The ER605 Omada Build: A Complete Budget Rack Around TP-Link's $60 Router

The ER605 is a strange product. It is a gigabit router with a managed-network control plane, VLAN support, IPsec and OpenVPN termination, and a web UI that would not embarrass a device costing five times as much — and it sells for about sixty dollars. TP-Link can do this because the ER605 is the entry point to Omada, and Omada is a platform play: get the router in the rack, and the access points, switches, and controller follow.

For a homelab that is a fair trade. You get a coherent single-pane-of-glass network for well under the price of one UniFi gateway, and the pieces are small enough that the whole stack lives comfortably in a 10-inch cabinet. This post builds that stack out: what the ER605 can and cannot do, which switch to pair it with, how the PoE math works, where to run the controller, and how it all racks.

The mount for this build:

10" TP-Link Omada ER605 Rack Mount - 1U

What the ER605 actually is

Physically it is a small steel box, roughly 126 x 85 x 26 mm — well under the 44.45 mm of a rack unit, and narrow enough that a 10-inch opening (about 220 mm of usable interior) has room left over beside it. Five gigabit ports: one fixed WAN, one fixed LAN, three configurable as either. No PoE in, no PoE out, no SFP, no fan.

Functionally, the parts that matter for a homelab:

• VLANs and inter-VLAN routing. Full 802.1Q, with ACLs between networks. This is the reason to buy it over a consumer router.
• Multi-WAN. Up to three WAN ports with failover or load balancing, which is more than most people at this price point need and occasionally exactly what they need.
• VPN. IPsec site-to-site, OpenVPN, L2TP, PPTP. Newer firmware adds WireGuard on some hardware revisions — check your version before planning around it.
• Throughput. Around 900 Mbps NAT with everything off. Turn on deep packet inspection or heavy IPsec and it falls a long way; the v2 hardware does perhaps 100-150 Mbps of IPsec depending on cipher. If you have a symmetric gigabit fiber connection and want a VPN saturating it, this is the wrong router.

Here's the gotcha nobody mentions until you hit it: the ER605 has no wireless and no switching intelligence beyond basic VLAN tagging. It is a router, full stop. Every design decision downstream — where you put the AP, how many ports you need, whether anything gets PoE — is a separate purchase.

The switch decision

Four usable LAN ports goes fast. A NAS, a mini PC, a printer, and one AP and you are out. So the switch is not optional, and the choice sets the ceiling on the whole build.

Three tiers make sense underneath an ER605:

• Unmanaged gigabit. A TL-SG105 or SG108. Cheapest possible, works fine, and completely undoes your VLAN plan the moment you need a tagged port. Fine for a single flat network, wrong for anything with an IoT VLAN.
• Managed 2.5G. The TL-SG105-M2 gives you five 2.5G ports with VLAN support and a price that no longer hurts. This is where most 2026 builds land — 2.5 gigabit uplinks to a NAS or a mini PC cost almost nothing now, and the ER605's gigabit WAN stops being the bottleneck for LAN-internal traffic.
• Omada-managed with PoE. The ES210X-M2 or the ES206XPP-M2. These adopt into the Omada controller alongside the router, which means one interface for the whole network, and they carry PoE budget for the APs.

The middle tier is the value pick and the TP-Link TL-SG105-M2 Switch 10" Mini Rack Mount 1U puts it in the same cabinet without wasting a U. But if you are buying into Omada at all, there is a real argument for the managed switch: the point of the platform is that the router, switch, and AP show up in one topology map with one set of VLAN definitions, and a dumb switch in the middle is a blind spot you will be squinting at during every troubleshooting session.

PoE math, done properly

This is where budget builds go wrong. PoE budget is not the sum of what your devices draw — it is the sum of what they draw at the far end of the cable, plus cable loss, and the switch's total budget has to cover all of it simultaneously.

The standards, briefly:

• 802.3af (PoE) — 15.4 W at the port, 12.95 W guaranteed at the device.
• 802.3at (PoE+) — 30 W at the port, 25.5 W at the device.
• 802.3bt (PoE++) — 60 W or 90 W at the port depending on type.

The gap between port and device is cable loss over 100 m of Cat5e, and it is not optional headroom you can borrow. A switch advertising "65 W PoE budget" means 65 W at the ports, so four af devices at 15.4 W each is already 61.6 W and you are done.

