@Fae 

Thanks for your reply.
Actually, I wouldn't mind not having different VLANs on the R605 if the LAN ports on the switches remain isolated from each other. I don't want any communication between the LANs on the switches, only providing internet from the main router, R605.

I'm just worried if that WR740N can hijack the whole network even if I configured the switches to isolate the LAN ports, the whole point of having these easy smart switches (replacing old unmanaged switches recently) was to avoid this issue. I thought it would make the network foolproof and if someone doesn't configure their router in a flat correctly, at worst case they won't have internet but won't interfere with others.

 

I'm wondering, to avoid this in the future:

Does the MTU VLAN setup on the switches means their uplink port is tagged or untagged?

Should I configure the LAN ports (connecting to the switches) on the R605 tagged or untagged?

If everything is on the default VLAN1 on the R605, does it mean that traffic from any VLAN on the switches gets connected in the R605 as if they weren't on different VLANs there initially?

Would it make any sense doing a work-around, choosing a rare IP range for the DHCP server on the R605, like 192.168.111.x and somehow blocking any communication in other IP pools?

I just read in another thread here that this R605 really has a serious issue with intervlan traffic always on. And I also read now that ACL won't rule out anything on the LAN of the router, only on the WAN ports. Really???

This is insane! What was the purpose of this router? (Other than being exclusively used in Omada ecosystem.) If its LAN ports will act as an unmanaged switch that connects every end devices regardless what you configured on "managed" switches.

Unfortunately I can't send the product back and ask a refund as the days had passed before I could have this important information about the limitation/deficiency of this router.

Now I guess I'll have to replace it back with the old R470T+ and wait some months or years for a firmware update of the R605.

 

People need to be informed about this limitation on the product's page!

And it should be helpful to know if the company is planning to solve this issue.

 

It's also not clear and needs to be answered if I can configure the router with Omada software that is not always on? And whether the necessary rules will cooperate with easy smart switches.

Because if you don't have Omada enabled switches and EAPs, it's really wasteful to buy an OC200 or operate a connected computer 24/7.

Fae wrote

Update: 

New firmware will be released on R605 by the end of May 2021. After upgrading the R605, you will be able to create different VLANs and assign different IP subnets for the LAN ports on the R605 in Standalone mode (without using Omada Controller).

 

Please pay attention to the TP-Link official website for the new firmware update: 

https://www.tp-link.com/en/support/download/er605/#Firmware

Thank you, that's a promising news!

Looking forward to it.

@Fae 

I came to the router's location to perform the update and now the new firmware isn't there on the site anymore.

It was released on 28 May. What happened? Was it too buggy?

If you have some info, please tell us!

Thanks

So, I just found in another thread here a beta firmware update shared by @Fae 

It seems to be a fix after the initially released and quickly removed firmware update:

https://community.tp-link.com/en/business/forum/topic/266026

This beta firmware can be downloaded directly from this link:

https://static.tp-link.com/beta/2021/202106/20210601/ER605(UN)_V1_1.1.0_20210531.zip

 

I'll check it out tomorrow whether it solves the vlan issues and will reflect then.

This beta firmware (1.1.0 Build 20210531 Rel.59047) solved the inter-vlan problem, mostly.

Setting up vlans with different IP subnet is quite easy. (However, it's not in Transmission -> NAT section but in Network -> LAN.)

And I could remove vlan1 for all of the LAN ports. If it matters...

 

However, there is a mystery:

I was able to reach the gateway address (of the R605 for any of the IP subnets for other vlans) via any LAN port.

Also I was able to reach the address of the switch that is on the other LAN port (with different vlan and subnet).

That is weird. It seems the router still can't isolate communication between the LAN ports, between vlans.

On the other hand, I couldn't reach the EAP's web address from the other LAN ports of the R605.

So, the switches I could, the EAP I couldn't.

No other inter-vlan connection could be found.

My devices connected to the switches don't reach anything on other LAN ports of the switches, fortunately, which is great news and it's definitely an improvement.

 

The Status section is poor and useless, IMO, comparing to the R470T+.

It shows in System Status the almost real-time graph of the CPU cores that can satisfy some engineers but for most people it's useless, not informative.

