TP-Link Omada Setup Guide: Full Configuration for Small Offices (2026)

By Richard Anderson | Cincinnati PC Repair LLC | Updated January 2026

I’ve been doing PC and network repair for 16 years, and in that time I’ve deployed a lot of network systems for small businesses — everything from consumer-grade routers duct-taped together to full enterprise stacks that cost more than a used car. Over the last three years, TP-Link’s Omada SDN platform has become my go-to recommendation for offices with 10 to 50 people, and I’ve now rolled it out in well over a dozen small office environments across Cincinnati.

Here’s what makes Omada different: it gives you centralized, enterprise-style network management — VLANs, captive portals, inter-VLAN firewall rules, band steering, seamless roaming — at a fraction of what you’d spend on Cisco Meraki or a Fortinet stack. If you’ve read my Omada vs. UniFi comparison, you know how it stacks up against the other popular SDN option. This guide is for when you’ve made the decision to go Omada and want to do it right from day one.

This is a complete TP-Link Omada setup guide — not a quick-start pamphlet. I’ll walk you through hardware selection, physical installation, controller configuration, VLAN segmentation, wireless setup, firewall rules, and monitoring. By the end, you’ll have a production-ready small office network that your staff can use reliably and your IT person (even if that’s you) can manage from anywhere.

Section 1: What You Need — Recommended Starter Kit for a 10–20 Person Office

Before touching a cable, you need the right hardware. After testing a lot of combinations across real office deployments, here’s the kit I recommend for a standard 10–20 person office with one or two floors of workspace:

Core Hardware List

Router: TP-Link ER605 V2 Gigabit VPN Router — The backbone of the network. It supports 1 dedicated WAN port, 2 configurable WAN/LAN ports, 2 LAN ports, and a USB port for 4G/LTE failover. Full Omada SDN integration, SPI firewall, up to 20 IPsec VPN tunnels, and load balancing across multiple ISP connections. This covers everything a small office needs for under $60.
Switch: TP-Link TL-SG2210P PoE+ Smart Switch — 8 gigabit PoE+ ports (802.3at/af compliant, 61 W total power budget) plus 2 SFP slots. This switch powers your access points over the Ethernet cable directly — no power adapters needed at the AP locations. Fanless design keeps the server closet quiet.
Access Points (×2): TP-Link EAP670 WiFi 6 Ceiling Mount APs — AX5400 class, with 4,804 Mbps on 5 GHz and 574 Mbps on 2.4 GHz. Supports 250+ concurrent clients per AP, covers up to 1,500 sq ft each, and has a 2.5 Gbps PoE+ uplink port. For a 10–20 person office, two of these placed strategically will blanket the space with fast, low-latency WiFi 6.
Controller: TP-Link OC200 Omada Hardware Controller — A small, always-on appliance that runs the Omada SDN controller software. No PC required to keep running. Plugs into your switch and manages up to 100 Omada devices. If you have a spare PC or server that stays on 24/7, you can run the free Omada Software Controller instead and skip the OC200.

What You’ll Also Need

Cat5e or Cat6 Ethernet cable (pre-made or bulk + crimping tool)
ISP modem/ONT with bridge mode support
Ceiling or wall mounting hardware for the EAPs (usually included)
A laptop or PC for initial configuration

Total hardware cost for this setup typically runs between $350 and $500 depending on where you buy. That’s a complete, enterprise-grade managed network. It’s one of the best values in small business IT.

Section 2: Physical Setup — Cabling, Modem Bridge Mode, and AP Placement

Step 1: Put Your ISP Modem in Bridge Mode

Most ISPs give you a combo modem/router device. If you plug the ER605 directly into it without putting the ISP device in bridge mode, you’ll end up with double NAT — two devices doing network address translation — which causes problems with VPNs, port forwarding, and general routing reliability. Log into your ISP device (usually at 192.168.1.1 or 192.168.0.1) and look for a Bridge Mode or IP Passthrough setting. Enable it so the ISP device acts as a pure modem, handing off the public IP directly to the ER605’s WAN port. Your ISP’s support line can walk you through this step if the modem admin panel isn’t clear.

