To correctly configure multiple upstream routers, you must establish a clear hierarchy where the OPNSense device acts as the primary gateway handling routing, DHCP, and firewall rules, while the TP-Link router operates strictly in Access Point mode to extend wireless coverage without creating a separate subnet or NAT layer. This setup prevents double NAT issues, ensures seamless client roaming, and maintains proper port forwarding functionality across your entire local area network.
Network Topology Overview
Before diving into configuration steps, it is crucial to understand the physical and logical flow of data in this specific topology. Your network consists of an internet source connected to a modem, which feeds into the WAN port of your OPNSense router. The LAN ports of the OPNSense connect to a Layer 2 managed switch, which serves as the backbone for all wired clients and provides connectivity to the secondary TP-Link router. Finally, the TP-Link connects to various LAN clients, including desktops, laptops, and IoT devices.
The most common mistake users make in this scenario is configuring both routers to perform Network Address Translation (NAT). If both devices attempt to translate private IP addresses to public ones, you create a "double NAT" environment. This breaks applications that rely on direct inbound connections, such as gaming consoles, VoIP phones, and web servers. By designating OPNSense as the sole router and the TP-Link as a simple bridge or access point, you eliminate these complications and ensure that every device on the network appears to be on the same subnet from the perspective of the main gateway.
Configuring the OPNSense Primary Router
The foundation of your network stability lies in the correct configuration of the OPNSense appliance. First, verify that the WAN interface is receiving a valid public IP address from your ISP via the modem. If you are experiencing issues obtaining a public IP, refer to our guide on
Pfsense Router: Unable to Obtain Public IP Address for Website Hosting, as the troubleshooting steps are largely identical for OPNSense due to their shared lineage.
Next, configure the LAN interface with a static IP address that will serve as the default gateway for all other devices. A common choice is
192.168.1.1 with a subnet mask of
255.255.255.0. Ensure that the DHCP server is enabled on the LAN interface within the OPNSense settings. This allows the main router to automatically assign IP addresses to all wired and wireless clients connected through the switch and the secondary TP-Link router. You should also set up DNS forwarders, typically pointing to reliable public resolvers like Google's
8.8.8.8 or Cloudflare's
1.1.1.1, to ensure fast resolution times for your users.
Setting Up the TP-Link Secondary Router
The configuration of the TP-Link router is the most critical step in preventing network conflicts. You must disable the DHCP server on this device. If the TP-Link continues to hand out IP addresses, it will conflict with the OPNSense DHCP server, leading to intermittent connectivity issues and IP address collisions. Navigate to the LAN settings or DHCP section in the TP-Link admin panel and turn off the DHCP service completely.
After disabling DHCP, you need to change the LAN IP address of the TP-Link router so it does not conflict with the OPNSense LAN IP. If OPNSense is at
192.168.1.1, set the TP-Link to
192.168.1.2. This makes the TP-Link accessible for future management without disrupting the network. It is important to note that you should never connect the modem or any upstream device to the WAN/Internet port of the TP-Link in this configuration. Instead, connect one of the Ethernet cables coming from the L2 Managed Switch directly into one of the four yellow LAN ports on the back of the TP-Link. The green WAN port should remain unused.
Wireless Configuration and SSID Management
With the physical connections established, configure the wireless settings on the TP-Link router. You can choose to use a different SSID (network name) than your OPNSense-managed Wi-Fi, or you can replicate the exact same SSID if you have additional access points supporting seamless roaming. However, keep in mind that basic consumer routers like standard TP-Link models do not support 802.11k/v/r fast roaming protocols natively. Therefore, clients may experience brief disconnections when moving between zones covered by different access points.
Ensure that the wireless channel selection on the TP-Link is set to a non-overlapping channel relative to any other Wi-Fi networks in your vicinity to minimize interference. Use tools like WiFi Analyzer to identify the least congested channels in the 2.4 GHz and 5 GHz bands. Additionally, verify that the security protocol is set to WPA2-AES or WPA3, avoiding legacy TKIP encryption which can severely throttle performance.
Troubleshooting Port Forwarding and Services
Once the network is stable, you may need to expose specific services to the internet. Because OPNSense is now the only device performing NAT, all port forwarding rules must be configured exclusively on the OPNSense firewall. If you previously forwarded ports on the TP-Link, those rules are now obsolete and should be removed to avoid confusion. Refer to our detailed troubleshooting guide on
Port Forwarding is not working - Troubleshooting Guide if you encounter issues directing traffic to internal servers.
Remember that any internal IP address you forward to must be static. While OPNSense handles dynamic assignment via DHCP reservations, ensure that the target device has a consistent IP address. This guarantees that when an external request arrives, it is always directed to the correct machine. Regularly test your external IP visibility using online tools to confirm that your firewall rules are correctly applied and that no intermediate device is blocking the traffic.
Frequently Asked Questions
Can I use the WAN port on the TP-Link router?
No, you should never use the WAN port when setting up a secondary router in Access Point mode. Connecting to the WAN port creates a separate subnet and triggers double NAT, which breaks inbound connections and complicates network management. Always use the LAN ports for connecting the secondary router to the main switch.
What happens if I forget to disable DHCP on the TP-Link?
If DHCP remains enabled on the TP-Link, it will compete with the OPNSense DHCP server. This causes some devices to receive incorrect gateway information, resulting in an inability to access the internet or reach other local resources. Disabling DHCP on the secondary router ensures all devices get their configuration from the central OPNSense gateway.
How do I manage the TP-Link router after changing its IP?
You must access the TP-Link admin panel using its new LAN IP address, such as
192.168.1.2, rather than its default address. If you cannot find the IP, check your DHCP lease table in OPNSense or use a network scanner tool to locate the device on the subnet. Once accessed, you can adjust wireless settings or firmware updates as needed.
Does this setup affect DNS caching performance?
This topology centralizes DNS resolution through OPNSense, which can improve consistency across the LAN. However, if you rely heavily on local caching, be aware that shared DNS caching behavior might impact how quickly clients resolve domain names during high traffic periods. For deeper insights into how DNS caching affects shared users, see
Understanding Router DNS Caching: Shared Among Users on a LAN.
Is it possible to have two different subnets with this setup?
While OPNSense can easily handle multiple subnets, adding a second router in bridge mode does not inherently create a new subnet. To implement distinct subnets, you should configure VLANs on your L2 Managed Switch and define corresponding interfaces in OPNSense. This approach provides better isolation and security than relying on a secondary consumer router for segmentation.