u/ticedoff8

Checking through the TP-Link catalog, I found the ES206X-M2.

The ES206X-M2 is almost exactly what I'm looking for, but it doesn't support SNMP & Remote Syslog. It has the VLAN support I'm looking for, five 2.5GbE ports, one SFP+ (10GbE), it's fanless, has some useful switch features and a great price-point ($44). For this use-case, I don't need PoE.

Did I miss the TP-Link switch with 4 to 6 port 2.5GbE, one SFP+, "Smart" switch with SNMP & rsyslog that might be in the same price range as the ES206X-M2?

MikroTik doesn't seem to have one and Ubiquity has the USW-Flex-2.5G-8 but it's $150

I already have two XikeStor 8 port 2.5GbE with one SFP+ (10GbE) that has the same features as the ES206X-M2. They're nice switches. But if I could find a TP-Link that is at a similar price-point and SNMP / RSyslog, I'd replace the two XikeStor and get two more for this next expansion (I'm getting rid of all the dumb switches).

I don't use an OC, and I don't plan to start. Everything is in standalone mode with LibreMNS and a Grafana stack for syslog

We want to block all clients on the LAN and all VLANs from directly accessing any external DNS servers. We really don't want anyone outside snooping on our DNS lookup history.

First: The question is how to set up the ER7206 for act as a forwarder?

I've already (I think) set up an Access Control to block all traffic from LAN -> WAN on port 53. It works, because it killed all DNS lookups on the LAN when I enabled it without setting up the rest of whatever is needed.

I started on Network > LAN > LAN DNS and selected "Forward" and then got lost on the required fields "Domain Name", "Alias Domain Name" and "DNS Server".

Should "Domain Name" be our registered domain? Or... what? (the * as an entry is invalid)

Should there be an "Alias Domain Name"? If so, what?

I "assume" the "DNS Server" would be where it's being forwarded to (Ex: quad9.net, 9.9.9.9 & 149.112.112.112 ).

Second: Should I setup DNS Proxy on the ER7206? In the Services > DNS Proxy > DOH, the predefined profile "quad9_2" is currently the only one enabled. I believe this "should" send all of the router's DNS quires to Quad9 using "DNS Over HTTPS". I "assumed" that this would also encrypt the forwarded DNS traffic (if I can get it to work) from the LAN DNS servers using the router as a forwarder.

Or, am I misunderstanding what this "DNS Proxy" is really used for?

Third: We don't want to try some other alternative to the ER7206, unless we know the ER7206 can't do what we think we need.

We have 3 MS 2019 Servers set up as redundant DNS servers for the internal LAN and they have their "forwarders" property set to the IP address of the ER7206's LAN interface (it resolves to the FQDN of the router). Right now, we needed to add a 2nd "forwarders" property (9.9.9.9) to keep DNS running. Without the 2nd "forwarders" property, all client DNS falls flat.

Note: We have not tried to enable / set up DNS Encryption on the 3 MS Servers "for reasons".

We run a split DNS with a registered DNS domain. The LAN DNS servers resolve all the clients internally and then resolve out to an services we host that are outside. The "outside" DNS is Dynu.com and there are only 3 outside services that resolve on that DNS server.

I want to setup a 5 to 8 camera system around the outside of my house. I'm looking for IR / Night Vision, and the typical "features" that come with a commercial system for the NVR (alerts, preview, remote access).

Our area is infested with skunks, raccoons and opossums and I've been using trail cams to track them (we don't let the dogs out when the skunk-squad comes around), but they are not real-time of have alerts. I'd like to be able to detect the critters and send an alert in RT when they are around.

The question is: Where to start planning, buying hardware and which combination of software?

I'm posting here so that someone can say "Wrong sub moron. Go to r/ somethingelse and start there". Or.. "Here's a recipe that should get you started".

I assume that Home Assistant and Frigate are the right starting points for SW. But, what add-ons would be needed?

The server hardware recommended on the Frigate site is either out of stock or too expensive, so I think I'm going to start with something weaker, then scale up as I get more familiar. I have a Minisforum TH80 that I could start with (11th Gen Core i7-11800H Processor, 2.5Gbps RJ45, WiFi, 16GB RAM).

