TP-Link Omada EAP670 Review: Is It Right for a Home Office or Small Business?

Real 4×4 Wi-Fi 6 and a 2.5GbE uplink most rivals at this price don't offer.

By John Hall — TechODash

Quick Verdict

The EAP670 is a ceiling-mount Wi-Fi 6 access point, not a router. That distinction matters: a typical home router does routing, firewalling, DHCP, and Wi-Fi all in one box — an access point like the EAP670 only handles the wireless side, and it's designed to be paired with a separate router or gateway. On paper it's an AX5400 dual-band access point: up to 4,804 Mbps on 5 GHz (4×4 MU-MIMO) plus 574 Mbps on 2.4 GHz, with a 2.5GbE wired port so the cable isn't the bottleneck. It's part of TP-Link's Omada ecosystem, which adds a controller, app, and optional cloud management for free — no recurring fee required.

Why This Product Matters

The EAP670 is a ceiling-mount Wi-Fi 6 access point, not a router. That distinction matters: a typical home router does routing, firewalling, DHCP, and Wi-Fi all in one box. An access point like the EAP670 only handles the wireless side, and it's designed to be paired with a separate router or gateway. Where it fits: a SOHO or small business that has outgrown a single all-in-one router and wants better coverage, cleaner separation between a main network and a guest network, or the ability to add more access points later without starting over. It's also a sensible upgrade for a remote worker whose ISP-provided router drops calls or can't handle a house full of video meetings, smart devices, and streaming at once.

Key Features That Matter

AX5400 Wi-Fi 6: 5 GHz runs a true 4×4 radio for up to 4,804 Mbps; 2.4 GHz adds 574 Mbps. 2.5GbE uplink: most access points in this price band still use a 1GbE port, which caps real Wi-Fi 6 throughput — the 2.5GbE port removes that ceiling if your switch and cabling support it. 250+ concurrent connections and ~1,500 ft² (140 m²) coverage: TP-Link's lab number; real coverage is lower and depends on walls and clients. Up to 16 SSIDs / VLANs: lets you run separate networks (main, guest, IoT, POS) from one access point, with isolation between them. Captive portal with SMS login: useful for small businesses that want a customer Wi-Fi sign-in without a third-party service. Omada Mesh and seamless roaming: add more Omada access points and devices roam between them without dropping the connection. Flexible power: supports 802.3at PoE+ from a switch/injector or a DC adapter — the Amazon US listing checked includes a 12V/1.5A adapter (and no PoE injector); box contents can vary by seller and region. Free firmware and management: firmware updates are free and can be applied through the Omada controller, the local web interface, or TP-Link's support download page; the controller itself carries no license fee.

Performance and Reliability

Treat the AX5400 number as a headline, not a promise. Wi-Fi marketing figures combine both bands at theoretical maximums and assume ideal clients. In practice, a modern 2×2 Wi-Fi 6 laptop near the access point typically sees several hundred Mbps to around 1 Gbps on 5 GHz, and that falls off with distance and walls — much like comparable Wi-Fi 6 access points from Ubiquiti and Aruba, which post roughly 700–800 Mbps at close range and drop sharply past a couple of walls. The genuinely useful performance detail is the 2.5GbE port: with a 4×4 5 GHz radio, a standard 1GbE port would cap real throughput, so the multi-gig uplink is what lets the EAP670 actually deliver on its radio potential. For a home office doing video calls and large uploads, the practical win is consistency under load — OFDMA and MU-MIMO keep many devices responsive at once rather than letting one streamer slow everyone down. For reliability, the EAP670 has a long track record since its 2022 release, with power draw around 19.8 W in a compact ceiling form factor roughly 9.6 × 9.6 × 2.5 in. Anecdotally, some Omada users report preferring the EAP670's range and stability enough that they returned to it after trying newer Wi-Fi 7 access points. The main reliability watch-item is the controller: features like mesh roaming, multi-site cloud, and the captive portal work best with a controller running, so plan to keep that software (or the optional OC200 hardware controller) on something that stays powered on.

Security Review

The security story here is solid for the category but realistic. The EAP670 supports WPA3 (and WPA2/WPA3 mixed mode), the current Wi-Fi encryption standard, mandatory for Wi-Fi-certified devices since 2020. Within the Omada system you also get VLAN segmentation, up to 16 isolated SSIDs, a secure guest network, captive portal with SMS login, rogue AP detection, management MAC access control, and 802.1X / RADIUS authentication for per-user Wi-Fi login rather than a single shared password. The important caveat: Wi-Fi encryption only secures the wireless link. It does not filter malicious traffic from the internet or stop a compromised device from reaching other parts of your network — that's the router/firewall's job. So think of the EAP670 as a strong access-layer building block, not a complete security solution. Pair it with a router that has a real firewall, keep IoT and guest traffic on separate VLANs, and you have a meaningfully safer small network than a single consumer router provides. On the firmware and update model: TP-Link continues to issue free firmware updates for the EAP670, and the broader Omada controller software is actively developed, with pre-release versions still shipping in 2026. Updates can be installed through the Omada controller (which can also push firmware across multiple sites), the access point's own web interface, or files from TP-Link's support download page, with no subscription required. One consideration for some buyers: TP-Link has faced scrutiny from U.S. authorities over security and supply chain concerns, so it's reasonable to keep firmware current and watch for official advisories — even though no EAP670-specific issue is in play.

