@TP-Link @TP-Link_Deco It's been over 4 years and this is still not implemented in ANY form? What the heck is this? Half of your clients are sold on the fact that you provide a "guest" and "IoT" network functionality, that we can't tag properly to act as such or manage in any way. It is quite obvious that most people who spend several HUNDREDS of dollars to plug your devices have a separate router and use this as... guess what... a MESH system like your product page sells it. Not being able to separate and tag vlans from another router upstream is absolutely horrifying for a company of your degree. Why is it taking 4 years to develop??? Is it because of product cannibalization with your corporate line of APs? Do you realize most people getting those products for their home and realizing the level of customer service you provided here are also lost customers forever on the corporate side of things too? This has to be changed asap, unbelievable...

  @David-TP

On behalf of the entire community, thank you for the first response from a TP-Link representative in lo these many years save from the prior response which merely asked, "what would you want that for?"

ACLs do not work for these purposes on these devices as when in AP mode as both the Main and Guest SSIDs share the same subnet address space. Upstream devices are unable to differentiate whether traffic ingrrssing from the AP mesh is associated with a device on the Main SSID or the Guest SSID.

It should be apparent from the multitude of comments in this thread over the years that the owners of these devices have a very strong interest in segregating and managing Main and Guest SSID traffic differently. The ability to do this largely goes away in AP mode, and it is simply impossible for upstream devices (i.e. a switch, router, or firewall) to differentiate.

What the folks in this thread are calling Guest VLAN tagging, apparently TP-Link calls Multi-SSID via VLAN tags. This sounds to me like a distinction without a difference.

It's an outrage that TP-Link has ignored these requests for over five years without engaging with the community on this issue. The response that the people who invested significantly in these devices and have been asking for this capability need to buy something else to get it is not surprising, but is still disappointing nonetheless.

Given the utter lack of official response to the community on this issue over the years, I wouldn't expect them to buy new TP-Link devices, though.

I think TP-Link's response should be read more as an admission that the software on the devices need to be upgraded. The version of OpenWRT TP-Link have based their software on is very old and the community can of course choose to upgrade to a much newer version of OpenWRT themselves.

This works fine for v2 of the Deco M9 Plus hardware (credit to 'meshing') while I have not fully succeeded with v1 yet. See this thread on the OpenWRT forums for more information: https://forum.openwrt.org/t/ipq4019-adding-support-for-tp-link-deco-m9-plus/216594

With a much newer version of OpenWRT it's of course no issue using separate VLANs for different SSIDs.

(Note: Upgrading to regular OpenWRT rather than TP-Link's inferior old fork means the device will no longer be a "Deco" and any TP-Link specifics when it comes to apps etc will not work)

I just expect companies to be up front in their marketing to be honest. It says supports guest and vlan it does not say only in router mode only or not in AP mode in the marketing blurb. That same marketing is what you have to use to choose a device and if it had been honest about this, me and many others on here probably would not have Deco hardware.

Equally if it says it does with no limitations stated then it needs to do it or at best its misleading, at worse its misselling.

Either way one of the above needs sorting to avoid more people being hit by this mess.

  @Paped Well, dishonesty in marketing means a potential court case...?

Well that's "where there blame there's a claim" territory not interested or worth it for a £160 set-up, my point is more...

https://www.tp-link.com/uk/home-networking/deco/deco-x10/

The above is the tp link page for the X10 decos I got - it mentions ap/router mode but nothing about limitations in the spec, it mentions tag vlans. It even mentions a "guest network" not a guest SSID fronting guests on the same network as your private clients, by definition "guest network" is a seperate isolated network that is routable aka a vlan in most cases.

So why would a buyer not think that it has working guest network with vlan separation even in ap mode?

Shame I had not picked up the lack of features in ap mode in the returns period as they would have gone back, but now destined for eBay and a user that does not need this function, which to be honest they are a good fit for...