Step 2: Cable the Core Network Devices

Run an Ethernet cable from the ISP modem’s LAN port to the ER605’s WAN port (Port 1). Then run a cable from any LAN port on the ER605 to an uplink port on the TL-SG2210P switch. This is your trunk link — all your VLANs will ride on it tagged. Keep this cable short and direct if the router and switch are in the same rack or cabinet.

Connect the OC200 controller to any remaining port on the TL-SG2210P. The switch will provide power to the OC200 if you’re using a PoE port; otherwise connect the OC200’s power adapter.

Step 3: Run PoE Drops to AP Locations

This is where planning pays off. For a single-floor rectangular office, I typically mount one EAP670 near the center-front of the space and one toward the center-rear, roughly 30–40 feet apart. For L-shaped or multi-room layouts, place each AP so it covers a distinct zone without too much overlap.

Run a Cat6 cable from each AP ceiling drop location back to the TL-SG2210P. Plug each cable into one of the PoE+ ports on the switch. The EAP670 draws about 22W under load, well within the 30W per-port limit and the 61W total budget for two APs. No power adapters needed at the ceiling — the PoE cable does it all.

Mount the EAPs on the ceiling using the included mounting bracket. They’re designed for standard ceiling tile T-bar mounting or drywall. The low-profile design keeps them unobtrusive.

AP Placement Tips

Avoid mounting APs in corners — they’ll waste half their signal broadcasting into walls
Keep APs at least 6 feet from large metal objects (HVAC ducts, filing cabinets)
For a two-story office, stagger the APs vertically — one above the other rarely works well
If you’re covering a conference room with glass walls, mount one AP inside it

Section 3: Omada Controller Setup — Hardware vs. Software vs. Cloud

The Omada controller is the brain of the whole system. All configuration — VLANs, SSIDs, firewall rules, monitoring — flows through it. You have three options:

Option A: OC200 Hardware Controller (Recommended)

The OC200 is a dedicated appliance that runs Omada Controller software permanently. It connects to your switch, gets an IP via DHCP, and you access it through a web browser. This is my preferred choice for small offices because it requires zero PC infrastructure and stays running even if all the office computers are off. After plugging it in, wait about two minutes for it to boot, then navigate to https://omada.tplinkcloud.com or use the Omada app to find its local IP and access the setup wizard.

Option B: Omada Software Controller

If you have a Windows PC, Linux machine, or Raspberry Pi that stays on 24/7, you can download and install the free Omada Software Controller from TP-Link’s support site. Install it, launch it, and follow the setup wizard. The catch is that the controller must be running for management functions to work — though the network itself keeps operating if the controller goes offline, you won’t be able to push configuration changes. This is a good option for offices with an always-on server or NAS.

Option C: Omada Cloud-Based Controller

TP-Link’s cloud-hosted controller requires a monthly subscription per site. For most small offices, this is overkill unless you need zero-touch provisioning across multiple locations. It does eliminate the need for any on-premise controller hardware or software.

Initial Device Adoption

Once your controller is running and accessible on the same network as your ER605, switch, and EAPs, it will automatically discover them. In the controller dashboard, go to Devices and you’ll see the router, switch, and access points listed as “Pending.” Click Adopt on each device. Adoption usually takes 1–3 minutes per device as they download their configuration from the controller.

Critical step before doing anything else: update firmware. After adoption, go to Devices, click each device, and check for firmware updates. Apply them in order: router first, then switch, then APs. Reboot each device after its update before moving on. Skipping firmware updates is the single most common cause of issues I see in new Omada deployments — features may not work as documented on older firmware versions.

