TP-Link says Deco has two VPN features. The VPN Server (OpenVPN, PPTP or L2TP/IPSec) lets remote devices reach your home network, and the VPN Client routes home devices through a third-party VPN provider with no software on each device. All setup is in the Deco app under More, VPN. For OpenVPN Server tap VPN Server, Add VPN Server, choose OpenVPN and fill Description, Service Type (UDP or TCP), VPN Port between 1024 and 65535, VPN Subnet and Netmask, and Client Access: Home Network Only, or Internet and Home Network. Export the config file and install the OpenVPN client on each remote device; mobile devices need a third-party app.
For the VPN Client you need credentials or a configuration file from your provider. Deco does not support VPN Server or Client in Access Point mode.
The checks in more detail
Because the server is reachable from the internet, a private WAN IP (double NAT) will block inbound VPN connections until the upstream device forwards the port. If the VPN will not connect, check the port, the service type, the WAN IP and that the client software matches. TP-Link also lists which Deco models support which VPN types. Pick the VPN feature by its purpose: the server lets you reach home from outside, and the client sends home devices through a provider. Confirm the provider or client software supports your protocol first, and keep the server's credentials strong, since it is reachable from the internet.
If you only need to reach one device at home, such as a network drive, consider whether the manufacturer offers a secure remote-access service, which avoids exposing a VPN port on the router at all.
Differential
Likely causes of “TP-Link Deco mesh wifi VPN client or server will not connect”, and how to tell them apart
- 1
Access Point mode
What separates it The VPN options are missing because the Deco is running in Access Point mode
How to confirm Use Router mode, since the VPN server and client are not available in Access Point mode
- 2
A private WAN IP
What separates it The inbound VPN fails because the WAN address is a private one, which means a double NAT
How to confirm Fix the double NAT first, since inbound connections cannot pass through two routers
- 3
A wrong port or protocol
What separates it The client cannot connect because the protocol or the port does not match the server
How to confirm Match UDP or TCP and the port number on both the server and the client
- 4
An unsupported model
What separates it There is no VPN menu because the model does not support the VPN features
How to confirm Check TP-Link's list of supported models, to see whether yours has a VPN server
- 5
Missing client software
What separates it The configuration cannot be imported because the client software is not installed
How to confirm Install the OpenVPN client on the device, and then import the configuration
Before you touch a setting
Record this first — changing settings destroys the evidence
- Which type of VPN you are using and which port it uses
- The WAN IP and its type
- The model of your Deco and which mode it is in
- The exact error message that the client shows
Try in this order
0 of 7 completedOpen VPN
ReversibleOpen VPN in the app, by tapping More and then choosing VPN from the list.
Choose Server or Client
ReversibleChoose Server or Client, depending on whether you want remote access or to route traffic out.
Add the server
ReversibleAdd the server by choosing the type, the port and the subnet that you want to use.
Export the config
ReversibleExport the configuration file, which the remote devices need to connect to your VPN server.
Install the client
ReversibleInstall the client on each device that will connect, such as the OpenVPN app on a phone.
Check the WAN IP
ReversibleCheck the WAN IP address, since it must be a public address for inbound connections to work.
Test from outside
ReversibleTest from outside your home, using cellular data on a phone, to check the connection works.
Model-specific
What is true of this model and not of its siblings
- Support
- Not every Deco model has VPN server or client; TP-Link publishes a supported list.
- BE85
- The BE85 is marketed with VPN support.
- Other models this page answers
- These steps also fit the Deco BE63 mesh, Deco X55 mesh, Deco M5 mesh.
Stop boundary
When this stops being a self-service repair
- !If the config imports but never connects, check the WAN IP and port forwards
- !If the model does not support VPN, use a VPN-capable router
- !If setup will not save, contact TP-Link support
Evidence ledger
Sources behind this answer
OpenVPN, PPTP, L2TP and the client.
Which models support VPN.
VPN questions.
Router versus Access Point features.
The company and its products.
Exact questions
Common questions
What VPN types does Deco support?+
OpenVPN, PPTP and L2TP/IPSec servers, plus a client.
What is the VPN Client?+
It routes home devices through a provider.
Which port range for OpenVPN?+
The port range for OpenVPN is 1024 to 65535, so choose a port inside that range.
Does AP mode support VPN?+
No, Access Point mode does not support the VPN, since the Deco is not the gateway.
Where is it in the app?+
The VPN is in the app under More, and then VPN, where you set it up.
Do I need client software?+
Yes, you need client software on each remote device that connects to your VPN server.
Can phones use OpenVPN?+
Phones can use OpenVPN with a third party app, such as the OpenVPN Connect app.
Does double NAT block it?+
Yes, double NAT blocks inbound VPN connections, so it must be fixed before the VPN works.
Can I export a config?+
Yes, you can export a configuration file from the VPN profile, for each client device.