TP-Link Omada VPN Gateway with 10G Ports · ER8411

Model code

ER8411

Manufacturer designation

Omada VPN Gateway with 10G Ports

Source hardware version

V1.20

IDS/IPS

Signature-based IPS/IDS threat detection

Access Control

• Source/Destination IP Based ACL ; • Stateful ACL; • IPv4/IPv6 ACL; • National Based ACL; • FQDN

DPI

• Deep Packet Inspection; • Support 2421 type Applications

DNS Proxy

DNSSEC, DoH, DoT, and DNS Override

Filtering

• WEB Group Filtering △ ; • URL Categories and URLs Filtering; • Web Security △

Attack Defense

• TCP/UDP/ICMP Flood Defense; • Block TCP Scan (Stealth FIN/Xmas/Null); • Block Ping from WAN

ARP Inspection

• Sending GARP Packets; • ARP Scanning; • IP-MAC Binding; • ARP Detection

GRE

√ (Only in Standalone Mode)

SSL VPN

• SSL VPN Server; • 500 SSL VPN Tunnels

IPsec VPN

• 300 IPSec VPN Tunnels; • LAN-to-LAN, Client-to-LAN; • Main, Aggressive Negotiation Mode; • DES, 3DES, SHA1, SHA256, SHA384, SHA512, AES128, AES192, AES256 Encryption Algorithm; • IKE v1/v2; • MD5, SHA1 Authentication Algorithm; • NAT Traversal (NAT-T); • Dead Peer Detection (DPD); • Perfect Forward Secrecy (PFS)

PPTP VPN

• PPTP VPN Server; • PPTP VPN Client (32)*; • 300 Tunnels (Shared with L2TP); • PPTP with MPPE Encryption

L2TP VPN

• L2TP VPN Server; • L2TP VPN Client (32)*; • 300 Tunnels (Shared with PPTP); • L2TP over IPSec

OpenVPN

• OpenVPN Server; • OpenVPN Client (10)*; • 110 OpenVPN Tunnels

WireGuard VPN

√

SD-WAN

√ (Only in Controller Mode)

Standards and Protocols

LLDP

Interface

• 2× 10GE SFP+ Ports (1× WAN, 1× WAN/LAN); • 1× 1GE SFP WAN/LAN Ports; • 8× 1GE RJ45 WAN/LAN Ports; • 1× RJ45 Console Port; • 2× USB 3.0 Ports (One supports LTE backup with LTE dongle)

Network Media

• 10BASE-T: UTP category 3, 4, 5 cable (Max 100 m); EIA/TIA-568 100Ω STP (Max 100 m); • 100BASE-TX: UTP category 5, 5e cable (Max 100 m); EIA/TIA-568 100Ω STP (Max 100 m); • 1000BASE-T: UTP category 5e, 6 cable (Max 100 m)

Fan Quantity

2

Button

Reset Button

Power Supply

Redundant Dual Power Supplies (100–240 VAC, 50/60 Hz)

Flash

4MB SPI NOR + 256 MB NAND

DRAM

4 GB DDR4

LED

PWR, SYS, WAN, LAN, USB, FAN

Dimensions ( W x D x H )

17.3 × 8.7 × 1.7 in (440 × 220 × 44 mm)

Protection

4 kV surge protection

Enclosure

Steel

Mounting

Rack Mountable

Max. Power Consumption

• 26.36 W (with USB 3.0 connected); • 19.12 W (without USB 3.0 connected)

Concurrent Session

2,300,000

New Sessions /Second

20,000

NAT (Static IP)

• Upload: 9445.82 Mbps; • Download: 9449.26 Mbps

NAT(DHCP)

• Upload: 9426.83 Mbps; • Download: 9426.20 Mbps

NAT(PPPoE)

• Upload: 9413.96 Mbps; • Download: 9102.01 Mbps

NAT (L2TP)

• Upload: 9064.66 Mbps; • Download: 8587.57 Mbps

NAT (PPTP)

• Upload: 8712.11 Mbps; • Download: 8505.61 Mbps

1,518 Byte Packet forwarding rate

• Upload: 820,982 pps; • Download: 820,982 pps

IPsec VPN Throughput

• ESP-SHA1-AES256: 3099.4 Mbps; • ESP-SHA256-AES256: 2928.4 Mbps; • ESP-SHA384-AES256: 2935.7 Mbps; • ESP-SHA512-AES256: 2878 Mbps