I would prefer a graph showing the traffic of each ports, especially the WAN ports. The Traffic Statistics/Interface Statistics does show a momentary status with about 10 seconds delay but it doesn't really show real bandwidth usage and when I run speedtest, it shows much lower rate on this statistics page. Mostly I can see couple of KB/s. First I thought it was a bug and those numbers are packets instead of KB/s.

 

Then another surprise is when you look at the total RX/TX Bytes, it shows that the load balance function is not following what I intended when I input the bandwidth for each ISP. It ssems the router sends traffic more to the 2nd wan port instead of the 1st. Even if the 1st is set to 10000 up and 80000 down, the 2nd with 1000 up and 1000 down. I had to do it so radical (the reality is the 2nd has half the download speed and 150% the upload of the 1st ISP) and even so it doesn't seem to send the right proportion of traffic.

Why the load balance doesn't work now correctly?

 

And why the router shows in the Interface Statistics the lines for WAN/LAN2 and WAN/LAN3 that is not existing in this config as I have 2 WAN and 3 LAN ports?

 

The Network List in LAN section shows the list out of order, as you can see. And I can't change it. Actually it shows the order in which I configured them. To look more organized, I should reconfigure some of them.

 

Another observation: the IP Statistics shows IP addresses that are different from the subnets I configured and it shows them with either only ingress or only egress traffic. It seems some router-on-a-stick on the switches and their connected devices with manually added IP. But how can I see them on this page?

Is there something to do with IGMP proxy on?

 

The major problem so far, beside of the intervlan issue is that my 2nd ISP is a 4G modem that sometimes doesn't operate well but it doesn't loose signal, just fails to connect to the internet somehow. So when Load Balance was configured with the 2 WAN connections, it caused issue for devices trying to reach the web because R605 detected incorrectly as if WAN2 was online when it was practically not.

I tried to change the Online Detection function to ping to 8.8.8.8 but no difference.

Then I decided to setup the 2nd WAN only for Link Backup. For some reason, for a while it kept sending me to the 2nd WAN, when Load Balance wasn't already even configured that way.

(I did not reboot the router after each modification. Should I have done it?)

 

@Fae

Thank you for that tip about enabling the layer-3 accessibility in EAP.

 

I still don't really understand the intervlan concept. If I configure each LAN port of the R605 with different VLAN, PVID and IP subnet, how could intervlan be on as if there were no isolation? I can understand that with an ACL rule I can define what to block but I thought it's unnecessary when I used different vlans. Should I setup the LAN ports tagged on the R605 and also tagged on the easy smart switches? I don't know if MTU-VLAN does the uplink port as tagged or trunk port?

 

Reaching the web UI for both switch is not a problem (it even makes it more convenient for me to check the network) but it's weird that I wasn't able to reach anything else from the other subnets, not even from the same subnet thanks to the easy smart switch in MTU-VLAN mode.

So, about this question I'm not complaining, just curious how is it possible or what did I miss when setting it up.

 

However I would need someone to clarify other questions mentioned above.

- in IP Statistics why do IP addresses appear in subnets that I didn't define in my configuration? Those are IP addresses of routers (and some of their connected devices) that are plugged into the switches' LAN port. Again, thanks to MTU-VLAN function on the switches these router-on-a-stick routers don't freeze the local network anymore.

But why can I see them in the R605's page? And why just a few and not all of the connected devices?

I had been getting paranoic with these rogue routers, that's why I have chosen IP ranges like 192.168.51.x to avoid any collision.

 

- other issue is with a not always reliable 4G modem (MR6400 with the great beta firmware), the culprit is probably the mobile ISP but the R605 doesn't help to detect the failing 4G connection.

So therefore the local network became unreliable, some members complained (correctly) that internet was not working for them sometimes. I went to investigate and found out that the 4G connection was weak but not disconnected and the R605 wasn't detecting it as offline and sent traffic to that wan port.

With this fragility I can't keep the 4G modem in the load balance concept. If the R605 was capable to correctly detect the failing connection, it would be a stable configuration.

Is there any good tip for that? (I tried adding google's dns ip to ping but it didn't improve anything.)