@DanFMT 
OK, so you're trying to use the layer 3 features of your switch, as a minirouter? For dividing up a network like that you should probably just use VLANs. TP-Link has a fairly long example article on setting up that kind of network, "Divide the Network and Ensure BYOD Security with Omada SDN Solution" that you could read through for terminology and example ideas. But more simply check out this related post "Configuring a Layer 3 Switch in Omada SDN" and how they solved it, which is basically what you want to do. I don't use the L3 switching features myself outside a few high speed niches, at smaller scale I prefer to just push it all through a dedicated router of my own, and just have any ISP links (be it a modem/direct GPON/satellite/wisp) be pure bridges that plug into that. More powerful features that way as well. So another option albeit one that costs money would be to get a basic dedicated router, keep the switching layer 2, and cut your ISP out of the equation entirely putting the modem into bridge mode. Good luck.

  @sonaric 

Yes, trying to use the layer 3 features, and the more I work on it, the more I think that I should have simply gotten a L2 switch and installed a dedicated firewall (thinking of pfSense) then bridged the ISPs modem/router/AP box.

The point I am at is I have 2 VLANs:

VLAN 1 : 192.168.1.0/24 (DHCP via modem)
VLAN 2 : 192.168.2.0/24 (DHCP via switch)

Ports assigned to VLAN 1 work fine, ports assigned to VLAN 2 get a IP lease but no internet access (i.e. cannot ping or reach anything from the modem onwards).

Now I'm not doing this via an Omada controller, I'm doing this directly from the switch. I'll check the documentation you shared and try Omada controller.

Seems like this L3 switch is going to be used just like a cheapo switch, with only one VLAN able to access the internet, which basically defeats the purpose of multiple VLANs.



 

  @DanFMT 

I use OPNsense myself, which predates my experiments with Omada. I'd definitely suggest that or VyOS over pfSense when it comes to x86 based dedicated routers. Of course TP-Link themselves have 3 levels of native router too which blend into the overall system. Depending on your needs and what you already have they may be plenty and offer decent value bang for the buck, $60 isn't much as an entry price to play with. Not as powerful and you're somewhat more tied in then an open source router, but on the other hand you get the full single pane of glass.

Anyway it definitely can work and Omada Switches/WAPs have performed fine for me overall with dozens of VLANs as advertised. As you say you are missing out a bit if you're not really able to leverage all the separation on offer, PPSK in the WAPs also works very nicely to segregate and control IOT stuff.

Thank you both for the input.

In this case, I guess I should be fine if I get something like the ER605 to start with? 

If yes, then do you recommend / do I need to bridge the ISPs modem/router or is it not necessary?

  @DanFMT 

Yes, ER605 will be plenty fine to get started with. Make sure you get the current v2 version, it's the same price as the old but has a few upgrades. You can easily upgrade down the road if you need more power, for the price it's a good way to start working with it. I would suggest using the controller, it'll make it a lot easier to keep everything straight as you get multiple devices. Runs fine in a VM which is how I do it, or there are a few standalones. They also now make an AIO (router+switch+controller) called the ER7212PC, though if you already have a switch I don't think it's a good value. If you don't already have an Omada WAP for WiFi, I'd suggest that as well since it'll again make it easier to manage and also to take full advantage of all the features available for splitting clients amongst various VLANs etc.

| If yes, then do you recommend / do I need to bridge the ISPs modem/router or is it not necessary?

It's always a good idea when possible to just have a single layer of routing/NAT, double NAT is a pain. So yes, once you get the ER605, switch the ISP CPE to bridge mode so that it's acting as a pure modem/gateway and that's it. Have the ER take care of all the routing functions, DHCP etc.

Also to be clear, here I'm assuming that you really do have a "modem" or CPE translator, so cable/DSL/or the like. If you get a clean ethernet connection from the ISP and their "modem" gateway is just acting as a router/switch/WiFi AIO, then you probably don't need it at all and can connect the ER directly.

  @sonaric, thanks for the information. 

Not sure about the modem or how to check. I have an ONT device for fiber, which goes into a Technicolor modem/AIO device.

  @KJK, unfortunately does not support static routing. The only things you can do is Port Forwarding and Firewall rules. No VLAN or Routing options.