I found some cameras that look like they'd be a good start (ClareVision CLR-V200-4B28W). According to the cctv-database, they have integration with Frigate, color night vision and 2560x1440 @ 30 fps (H.265+). But, to get the H.265, Frigate needs some HW acceleration, and I don't know if any of the ones on the Frigate recommended HW list would be supported by the Minisforum TH80.

All the networking is in place (2.5Gbps 8-port PoE switch, 25TB NAS, WiFi 6, etc, etc).

I plan to have a CCTV VLAN that is isolated from the 'Net. The RJ45 port of the TH80 would be connected to the CCTV VLAN. and the WiFi would be connected to the Management VLAN. That should should keep the cameras safe.

I use Rocky Linux on most of my systems. Assuming it's supported, I'll start with that on the TH80. If Frigate and Home Assistant can run on the same server, that'd be great. But, I can run docker on the TH80 if that's better (I already have 3 Apple "Late-2018" Mac Minis as docker hosts running Rocky Linux now, but they are for low performance containers)

Roast away. (Or thanks)

I'm tired of buying no-name power bricks off Amazon or eBay that have the correct specs for a PR4100 replacement that cannot deliver what their "ratings" say they are spec'ed at.

Their outputs are noisy and the voltage output drops as the load goes up. Then, they get hot and I don't know how this is affecting the PR4100 internal MOSFET and voltage conversions.

So, where can I get real, "certified" WD power bricks for the PR4100?

WD sent me a list of "affiliates" that include Best Buy, Office Max, PC Mall, Sam's Club (really?), Staples, Walmart, Target (wtf?) and Amazon. Obviously, none of those are going to have real WD replacement power bricks for the PR4100.

I run 2 power bricks per PR4100. One is connected to the APC UPS battery backup output and the other to the UPS's protected outlets.

In the ER7206, there is URL Filtering (Firewall > URL Filtering) that will accept a TXT file of URLs.

If I download a Blacklist file from a reputable site that can be used in routers instead of in a PC's host file, would that work in the ER7206 to block the URLs listed on all the LAN clients?

TL-ER7206 Firewall > URL Filtering

My "best practice" has been to use the same SSID name on both 2.4GHz and 5GHz, each with the same setting on both and then use the band steering to prioritize 5GHz. It's worked great for as long as I can remember.

This my first WiFi 7 enabled AP with MLO

I already have a Guest Network setup that uses both 2.4GHz & 5GHZ named "SSID-GST".

When I try to set up an MLO SSID, it complains that "SSID-GST already exists"

My assumption is that I need to delete the existing 2.4GHz "SSID-GST" and "SSID-GST" 5GHz and then create a new "SSID-GST" MLO (checking both 2.4GHz & 5GHz).

My question is basically: Will band steering still prioritize 5GHz for non-WiFi 7 clients that support 5GHz?

My dK workstation is an Alienware Aurora R8 running Windows 11 with 32GB RAM, nVME SSDs and an NVidia RTX 2070 graphics card.

The instructions to configure the NVidia card as the GPU seem pretty straight forward, but there seems to be "gaps" in the procedure.

Anyway, after going through it, the system is still failing the GPU AI compatibility check.

The <Help> button takes you to the recommended steps, but there is a special cut-out for NVidia.

NVidia RTX 2070 software download and install

These are basically good instructions, but there were some issues with installing the CUDA Tool kit and the cuDNN Library.

On the NVidia web site, there are prerequisites for the CUDA Toolkit needed to have drivers installed before installing the Toolkit. But the NVidia Studio app for my gaming downloaded the latest drivers already. Are there two different sets of drivers and do I need to install drivers specific to the CUDA Toolkit? I don't want to break what I have already.

Next was the cuDNN Library. When I went to download it, there was no X86 version for Windows 11, only for arm64 Windows 11. I downloaded and installed the arm64 cuDNN library and expected it to fail installing due to it not being compatible with x86. But it installed. So, if it installed the arm64 but they don't work, is there an x86 version I should be looking for?

It's a confusing title, but I hope it will be pretty basic. (BTW: There is no OC, it is all standalone).

First, everything is working as I expected. Except one thing that has me puzzled. - A laptop hardwired into the same tagged VLAN on a different switch cannot see / ping any of the WiFi clients even though they are on the same tagged VLAN, but it can discover the Default GW (and its 3 services) and itself.

