TL-R605 VLAN and Guest Network Questions
This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Hello
I recently purchased the TL-R605 and EAP225 and have some questions about using these for a home network.
Topology is cable modem > TL-R605 (router/switch) > EAP225 > wireless devices.
My goal is to keep a network printer in a sort of DMZ to allow trusted and untrusted devices to print without accessing each other. I have a very workable solution and am okay with the security tradeoff.
I'm trying to keep things simple by using guest networks as much as possible. Putting my work-from-home laptop on its own guest network so it can't access any of our other devices. Putting my kids COVID school-from-home laptops on their own, separate, guest network for the same reason.
Then I want to setup another network for the printer. A laptop from either work, school, or a trusted device should be able to switch SSIDs to this new network and then print.
Will either of these options below work?
- Create a guest network for the printer and allow devices on the network to discover each other? I don't see this type of permission setting in the EAP 225.
- Create a VLAN on the TL-R605 and assign it to an SSID on the EAP225.
I've spent hours trying to setup #2 but have no experience with VLANs and need help. I've created the VLAN, tried to figure out what I need to do in terms of tagging ports (or not), what to do with PVIDs, etc.
I'm at the point where I've got the printer SSID setup on EAP225, it references the custom VLAN (I'm calling it 200). I've got that VLAN created on the TL-R605, tried various combinations of other options. I can connect to the SSID and print with one computer but not the other. Neither computer can access the internet from that SSID (maybe a good thing?). And I'm just thinking that fumbling through this may create a bigger security risk.
Appreciate any detailed help or guidance. Somehow I can't find an actual manual in the support area of the website. Many of the other posts here and on Spiceworks (and elsewhere on Google) are for other equipment - mostly separate switches and routers.
Thanks for any help!
Ah yes the MAC Telecoms video, passed that on a few people the last while.. it is very good for this type of thing
Thinking about this last night and pretty sure it is the lack of a switch that is causing it. The Router is literally a router alone, combi Router / switch devices are not the normal in Business Grade setups, most IT guys prefer to keep these separated (myself included) for a number of reasons
1. 1-4 ports simply isn't enough switch capacity for business grade, hell most homes would fill a 4 port switch.
2. If that device goes, you lose EVERYTHING.. LAN and WAN. That is a risk, least if its just a router its only WAN and your users can still print, access shares etc.
3. Combi devices are not as high capacity or as reliable. They come with shorter warranty and tend to be "good at everything, master at nothing" devices
4. The big one.. as they are combi, you cant configure them as tightly as you can a device specific for one task.
Basically how this will work is traffic is coming in from the internet Untagged (with no vlan), the router will look at the packet and tag it with a VLAN header (say 101 Guest) and pass it down the TRUNK port to the switch. Trunk ports are basically back haul used for mass transport of data between switches, Routers APs etc.. .
The Switch will then read the TAG and move the data to the appropriate interface port based on the VLAN Tag.. That could be a end device, or another Switch / AP where the process starts again.
The VLAN movement is very much a switch technology. The R605 being a router doesn't work like this, rather it has 1-4 trunk ports its expects to send tagged packets down for attention of a switch. Routers don't care about end devices, they just move data from Network A (Internet) to Network B (your LAN). Switches are the opposite, they care only about what devices are connected to them specifically and don't know about different networks.
Hope that helps? With that in mind, you will need a switch that can support VLANs.. Of the 2x you mentioned, I personally went for the 2008P as it offered full support for the SDN, was newly released in late 2020 and had 4x POE ports so I could power my EAP245s from the switch without the injectors.
The TL-SG105E will likely work if you go for it.. however as its an older model now and doesn't support the SDN you would need to manually configure the VLANs and Trunks yourself to match the SDN setup. That could get messy, cant see why it wouldnt work but it would be more.. well messy..
If you want my honest opinion, when it comes to SDN setups like Omada, Ubiquiti, Meraki you are expected to go all SDN or no SDN. That is generally why they come as new device ranges, in the Omada case this is the 2xxx and 3xxx range of switches for example.
I only moved to Omada from Ubiquiti last year for home use, the reason was Uniquiti was working out much too pricey at the time. However for all SDN setups, you need to buy the hardware.. Yes its a bit of a kicker, but look at it as an investment long term ad ultimately you are buying Business Grade hardware with lifetime warranties vs home grade with 1 year warranty and perhaps 1 firmware update over its life.
The Omada range is VERY new and will only get improved over time with firmwares and features, its $70 more yes, but in the long run it will be easier and better supported for you, my opinion for what its worth.. spend the money and enjoy a few years of playing with the new SDN as this appears to be how the market is heading.
p.s.. I live in the UK and prices are higher here, its £80 difference for me, which is about $120 US... 
