---
title: "Router — TP-Link AX72 + Mesh RE605X + RE705X"
tags: [homelab, network, router, mesh, dhcp, dns]
created: 2026-05-03
updated: 2026-05-03
status: reference
---

# TP-Link AX72 + OneMesh (RE605X + RE705X)

> Web UI: `http://192.168.1.1` (after initial setup)
> Default factory: `http://tplinkwifi.net` or `http://192.168.0.1`
> App: TP-Link Tether

**Hardware:**
- AX72 — AX5400 dual-band Wi-Fi 6 (main router)
- RE605X — AX1800 mesh extender (mid range)
- RE705X — AX3000 mesh extender (main extension, has Ethernet backhaul port)

---

## LAN / DHCP Server

**Network → LAN:**
- Router IP: `192.168.1.1`
- Subnet mask: `255.255.255.0`

**Network → DHCP Server:**
- Status: Enabled
- Pool: `192.168.1.100` – `192.168.1.199`
- Lease time: `1440` min (24h)
- Gateway: `192.168.1.1`

> IP range design: `.1–.99` = static/reserved (servers), `.100–.199` = DHCP pool, `.200–.254` = IoT/guest reserve

---

## DNS — Critical

**Network → DHCP Server → DNS settings:**
- **Primary DNS: `192.168.1.225`** ← CT102 Docker AdGuard (split-DNS for `*.ai-impress.com`)
- **Secondary DNS: `1.1.1.1`** ← fallback if CT102 is down

> ⚠️ Do NOT use `192.168.1.62` (CT101 legacy AdGuard — pending destruction)
> After changing: flush DNS on clients (`ipconfig /flushdns` Win, `sudo killall -HUP mDNSResponder` Mac)

---

## DHCP Address Reservations

**Network → DHCP Server → Address Reservation:**

| Device | MAC | Reserved IP | Notes |
|--------|-----|-------------|-------|
| pve (host) | (run `ssh pve "ip link show eno1"`) | `192.168.1.48` | Proxmox host |
| CT101 adguard (legacy) | `BC:24:11:56:36:05` | `192.168.1.62` | until destroyed |
| CT102 docker | `BC:24:11:52:32:9F` | `192.168.1.225` | **DNS server — critical** |
| CT105 immich | `BC:24:11:EA:8F:FD` | `192.168.1.71` | |
| CT111 media | `BC:24:11:7A:1B:8A` | `192.168.1.230` | |
| CT112 n8n | `BC:24:11:A2:32:01` | `192.168.1.232` | |
| RE605X extender | (see sticker) | `192.168.1.2` | mesh node 1 |
| RE705X extender | (see sticker) | `192.168.1.3` | mesh node 2 |

> MACs verified on 2026-05-03 from `pct config <ID> | grep hwaddr`

---

## NAT / Port Forwarding

**NAT Forwarding → Virtual Servers:**

| External Port | Internal IP | Internal Port | Protocol | Purpose |
|---------------|-------------|---------------|----------|---------|
| 80 | 192.168.1.225 | 80 | TCP | NPM HTTP (Let's Encrypt ACME + HTTP→HTTPS redirect) |
| 443 | 192.168.1.225 | 443 | TCP | NPM HTTPS — all public services |

> **If Cloudflare Tunnel is implemented (P1 task):** delete both rules. Cloudflared uses outbound connection only — no NAT holes needed.

**Ports NOT to forward (access via Tailscale instead):**

| Port | Service |
|------|---------|
| 22 | SSH to pve |
| 8006 | Proxmox Web UI |
| 81 | NPM admin |
| 53 | DNS |
| 8090 | Beszel |
| 9090/9093/3100 | Prometheus/AM/Loki |
| 9999 | Dozzle |
| 9898 | Backrest |

---

## DMZ

**NAT Forwarding → DMZ:** **Disabled** (never use — use explicit Virtual Servers only)

---

## UPnP

**NAT Forwarding → UPnP:** **Disabled**

> UPnP allows any LAN device to silently open ports — security risk. qBittorrent works fine without it. If qBit needs incoming connections: add explicit Virtual Server `50000 TCP+UDP → 192.168.1.230:50000`.

---

## Firewall / Security

**Security → Settings:**
- SPI Firewall: Enabled
- DoS Protection: Enabled (Medium)
- ICMP-Flood protection: Enabled
- TCP-SYN-Flood protection: Enabled
- UDP-Flood protection: Enabled
- **Ignore Ping From WAN: Enabled** (hide router from ICMP scans)
- Ignore Ping From LAN: Disabled

---

## IPv6

**Advanced → IPv6:**

If ISP provides IPv6 — enable **but** block all inbound IPv6 in firewall (established/related only).
If unsure — **disable IPv6 on WAN** to avoid bypass of NAT port rules.

---

## Wi-Fi (AX72 Main)

**Wireless → Wireless Settings:**
- 2.4 GHz SSID: same as 5 GHz (e.g. `home-network`)
- 5 GHz SSID: **same SSID** — enables band steering + seamless mesh handover
- Security: WPA2/WPA3 mixed
- Smart Connect: **Enabled** (merges 2.4 + 5 GHz under single SSID)
- WPS: **Disabled** (security)
- Transmit Power: High

**Guest Network (Wireless → Guest Network):**
- SSID: `home-network-guest`
- WPA2
- **Allow guests to access my local network: Disabled** — isolation from 192.168.1.0/24

---

## OneMesh — RE605X + RE705X Setup

**Advanced → OneMesh → Add Device:**

1. Power on extender near the router during pairing
2. Press WPS on extender, or use Tether app → Add Device
3. Both appear in `OneMesh → Network` topology

**Recommended placement:**
- RE705X (AX3000, stronger) — far room / different floor. **Use Ethernet backhaul if possible**: plug LAN cable from switch → RE705X LAN port → zero Wi-Fi bandwidth wasted on backhaul
- RE605X (AX1800, lighter) — mid-distance corridor or entrance area

**What mesh nodes provide:**
- Same SSID + password (clients don't notice the handover)
- DHCP served by AX72 only (nodes are bridge/AP mode)
- DNS setting comes from AX72 DHCP options

**Verify topology:**
- `OneMesh → Network` shows: root=AX72, leaves=RE605X/RE705X, backhaul type (Wi-Fi 5GHz or Ethernet)

---

## Firmware Updates

**Advanced → System → Firmware Upgrade → Check for Updates**
- AX72: update if available
- RE605X / RE705X: update via their web UI (192.168.1.2 / .3) or via AX72 OneMesh management
- Enable Auto-Update if available in Tether app

---

## Config Backup

**Advanced → System → Backup & Restore → Backup**
Save `.bin` file after any settings change.
Store at: `03 Resources/Infrastructure/router-tplink-ax72-backup-YYYY-MM-DD.bin`

---

## Related

- [[wiki/infrastructure/server-pve|server-pve]] — Proxmox host details
- [[wiki/homelab/homelab-services-map|homelab-services-map]] — full services, ports, DNS
- [[wiki/infrastructure/network-topology|network-topology]] — traffic flow (Internet → router → NPM → services)