Section 4: Configuring the Router (ER605) — WAN, LAN, DHCP, and Firewall

WAN Setup

In the Omada controller, go to Settings > Wired Networks > Internet. Your WAN interface (connected to the ISP modem) should appear. Most ISPs use DHCP for broadband connections — select Dynamic IP and the ER605 will pull its public IP automatically. If your ISP uses PPPoE (common with DSL or some fiber providers), select PPPoE and enter the username and password from your ISP.

If you have a backup ISP connection — even a USB 4G modem — this is the time to configure WAN2 or the USB WAN as a failover. Under the WAN settings, enable Load Balance or Failover mode and set your priority. With dual WAN and failover enabled, the office network stays up even if your primary ISP goes down.

LAN Configuration

The default LAN on the ER605 will be something like 192.168.0.1/24. I recommend changing this to a less common subnet to avoid conflicts if users VPN into corporate networks from home. A good choice is 10.10.10.1/24 for your primary corporate LAN (VLAN 10, which we’ll create shortly).

Under Settings > Wired Networks > LAN, edit the default LAN and change the IP to 10.10.10.1 with a /24 subnet mask. Enable the DHCP server and set a range of 10.10.10.100–10.10.10.200 to leave the lower addresses free for static assignments (printers, servers, NAS devices, the controller itself).

Basic Firewall Rules

The ER605’s SPI firewall is enabled by default, which gives you basic inbound protection. At this stage, leave the default rules in place. We’ll add inter-VLAN rules in Section 7 once the VLANs are built. For now, enable DoS Protection under Settings > Network Security — this blocks common flood attacks and scanning probes without any performance hit.

If any users need port forwarding (for a VoIP server, remote desktop, or similar), configure those under Settings > NAT > Port Forwarding. Always restrict forwarded ports to specific destination IPs using the ER605’s Destination IP field rather than forwarding to a broad range.

Section 5: Setting Up VLANs — Why They Matter and How to Build Them

VLANs are the single most important configuration step for any small office network, and they’re the thing most non-enterprise setups skip entirely. Without VLANs, your guest WiFi user, your office laptop, the smart TV in the conference room, and the IP cameras on the wall are all on the same network — any one of them can potentially communicate with the others. That’s both a security problem and a reliability problem.

I build three VLANs in every small office deployment:

VLAN 10 — Corporate: Employee workstations, phones, printers, NAS devices. Full local network access, internet access.
VLAN 20 — Guest: Visitor devices and personal phones. Internet access only. Isolated from all corporate resources.
VLAN 30 — IoT: Smart TVs, IP cameras, thermostats, printers with web interfaces, anything that doesn’t need to talk to employee machines. Internet access only, isolated from Corporate.

Creating VLANs in the Omada Controller

Go to Settings > Wired Networks > LAN > Networks and click Create New LAN for each VLAN.

VLAN 10 — Corporate Network:

Name: Corporate
VLAN ID: 10
Purpose: Interface
Gateway IP: 10.10.10.1
Subnet: 10.10.10.0/24
DHCP Server: Enabled, Range: 10.10.10.100–10.10.10.200
DNS: 10.10.10.1 (router handles DNS) or use 1.1.1.1 / 8.8.8.8

VLAN 20 — Guest Network:

Name: Guest
VLAN ID: 20
Purpose: Interface
Gateway IP: 10.10.20.1
Subnet: 10.10.20.0/24
DHCP Server: Enabled, Range: 10.10.20.100–10.10.20.200
DNS: 1.1.1.1 (external DNS keeps guests off internal resolver)

VLAN 30 — IoT Network:

Name: IoT
VLAN ID: 30
Purpose: Interface
Gateway IP: 10.10.30.1
Subnet: 10.10.30.0/24
DHCP Server: Enabled, Range: 10.10.30.100–10.10.30.200
DNS: 1.1.1.1

Assigning Ports on the Switch

After creating the VLANs, you assign switch ports to them. In Devices > TL-SG2210P > Ports, configure each port:

Uplink to ER605: Leave as trunk (all VLANs tagged). The controller handles this automatically.
Ports connected to APs: Also trunk ports (all VLANs tagged), so each AP can broadcast all three SSIDs.
Ports connected to employee workstations or IP phones: Set PVID to 10 (Corporate), access port.
Ports connected to IoT devices (smart TV, IP camera): Set PVID to 30 (IoT), access port.

