A VPN that will not connect, drops or runs slowly on a network with a TP-Link Deco XE75 has a cause that sits more often in the VPN, the device or the router's settings than in the mesh itself, and a few checks separate them. The XE75 is a Wi-Fi 6E tri-band mesh in the AXE5400 class managed entirely through the Deco app. On this system the 6 gigahertz band often serves as the backhaul between nodes, and clients use the 5 and 2.4 gigahertz bands, which matters little for a VPN but explains why a device may not see a 6 gigahertz network.
The checks in more detail
Test the VPN on another network first: a phone on mobile data or a friend's Wi-Fi. If it works there and not at home, something in the home network interferes. Make sure the Deco firmware is current through the app, since updates fix compatibility bugs. The Deco passes VPN traffic from devices behind it, and most VPN apps work without any router setting; but if a VPN uses PPTP, L2TP or IPSec and fails, check whether the app has a VPN passthrough or a similar option.
Try a different protocol in the VPN app, such as OpenVPN or WireGuard, because some networks handle one better. Check that a security feature in the Deco app, such as an antivirus or an intrusion blocker, is not blocking the VPN; test with it off and then turn it back on. If the VPN is slow or drops, test on the same node and keep the device on one node, since roaming across nodes changes the path; try an Ethernet connection to take the wireless link out.
A weak node backhaul reduces the speed of every device behind it, so move the node closer. If you want to host a VPN at home for access from outside, check the app's features first, since the Deco's ability to run a VPN server depends on the model, and you will need a public internet address, which carrier-grade NAT prevents. Dynamic DNS helps with a changing address. Quote the Deco serial number to TP-Link if the network seems to block VPN traffic.
Differential
Likely causes of “TP-Link Deco XE75 mesh VPN client or server will not connect”, and how to tell them apart
- 1
The VPN service or app
What separates it It fails on every network
How to confirm Test on another network
- 2
A security feature blocking the VPN
What separates it It works on a hotspot but not at home
How to confirm Test with the feature off
- 3
A protocol that suits badly
What separates it The connection stalls
How to confirm Try another protocol
- 4
Roaming between nodes or a weak backhaul
What separates it The VPN drops or is slow
How to confirm Stay on one node or move the node
- 5
Carrier-grade NAT for hosting
What separates it A home VPN server is unreachable
How to confirm Ask for a public address
Before you touch a setting
Record this first — changing settings destroys the evidence
- Where the VPN runs
- Whether it works on mobile data
- Which protocol it uses
- The Deco firmware version
Try in this order
0 of 6 completedTest on mobile data
ReversibleTo isolate the network.
Update the Deco firmware
ReversibleIn the app.
Check security features
ReversibleIn the app.
Try another protocol
ReversibleIn the VPN app.
Stay on one node
ReversibleOr use Ethernet.
Contact TP-Link
ReversibleIf it persists.
Model-specific
What is true of this model and not of its siblings
- The mesh
- It passes VPN traffic from devices behind it.
- Protocols
- Each behaves differently on a network.
- Roaming
- Switching nodes can drop a VPN.
- Hosting
- A public address and forwarded ports are needed.
- 6 GHz
- It is the backhaul on many Deco 6E systems.
- TP-Link help
- Quote the serial number.
Stop boundary
When this stops being a self-service repair
- !Do not disable security for long
- !Do not share VPN credentials
- !Contact the VPN provider for account errors
Evidence ledger
Sources behind this answer
Exact questions
Common questions
Why will my VPN not connect at home?+
A security feature or a protocol.
Does 6 GHz matter for a VPN?+
Not directly.
Can the Deco host a VPN?+
Check the app's features.
Why does it drop when I move?+
The device roams between nodes.
What is carrier-grade NAT?+
A shared address that blocks incoming connections.