First Settings I Would Change

1. Update the firmware first — out-of-the-box firmware can be months old; install the latest before configuring anything serious.
2. Create a strong admin password that is different from your Wi-Fi password, and write it down somewhere safe.
3. Rename your SSIDs to something not tied to your name or business, and set a long WPA3 (or WPA2/WPA3 mixed) passphrase.
4. Set up VLANs: main, guest, and IoT at minimum, with guest and IoT isolated from your work devices.
5. Enable the guest network and confirm "allow guests to access my local network" is off.
6. Pick your band plan: keep 5 GHz wide (80 MHz is a safe default; 160 MHz can help close-range speed but is noisier and not available everywhere).
7. Turn on rogue AP detection and review it periodically if you're in a shared building.
8. Turn off the LED if the access point is in a living space or bedroom, and enable email alerts so you hear about problems without checking.

Setup Difficulty

Rating: Beginner to Intermediate — physically mounting and powering it is easy; it ships with a 12V DC adapter and mounting kits, so you can plug it into a wall outlet and skip PoE entirely. The Omada app walks you through adoption and basic Wi-Fi setup, and zero-touch provisioning exists for multi-site deployments. The "intermediate" part is the network design: deciding on VLANs, choosing whether to use the free software controller, the optional OC200 hardware controller, or just the web interface, and getting a cable to the right location. If you're comfortable with a router's admin page, you'll manage. If the words "VLAN" and "PoE+" are new, expect a short learning curve — and that's fine.

Best Alternatives

Alternative	Why Consider It
TP-Link Omada EAP650	Cheaper, slimmer Omada for lighter loads — AX3000, 1GbE port (~$75–$90)
TP-Link Omada EAP610	Budget Omada entry point — AX1800, 1GbE (~$60–$80)
Ubiquiti UniFi U6 Pro	For buyers already in (or wanting) the UniFi ecosystem — AX5700, PoE+ (~$159)
HPE Aruba Instant On AP22	Simplest cloud-managed option, no subscription — AX1800 (~$130–$150)

Final Verdict: Good Buy

The EAP670 hits a practical sweet spot: real 4×4 Wi-Fi 6 on 5 GHz, a 2.5GbE uplink that most rivals at this price lack, free cloud/controller management, and a power adapter in the box so you can start without extra gear. For a home office or small business that's ready to think slightly beyond a single consumer router — and ideally willing to add a controller and a second access point later — it's one of the most sensible picks available. If you want the simplest possible setup, an all-in-one mesh is easier. If you want the UniFi ecosystem specifically, the U6 Pro is the direct rival. But for most SOHO buyers who want performance and room to grow without enterprise complexity, the EAP670 is a Good Buy.

Realistic Standard: An access point at this price should give you a wired uplink that can actually keep up with its own radio — most competitors in this price band still bottleneck at 1GbE. The EAP670's 2.5GbE port is the real differentiator here, not the headline Wi-Fi speed number.

FAQ

Does the EAP670 need a subscription?
No. Omada cloud access, the mobile app, and the software controller are free. The optional OC200 hardware controller is a one-time purchase. You only pay for the access point and any PoE switch or extra hardware you choose to add.

Can I use the EAP670 as my only router?
No. It's an access point, not a router. You still need a router (or a modem/router from your ISP) to handle internet, NAT, DHCP, and firewalling. The EAP670 handles the Wi-Fi layer only.

Do I need a PoE switch to power it?
Not necessarily. It supports 802.3at PoE+ for clean ceiling installs, and the Amazon US listing checked includes a 12V DC adapter, so you can power it from a nearby outlet instead. Box contents vary by seller, so confirm before buying.

How many devices can it handle?
TP-Link rates it for 250+ concurrent connections, but notes real capacity depends on traffic and environment and is usually lower. For a typical home office or small business with 20–60 active devices, it has plenty of headroom.

Is it worth buying if I don't have 2.5GbE equipment?
Yes, it still works perfectly on a standard 1GbE switch — you just won't fully use the multi-gig uplink. The 2.5GbE port is "future-proofing" for when you add a faster switch or use multi-gig internet.

Where to Go From Here

• Browse more SOHO Reviews
• Home Network Security
• Remote Work Security
• SOHO Architecture

Sources: TP-Link — official EAP670 product page, TP-Link — WPA2 vs. WPA3 security breakdown, HomelabAddiction — UniFi vs. Omada vs. Aruba Instant On comparison

Want the full picture on securing your home office network? SOHO 2026 covers it end to end.

Get SOHO 2026 →

TechODash may earn a small commission if you purchase through some links, at no extra cost to you. Recommendations are based on practical IT judgment, not paid placement.

About the Author: John Hall has 25+ years of IT experience in networking and small-office technology.