You can also create port profiles in Settings > Wired Networks > LAN > Profiles to make applying these port assignments faster — especially useful when adding new devices later.

Section 6: Wireless Network Configuration — SSIDs, Security, Band Steering, and Guest Portal

Creating One SSID Per VLAN

Go to Settings > Wireless Networks > WLAN and create three wireless networks. Each SSID maps to a VLAN, which controls what that wireless client can access.

Corporate SSID (VLAN 10):

SSID Name: YourOffice-Corporate (or whatever you name it — keep it professional)
Security: WPA3-Personal at minimum. If you have enterprise RADIUS infrastructure, use WPA3-Enterprise. For most small offices, WPA3-Personal with a strong passphrase (16+ characters, mix of character types) is the right call.
VLAN: 10
Band Steering: Enabled — pushes dual-band capable clients to 5 GHz automatically
Fast Roaming (802.11r): Enabled — essential for VoIP phones and laptops moving between APs
Guest Network: Disabled

Guest SSID (VLAN 20):

SSID Name: YourOffice-Guest
Security: WPA3-Personal with a simple, shareable passphrase, or open with a guest portal (see below)
VLAN: 20
Guest Network: Enabled — this flag enforces client isolation, preventing guest devices from communicating with each other
Band Steering: Optional (guests don’t need the optimization)

IoT SSID (VLAN 30):

SSID Name: YourOffice-IoT (or keep it hidden — IoT devices connect once and rarely need you to find the SSID)
Security: WPA2-Personal (many IoT devices still don’t support WPA3)
VLAN: 30
Guest Network: Enabled (for client isolation)
Band: 2.4 GHz only — most IoT devices are 2.4 GHz only, and pinning the SSID to 2.4 GHz avoids band steering issues

Setting Up the Guest Portal

For the Guest SSID, I recommend using a captive portal instead of a plain WPA2 password. It looks professional, lets you display terms of service, and makes it easy to rotate access without handing out a new WiFi password.

In the controller, go to Settings > Authentication > Portal and click Create New Portal. Give it a name, select your Guest SSID, and choose an authentication type. For most small offices, Simple Password or No Authentication (click-through) works fine. Customize the portal page with your company name and logo. Under Advanced, set a session timeout (8 hours is typical for a business day) and enable Rate Limiting to cap guest bandwidth (more on this in Section 7).

Band Steering and Roaming

With two EAP670 APs covering the office, seamless roaming is important for staff who move around with laptops and phones. The Omada controller handles this through a combination of 802.11r (fast BSS transition), 802.11k (neighbor reports), and 802.11v (BSS transition management). Enable all three under Settings > Wireless Networks > Advanced Settings. This combination gives you near-seamless handoffs as clients walk between AP coverage zones — critical for uninterrupted VoIP calls and video conferences.

The EAP670’s AI Roaming feature (available on recent firmware) also helps prevent “sticky clients” — devices that cling to a distant AP instead of switching to a closer one. Enable it in the AP properties under Devices > EAP670 > Config > Radio Settings.

Section 7: Access Control and Firewall Rules — Inter-VLAN Blocking, Rate Limiting, and Content Filtering

Creating the VLANs separates the traffic logically, but without firewall rules, the ER605 will happily route traffic between them by default. You need explicit deny rules to keep VLANs isolated from each other.

Inter-VLAN Firewall Rules

Go to Settings > Network Security > ACL (or Firewall in newer firmware versions) and create the following rules. Apply them to the Gateway level so the ER605 enforces them.

