TP-Link Deco BE63 Subnet Settings

TP-Link Deco BE63 Subnet Settings Guide

The TP-Link Deco BE63 is a Wi-Fi 7 mesh system rated among the best mesh routers in 2026. Managed through the Deco app rather than a browser-based admin UI, its subnet settings follow the 192.168.68.0/24 default found across the Deco lineup. Mesh systems extend a single subnet across multiple access points, and all units in a Deco network share one DHCP server and one broadcast domain, meaning all devices regardless of which access point they connect through share the same /24 subnet.

Specifications¹

Default subnet configuration

The Deco BE63 uses 192.168.68.0/24 as its default LAN subnet², a deliberate choice to avoid conflicting with the 192.168.0.x and 192.168.1.x ranges used by most ISP modem-routers. With the default DHCP pool spanning 192.168.68.2 to 192.168.68.254, the system assigns up to 253 addresses dynamically. In a typical home, 10 to 60 devices connect across all Deco nodes, leaving most of the /24 unused. Yet the flat network means a compromised smart TV on one node can still communicate with a work laptop connected to another, which is exactly why the Deco app includes an IoT Network feature that creates a second subnet for untrusted devices.

Why 192.168.68.0/24 avoids ISP conflicts

TP-Link picked 192.168.68.1 as the default gateway because the 192.168.0.x and 192.168.1.x ranges are overwhelmingly common on ISP-supplied modem-routers, and picking a rare subnet prevents the silent failures that occur when two routers on the same network hand out addresses from overlapping ranges. Placing the Deco on 192.168.68.0/24 means you can plug an ISP gateway into the Deco WAN port without an IP overlap breaking DHCP or DNS forwarding.

This matters more than most users realize. An overlapping range causes devices to receive addresses from the wrong gateway and lose internet access without any obvious error message, and tracking down that misconfiguration across a mesh of several nodes takes far longer than picking a clean subnet up front. CapyToolkit's subnet calculator lets you verify that your chosen subnet does not overlap with the ISP gateway range before you connect the Deco.

Changing subnet settings via the Deco app

Open the Deco app, tap the More menu (bottom right), then Advanced > DHCP Server. Here you can view and edit the router IP and subnet mask. Change the IP address and mask to move the entire mesh to a different subnet, for example 10.0.1.1 with 255.255.255.0 for a /24 at 10.0.1.x, and keep in mind that every Deco node in the mesh adopts the new subnet at once because there is only one DHCP server running on the main unit. Tap Save and the Deco reboots its network stack so all connected devices must renew DHCP leases.

Editing the DHCP pool boundaries

Building on this, the DHCP reservation feature lets you assign specific IPs to devices by MAC address, which is useful for servers and smart home hubs that need consistent addresses for firewall rules and port forwards. You can also shrink the pool to reserve a block of addresses for static assignments, preventing the router from handing out an IP that you intended to reserve for a server.

Multi-subnet and IoT isolation patterns

The Deco app's IoT Network feature creates a second Wi-Fi SSID backed by an isolated subnet,³ preventing IoT devices from accessing the main LAN. Devices on the IoT network can reach the internet but not devices on the primary SSID. For more granular VLAN segmentation beyond what the Deco app offers, connect a managed switch to the BE63's LAN port with 802.1Q VLAN tagging configured.

Planning VLAN subnets before adding a switch

The Deco functions as the WAN edge while the managed switch enforces inter-VLAN routing rules between the segments you define. Planning each VLAN's subnet CIDR with the subnet calculator before purchasing the managed switch ensures you allocate correctly sized blocks for each trust zone without overlap. A common split is a /24 for primary devices, a /24 for IoT, and a /26 for guest traffic, each with its own DHCP scope.

Mesh topology and its impact on subnet design

In a Deco mesh, every node extends the same Layer 2 broadcast domain.² Unlike a traditional multi-AP setup where each access point can connect to a different VLAN through a trunk port, all Deco nodes share one subnet managed by the main unit's DHCP server. Building on this, adding more Deco nodes increases Wi-Fi coverage without changing the subnet: a three-node BE63 mesh still serves one 192.168.68.0/24 subnet. The mesh backhaul (wired or wireless) carries traffic between nodes at Layer 2, so a device connected to the farthest node can communicate with a device connected to the main node without routing. This simplicity is a strength for home users but a limitation for anyone who needs per-segment isolation without adding a managed switch.

DHCP management and device naming in the Deco ecosystem

The Deco app displays every connected device with its hostname, IP address, and connection node. Renaming devices in the app (for example, "Living Room TV" instead of "android-abc123") makes it easier to identify which device holds a given IP when troubleshooting. Building on this, DHCP reservations under each device's settings let you pin a specific MAC address to a fixed IP. A home server at 192.168.68.50 that hosts a Plex media library or a Home Assistant instance benefits from a reservation: the address survives mesh node reboots and firmware updates. The Deco app also shows per-device bandwidth usage, which helps identify which device is consuming bandwidth during slowdowns : information that correlates with the IP address in your subnet plan.

Using the Deco BE63 with a managed switch for VLAN segmentation

Connecting a managed switch to the Deco BE63's LAN port opens up VLAN segmentation that the Deco app cannot provide on its own. Configure the switch port connected to the Deco as a trunk carrying VLAN 10 (primary LAN) and VLAN 20 (IoT). The Deco handles VLAN 10 devices normally, while VLAN 20 devices route through the managed switch's inter-VLAN routing rules.

Building on this, the managed switch's DHCP server (or a separate DHCP relay to a router) assigns addresses from a different subnet to VLAN 20 devices: 192.168.69.0/24 for IoT, while the Deco continues serving 192.168.68.0/24 for the primary LAN. A firewall rule on the managed switch blocking VLAN 20 to VLAN 10 traffic isolates IoT devices at the switch level. The subnet calculator keeps Deco VLANs on separate subnets before you configure the switch, ensuring non-overlapping allocations that the Deco and managed switch can coexist without routing conflicts.