Dear @Martin_Theobald,

Need to know more information.

I just got a new TL-R605 and am trying migrate our VLANS onto the new router. My main problem is that every vlan as soon as it is configured automatically seems to have internet access which i really don't want. Additionally there seems to be Nat happening which i never told it to do anywhere.

Do you use the TL-R605 to assign the DHCP IP address and provide Internet access for the end clients?

Could you please provide the whole network topology for checking? Is the TL-R605 configured with Omada Controller? 

What kind of VPN you configured on the TL-R605, IPSec LAN-to-LAN VPN?

In the old router you had to set nat from and to individually for each vlan before it even had any kind of internet access and the vpn connection became an own routing target but in this system i seem to not get how it works at all.

Do you mean the TP-Link old router? What's the model number? 

For the TL-R605 router, we have no option to disable NAT. I doubt your requirements may not be achieved with the TL-R605.