP Pool of "192.168.50.0". Instead of the ZERO you should have a ONE (1).
I don't have an OMADA device but on my ASUS router I have a "1" as the last digit.
does it supports IPSec VPN with Azure and AWS
As in Azure and AWS host the VPN service and you connect the router to those?
In order to use you home internet instead of your mobile internet and to have access to all your internal servers, you need to make the ip pool be on the same subnet as your internal servers.
In this version of the software depicted in the video. That was not an option.
@@SPXLabs actually this only allows access to my internal servers, I still can't get to the Internet. I still had my wifi on my phone doh! Still need to find a way to route all traffic thru the VPN.
L2TP VPN instead
@@SPXLabs do you know of a mobile app that works with LT2P? My default Android 12 doesn't support LT2P and so far I haven't been able to find an app that works with LT2P.
Oh uh no I don’t. It’s built into iPhone so I’ve never had to look before.
Can one install a VPN onto the Omada ER605 VPN Router, so that every device that connects to the router will be by default utilize the VPN connection going out (thereby eliminating to create a VPN on each individual device on the network)? And if this is doable, can one create a rule that configures a single device to bypass the VPN? If yes and yes... anyone tell a tutorial or more on this? Without and with the connector... too much to ask? Newb, but capable of following directions.
You cannot install a VPN on the Omada router but there are already some VPN protocols already installed on it for you. To do what you are asking you will be essentially doing a site to site vpn. Your router will be a client and you need to connect to a remote vpn server.
what is the maximum speed you can get using openVPN compare to max speed of ISP?
41.5Mbps
This product shouldn’t be called VPN Server as it doesn’t route internet traffic through Open VPN Server to a VPN Client. In addition it is also slow. What a crap I bought… is there any alternative on the market that actually works? I don’t want to route all my internet traffic via Cisco Meraki.
If you use L2TP your traffic will be routes through the router.
@@SPXLabs thank you, I read that L2TP works, unfortunately it isn’t supported by VPN Client I use on the other end.
Currently I have a folder on desktop, mapped to a folder on my local NAS. Can I use a VPN on router to remotely access those files?
Yes
@@SPXLabs can you briefly describe how that works?
Is it possible to switch to "client" mode and route VPN connection to WIFI?
I don’t think I understand. Can you rephrase?
@@SPXLabs Sorry about the confusion and I was not clear enough due to English being my second language.
I am able to connect to another OpenVPN server using an external ovpn file with Omada router. However, I don’t know how to use that VPN connection within my local network. I tried to tie the VPN connection to VLAN and also created a Wifi on that VLan but i am unable to use the vpn in that vlan. Somehow I keep getting my wan IP instead of the VPN ip.
All I am trying to do is to use external VPN server for my home internet via omada router in VPN client mode. Every device in my local network should connect to outside via external vpn connection. I was wondering if you have any idea about this..
You don’t have to apologize! I understand what you are asking now. I am going to take a guess because I do not know the answer. I’m guessing that if you put the router in client mode that ALL traffic will go through the VPN, whether that is WiFi traffic or Ethernet traffic. Again, I’m guessing and not sure if that is true. Sorry that I wasn’t helpful.
@@SPXLabs Thanks for taking the time to reply. Unfortunately it does not route the traffic once in client mode (and this is exactly what I expected as well). I will keep investing and update here if ai find out anything.
No problem. If you do figure things out let me know!
The omada router has a built-in firewall feature….you must set some policy to make it work….otherwise it’s useless take a look at crosstalk solution he explains where to find it and how to do…
In the latest update this is true. But back then, firewall stuff was not web UI accessible
you nead to have openvpn client on you sever i have done it on windows server and i can accses me files fine
That doesn't sound accurate. The server is hosted on the TP Link hardware, so in theory if the routes are built I should be able to reach any system on the allowed subnet. When I host OpenVPN in a container or VM, I have to manually create the routes to reach any system on the approved subnet.
@@SPXLabs i have the openvpn clint on windows server i might not work for outher devie thoue i havent try it yet and i dont think you can if you are runing unraid
TP Link is underrated
You’re under rated
Lets update this "How to Setup OpenVPN Server on the TP-Link Omada ER605 Router with the OC200 Hardware Controller" :) , please !
One day. Been a bit busy with other projects
Haven’t played with the Omada router yet, just ordered one on Amazon, but it would appear to be since you restricted the VPN to the 192.168.50.0/24 subnet. Seems like your controller and the router are configured to accept traffic from other sinners. Omada’s own doc video th-cam.com/video/F83QTND3Yp8/w-d-xo.html shows you shouldn’t need to have the VPN on a different subnet, they assign the whole 10.0.0.0/8 subnet.
You get an error if you try to put the VPN on the same subnet as the LAN one
Wait what's the point if you can't run internet traffic through it and can't reach your internal services lol
Internal service could be my fault but I genuinely could not figure out what to fix.
But folks were asking so I gave the people what they wanted.
@@SPXLabs Are you using the TPlink as your main router or is it sitting behind another router? Like is it AT&T GW -> TPLINK, or AT&T GW -> something else -> TPLINK
In this scenario the router is sitting behind the ATT gateway.
Dude this is bs , instead of wasting your breath on irrelevant stuff that 90% don’t care about. , why don’t you just make a complete setup step by step with a test account , you didn’t say a word about the most important thing the VPN itself, you didn’t mention if people can use this thing with smart tv , iPads etc .
He spoke exactly about what I wanted him to speak about. He explained ho to setup an OpenVPN SERVER.
You are looking for a tutorial on how to connect to an OpenVPN server... which is an entirely different subject.
@jorgemtds I totally remember this comment. I still don’t really understand the issue