TP-Link Archer BE900 Subnet Settings

TP-Link Archer BE900 Subnet Settings Guide

The TP-Link Archer BE900 is TP-Link's flagship Wi-Fi 7 router, operating on 2.4 GHz, 5 GHz, and 6 GHz bands simultaneously. Its default LAN subnet is 192.168.0.0/24, placing all connected devices in a single flat network of 254 usable addresses. For households with many IoT devices, smart home hubs, and work computers, reconfiguring the subnet into VLANs prevents IoT devices from reaching personal computers on the same switch, which is a common security improvement the BE900's admin UI supports through VLAN tagging.

Specifications¹

Default subnet configuration

The BE900 ships with 192.168.0.0/24 as the LAN subnet.² A /24 block holds 254 usable host addresses, which is enough for households with dozens of connected devices, but at 150 DHCP leases the default pool is more limiting than the subnet itself. Out of the box, the router hands out addresses from a narrow band in the middle of the range, leaving the lower and upper addresses available for static assignment.

Why the default DHCP pool is smaller than the subnet

Expanding the pool in the admin UI to cover the full /24 (192.168.0.2 through 192.168.0.254) gives all 253 addresses to DHCP. Yet 254 addresses in a flat network means every device can reach every other device directly, including IoT sensors, smart TVs, and work laptops. Consequently, users with mixed-trust devices benefit from splitting the /24 into VLANs backed by separate subnets, one for each trust level.

Changing subnet settings on the BE900

Open a browser and navigate to 192.168.0.1 or tplinkwifi.net. Log in with your admin credentials. Go to Advanced > Network > DHCP Server. The LAN IP section shows the current gateway IP (192.168.0.1) and subnet mask (255.255.255.0). To change the subnet, modify the IP address and subnet mask fields (for example, changing to 10.0.0.1 with mask 255.255.0.0 moves the router to a /16). Click Save after each change. The router reboots the DHCP service and devices must renew leases. Building on this, under Advanced > Network > LAN you can configure VLAN IDs for guest networks, which create separate subnets behind the same router.

Multi-subnet and VLAN patterns

The BE900 supports a guest Wi-Fi network that runs in an isolated segment, preventing guest clients from reaching the main LAN. Enabling the guest network under Wireless > Guest Network creates a virtual interface with its own DHCP pool. For more advanced VLAN segmentation, such as a separate IoT VLAN, home office VLAN, and gaming VLAN, connect the BE900's LAN port to a managed switch that supports IEEE 802.1Q VLAN tagging. Configure the switch ports with the appropriate VLAN IDs and set the BE900 as the inter-VLAN router.

Planning VLAN subnets with the calculator

Consequently, each VLAN gets its own subnet allocation planned with the subnet calculator, and the firewall rules between VLANs prevent cross-segment access for untrusted device categories. Planning the CIDRs before configuring the switch ensures that the IoT VLAN at 192.168.1.0/24 cannot route to the home office VLAN at 192.168.2.0/24 without an explicit firewall rule, which is the core benefit of subnet-based isolation.

Beyond the switch-based VLAN approach, the BE900's built-in Private IoT Network feature offers a lighter-weight alternative: it creates a separate wireless network specifically for IoT devices with HomeShield and WPA3 protections layered on top, without requiring an external managed switch. The router also exposes four independent guest networks, one per radio band (6 GHz, the two 5 GHz bands, and 2.4 GHz), each of which can be assigned its own subnet for band-specific isolation.

IPv6 prefix delegation on the BE900

The BE900 supports DHCPv6 Prefix Delegation, which requests a prefix from your ISP and distributes /64 blocks to LAN segments automatically. When your ISP delegates a /56, the BE900 can assign one /64 to the main LAN and additional /64s to guest or IoT VLANs. This gives every segment its own globally routable IPv6 range without manual configuration. ³

How prefix delegation assigns a /64 to each VLAN

For the main LAN, the BE900 assigns a /64 from the delegated prefix using SLAAC, allowing every device to self-configure a global IPv6 address. Building on this, the guest network receives a separate /64, which isolates guest devices at the IPv6 level even if the IPv4 firewall rules are misconfigured. Verifying the delegated prefix length in the BE900's admin UI (under Advanced > IPv6) confirms whether your ISP provides a /56, /48, or only a single /64. If the ISP delegates only a /64, you cannot assign unique /64s to multiple VLANs; in that case, use NAT66 or ULA (fc00::/7) for internal segments.

OneMesh and subnet considerations for TP-Link extenders

TP-Link OneMesh lets you add compatible TP-Link range extenders to the BE900's network, creating a mesh-like experience without replacing the router. OneMesh extenders connect to the BE900 over Wi-Fi and extend the same SSID, meaning all devices (whether connected to the router or an extender) share the same subnet and broadcast domain. This simplifies client roaming but means the extender does not create a separate segment.

For households that need both extended coverage and subnet isolation, connect a managed switch to the BE900's LAN port and run Ethernet to access points that support VLAN tagging. Building on this, the access points assign VLAN IDs per SSID (main SSID on VLAN 10, IoT SSID on VLAN 20), and the managed switch enforces inter-VLAN routing through the BE900. The subnet calculator plans the CIDR for each VLAN before configuring the access points, ensuring the main LAN at 192.168.0.0/24 and the IoT VLAN at 192.168.1.0/24 do not overlap. Consequently, the subnet calculator helps you separate IoT devices from your main LAN, giving you both extended Wi-Fi coverage and proper subnet segmentation that OneMesh alone cannot provide.