@Riley_S On prev tp-link wifi routers, the VPN process created a config to import into OpenVPN. Although I have upgraded the firmware, and have the VPN function on my X55 system, there's only mobile app access (VPN not listed as an option in the web portal) and the process doesn't appear to 'save' a config, or create a certificate. How then do I config OpenVPN to work with the VPN?

Also, the process wants to use the main router DDNS or DN created... What if I only want to use the VPN function for a specific internal IP, ie. a Virtual Machine?

Please advise.

  @Riley_S 

As you may know, I have messaged with TP-Link Support separately about this, but I simply do not understand why the new IoT network feature on the Deco X55 does not isolate devices on that IoT WiFi network from devices on the main network. In our home we have over 30 TP-Link Kasa smarthome devices, plus about 10 Wyze cameras, and I want those IoT devices completely isolated from my computers, printers, and NAS devices.  Given the possiblity of hacks or bugs in any IoT device, they absolutely need to be isolated on their own network. Steve Gibson on the Security Now podcast has spoken about this issue for years, and it is mystery to me why the major router vendors haven't addressed this issue.

So I was very excited when I first saw this feature in the new firmware but then stunned and disappointed when it didn't work right. From everything I have read and heard, isolation is the well-understood and desired (and only?) definition of having an IoT network, yet the new IoT network feature you just added does not isolate! The answer I got from support made no sense to me, something about customers needing to "control back-end IoT devices via smart gateway" -- what does that even mean?? TP-Link sells wonderful Kasa devices, which simply connect via WiFi; there is no "smart gateway" involved, other than a WiFi router.

I love TP-Link products and I am very delighted that you are updating firmware and adding features, but please get this one right!

Thanks

  @Riley_S In the app, there's nothing to click on after setting up the VPN.

What about tunneling the VPN server for only certain IP addresses? Doesn't seem it's possible to use with only a main DDNS?

  @Riley_S

Thanks. But the simple solution for all the things you mentioned is simply to put everything (IoT devices included) on the main network. Having an IoT network which is identical in every way and with full access to/from the main network is no different from just putting the IoT devices on the main network. I don't see the point at all, other than perhaps being able to say "I have an IoT network". What is the benefit, compared to just putting everything on the main network?? Maybe I'm missing something.

In any case, having isolation as a user-selectable option (you could default it to "off") on the IoT network doesn't hurt anybody who likes your current solution, but it helps a lot of us who bought a bunch of IoT devices and are worried about security. There's an old joke: "the 'S' in IoT is for security"; the fact that there is no 'S' in IoT is exactly the point -- there is no security in IoT. Your current IoT network does absolutely nothing to address that concern.

  @Riley_S 

OK, thanks! I will look that over.

So is this new IoT network feature a Matter controller? That might make a lot of sense actually, though of couse the isolation option is still a good idea for a future feature.

  @Riley_S 

OK. It will be interesting to see how this all plays out.

FWIW, here's my generalization that you might want to have your product folks think about:

I see no reason why a WiFi router shouldn't have multiple SSIDs (4? 8?), each with the following two configuration choices:

• isolate this SSID's devices from the main network
• isolate this SSID's devices from each other

If you think about it, the typical Guest network has these choices both set to "isolate", while my desired IoT network would be configured to isolate from the main network but not from each other. This way the user could select the configuration he wants, and the Guest network just becomes a particular setting of the generation configuration options. A old D-Link router (DIR-655, iirc) had these options for its Guest network. The router could pre-configure the Guest network to work as usual. This gives the user a lot of flexiblity in configuring his network, and it would set your router apart from your competitors. There is no extra hardware cost, and the software overhead is fairly small.

Just a thought...

Thanks