Rule 1: Block Guest to Corporate

Action: Drop
Source Network: Guest (VLAN 20, 10.10.20.0/24)
Destination Network: Corporate (VLAN 10, 10.10.10.0/24)
Protocol: All
Direction: LAN In

Rule 2: Block Guest to IoT

Action: Drop
Source: Guest (VLAN 20)
Destination: IoT (VLAN 30)

Rule 3: Block IoT to Corporate

Action: Drop
Source: IoT (VLAN 30)
Destination: Corporate (VLAN 10)

Rules are processed top-down. Add these deny rules before any broader allow rules. After applying, test by connecting a device to the Guest SSID and trying to ping a Corporate network IP — it should time out.

One important exception: If you have network printers that employees and guests should both be able to reach, create a specific allow rule before the block rule that permits traffic from Guest to the printer’s static IP only. This keeps the printer accessible without opening the entire corporate subnet.

Rate Limiting for the Guest Network

Uncapped guest WiFi in a busy office will get used by visitors streaming video, which eats into everyone else’s bandwidth. In the Omada controller, create a rate limit profile under Settings > Profiles > Rate Limit:

Profile Name: Guest-Limit
Download Limit: 20 Mbps per client
Upload Limit: 10 Mbps per client

Assign this profile to the Guest SSID under its wireless network settings. This gives guests functional internet access while preventing any single device from saturating the connection.

Content Filtering Basics

The ER605 supports basic URL filtering under Settings > Network Security > URL Filtering. You can add a blocklist of domains or use keyword blocking. For more robust content filtering, point your DNS to a filtering service like Cloudflare for Teams (1.1.1.3 for malware blocking, 1.1.1.2 for malware + adult content) or configure OpenDNS on the Guest and IoT VLANs. Simply set the DNS server in those VLAN’s DHCP settings to the filtering DNS IP, and every device on that VLAN will run through the filter automatically.

For the Corporate VLAN, I typically leave DNS filtering off or use a lighter touch — employees get frustrated when legitimate sites are blocked by overly aggressive filters. Apply stricter filtering to Guest and IoT only.

Section 8: Testing and Monitoring — Verifying the Setup and Staying on Top of Network Health

Speed Test from Each VLAN

Connect a device to each SSID — Corporate, Guest, and IoT — and run a speed test using Cloudflare’s speedtest.net or fast.com. You should see:

Corporate WiFi: Near line-rate speeds (limited by your ISP connection, not the EAP670)
Guest WiFi: Speeds capped at your rate limit profile (20 Mbps down in our example)
IoT WiFi: Functional speeds — doesn’t need to be fast, just stable

If you’re not seeing expected speeds, check that the correct VLAN is assigned to the SSID and that your switch uplink is running at gigabit (check the Devices page for link speed indicators).

Client List Verification

In the Omada controller, go to Clients and review the client list. Every connected device shows its IP, MAC address, connected SSID, and which AP it’s connected to. Verify that:

Corporate devices have 10.10.10.x IPs
Guest devices have 10.10.20.x IPs
IoT devices have 10.10.30.x IPs

If a device shows up on the wrong VLAN, it either connected to the wrong SSID or the port it’s wired to has the wrong PVID configured.

Inter-VLAN Isolation Test

From a guest device (connected to Guest SSID, 10.10.20.x), open a terminal or command prompt and run:

ping 10.10.10.1

This should time out with no reply — the ER605 firewall rule is blocking Guest-to-Corporate traffic. If you get a reply, double-check that your ACL rules are saved and applied correctly and that the rule direction is set to LAN In.

Omada Insights Dashboard

The Omada controller’s Insights section is genuinely useful for ongoing monitoring. It shows:

Network Overview: Device count, active clients, total traffic, alerts
Client History: Which devices have connected, when, and to which AP
Traffic Statistics: Per-SSID and per-client bandwidth usage over time
Event Logs: Firmware updates applied, devices going offline, authentication failures

Set up email alerts under Settings > Alert Settings so you get notified if an AP goes offline or the WAN link drops. Five minutes of alert configuration saves hours of “why is the internet down?” troubleshooting calls.

