TP-Link ER605 Omada Gigabit VPN Gateway

A five-port gigabit VPN gateway with multi-WAN and LTE backup

The ER605 is a compact Omada VPN gateway with five gigabit ports: one dedicated WAN, two that can be set as WAN or LAN, and two LAN. Up to three WAN lines can therefore be balanced, and a USB 2.0 port accepts an LTE dongle for mobile-broadband backup.

It is built for the Omada SDN: zero-touch provisioning through the cloud-based controller, centralized monitoring and the Omada app, or standalone web management. The enclosure is a 158 x 101 x 25 mm desktop box powered by a 12 V adapter drawing at most 7.94 W.

Technical specifications

Below, the ER605 parameter list taken from the TP-Link datasheet.

Reading the numbers: NAT throughput close to 940 Mbps in each direction means the gateway can serve a gigabit internet line, but the encrypted VPN figures are far lower, such as 239.39 Mbps for IPsec ESP-SHA1-AES256 and 15.90 Mbps for OpenVPN. The tunnel counts are therefore not a throughput promise: twenty IPsec tunnels share the same encryption capacity. Plan multi-WAN load balance for web traffic and keep the site-to-site VPN load within the printed IPsec rates. With 150,000 sessions, a small office or shop is well within the limit.

VPN, routing and security features

• Up to 3 gigabit WAN ports with intelligent load balance, link backup and online detection.
• VPN: 20 LAN-to-LAN IPsec tunnels, 50 OpenVPN, 16 L2TP and 16 PPTP, plus WireGuard; can act as client to up to 10 VPN servers.
• Security: advanced firewall policies, DoS defense, IP/MAC/URL filtering, ARP inspection and access control lists.
• IPv6 address modes, IGMP v2/v3 proxy for IPTV, 802.1Q VLAN, bridge VLAN and QoS.
• 150,000 concurrent sessions and 1,800 new sessions per second.

Ordering notes and package contents

Order code ER605, hardware version 2.30 (UN) per the datasheet. The package contains the gateway, power adapter, RJ-45 Ethernet cable and quick installation guide. LTE dongle compatibility is limited to TP-Link’s published list, so check the dongle before ordering. For many tunnels or a faster uplink, the ER7206 or ER8411 are the next steps up.

Power, placement and management modes

Several features depend on mode: zero-touch provisioning needs the Omada cloud-based controller; CLI, RIP, OSPF, port triggering, URL group filtering and ARP scanning are standalone-mode only; captive-portal methods such as voucher and SMS need controller mode. Decide the management mode before commissioning. The operating range is 0 to 40 degrees C, so it should sit in an indoor cabinet away from direct heat.

Branch offices and multi-line sites

Typical uses include shops, small offices, schools and site cabins that run two broadband lines plus a 4G backup, and branch sites linked back to head office by IPsec. At the printed 940 Mbps NAT figures it suits gigabit internet lines, but IPsec throughput on this model is much lower (about 250 Mbps with AES256 and SHA256), so size VPN traffic accordingly.

Information to send with an RFQ for the TP-Link ER605 Omada Gigabit VPN Gateway

Network hardware is easier to quote correctly when the application is clear. For the TP-Link ER605 Omada Gigabit VPN Gateway, tell us how many sites or users it will serve, the WAN connections at each site (fibre, DSL, LTE or microwave) and the throughput you expect with firewall and VPN rules active, because encrypted throughput is usually well below the headline routing figure.

• Quantity, and whether spare units are needed for critical sites.
• Power arrangement: included adapter, PoE input or DC supply from a site battery.
• Optics: the SFP or SFP+ modules and fibre type, single-mode or multimode, if fibre ports will be used.
• Mounting: desk, wall, DIN rail, pole or 19-inch rack, and any enclosure needed outdoors.

If the device is replacing existing equipment, the current configuration or a short description of the network layout helps confirm that the replacement supports the same features.

Related items and documents

Pair it with the SG2008P or SG2428P PoE switches, the EAP670 access point and the OC200 controller. See the industrial communications category.

See the attached datasheet. Enquiries for ER605 go to Seven Star LLC with quantity and project location.