1. Home
  2. Knowledge Base
  3. Grandstream Routers – FAQ

AI Documentation Assistant

✨

Grandstream Routers – FAQ

This Frequently Asked Questions (FAQ) article provides quick, practical answers for configuring and troubleshooting Grandstream routing products, including the GWN700x series (wired, multi-WAN business routers), the GWN70xx series (Wi-Fi routers), and the GCC60xx series when using the Networking module (routing features inside GCC). It focuses on common setup tasks, security and VPN basics, and the most frequent issues users encounter in real deployments.

Overview & Router Series

Grandstream routing products generally fall into four groups:

  • GWN700x series (GWN7001/GWN7002/GWN7003): Wired multi-WAN VPN routers for business networks that need higher reliability, load balancing/failover, and advanced routing/security.
  • GWN7062 and GWN7052/GWN7052F: Wi-Fi routers for SOHO/SMB that combine wireless connectivity with full router functions (VPN, firewall, NAT, etc.).
  • GWN7062E and GWN7062ET: Wi-Fi 6 routers designed for simpler setup and day-to-day use; the ET model adds telephony ports.
  • GCC60xx series (Networking module): Convergence devices that include a Networking module providing routing features (WAN/LAN, VPN, firewall, VLANs, NAT, port forwarding) alongside other GCC modules.

Grandstream routers generally support the most common VPN types, including WireGuard, IPsec, OpenVPN, L2TP, and PPTP. Support and limits can vary by model.

Example: Some models may support these VPN types but limit you to one active VPN service/tunnel at a time (ex: GWN7062E/ET).

Tip: If you need higher VPN capacity, more flexibility, or a more “enterprise” VPN feature set, choose the GWN700x wired router series or GCC60xx series.

Grandstream routing products are mainly wired or wireless (Wi-Fi) depending on the model:

  • Wired routers: GWN700x series, and most GCC60xx devices (routing is provided via the GCC Networking module).
  • Wi-Fi routers: GWN70xx series (Wi-Fi router models).

Tip: Choose wired for business edge/multi-WAN/VPN and predictable performance. Choose Wi-Fi if the router also needs to provide wireless coverage.

Yes. Grandstream routers support load balancing and failover when more than one WAN connection is used. The main difference between models is how many WAN ports/interfaces the router supports.

Note: for some models Load balancing/failover options may not appear in the Web UI until you enable at least a second WAN interface/port (ex: (GWN7062E/7062ET).

Yes. Grandstream supports mesh in two ways, depending on the router model:

  • AP-based mesh (managed access points): On GWN700x, GCC60xx (Networking module), and GWN7062 / GWN7052 / GWN7052F, you typically pair/adopt GWN76xx access points to the router/controller, then enable mesh between the APs.
  • Router-node mesh: On GWN7062E / GWN7062ET, mesh is created by adding other 7062E/ET units as mesh nodes, managed directly from the router’s Mesh/Network Map screens.

Tip: If you want to mesh GWN76xx access points, use a router that can manage/pair APs. If you want a router-to-router mesh, use the 7062E/ET mesh node approach.

Getting Started

Connect to the router’s local network first (LAN cable or the router’s Wi-Fi), then open the Web UI using:

  • Default IP address: https://192.168.80.1
  • Domain name: myrouter.grandstream.com (for GCC60xx use gcc.grandstream.com)
  • Username: admin
  • Password: the random password printed on the router’s MAC sticker/label (device tag).

Note: On first login (or after a factory reset), some models may prompt you to change the default password before continuing.

On a new or factory-reset router, check the physical port markings first: ports are usually labeled WAN/LAN or use an icon (for example, a △ symbol can indicate a factory-default WAN port).

If the router was used before, don’t trust the labels alone, because ports can be reassigned. In that case, log in to the Web UI and confirm which ports are currently set to WAN and LAN.

Note: This matters. Plugging your uplink/switch into the wrong side can cause network issues (for example, connecting the LAN side into an existing network can create multiple DHCP servers and break client connectivity).

Check the sticker/label (MAC tag) on the router.

  • Default SSID: GWN + the last 6 characters of the router’s MAC address (example: GWN6343B0).
  • Default Wi-Fi password: also printed on the same sticker/label (often shown as the Wi-Fi key and/or inside the QR code).

Start with Automatic/DHCP (it’s the default for most ISPs).
If your internet doesn’t come up, use the option that matches what your ISP gave you:

  • PPPoE: only if you have a PPPoE username + password from your ISP.
  • Static IP: only if your ISP gave you a fixed IP + subnet mask + gateway + DNS.
  • USB 4G/5G modem: only if your router model supports it (you’ll enter APN/SIM settings).