Common Troubleshooting Scenarios

AP not adopting: Make sure the AP and controller are on the same subnet or that you’ve entered the controller’s IP in the AP’s management page. Try resetting the AP with the reset button (hold 5 seconds) and readopting.

Clients on the wrong VLAN: Check the SSID’s VLAN assignment in the wireless network settings. Also confirm that the switch port the AP is connected to is configured as a trunk (carrying all VLANs).

Slow WiFi on 2.4 GHz: The EAP670’s band steering should push dual-band clients to 5 GHz. If a device is stuck on 2.4 GHz, check that band steering is enabled and that the 5 GHz radio shows as active in the AP properties.

VPN connections dropping: If staff use VPN clients on the Corporate VLAN, verify that IPsec ALG and PPTP ALG are enabled on the ER605 under Settings > Network Security. Some VPN protocols need these helpers to traverse NAT properly.

Guest portal not appearing: The portal page requires the client’s DNS query to be intercepted. Make sure the Guest VLAN’s DHCP is handing out the ER605’s VLAN 20 gateway IP as the DNS server, not a hardcoded external DNS. The portal intercept only works when DNS goes through the gateway first.

Conclusion

A properly configured Omada network is genuinely impressive hardware for the price. I’ve deployed this exact stack — ER605, TL-SG2210P, two EAP670s, OC200 — in accounting offices, dental practices, real estate teams, and light manufacturing floors, and it holds up. The management interface is clean, firmware updates are regular, and when something goes wrong, the controller’s event logs almost always point you straight at the problem.

The piece most small offices skip — and the one that matters most — is the VLAN segmentation. Spending an extra hour on sections 5 through 7 is what separates a network that’s just “working” from one that’s actually secure. Don’t skip it.

If you’re deciding between Omada and UniFi for your office, check out my side-by-side comparison of the two platforms — both are solid, but they make different tradeoffs that matter depending on your situation.

Quick-Reference Setup Checklist

☐ ISP modem set to bridge mode
☐ ER605 WAN port connected to modem
☐ TL-SG2210P connected to ER605 LAN port via trunk link
☐ OC200 connected to switch and powered on
☐ EAP670 APs connected to PoE+ ports on switch, mounted at ceiling
☐ All devices adopted in Omada controller
☐ Firmware updated on all devices (router, switch, APs, controller)
☐ WAN configured (DHCP or PPPoE)
☐ LAN subnet changed to preferred IP range
☐ VLAN 10 (Corporate), VLAN 20 (Guest), VLAN 30 (IoT) created
☐ Switch ports assigned correct PVIDs / trunk profiles
☐ Three SSIDs created and mapped to correct VLANs
☐ WPA3-Personal security enabled on Corporate SSID
☐ Guest portal configured and enabled on Guest SSID
☐ IoT SSID pinned to 2.4 GHz band
☐ Band steering and fast roaming enabled on Corporate SSID
☐ Inter-VLAN firewall rules: Guest→Corporate blocked, IoT→Corporate blocked
☐ Guest rate limit profile applied (20 Mbps down / 10 Mbps up)
☐ Content filtering DNS applied to Guest and IoT VLANs
☐ Speed test verified from each VLAN
☐ Client list reviewed — all devices on correct subnets
☐ Inter-VLAN isolation test passed (ping from Guest to Corporate times out)
☐ Email alerts configured for device offline / WAN down events

Richard Anderson is the owner of Cincinnati PC Repair LLC with 16 years of experience in PC repair, networking, and small business IT. He is a contributing author at pcfixhub.com.

Related reading: Not sure between TP-Link Omada and Ubiquiti UniFi for your business? Read our detailed TP-Link Omada vs UniFi comparison to make the right choice before setting things up.