Real numbers for the devices in this class of build: an EAP225 or EAP245 sits around 10-13 W under load; an EAP670 or other Wi-Fi 6 AP wants PoE+ and will pull 15-20 W with all radios busy; a small PoE camera runs 4-8 W. Two Wi-Fi 6 APs and a camera is comfortably 45 W and needs a switch with a genuine PoE+ budget, not a two-port af switch. The 10" TP-Link Omada ES206XPP-M2 PoE++ Switch Mini Rack Mount - 1U covers that case with room left; the TP-Link Omada ES210X-M2 Switch 10" Mini Rack Mount 1U is the pick when you need more ports than watts.

One more line item people forget: the switch's own consumption is separate from its PoE budget, and a PoE switch running near capacity is putting most of that wattage into the room as heat. A 65 W PoE budget fully allocated means roughly 70-75 W of total draw and a meaningful fraction of that dumped into a small cabinet.

The controller question

Omada needs a controller for the platform features to exist. Without one, the ER605 is a standalone router with a standalone web UI and no topology view, no centralized VLAN push, no unified client list. Four options:

• Standalone mode. No controller. Configure the router directly. Perfectly functional, and if you own only the router this is the correct answer.
• Software controller. Free, runs on Windows, Linux, or Docker. If you already have a mini PC or NAS in the rack, this is the obvious home for it. Roughly 1 GB of RAM and negligible CPU.
• Hardware controller (OC200/OC300). A small dedicated box, powered by PoE, that runs the controller with no host to maintain. Costs about as much as the router.
• Cloud-based controller. TP-Link's hosted option. Convenient, and it means your network's control plane lives somewhere you do not administer.

For a homelab the software controller in Docker is usually right — you have a machine, it is already on, and running the controller as a container makes upgrades a one-line operation. The failure mode is worth understanding: if the controller goes down, the network keeps running. Devices retain their configuration and forward traffic normally. You lose the ability to make changes and see statistics until it comes back. That is a much softer failure than people expect, and it means the controller does not need to be on the UPS-protected tier of your rack.

Racking it: a 6U layout

Everything above fits in a small cabinet with room to spare. A workable arrangement, top to bottom, in a 10-inch 6U rack:

• 1U: patch panel or keystone strip. Terminate the house runs here, patch down.
• 1U: the ER605. Ports face front, WAN on the left, done.
• 1U: the switch. Directly below the router keeps the router-to-switch patch to about 200 mm.
• 1U: mini PC running the controller and whatever else.
• 1U: blank or vented panel for airflow separation.
• 1U: power — strip or small UPS at the bottom, where the mass belongs.

The ER605 is one of the easier devices to mount because it has no fan, no vents on the bottom, and a chassis that is essentially a rectangular steel brick. It also runs cool enough that stacking it directly under a patch panel costs you nothing. The switch is the device that wants breathing room, particularly if it is delivering PoE.

If the cabinet is 19-inch rather than 10-inch, the same stack works but every device is swimming in a 450 mm opening. The 19" TP-Link Omada ER605 Rack Mount - 1U (Modular) is the answer there — put the router in one segment and the switch or a keystone strip beside it, and one U carries what would otherwise take three.

Where this build runs out of road

Being honest about the ceiling saves money later. The ER605 stops being the right router when:

• Your WAN exceeds about 900 Mbps. The gigabit WAN port is a hard wall. Multi-gig fiber needs the ER707-M2 or a different platform entirely.
• You need line-rate VPN. IPsec throughput on this hardware is a fraction of its NAT throughput. A remote-access tunnel for phone-home use is fine; a site-to-site link carrying backups is not.
• You want IDS/IPS. Omada's deep packet inspection on the ER605 is limited and costs throughput when enabled.
• You have more than about a dozen VLANs with complex ACLs. It will do it, but the UI stops being pleasant and the rule evaluation starts showing up in latency.

None of those are surprises at sixty dollars. The ER605 is doing exactly what it was designed to do: give a small network real segmentation and real management at a price that makes the decision easy. When you outgrow it, the switches and APs come with you — that is the actual value of buying into a platform at the bottom rung.

Wrap-up

A complete Omada rack — router, managed 2.5G switch with PoE, controller on a box you already own, patch panel, and power — comes in under the cost of a single mid-tier gateway from anyone else, and it fits in six rack units of a 10-inch cabinet. Budget the PoE at the port rather than at the device, put the controller somewhere convenient and stop worrying about its uptime, and give the PoE switch the air the router does not need. The ceiling is real and it is roughly gigabit, which for most houses in 2026 is still the ceiling of the internet connection anyway.

Mounts in this build