@HunTom Are you able to Ping from VLAN2 to VLAN1? Some application cannot detect devices in other VLANs, but require you to add the client IP manually. Also make sure you have the newest firmware and...

@ciesiew Maybe try the same VPN IP pool subnet for both routers?

@UNIMET AP sold in different region have different firmware.

@ankazoli Try OpenVPN. Tplink router L2TP has some default encryptions but we can't modify it. Maybe your win10 PCs just cannot work with that. Another solution is to disable "Encryption" on your...

Check the EAP firmware version, only the newest firmware can work with new SDN controller. If that is not the issue, I think it could be a hardware problem. Will your EAP work in standalone mode?

@Jellyhead It won't work. VPN tunnel won't let you remote access the WAN port netowrk. It's the limitation of NAT router