The EAP620HD, shows 6 clients on SSID-2a and 3 clients on SSID-2b. But an nmap scan on the laptop only lists 10.10.13.1 and itself (10.10.13.9). However, from my SNMP server, it shows all 9 client's MAC and IP addresses on VLAN 13 (as reported by the ER7206).

[Update] From a laptop that joined SSID-2b, nmap shows 9 clients plus the Def-GW (one of the clients is itself and the other 8 clients are things washing machine, dryer, leak detectors, dishwasher - etc). But the other laptop that's on the wired port of the same tagged VLAN does not show up and the namp traceroute cannot find it.

If you stop here, you miss the details. But I think the laptop should be finding the other 9 clients connected through WiFi that are on the same VLAN.

The EAP620HD has 6 SSID:

• SSID-1, 2.5Ghz & 5Ghz, untagged, VLAN 1, Guest Network = Disabled
• SSID-2a, 2.5Ghz, tagged VLAN 13, Guest Network = Disabled
• SSID-2b, 5Ghz, tagged, VLAN 13, Guest Network = Disabled
• SSID-3, 2.5Ghz & 5Ghz, tagged, VLAN 12, Guest Network = Enabled

Connections between the switches:

• The EAP620HD is connected to an SG3210XHP-M2 and has the 1 untagged and 2 tagged VLAN configured,
• Connected to a MikroTik CSS326-24g-2s-01 has the 1 untagged and 2 tagged VLAN configured,
• Connected to a ER7206 with the 1 untagged and 2 tagged VLAN configured, and is acting as the DHCP server and Def-GW for VLAN12 & VLAN13,
• Connected to a small desktop "smart switch" that has the untagged VLAN and tagged the tagged VLAN 13 configured.
  • It has with a 10GbE uplink to the MikroTik,
• Laptop is Windows 10 with a RealTek 5GbE USB attached NIC connected to a port on the desktop smart switch.
  • It's been configured with the PVID (native) on VLAN1 and 1 tagged "RealTek Virtual Adapter" using VLAN 13
  • The laptop's native NIC is set to DHCP from the Windows server and the tagged VLAN NIC is set to static (10.10.13.9, 255.255.255.0, -.-.-.-).

I figure that all the switches and connections are okay, because nmap finds the Def-GW during the scan (10.10.13.1 and 2 hops away).

It's almost like the EAP620HD is blocking the wired clients from discovering the WiFi clients.

I know this is a long shot, and I know this router is EOL and long out of support, but I'd like to know if this is a simple problem or it's the end of the road. It's a $30 router on fleeBay, and there are better ones out there for less then $100, so I won't be to sorry to see if go, but I'd like to know if I'm missing a step someplace in the setup (like a "Save" button).

This is a BR200 Insight Managed Business Router with the latest and last firmware installed.

Every time it is rebooted or power cycled, it comes back in the factory default setup (admin password is "password" and IP set to 192.168.1.1) and all the settings are at their defaults.

I will log in, set the new PW, change the IP, add two VLAN (with the router for DHCP) and everything is back to "normal". Traffic is flowing, the WiFi VLAN clients are logging in through the WiFi AP's VLAN - it all looks good.

But, it's waiting for a reboot or power cycle to to take a dump again.

I can save the config. But then try to restore that saved config, it reboots itself as part of the process and it comes back as factory default.

I checked the reset button (in case it's stuck "closed") and that checks out okay and there is no CMOS / RTC battery on the PCB (I was hoping there was one, but nope). The LED pattern does not look like they do when it is doing an actual Factory Reset (either through the GUI or with the reset button), so I suspect a bad NVRAM.

I don't expect too much from the sub, but I thought I'd through it out there to see if anyone has a suggestion (besides "retire" it to the landfill).

This would be our 1st time trying to install OpenWrt, and I have a couple of questions.

Our confusion is mainly around the two OpenWrt installation options. When the titles are "OEM easy installation" and "OEM installation using the TFTP method", it makes it seem like flashing the firmware isn't needed.

Could we install & run OpenWrt on the EAP-683 without replacing the TP-Link firmware?

Or, do we have to flash the firmware first?

"Supported Since Commit" tells us that flashing via OEM firmware is not supported, and we would have to use the bootloader. Reading through the links that are listed on the device's page, flashing the firmware seems to be non-trivial.

