ER706W and Home Hub 3000 Advanced DMZ
So I bought an ER706W to repalce an aging Deco for home. Went through the the process of setting it up and ended up with road blocks, specifically:
1.. My previous setup had advanced DMZ for the Deco M4, with no issues. I put the ER706W in place. Added the MAC in the advanced DMZ setup and it gets an external IP. Looks all good but no traffic passes. If I remove the advanced DMZ, it gets a 192.168.x.x.and it works but double NAT. The Deco did this just fine. Rebooted all. Looks great, shows connected with the public IP...no traffic moves. Put the Deco back in place, works fine.
2.. I bought an EAP 650 as well. Cabled it to one of the ports on the ER706W. Go to add a device to the mesh and it does not discover it.
Both now are setup to return with Amazon as I just wasted hours on this.
Also, as an FYO on Adavanced DMZ, I am with Bell Aliant and they do not allow PPPoE. I also have TV and Phone so I know I could move the SFP to the WAN1 but I don't see if definiite enogh guide on the VLAN config and requirements for TV and Phone. Also, I am guessing knowing what I know about ISP's and the security risk, that door will be closed here shortly.
Any thoughts on why the ER706W will not pass traffic? The route table looks correct when connected and again, put the Deco back in place and it is all good.
- Copy Link
- Subscribe
- Bookmark
- Report Inappropriate Content
Wired backhaul access points isnt "mesh" and its just wired backhaul APs. Mesh is really the terms for APs linked to each other over WiFi with only certain "root nodes" having a wired uplink. If you can wire all of them, its far better. Having the same SSIDs broadcast by multiple APs isnt an issue and is a totally standard function.
As for the advanced DMZ, when you put the new router behind the ISP one with DMZ enabled, what IP and subnet does the router get, and what is the gateway IP it gets ? does it also get a DNS server or are you manually setting those. Is it possible it also needs a vlan tag for the ISP ?
If it gets a subnet mask that is outside the scope of the gateway IP the ISP gives it, im fairly sure the router just wont get any WAN as by design - on all brands and by the spec, gateway IPs SHOULD be inside the scope of the mask.
Does the ISP device not have bridge / modem only mode ?
ALSO - make sure you are assigning to the DMZ the WAN PORT mac of the router and not its LAN mac
- Copy Link
- Report Inappropriate Content
Ok,
I have solved the advanced DMZ connectivity and have both the ER706W and old Deco M4 working alongside each other. The M4 is now just getting a 192.168.2.X and the ER706W is getting the Public Address. All good.
Now how do I add the EAP650 to the ER706W as a wired backhaul AP so that it participates in the 3 Wireless networks I have created? The EAP650 is plugges into port 6 fo the ER706W and has a local IP. I can access it but it is broacasting the default SSIDs. How do I get it to participate in the 3 SSIDS configured in the ER706W?
- Copy Link
- Report Inappropriate Content
There are tons of self-help guides on the forum and official website, FAQs.
https://community.tp-link.com/en/business/forum/794?tagId=638&labelIds=8760
If you forget to read them and are still interested, you can revisit them.
About your description in Advanced DMZ, I am not sure I understand this term. It is DMZ, right?
It's similar to Port Forwarding. You gotta be triggered before you see the device is exposed to the public Internet.
And your first issue described seems to be a problem with the network diagram where things go wrong. You might wanna create a diagram and show it so people can give suggestions on what a proper network should look like.
EAP mesh is not Deco mesh. These are totally different concepts. In our Omada series, mesh only means wireless bridging without a wired connection. Well, you connect the AP to the router; that's not meshing in our concept. Fast Roaming should be enabled in Controller mode, as I recall.
How to Configure your Omada EAP into a Mesh Network Using the Omada App
Troubleshooting guide of Omada AP Mesh network
Can Deco Mesh, OneMesh, EasyMesh and Omada Mesh products work together?
- Copy Link
- Report Inappropriate Content
Thanks for the reply.
The advanced DMZ is the only easy way to put a router behind the Home Hub Bell Aliant provides as part of their Fibre to the Home Service. Essentially you tie a mac address to the Advanced DMZ and it gets a public IP address.
Through some other forum posts it appears that Bell ALiant does some questionable magic with this resulting in a subnet mask that does not align with the gateway IP. As in it is out of the range of the subnet.
