@MeninGate 

router ned access to controller management port, deafult is 443 on hardware controller or 8043 on software controller.

whitout this access upgrade will fail

and to be sure add this port to, 

UDP 29810, TCP29811-29816

https://www.tp-link.com/no/support/faq/3281/

  @Tedd404 

Hi Tedd,

Many  thanks for the useless answer.

I have 15 EAP660 HD(EU) v1.0 access points on 3 sites connecting via ER605 v2.0 over VPN to the OC200 controller in our office.

Everthing is working perfect except the upgrades.

I did read the manual as well as the forum(s), configured and tested everything but unfortunately until now no joy with the upgrades. 

I'll keep pinging through the VPN tunnel and scanning for open/closed ports till I find the culprit.

Stefaan.

  @MeninGate 

Apparently other people have the same problem: https://community.tp-link.com/en/business/forum/topic/581692 

  @Tedd404 

no

This is what a port scan says on the device side.

all seems to be correct.

  @MeninGate 

As I told you, router ned access to controller on port 443. router is probably not adopted in vpn tunnel but on wan interface, so you have to port nat from wan to controller on lan.

do port nat off all port you need, 

tcp 443 

udp 29810

tcp 29811-29816

then you can enjoy the new firmware.. ;.)

  @MR.S 

VPN Tunnel goes straight from ER605 to OC200 controller. Endpoint is the controller itself. In picture above you can see that all ports on the controller are open.

In that post the same problem is described:

https://community.tp-link.com/en/business/forum/topic/581692?sortDir=ASC&page=1 

Many thanks to help thinking.... :-) 

  @MeninGate 

OK