# Configuring NordVPN on a Specific VLAN (TP-Link Omada)

This guide explains how to route a specific **VLAN** through a **NordVPN OpenVPN** tunnel on a TP-Link Omada network. This configuration ensures that only devices on a designated secure network are encrypted, while the rest of the network remains on the standard ISP connection.

## 1. Prerequisites

Before beginning, log in to your NordVPN dashboard to collect the following essential data:

<div class="kb-container" id="bkmrk-service-credentials%3A">- **Service Credentials:** Your manual username and password (found under *Services &gt; NordVPN &gt; Manual Setup*). **Note:** These are different from your email login.
- **OpenVPN Configuration File:** Download the `.ovpn` file for your desired server. UDP is recommended for better performance.
- **Server IP:** Note the **Direct IP address** of the NordVPN server (e.g., `89.187.183.182`).
- **NordVPN DNS:** Use `103.86.96.100` for a secure, leak-proof setup.

---

</div>## 2. Configuration Steps

### Phase A: Create the Secure VLAN

<div class="kb-container" id="bkmrk-navigate-to-settings">1. Navigate to **Settings** → **Wired Networks** → **LAN**.
2. Click **+ Create New LAN**.
3. **VLAN ID:** Assign a unique ID (e.g., `100`).
4. **Gateway/Subnet:** Define your desired local range (e.g., `192.168.x.1/24`).
5. **DNS Server:** Select **Manual** and enter the NordVPN DNS: `103.86.96.100`.

</div>### Phase B: The MTU Fix (Critical for Web Browsing)

To prevent "fragmentation," where some sites, like Google, load while others, like Amazon or Netflix, fail to load, you must manually adjust the packet size in the configuration file.

<div class="kb-container" id="bkmrk-open-your-downloaded">1. Open your downloaded `.ovpn` file in a text editor (like Notepad).
2. Add the following command to the **very top** of the file:

</div>```
mssfix 1300
```

<div class="kb-container" id="bkmrk-"><div style="text-align: center; margin: 20px 0;">  
</div></div>*\[Image showing the mssfix command placed at the start of an OpenVPN config file\]*

### Phase C: Set up the VPN Client

<div class="kb-container" id="bkmrk-go-to-settings-%E2%86%92-vpn">1. Go to **Settings** → **VPN** → **VPN Client** → **OpenVPN**.
2. **Remote Server:** Enter the NordVPN Server IP (e.g., `89.187.183.182`) and Port (`1194` for UDP).
3. **Username/Password:** Use your NordVPN **Service Credentials**.
4. **Local Networks:** Select only your **Secure VLAN**.
5. **Configuration:** Upload your edited `.ovpn` file.
6. Click **Apply**.

---

</div>## 3. Security &amp; Isolation (Gateway ACLs)

To keep the Secure VLAN isolated from your primary network while still allowing management access, configure **Gateway ACLs**.

<div class="kb-container" id="bkmrk-rule-name-policy-sou"><table style="width: 100%; border-collapse: collapse; margin: 20px 0;"><thead><tr style="background-color: #f8f8f8; border-bottom: 2px solid #ddd;"><th style="padding: 10px; text-align: left;">Rule Name</th><th style="padding: 10px; text-align: left;">Policy</th><th style="padding: 10px; text-align: left;">Source</th><th style="padding: 10px; text-align: left;">Destination</th></tr></thead><tbody><tr style="border-bottom: 1px solid #eee;"><td style="padding: 10px;">Allow Management</td><td style="padding: 10px;">Permit</td><td style="padding: 10px;">Main Network</td><td style="padding: 10px;">Secure VLAN</td></tr><tr><td style="padding: 10px;">Isolate Secure VLAN</td><td style="padding: 10px;">Deny</td><td style="padding: 10px;">Secure VLAN</td><td style="padding: 10px;">All Local Networks</td></tr></tbody></table>

---

</div>## 4. Troubleshooting

<div class="kb-container" id="bkmrk-no-internet%3A-ensure-">- **No Internet:** Ensure the device (phone/laptop) does not have a native VPN app active. Double-encryption (VPN-in-VPN) often causes packet drops and connection failures.
- **Remote Desktop (RDP) Fails:** Ensure the target machine's network profile is set to **Private** in Windows settings. If connecting by hostname fails, use the specific **Reserved IP** address.
- **DNS Leaks:** Verify your setup by visiting `dnsleaktest.com` from a device on the Secure VLAN. The results should show NordVPN servers, not your ISP.

</div>