After saving, check the WAN status: it should have a WAN IP and show “connected/online”.

Some Grandstream routers support PoE-in, meaning they can be powered either by the included DC power adapter or by PoE on a dedicated PoE-IN port (on supported models).

Best practice: use the power adapter that comes in the box for the most stable operation. If your PoE source (switch/injector) can’t provide enough power, the router may behave unstably (random reboots, features not working reliably).

Note: Not every router has PoE-in, so if you don’t see a dedicated PoE-IN port, it’s adapter-only.

Network Configuration

You can change a port role (WAN/LAN) from the Internet/WAN settings page.

  • GWN700x / GWN70x2 / GCC60xx: Network Settings → WAN → Add (or Edit) → choose the Port → Save/Apply.
  • GWN7062E(T): Advanced → Internet Settings → select the port → Property: WAN/LAN → Save.

Caution: Unplug the cable from the port before switching its role. A WAN port expects an IP from upstream, while a LAN port typically serves devices (and may hand out IPs via DHCP). Changing it while connected can disrupt the network.

It depends on whether the model has fixed WAN/LAN ports or configurable ports.

  • Fixed WAN/LAN models: the number of WANs is limited to the ports labeled WAN (you can’t convert LAN ports into WAN).
  • Configurable WAN/LAN models: you can add WAN interfaces, but at least 1 port must remain LAN for local access.
    Rule of thumb: Max WANs = total physical ports − 1 (example: 5 ports → up to 4 WANs).

They’re three ways to use multiple uplinks: Load Balance = use them together, Backup = fail over to an active backup, Standby = fail over to an inactive backup.

  • Load Balance: Sends traffic across multiple interfaces using weights (ratio) so you can split traffic proportionally. Use it when: you want to utilize more than one WAN at the same time.
  • Backup (Failover): Uses preferred interface(s) first, then switches to alternate interface(s) only when all preferred links are down. Backup links stay active/ready, and weights can still apply after failover. Use it when: you want redundancy with fast switchover, but still prefer a “main” WAN.
  • Standby: Keeps one standby interface inactive, and only activates it when all preferred links fail (commonly used to avoid PPPoE session/authentication conflicts). Use it when: the backup link must stay offline until needed (PPPoE conflicts, metered backup, etc.).

Weight controls the traffic share per WAN in Load Balance mode (higher weight = more traffic sent through that WAN).

  • Example: WAN1 weight 3 + WAN2 weight 1 = about 75% / 25% split across many connections.
  • If you want an even split, set the same weight on both WANs (example: 1 and 1).

Create two Forwarding Rules that deny traffic in both directions between the two VLANs/subnets.

  • Go to Firewall → Forwarding Rules → Add.
  • Rule 1: Source = VLAN/Subnet A, Destination = VLAN/Subnet B, Action = Drop (or Reject).
  • Rule 2: Source = VLAN/Subnet B, Destination = VLAN/Subnet A, Action = Drop/Reject.
  • Move both rules above any broader “Allow” rules, then Save/Apply.

Tip: If one VLAN still needs limited access (example: an admin VLAN managing devices), add a specific Allow rule for that one flow and keep it above the deny rules.

No. Routing all network traffic through the WireGuard VPN, or configuring the route as 0.0.0.0/0, is not supported.

Features & Security

Use WireGuard for most remote users, IPsec for site-to-site tunnels, and OpenVPN when you need maximum client compatibility.

  • WireGuard (Recommended): Best pick for remote access (client-to-site). Fast, low latency, lightweight, and easy to deploy/export profiles.
  • IPsec: Best pick for site-to-site between two networks (router-to-router). Very common in business deployments and generally reliable for permanent tunnels.
  • OpenVPN: Best pick when you need broad compatibility and flexible authentication (certificates/users). Usually slower than WireGuard.
  • L2TP / PPTP: Use only if you must support legacy clients. PPTP is not recommended (weak security). L2TP alone does not encrypt traffic unless paired with IPsec.

Tip: If performance matters, start with WireGuard (remote users) or IPsec (site-to-site). If a client/device can’t support them, fall back to OpenVPN.

They control traffic in three directions: to the router, from the router’s networks, and between networks.

  • Inbound Rules: Control traffic coming from WAN to the router itself (management access like Web UI/SSH/VPN services). Use this to allow or block WAN access to the router.
  • Outbound Rules: Control traffic going from your LAN/VLANs to the Internet (WAN). Use this to restrict what internal clients can reach externally.
  • Forwarding Rules: Control traffic going between internal networks (LAN ↔ VLANs ↔ VPN zones). Use this to isolate VLANs or allow specific inter-VLAN access.