It's clear the device page needs updating, but it's tough to tell the difference between the sections that might be place-holders and the ones that are needed to succeed.

I had 4 NetGear WAC720 access points arranged around the house, and using their built-in NetGear Ensemble feature, they were all working together to provide a (more or less) seamless experience for the WiFi 2.5GHz & 5GHz clients as the moved around the property. They are long ago EOL'ed, limited in range (per unit) and missing some security features and they need to be retired.

The replacement looks like it could be based on devices that support Easymesh.

I don't think I need WiFi 7 and I don't need 10Gbps speeds.

But, I do need to be able to have a "base" SSID that resides on an untagged VLAN1 and at least 4 SSID residing on 4 different tagged VLANs with the "Guest" supporting client separation, support for PoE, 2.5GbE ports and ceiling mounts.

I've read about Easymesh, but the manufacturer's device specs that I've found don't seem to include details about support for tagged VLANS.

Is that because Esaymesh doesn't support tagged VLANs? Or is it more of a lack of the manufacturer's support?

I don't want a central management controller (A/K/A: Omada Controller), unless that controller is embedded in the device and allows me to manage them all through 1 Web UI (like the WAC720 in Ensemble did)

I have an EAP610 & an EAP620 and want to create a "mesh" using them. I have one in the front of the house and one in the back. There is some overlap in signal strength, so they should be aware of each other.

They are in standalone mode (as is every device on my little network) and no OC200, OC SW version or a phone app.

EAP610 (EAP610, HW 3.0, FW: 1.6.0 Build 20250507 Rel. 66340(5553))

EAP620 (EAP620 HD, HW: 3.0 FW: 1.6.7 Build 20260507 Rel. 10954(5553))

If it matters, they are connected to a SG3210XHP-M2 v3.6 running the latest FW with a 10GbE uplink.

I have them online right now, and (other than the IP addresses) have the same configuration with 2 SSID (SSID-A & SSID-B) with all the settings for each SSID being the same.

I can't find anything in either Web UI that has the word "Mesh" in the menu. The AI answer is that I need the phone app to do this.

1- Is this even possible using two different models? If so, can anyone point me in the right direction?

2- Do I need the app for this? A: Will the app "adopt" the two EAP and reset them to factory defaults? B: Is the app as bad as the OC200 in that it randomly makes things worse?

3- Is TP-Link so advanced that I don't even have to do anything except set the two EAPs up exactly the same, and now they are meshing? - I don't think this is the case, because there has to be a "master" so configuration changes would propagate to all other EAPs without having to manually make changes across the whole fleet.

I have a small home network with TP-Link / Omada, MikroTik & Netgear. Everything is in (for want of a better term) "stand-alone mode". The complexity is that all the devices have been configured from their web UI in the sapn of several years and the closest thing I have to a "central controller" is embedded in the NetGear WAC720 EAP ("ensemble mode").

I have an OC200 in the box, waiting for me to "do something" with it.

The concern is that when the TP-Link devices get "discovered" and added to the OC200, they will lose their configuration and revert to a factory default or (at least) some of their configurations will be lost by the OC200. Then I have hours of work to try to recreate the setup while also learning how to use the OC200's UI.

• There are 2 "secure" VLAN and the default LAN.
• The ER7206 has:
  • 2 ISP connected in a load balancing / redundant configuration.
  • Plus it is acting as the DHCP / DNS server for the 2 secure VLANS.
  • It has ACL & policy based routing defined. It is updating my DynuDNS addresses, it is using the encrypted Quad9 forwarders, etc, etc, etc.
  • It's kind of important.
• DHCP and DNS are disabled on all the router devices and switches
  • DHCP/DNS/AD is hosted on a pair of Windows Server 2019 with redundancy configured.
• Every network device and all servers are up to date on their FW / SW versions.

The WAN gateway is a ER7206, connected via RJ45 to one port of a MikroTik CSS2326 SwOS switch. There is a MikroTik CRS305 RouterOS that is (basically) acting as a 10GbE hub from various rooms and the Wi-Fi router (TL-SG3210) with (currently) 3 NetGear WAC720 EAP (I have some old EAP610 that I got in a trade that I'll use to replace the WAC720 when the dust settles).

