I also tried something else today Im in the UK, and i found some small hosting company in brazil, found their public IP, and set that as my echo server. Same 1ms for the whole time i had that set...

@Nick-M Agreed, S/N or device MAC - both of which are unique to that device anyway, TP-Link must have a central server of macs<>keys , and if this functionality if cloud based only, cant it just...

@relvy I believe this is incorrect Port Based will lock a switch port to the vlan of the first authenticated client and set the vlan as untagged on that port, regardless of what else is downstream of...

@Dougie175 i sent you a message last night, take a look Its hard to say whats going on here, this all seems right. There could be some small details or configuration you have made somewhere...

@Schwaus Have you added all necessary IP ranges / NEtworks to the "local networks" config of the VPN?

@Dougie175 Other things to check - - Have you set any switch ACLs that might be bocking a vlan to itself? this will prevent clients in that vlan getting an IP and communicating - Same as above but...