Tip: If you’re trying to control device-to-device traffic across VLANs, you want Forwarding Rules. If you’re trying to stop the Internet from reaching the router, you want Inbound Rules.

Enable WAN Web access in the router’s management settings, then (optionally) restrict it to trusted IP addresses.

  • GWN700x / GWN70x2 UI: Go to System Settings → Security Management → Web Service → enable Web WAN Port Access → set the HTTPS Port → Save.
    To restrict access: add entries under IP Addresses Allowed Through WAN, then Save.
  • GCC60xx UI: the settings are under Home Module → System Settings → Security Settings → Web Access tab.
  • GWN7062E / GWN7062ET UI: Go to Access Management → Access Control → under WAN enable Access through WAN → set the HTTPS Port → Save.
    To restrict access: add entries under IP Addresses Allowed to be Accessed, click Add, then Save.

Note: If the “Allowed IPs” list is empty, WAN Web access is allowed from any public IP. If you add IPs, only those IPs are allowed.

On the Port Forwarding page, create a rule that maps a public (WAN) port to a private device IP and service port.

Required fields to complete the mapping:

  • Interface: Select which WAN interface the rule applies to (WAN1/WAN2).
  • External Port: The port opened on the router’s WAN IP (the port users connect to).
  • Internal IP Address: The private IP address of the target device on the LAN/VLAN.
  • Internal Port: The service port running on the target device (e.g., 80/443/22).

Optional (access restriction): Use Source Address Type / Source Address to limit who can access the forwarded port. If left empty, the rule accepts connections from any source.

It depends on the router model:

If the router speed is limited or below 200 Mbps, verify whether hardware acceleration is disabled. If it is disabled, enable hardware acceleration to increase the router speed.

No. The GWN7062E/ET/M do not include an AP management controller and therefore cannot manage access points directly.

No. It is not possible to change the router’s certificate. The Certificate section is only used for certificates that will be applied to VPN connections.

Maintenance & Troubleshooting

  • From the Web UI: Go to the Factory Reset page, click Factory Reset, confirm, then wait for the router to reboot to defaults.
  • Hard reset (RESET pinhole): With the router powered on, press and hold the RESET pinhole/button until the device indicates a reset/reboot (LED change), then release and wait for it to boot with default settings.

Note: it’s recommended to use the Web UI method when possible, and exporting a configuration backup before performing a factory reset.

Caution: Disconnect network cables before resetting. After a factory reset, ports return to their default WAN/LAN roles. If you previously reassigned ports, reconnecting too early can cause the router to start handing out IPs (DHCP) on a port that used to behave differently, which may disrupt the network.

If you forgot the local admin password. Use one of the options below:

  • If the router is managed in GDMS Networking (cloud):
    You can set a new Device Password from GDMS (device Configuration page). After it’s applied to the router, you can log in locally using the updated password.
  • If the router is not reachable/managed in GDMS (or the change can’t be delivered):
    The only option is a factory reset to restore default access, then set a new admin password.

Note: If you have a recent configuration backup, restore it after the reset to bring back your settings.

Go to Maintenance → Backup & Restore, then click Export to download the current configuration file.

  • The router saves a backup of all current settings (WAN/LAN/VLAN, firewall, VPN, policies, etc.).
  • Store the file somewhere safe so you can Import it later if you reset the router or replace hardware.

Best practice: take a backup before major changes or firmware upgrades.

You can upgrade firmware either by uploading a .bin file (manual) or by using Grandstream’s firmware server path.

  1. Manual upgrade (upload a .bin file)
  2. Upgrade using firmware server path
    • From the firmware page above, copy the Firmware Server Path for your model.
    • In the router Web UI, go to the Upgrade page, paste the Firmware Server Path, then Save and Detect/Check for the new version.

Optional:

  • Beta firmware: Use firmware.grandstream.com/BETA as the server path to pull beta releases.
  • DHCP-provided server: If your network provides the upgrade server automatically, enable the option that allows DHCP override for the firmware server.

Note: it’s recommended to back up your configuration before upgrading.

Set the router’s Time Zone and NTP Server under System Settings → Basic Settings, then click Save.

  • Time Zone: pick your correct region/timezone first.
  • NTP Server: keep the default pool servers or replace them with your internal NTP if your network requires it.
  • If time won’t sync, make sure the router has working Internet/DNS (NTP needs it) and that NTP traffic isn’t blocked by upstream rules.

Why it matters: wrong time can break VPN authentication, cause HTTPS/certificate warnings, and make logs useless when you’re troubleshooting.

Was this article helpful?

Yes No
Need Support?
Can’t find the answer you’re looking for? Don’t worry we’re here to help!
Contact Support