TP-Link SafeStream TL-ER6020 Gigabit Broadband Desktop/Rackmount VPN Router, 940M NAT throughput, 40k Concurrent Sessions, 64 IPSec VPN Tunnels, VLAN, Multi-NAT, 4 WAN Load Balance or auto failover

Note: for some reason this review (originally for just the TL-ER6020) shows up against both the TL-ER6020 and the TL-ER604W. I have therefore updated it (April 2017) to cover both products:TL-ER6020:I had been using the TP-Link R600VPN router to provide secure remote access via client/server PPTP VPN into my home/small-business network and have been very satisfied with it. I was forced to look for another router because our dear friends at the fruit-named company killed PPTP support in iOS10, leaving me unable to connect to my home network from an iPad (although Windows still supports PPTP). The TL-ER6020 was advertised as supporting L2TP VPN in client/server mode as well as PPTP. As an enterprise-grade product, the TL-ER6020 far exceeds my requirements. (I certainly can’t afford a second Internet provider to use the second WAN port, and I doubt if my provider will be delivering gigabit speeds to my building any time soon.) However, the 13-inch unit is an acceptable size physically and has the advantage of not having a separate power supply to add to the clutter under my equipment cabinet. (The mains power plugs directly into the unit.) I found the set-up process for L2TP OK because I was already familiar with the R600VPN router and had made a 13-step checklist, with screenshots, when I did that. The only tricky step with the TL-ER6020 is where you have to go to the ‘IPsec’ screen and select the Enable button (but ignore everything else on that screen, which is the thing that is not very well explained) before you can configure an L2TP server. Having got the router configured, I then tested L2TP with a Windows VPN client and it worked fine. However, with iOS it failed to set up a connection. I tried changing various things, but nothing fixed the problem. I then called the TP-Link helpline (and this experience is where they earned five stars). I would be the first to find fault with a vendor’s offshore helpdesk but these guys are definitely the ‘A’ team. They understood the problem. They called me back at the time they said they would. They emailed me a link to a beta release of the firmware that fixes the iOS incompatibility. And they called me back the next day to make sure it had worked. Every part of this experience was a pleasant surprise, based on my many helpline experiences with other vendors. The router is now working well in L2TP mode with iOS devices (as well as Windows). I left an iPad playing videos via the L2TP tunnel for four hours to make sure the connection was stable and it stayed up the whole time. By the way, after I first called TP-Link I found an old iOS device that was still at iOS6.1.6 and that worked with the original firmware, so the incompatibility was introduced on the iOS side some time after iOS6. Note also: if you put the TL-ER6020 behind your main router as I did, in the main router you only need to enable port forwarding to the TL-ER6020 on ports 500 and 4500. Some websites say you need ports 1701 and 50, but you don’t: ports 500 and 4500 get the handshake going and NAT takes care of the rest.TL-ER604W:This is a lower-end but nonetheless excellent functional equivalent to the TL-ER6020, with WiFi added, and an external (rather than built-in) power supply. If the TL-ER604W had been available at the time I bought my TL-ER6020, I would probably have gone for the TL-604W because it (a) is physically smaller (8" wide versus 13"), (b) has WiFi, (c) is less expensive, and (d) is adequate for the amount of traffic I'm running through it. I bought a TL-ER604W just to try it out. It performs exactly like the TL-ER6020 and, once again, TP-Link technical support was great: they promptly sent me a beta-version update of the firmware for the TL-ER604W that addresses the issue with iOS10 L2TP handshake (see above); and they called me back when they said they would to see if it was working OK. Even if you don't need VPN support, this is a great little WiFI router for the home or small office.