It seems like everyone is posting YT videos for the last 4 or 5 years about how easy it is to setup a homogeneous TP-Link network using 1 router, 2 switches and a couple EAPs.

But, I can't find anything about adding an OC200 (or even the Windows version of the controller) to an existing heterogeneous environment that is up and running with "unconventional" settings in the various devices - especially the ER7206 (IP Groups with IP addresses and devices, ACLs for the VLAN security, Policy Based routing for email & other stuff).

Anyone have some real-world experience doing this?

Thx

My TL-ER7206 is logging failed attempts from seemingly random IP addresses to my OpenVPN. Is this typical of every VPN router in the 'net?

I have two ISPs connected (Frontier & Spectrum) and each has their own OpenVPN profile set up (Spectrum_VPN & Frontier_VPN). These failed attempts are coming in on both ISPs.

There are only 2 VPN user accounts for both VPNs. These are accounts that I use when I'm traveling, and I'm not traveling, so I know it's not me.

And I don't know the significance of the word [OMADA] in the log string.

Should I be worried about this?

2026-06-24 14:21:24.978 info 2026-06-24 14:21:24 openvpn<5>: 55: OpenVPN(Spectrum_VPN) TLS handshake failed.
2026-06-24 14:21:24.972 info 2026-06-24 14:21:24 openvpn<5>: 55: OpenVPN(Spectrum_VPN) TLS key negotiation timeout.
2026-06-24 14:20:24.128 info 2026-06-24 14:20:24 openvpn<6>: [OMADA][AF_INET]198.235.24.41:5468355: OpenVPN(Spectrum_VPN) TLS: Initial packet from [AF_INET]198.235.24.41:54683
2026-06-24 14:01:22.737 info 2026-06-24 14:01:22 openvpn<5>: 55: OpenVPN(Frontier_VPN) TLS handshake failed.
2026-06-24 14:01:22.730 info 2026-06-24 14:01:22 openvpn<5>: 55: OpenVPN(Frontier_VPN) TLS key negotiation timeout.
2026-06-24 14:00:22.110 info 2026-06-24 14:00:22 openvpn<6>: [OMADA][AF_INET]185.200.116.35:5747855: OpenVPN(Frontier_VPN) TLS: Initial packet from [AF_INET]185.200.116.35:57478

When Google Takeout for Photos is downloaded, there is a jpg file and a matching json file.

Can dK use the json metadata files for anything? If so, what options should be used when I create a new Collection with the files?

There are 78GB of jpg with 100k files to add.

My WAC720 AP changes back to time-b.netgear.com (54.245.96.218) even after setting a valid NTP server.

I've changed the hostname / IP Address field in the Configuration / Time page several times to different valid NTP servers and each time, the log file shows a valid sync and resolves IP address and hostnames.

I use a remote syslog server, and the SNTP service shows the current NTP server that is being user, so it's easy for me to see when it flips.

I've even entered a bogus IP address, and the log show an error message that no valid sync data was received.

I've used my internal MS server 2019 hosts (2) that are configured as NTP servers, and the IP addresses of nist.org servers. They will resolve and the log will show the sync up every 3600 seconds for 2 or 3 times, then with no error displayed in the log file, it changes back to time-b.netgear.com.

Also, the setting in the WAC720 does not show that it flipped back to NetGear, it will always show the IP or hostname I entered.

These are old and there are no FW updates (current / last 3.9.1.13), so I assume there will never be a fix for this.

Is this a way for NetGear to log how many WAC720 are still alive and running in the wild?

I could try blocking their time server at my FW, just to see if it sticks to the NTP server I set it to.

Is there a plug-in that would allow me to bulk download all the pix in my Google Photos folders?

I haven't tried anything yet with jD, so it could be easy. But I don't anticipate it will be.

I'm trying to get away from all things Google.

I new to SwitchOS, and need some help configuring it to allow both "tagged" and "untagged" VLANs on the same ports.

When "appending" a new VLAN on the "VLANs" tab, does a VLAN that will be "tagged" need "Port isolation", "Learning" and "IGMP Snooping" enabled? There are 2 ports that will need to be on this new tagged VLAN12 and the original untagged VLAN1

Then on the "VLAN" tab, each port has a pull-down for "Disabled", "Optional" (all ports are currently set to "Optional"), "Enabled" and "Strict" (no clue about these), a 2nd pull-down for "VLAN Receiver (I assume that should be "Any"), the "Default VLAN ID" should be 1 (??) and "Force VLAN ID" (unchecked??)

