Business Community > Gateways > Omada Gateway (ER8411) Applying NAT to Inter-VLAN Traffic After Firmware Update
< Gateways

Omada Gateway (ER8411) Applying NAT to Inter-VLAN Traffic After Firmware Update

Omada Gateway (ER8411) Applying NAT to Inter-VLAN Traffic After Firmware Update

Omada Gateway (ER8411) Applying NAT to Inter-VLAN Traffic After Firmware Update
Omada Gateway (ER8411) Applying NAT to Inter-VLAN Traffic After Firmware Update
2025-08-04 14:19:11 - last edited 2 weeks ago
Tags: #VLAN & Multi-Networks #NAT
Model: ER8411  
Hardware Version: V1
Firmware Version: 1.3.2

Hi all,

I'm hoping someone can help me with a frustrating issue that appeared after a firmware update. I've already opened a ticket with TP-Link, but I'm hoping the community might have a faster solution.

 

My Setup:

 

  • Gateway: TP-Link Omada ER8411 (Upgraded from 1.3.1 to 1.3.2, now downgraded back to 1.3.1).

  • Controller: Omada OC200

  • Client Network: VLAN 10 (192.168.0.0/24)

  • Server Network: VLAN 50 (10.10.5.0/24)

  • Reverse Proxy: Nginx Proxy Manager on VLAN 50, with ACLs to only allow access from local subnets.

 

The Problem:

 

Since upgrading the gateway firmware, all traffic routed between my VLANs is being subjected to Source NAT (SNAT).

For example, when a client on 192.168.0.30 tries to access a service on VLAN 50, my reverse proxy no longer sees the client's true local IP. Instead, it sees my public WAN IP address, causing my local-only ACLs to block the request with a 403 Forbidden.

Here's the NPM log showing the public IP:

 

[04/Aug/2025:13:32:50 +0000] - 403 GET https omada.mydomain.com "/favicon.ico" [Client my.public.ip.address] ...

 

This started immediately after the firmware update. Downgrading the firmware did not fix it, suggesting a persistent configuration change pushed by the controller.

 

My Diagnosis:

 

The gateway is applying a hidden, default Masquerade policy to all routed traffic, including local inter-VLAN traffic. The Omada Controller UI appears to have no obvious way to disable this behavior.

 

What I've Already Tried:

 

  • Confirmed DNS is correct. My internal DNS resolves local services to their correct private IPs on the 10.10.5.0/24 network.

  • Checked Firewall ACLs. I have a LAN > LAN Permit rule for traffic between these two VLANs. I've checked the advanced settings for this rule, and there is no option to disable NAT.

  • Checked NAT Settings. The Settings -> Transmission -> NAT section only shows my Port Forwarding (DNAT) rules. There are no visible Outbound/Source NAT rules, and no apparent way to create an exception rule.

  • Ruled out client issues. The problem is confirmed with curl from the command line and occurs across multiple devices.

 

My Question:

 

Has anyone with a similar Omada setup run into this? Is there a hidden setting, CLI command, or a specific controller/firmware combination that fixes the inability to control NAT on inter-VLAN traffic?

 

Thank you!

  0      
 
  0      
 
#1
Options
1 Accepted Solution
Re:Omada Gateway (ER8411) Applying NAT to Inter-VLAN Traffic After Firmware Update-Solution
2025-08-06 01:18:00 - last edited 2 weeks ago

  @Kalquaro 

Kalquaro wrote

  @Clive_A 

 

I'm not sure I understand the reasoning behind your line of questioning, I posted the nginx logs in my previous answer to your questions, which tells that the site portainer . mydomain . com gave a 403 forbidden when accessed through a public IP address, which is the expected behavior.

 

The problem is nginx sees my public, ISP supplied, IP address even though the request comes from a vlan within my own network.

 

Below is the access list I use in NPM to prevent access to URLs I don't want accessible from outside my network. The redacted IP address is my public, ISP provided IP address that I've had to add as a temporary workaround, until I can figure out the root cause of why a request coming from the 192.168.0.0/24 network gets re-written as coming from the public internet when crossing vlans.

 

 

Wait for the future firmware to fix this.

 

Edit:

1.3.2 firmware will provide a fix to this issue. As mentioned above. 

A beta release is placed here for people who need it. 

Recommended Solution
  1  
  1  
#6
Options
8 Reply
Re:Omada Gateway (ER8411) Applying NAT to Inter-VLAN Traffic After Firmware Update
2025-08-05 03:21:29

  @Kalquaro 

If you upgraded from 1.3.1 and now are back to 1.3.1, I don't see this is a problem with the router or controller.

Controller absolutely has nothing to do with the NAT or config. It only controls the devices and sending the commands to change the settings instead of modifying the NAT stuff unless you create some kind of rules. 

 

Did you have any change on your LAN or Nginx? 

What does the traceroute look like from this VLAN to the domain?

  0  
  0  
#2
Options
Re:Omada Gateway (ER8411) Applying NAT to Inter-VLAN Traffic After Firmware Update
2025-08-05 16:41:22

  @Clive_A 

 

Hi Clive,

 

Thanks for replying.

 

I have not done any modifications to my network or nginx before the firmware upgrade. The issue started happening right after I upgraded the firmware, when I tried accessing a site behind my reverse proxy and received a 403 forbidden.

