I set up a site-to-site VPN between two TP-Link routers, following the instructions here: https://www.tp-link.com/ae/faq-380.html . The VPN is based on IPSec. Now both routers say that the IPSec security association has been established, but I still cannot send traffic from one net to the other.

enter image description here

My configuration is as follows:

Router A:

Router B:

I would like to be able to access a computer in one subnet from the other. Do I have to set up NAT, or static routes? Or do I have to enlarge the subnet mask so that the nets overlap? From the instructions I had the impression that they can be disjoint.

Since the association worked, am I right to assume that the problem must be in the internal routing, and not on the WAN side (e.g. a closed port, or an intermediate router I don't know about)?

  • Unfortunately, questions about consumer-grade devices are explicitly off-topic here. You could try to ask this question on Super User. – Ron Maupin Jul 7 '18 at 21:08
  • @RonMaupin These are rack-mounted TL-ER6120 routers. I know people tend to look down on TP-Link devices, but I wouldn't call these ones consumer-grade. Nor would I think site-to-site IPSec is a consumer topic. We are using the routers in an enterprise network. – jdm Jul 8 '18 at 10:55
  • For a device to be on topic here, the manufacturer must offer optional, paid support, and, unfortunately, TP-Link does not. From the What topics can I ask about here? page, under the and meets the following requirements caveat: "hardware that has a paid support option from the manufacturer" – Ron Maupin Jul 8 '18 at 13:25
  • Hmm... would it be OK if I removed mentions of TP-Link? I think the question applies as well to products of e.g. Cisco or Fortigate (which we also use). "What do you have to do about routing when setting up Site-to-Site VPN?". The answer becomes a bit less concrete and useful then, of course... – jdm Jul 8 '18 at 15:58
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 8:56

I don't know the exact syntax for your router, but yes, you need static routes on each for the remote subnet. The gateway is the next hop on your outgoing interface.


As the manual by you supplied there does not need to be a static route supplied manually. Have you defined the IPsec Policy in a probable way? I guess the Remote Subnet is being used to determine the route automatically.

If this is not the case you can check out here how to set up a static route for a TL-ER6120 or here for a TL-R600VPN.


Thanks for the answers, in general they are good advice. In my particular case, the culprit was the firewall rules. (I think - it was no where indicated that the default rule was deny, but after adding some rules it worked.)

In Preferences / IP Group / IP Address, I defined a "Address" for the remote subnet, and a corresponding group. Then I added firewall rules to allow traffic from that group to IPGROUP_LAN, and vice versa. Do this for each side. If you have the old GUI, you just enter the subnets directly.

You should also check if the subnet masks are really right, and if the DHCP settings are correct. Otherwise it will fail from DHCP connected clients.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.