I'm assuming that the port that connects to the AP's switch should be "Access" and the one connected to the FW/Router would be trunk - or maybe not.

Details:

I am creating a private VLAN for a "Guest" WiFi with VLAN 1 as the "untagged" system VLAN and VLAN 12 the "tagged" network.

• There are two NetGear WAC720s. There is a SSID (blackhole) on VLAN 1 (this is private traffic to anything on the LAN and access to the Internet) and a new SSID (ghost) on VLAN 12 (For IoT and guests with access only to the Internet). The APs are connected to ports 1 & 2 on a TL-SG3210XHP running TP-Link's standard firmware.
• The SG3210XHP (port #9 (SFP+)) is connected to a MikroTik CSS326-24G-2S V2 (SFP1 (SFP+)) running SwitchOS.
• The CSS326 (Port 1 (RJ45)) is connected a TL-ER7206 FW/NAT (Port 3 (RJ45))

I think I need Ports 1 and 9 on the SG3210XHP to use VLAN1 as the default (untagged) and VLAN12 as the tagged.

I don't think I have any way to test it right now, but I think I've got the 2 APs and the TL-SG3210 configured. The ER7206 should also be straight forward (using IPGroups).

As simple as SwitchOS seems, it reminds me of the old Cisco routers I was using back in the late '90s.

Thx.

Was driving today with the e-Pedal engaged (as always) and approaching a stop sign. The e-Pedal was doing it's job, but I added a little brake pedal to get it stopped before the sign. And as we went over a bump in the road, it felt & sounded like the ABS kicked in and the dashboard lit up with warnings. I could feel the ABS and had to get on the brake pedal a little harder to get it stopped in time.

Warning when trying to engage e-Pedal

Power cycling the car didn't help.

Already showing the VDC is offline

It's a 2018 S with 71k miles. I checked the car's dashboard settings for VDS, Emergency Brake, Active Trace Control (??) and they are all still enabled.

I couldn't find anything in the owner's manual about this:

https://preview.redd.it/oek3br7jz46h1.jpg?width=5712&format=pjpg&auto=webp&s=7d666a820602aac6cc70cce14b75f97d8c173b66

The icon in the dead-center of the dash (looks like 2 cars nose-to-tail) isn't normally on.

This happened close to the dealer I bought it from and dropped by. They couldn't look at it, because their EV Specialist died (again). Or has family issues. Whatever, the Service Department said there was nothing they could do. They said I should take to the dealer that is 40mi away (not the one that is 30mi away). They couldn't tell me if I could drive it there or tow it - because their EV Guy died (or had family issues).

I haven't plugged in LEAFSpy Pro yet. I suspect that it can't really get into the car's computers to diagnose the VDS / ABS or CC systems. But, I'll update this if it shows something.

So, how screwed am I?

I'm not sure this is the right place to start this, but...

I want to create a WiFi Guest VLAN. I understand the concepts, but I getting wrapped around the axle on the details.

I have NetGrear WAC720 APs and they will support multiple SSID and have them assigned to different VLANs. I also have MikroTik & TP-Link smart switches so I can configure VLANs to match. I also have a TP-Link TL-ER7206 FW/Router that supports VLANs.

My question really deals with setting the DHCP and DNS server requirements for the VLAN and setting up router ACLs that blocks all Guest IP traffic from the secure Home network and send all the data to the WAN. The TL-ER7206 doesn't seem to have the options to get this part defined or able to be configured.

I have redundant MS Windows 2019 servers with fail-over DNS & DHCP that are on the Home network. I can easily add a new DHCP scope to the 2019 servers, but I can't see anything in them that could respond to a DHCP Relay request (even if the switches supported it).

None of the AP, switches or the router have the options to do DHCP Relay (that I can find).

I may be over thinking this and it's really much easier than I'm thinking.

One "solution" may be to add an dedicated router that on the LAN side of the TL-ER7206 and running RouterOS. I have a spare CSS305-1G-4S that can dual boot into RouterOS that I think could do part of the job.