 

After investigating, I noticed that my nginx proxy manager was now seeing my public IP address. Here's an example of the logs (sensitive information redacted). Also please ignore the spacing in the addresses, the forum wouldn't let me post with them being seen as URLs:

 

[04/Aug/2025:15:30:46 +0000] - - 403 - GET https portainer . mydomain . com "/" [Client my.public.ip.address] [Length 182] [Gzip 3.23] [Sent-to doppio . 397 . mydomain . com] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" "-"

 

This is what it would normally look like:

 

[03/Aug/2025:11:42:42 +0000] - 200 200 - GET https portainer . mydomain . com "/api/settings/public" [Client 10.10.7.2] [Length 771] [Gzip -] [Sent-to doppio . 397 . mydomain . com] "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" "https:// portainer . mydomain . com/"
 

This is what a traceroute looks like:

 

C:\Users\Kalquaro>tracert portainer . mydomain . com

Tracing route to npm . mydomain . com [10.10.5.3]
over a maximum of 30 hops:

  1     4 ms     4 ms     1 ms  10.10.7.1
  2     5 ms     2 ms     3 ms  10.10.5.3

Trace complete.

 

The request doesn't go to the public internet, but does cross vlans, yet gets logged in the nginx logs as coming from my public IP address. This strongly suggests a SNAT issue, but I'm keeping an open mind to explore other potential root causes if my diagnostic is erroneous.

 

Thanks,

  0  
  0  
#3
Options
Re:Omada Gateway (ER8411) Applying NAT to Inter-VLAN Traffic After Firmware Update
2025-08-06 00:56:06

  @Kalquaro 

403 means you have no access to the page. 

Did you locate the log on the nginx server? What does the log say? 

 

Assuming your nginx does not allow the unknown LAN IP to access it. 

  1  
  1  
#4
Options
Re:Omada Gateway (ER8411) Applying NAT to Inter-VLAN Traffic After Firmware Update
2025-08-06 01:08:06 - last edited 2025-08-06 01:10:44

  @Clive_A 

 

I'm not sure I understand the reasoning behind your line of questioning, I posted the nginx logs in my previous answer to your questions, which tells that the site portainer . mydomain . com gave a 403 forbidden when accessed through a public IP address, which is the expected behavior.

 

The problem is nginx sees my public, ISP supplied, IP address even though the request comes from a vlan within my own network.

 

Below is the access list I use in NPM to prevent access to URLs I don't want accessible from outside my network. The redacted IP address is my public, ISP provided IP address that I've had to add as a temporary workaround, until I can figure out the root cause of why a request coming from the 192.168.0.0/24 network gets re-written as coming from the public internet when crossing vlans.

 

  0  
  0  
#5
Options
Re:Omada Gateway (ER8411) Applying NAT to Inter-VLAN Traffic After Firmware Update-Solution
2025-08-06 01:18:00 - last edited 2 weeks ago

  @Kalquaro 

Kalquaro wrote

  @Clive_A 

 

I'm not sure I understand the reasoning behind your line of questioning, I posted the nginx logs in my previous answer to your questions, which tells that the site portainer . mydomain . com gave a 403 forbidden when accessed through a public IP address, which is the expected behavior.

 

The problem is nginx sees my public, ISP supplied, IP address even though the request comes from a vlan within my own network.

 

Below is the access list I use in NPM to prevent access to URLs I don't want accessible from outside my network. The redacted IP address is my public, ISP provided IP address that I've had to add as a temporary workaround, until I can figure out the root cause of why a request coming from the 192.168.0.0/24 network gets re-written as coming from the public internet when crossing vlans.

 

 

Wait for the future firmware to fix this.

 

Edit:

1.3.2 firmware will provide a fix to this issue. As mentioned above. 

A beta release is placed here for people who need it. 

Recommended Solution
  1  
  1  
#6
Options
Re:Omada Gateway (ER8411) Applying NAT to Inter-VLAN Traffic After Firmware Update
a week ago

  @Kalquaro 

 

I have the same issue with the ER605v2 2.3.0 firmware. In my case, a rollback to 2.2.6 fails, so I think I'm stuck and can't test if a rollback would fix it.

 

Like you, I discovered this because my IP whitelist rules in my reverse proxy (traefik) suddenly started blocking access from my LAN.

 

Have you figured out anything else? Interesting that the issue persisted across the router firmware rollback...

 

Here's my post for reference:

 

 https://community.tp-link.com/en/business/forum/topic/838820?replyId=1600772

 

  0  
  0  
#7
Options
Re:Omada Gateway (ER8411) Applying NAT to Inter-VLAN Traffic After Firmware Update
a week ago

  @SSIDad 

 

I opened a ticket to TP Link for this and they acknowledged the issue. A beta firmware was provided that fixed the issue for me. 

 

Suggest you do the same and see if they also have a beta firmware available for the 605. I've been told the fix will be included in the October official firmware release. 

 

Good luck! 

  0  
  0  
#8
Options
Re:Omada Gateway (ER8411) Applying NAT to Inter-VLAN Traffic After Firmware Update
a week ago

  @Kalquaro 

 

Thanks for the reply. In the meantime, tplink has already released a beta that fixes the issue for the ER605. So I'm happy.

  0  
  0  
#9
Options

Information

Helpful: 0

Views: 394

Replies: 8

Tags

VLAN & Multi-Networks NAT
About Us
Press
Copyright © TP-Link Systems Inc. All rights reserved.