I was really excited to get this router as my first "big boy" router that was separate from my wireless access points. I read the smallnetbuilder review on it and thought it seemed great. My plans were to use the VPN extensively to conceal my internet traffic while on others' networks and to be able to access my own network easily. I was encouraged by the high VPN throughput numbers I was seeing. But having received the router and tried to configure it for the past 8 hours, I can say that I need to return it. My major issue is the VPN.Despite extensive research into the proper settings, I was only able to use PPTP VPN to connect. I tried having both my android 4.1 phone connecting and my Window 7 PC. At first, my Windows 7 PC would not connect, but then it mysteriously did connect. Hmm. Then, I realized something that is really annoying. Your VPN clients have to be on a separate subnet! That's right, it won't assign your VPN clients an address that is on the same subnet is your main network. So, for example, if you want to access a network share via VPN, you can't just type \\hostname. You have to know the host's IP so that the router can route you into your own network that you just VPN'd into. Ridiculous! There's someone else complaining about this on TP Link's forum.Edit 1/25:I tried a few more things to get this working. To do this, I set up a small private network with one router that had the ER-6020 below it as another router. I joined the first router and tried to VPN into the ER-6020. Doing this eliminates any questions of problems with my ISP. Using this, I was able to reliably connect using PPTP and a Windows 7 laptop with the native client. However, my Android 4.1.1 phone would not connect via PPTP and I was not able to get L2TP working on any device. For L2TP I kept getting the 789 error indicating that there was a problem during authentication negotiations. I tried using different proposals but this did not help. One thing I realized I forgot to mention in this review previously is that you cannot have an IPsec remote host setting of 0.0.0.0 (effectively allowing a remote host from any IP) while also setting your L2TP host to this setting. This is totally ridiculous because it means that you must always know the IP for the client that is going to connect. This is a totally unrealistic assumption to make. People are complaining about this issue on the TP Link forums as well.See my comments to this review for the link to the TP Link forums.So, when it's all said and done, it was a nice 15 hours spent messing around with this router, but it's gotta go back due to:-The inability to assign VPN users to the my main subnet (this is major!)-Being unable to connect via L2TP on any device-Being unable to connect via PPTP on my android 4.1 phone-The user manual is 156 pages but they are mostly screenshots of the web management interface alongside information that is already more easily available via the interfaceI stand by my 2 star rating and say "never again" to TP Link products. I really like my two TRENDnet switches, let's see what they have in the way of VPN routers...Edit 1/27/13:OK so I have to go back on part of what I said earlier and upgrade my rating to 4 stars. I have learned the following via testing with a friend's ASUS RT-N66U router:-It seems that it is standard for routers to assign VPN users IP's from a different subnet than the local hosts use. But, one of the commenters to this review seems to think otherwise. I'm still not clear but at least it seems that this is a problem that is not solely due to TP-LINK.-My android 4.1.1 phone is not able to connect to my friend's ASUS router either! This is on a Verizon Galaxy Nexus. This is SO lame, but seems to not be the router's fault. My wife's Nexus 7 tablet (an android 4.2 device) can connect just fine to his router. I haven't tested if it can connect to the TP-Link, yet.So, yes, I thought that there were some non-standard IP assignment problems and an issue with Android devices when connecting to the ER-6020. But given this new information I have learned, I can't really blame TP-LINK as much as I thought. But, I will do some more testing when I have the opportunity and see if I can learn more.Please also check the comments for some evolution of this discussion.EDIT 1/28/2013:Well, I finally got it working pretty well. I can reliably connect over PPTP and L2TP over the internet. I am not sure what was up with PPTP, it was not working before but now it is. I am connecting via tethering on my phone so maybe that was causing some flakiness?For L2TP, I finally figured out how to make it work. I was configuring the L2TP VPN to rely on IPsec and IKE policies. Apparently, you don't have to set up policies to make L2TP over IPsec work. You just have to enable IPsec. It will still use a pre shared key to connect via IPsec. I guess you just won't know how much protection you are getting. I had to manually configure the VPN connection in windows 7 to make it work, though. It wouldn't automatically detect the settings necessary. I was able to use the set up to force windows 7 to use "strong encryption." So maybe at least the encryption is strong even if the initial negotiating of the connection may not be. From windows VPN connection settings it seems that MSCHAPv2 is being used, which I've read is not secure. I suspect it's still more secure than PPTP, though.Now this thing would be perfect if it would put me in the darn main subnet! I don't think there's a way around it!

I do not do many reviews, but felt compelled to warn any prospective purchasers. I am a tech coordinator at a medium sized school and while not a network expert I am far from a novice. I purchased two of these devices with the hope of combining our internet service. Both worked for a short time, but with a few days I had problems with the router either not distributing DHCP addresses or DHCP failing completely. At the advice of tech support (more on this later) I returned the router and ordered another. The second one displayed the same behavior. Tech support is an absolute joke. 24/7 support means that outside of M-F 9-5, you get some poor operator in China that has no knowledge or the product and while her english is better than my chinese, it is a close call. This product may work in some circumstances, but I would not bet on it, I am sending this second one back also.