PERFORMANCE / GRE

• Unencrypted: 8437 Mbps; • Encrypted: 2775 Mbps

PERFORMANCE / WireGuard VPN

1411 Mbps

PERFORMANCE / OpenVPN

1043 Mbps

L2TP VPN Throughput

• Unencrypted: 10497 Mbp; • Encrypted: 3178.5 Mbps

SSL VPN Throughput

1006 Mbps

DPI Throughput

• TCP: 9067 Mbps; • UDP: 5873 Mbps

64 Byte Packet Forwarding Rate

• Upload: 2,109,375 pps; • Download: 2,011,719 pps

IPS Throughput

• TCP: 9388 Mbps;; • UDP: 7538 Mbps

Omada App

Yes. Requiring the use of an Omada Controller.

Centralized Management

• Omada Hardware Controller; • Omada Software Controller; • Omada Central (Cloud-Based)

Cloud Access

Yes. Requiring the use of an Omada Controller.

Service

Dynamic DNS (Dyndns, No-IP, Peanuthull, Comexe, DDNS ; Customization)

Maintenance

• Web Management Interface; • Remote Management; • Export & Import Configuration; • SNMP v1/v2c/v3; • Diagnostics (Ping & Traceroute); • NTP Synchronize △ ; • Port Mirroring; • Syslog Support

Management Features

• Automatic Device Discovery; • Intelligent Network Monitoring; • Abnormal Event Warnings; • Unified Configuration; • Reboot Schedule; • Captive Portal Configuration; • ZTP (Zero-Touch Provisioning) †

LAN DNS

√

WAN Connection Type

• Static/Dynamic IP; • PPPoE; • PPTP; • L2TP; • 6to4 Tunnel; • Pass-Through; • Mobile Broadband: 4G/3G modem for backup via USB port

MAC Clone

Modify WAN/LAN MAC Address △

DHCP

• DHCP Server/Client; • DHCP Address Reservation; • Multi-net DHCP; • Multi-IP Interfaces; • WAN DHCP 60

IPv6

WAN Connection

VLAN

802.1Q VLAN

IPTV

IGMP v2/v3 Proxy

Advanced Routing

• Static Routing; • Policy Routing; • RIP △ ; • OSPF △

Bandwidth Control

• IP/Port-based Bandwidth Control; • Guarantee & Limited Bandwidth

Load Balance

• Intelligent Load Balance; • Application Optimized Routing; • Link Backup (Timing △ , Failover); • Online Detection

NAT

• One-to-One NAT; • Multi-Net NAT; • Port Forwarding; • Port Triggering § ; • NAT-DMZ; • FTP/H.323/SIP/IPSec/PPTP ALG; • UPnP; • Disable NAT

Session Limit

IP-based Session Limit

Web Authentication

• No Authentication; • Simple Password; • Hotspot（Local User / Voucher ‡ / SMS ‡ / Radius ‡ ）; • External Radius Sever; • External Portal Sever ‡

System Requirements

Microsoft Windows 98SE, NT, 2000, XP, Vista™ or Windows 7/8/8.1/10/11, MAC OS, NetWare, UNIX or Linux

Environment

• Operating Temperature: 0–40 ℃ (32–104 ℉);; • Storage Temperature: -40–70 ℃ (-40–158 ℉); • Operating Humidity: 10–90% RH non-condensing; • Storage Humidity: 5–90% RH non-condensing

Selection limits

Confirm exact hardware revision, regional model, adapter plug, firmware/controller support and required accessories before ordering. Published wireless PHY rates and maximum wired/VPN performance are conditional laboratory/standard limits, not guaranteed application throughput. PoE input powers this device; PoE output powers downstream equipment. Passive PoE is not automatically IEEE 802.3af/at/bt compatible; match voltage, polarity, pairs and available power budget.

Manufacturer operating-mode notes

† These features require the use of an Omada controller. △ These features are supported only in Standalone Mode ‡ These features are supported only in Controller Mode *ER8411 can work as a VPN client and can connect with up to 32 PPTP/L2TP VPN servers and 10 OpenVPN servers.

Identifier scope

Documented model code. Regional ordering suffix and bundle are not invented and are confirmed separately.

Specification source: TP-Link ↗
Checked against documentation: 16.10.2026