I don't know why my crap Deco M4 can deal with it but knowing this, I am going to put the ER706 back in place to validate. Actually, what I did was create a 4 port vlan on the LAN and put that between the Home Hub and the M4 so I can also add in the Omada to troubleshoot without having to dump my exisiting connectivity.
If it get crazy, maybe I will pull the SFP out of the Home Hub and see if I can bypass it all together. (Found others who have done it). My only problem is that I have TV and phone, which then involves some more VLAN's and other adavanced settings to get it to work.
- Copy Link
- Report Inappropriate Content
For the wireless.
Maybe I have the terms wrong. My Decos are connceted to each ohter with Cat6. Essentially I want to do the same here to be able to put AP's through the house wired back to the ER706W and manage them as a single SSID.
One more thing:
When i go to the ER706W page, it appears all I see are preview firmware? Where do I find the latest stable and supported firmware?
- Copy Link
- Report Inappropriate Content
Wired backhaul access points isnt "mesh" and its just wired backhaul APs. Mesh is really the terms for APs linked to each other over WiFi with only certain "root nodes" having a wired uplink. If you can wire all of them, its far better. Having the same SSIDs broadcast by multiple APs isnt an issue and is a totally standard function.
As for the advanced DMZ, when you put the new router behind the ISP one with DMZ enabled, what IP and subnet does the router get, and what is the gateway IP it gets ? does it also get a DNS server or are you manually setting those. Is it possible it also needs a vlan tag for the ISP ?
If it gets a subnet mask that is outside the scope of the gateway IP the ISP gives it, im fairly sure the router just wont get any WAN as by design - on all brands and by the spec, gateway IPs SHOULD be inside the scope of the mask.
Does the ISP device not have bridge / modem only mode ?
ALSO - make sure you are assigning to the DMZ the WAN PORT mac of the router and not its LAN mac
- Copy Link
- Report Inappropriate Content
Ok,
I have solved the advanced DMZ connectivity and have both the ER706W and old Deco M4 working alongside each other. The M4 is now just getting a 192.168.2.X and the ER706W is getting the Public Address. All good.
Now how do I add the EAP650 to the ER706W as a wired backhaul AP so that it participates in the 3 Wireless networks I have created? The EAP650 is plugges into port 6 fo the ER706W and has a local IP. I can access it but it is broacasting the default SSIDs. How do I get it to participate in the 3 SSIDS configured in the ER706W?
- Copy Link
- Report Inappropriate Content
If you dont have a controller on the network (OC200/300/Software) you will need to log in to the EAP and create the same SSIDs and give them the correct 802.11q vlan tags and the same passwords / WPA settings as you set on the router
- Copy Link
- Report Inappropriate Content
@GRL I added the Software controller and after a bunch of fumbling, I reset the ER706W and started new.
Now I have the environment doing what is intended as both are now operating a single entity.
I appreciate your responses as they have helped me cancel the Amazon Return on this and get it to do what I wanted it to do. If you don't mind, I have one more item
I have created a Home SSID as well as a Guest and an IoT network for stuff that I have that I don't want as a possible attack vector to my network. They all work but all get IP's on the LAN. They are isolated as they are Guest networks but I would rather they all have seperate VLAN's and subnets. I can create a new VLAN but it doesn't allow me to make a subnet and DHCP. The only way it appears I can do it is to create a new LAN with an Interface. This will work for the IoT as some devices are physcial but for the Guest, do I have to burn a physical port to have a VLAN for the Guest that puts in their own subnet? Not the end of the earth to do so but if I do, I will have to trunk up from my other switch as I will be 1 port short on the ER706W. Can do it but didn't want to.
Or is the Guest speration fine that is built in to keep my guests out of the LAN.
Again, thanks for your response as it helped out alot.
Cheers,
- Copy Link
- Report Inappropriate Content
If you dont have a L2+ or L3 switch capable of switch routing, you have to make the vlans as interfaces. This is perfectly normal.
You can assign any vlan as native to a router port, or you can trunk them all to the EAP uplink (which is the default behaviour anwyay) if you are only using wifi devices and just make another ssid for them.
- Copy Link
- Report Inappropriate Content
Information
Helpful: 0
Views: 251
Replies: 8
Voters 0
No one has voted for it yet.