Dear sir, Thanks for your message. But, I want to disable the “remote” control capability. Would you please tell me how to configure it. Thanks.

Dear sir, Thanks for your reply.

@Kevin_Z Sorry, I'm not happy with your answer.

Such forced access means that I have to fully trust TP-link, while I had to accept all kinds of conditions I did not have time to read (and else I would not be able to use the device).

Stating there is no security issue because "SSH is blocked for clients" is misleading. You obfuscated SSH-commands (if I understand correctly), but it still runs an (altered) SSH-server which can have old security flaws.

I also share the concerns about the cloud control. I'd prefer to have the full control to my routers, otherwise I cannot be sure that these routers don't send tracking metrics to tp-link even when it is configured in ap mode. I'm thinking about to return this router back to the shop.

Another annoying thing. If I reboot my dedicated router, tp-link in ap mode takes the DHCP role and routes the traffic through the primary deco. From my point of view this is inacceptable. In certain cases it also gives its own default ip subnet 192.168.68.0/24, when my local network doesn't use this.

Yup, also going to send back the Deco and warn others for this stupid security design flaw.

Some links around security problems:

•     https://blog.keane.space/tp-link-deco-m5-hardware-hacking.html
•     https://techcrunch.com/2019/05/22/tp-link-routers-vulnerable-remote-hijack/
•     https://community.tp-link.com/en/home/forum/topic/179710
•     https://www.tp-link.com/us/support/faq/1970/

I'm not at all happy with this crap "management in the cloud" bull... I have no control of what goes back and forth between my network and TP-Link. For goods sake, make it optional for those who for some reason has a need to remotely manage their Deco.

One of these days I might spend some time on checking on the traffic by running wireshark on it in order to see where it communicates to and with what protocols.

What I have done is that I'm running my Deco e4's in AP mode and simply denied internet access to the Decos by not giving them an gateway from the DHCP. They complain that there is no internet, but this is no issue as such. I can still "manage" them through the not so great Android app. It's also possible to log in to them through the http:// interface.

In case there is a firmware upgrade, then I can give the Decos a gateway IP and let them grab the firmware over the internet or just download it and do the upgrade over the web interface.

The management didn't work correctly without "internet", the minimum requirement seem's to be that DNS servers are reachable, the e4's are now happy after I gave them access to the DNS servers.

Edit 1: This is my final setup for the Decos with blocked "cloud management".

 - Running in AP mode.

 - Access to any NTP server on the internet, as the Decos doesn't honor the NTP servers  provided by DHCP.

 - Access to my DNS servers.

 - Blocked all other internet access. Most important is to block outboud traffic on tcp port 443.