July 12, 20241 yr I just wanted to post a thankyou to PeteAsking....... And likely a goodbye. This container filled a hole for me for a while this year while waiting forever for the Unifi stock to come in for Australia. I am live on my new Cloud Gateway Ultra now which has a built in controller that must be used. Your container is now stopped and moved to the bottom of the list where it will stay in the event I move back to the old USG, which is unlikely is I am also taking advantage of the extra ports in the CGU and have incorporated it fully into my HA plans this way - i.e it is a direct swap for the duplicated config on an EdgeRouterX - just switch the cables port for port and it is up and running.
July 13, 20241 yr 21 hours ago, vw-kombi said: I just wanted to post a thankyou to PeteAsking....... And likely a goodbye. This container filled a hole for me for a while this year while waiting forever for the Unifi stock to come in for Australia. I am live on my new Cloud Gateway Ultra now which has a built in controller that must be used. Your container is now stopped and moved to the bottom of the list where it will stay in the event I move back to the old USG, which is unlikely is I am also taking advantage of the extra ports in the CGU and have incorporated it fully into my HA plans this way - i.e it is a direct swap for the duplicated config on an EdgeRouterX - just switch the cables port for port and it is up and running. You should still be able to back up and export the container network application config to the official hardware maintaining any rules, adaptions and other previous setups in the Official Hardware. I myself am slowly saving up for a UDM-Pro-SE for unifi protect and network application needs.
July 13, 20241 yr Author You guys should just save up for a opnsense box. Its way cheaper and better anyway.
July 13, 20241 yr Author 8 minutes ago, vw-kombi said: I like the unifi 'unified' approach...... One interface to rule them all. Yes but that quote was one of dread and warning dont forget.
July 14, 20241 yr 1 hour ago, PeteAsking said: You guys should just save up for a opnsense box. Its way cheaper and better anyway. Funny, you should say that I'm currently testing opnsense software on other hardware. Irony So why not. Having 10 years os ISP tier level 2/3 and otehr backgourd lets talk about opnsense. ATM its satisfying my needs of the experiment. Opnsense has a better IDS/IPS system built-in and in place. A Perfect implementation of DNS via (unbound/dnsmasq) and has integrated the ics dhcp with ikea fairly well. I did have to sideload and break into Freebsd quite a bit to fix some non opnsense things for my needs but it one of the better systems out there. My quick go to for something that just works is still ipfire... Lots of pros and cons with any networking/router os and systems... throw it in a VM and test it sometime... https://opnsense.org/download/ Better to follow some youtbue video to use opnsense... My 4 Major cons with opnsense atm is: Opnsense is freebsd. Was not a easy installer setup...(https://docs.opnsense.org/manual/install.html#installation-images) I would have prefered a better community or supported distro like Debian... alot of documentation is old referencing freebsd 11,12,13 its version 14 with 15 coming soon... *Con Other Personal reasons and issues with bsd / unix... more with community and unpatched CVEs... had to sideload and force a few fixes against cve that should have been default fix out of box... Opnsense will use FreeBSD packages but not maintain the actual distro packages. Hence, the side load of some common apps and other patches... *I would have ran pfSense to keep the underlying distro up to date and more secure knowing what i know now... Opnsesne doesn't have a good system for AP/Wifi...(https://docs.opnsense.org/manual/how-tos/interface_wireless_internal.html) ...https://srobb.net/fbsdquickwireless.html ... I have already submitted a few support and bug fixes... Openness doesn't have a good muti wan setup (https://docs.opnsense.org/manual/how-tos/multiwan.html) *Broken routing with muti wan fail over when it happens... https://www.tspi.at/2020/02/28/wlanethfailoverfreebsd.html --A manual assignment of the wan interface should fix that but doesn't... hence bug reports... added mimugmail(https://www.routerperformance.net/opnsense-repo/) repos to get/try os-unifi The unif 7 is stable and works. unfi 8 is a build behind and is not recommend to run to maintain current network application setups. IMHO BUT yeah... Opnsesne boxes... Sorry from similar comparison of multiple setups, installs and test, Unifi still has a leg up on them. If we are willing to talk true hardware its brocade(foundry) and MikroTik but thats ISP backend stuff. Edited July 14, 20241 yr by bmartino1
July 14, 20241 yr Author 22 minutes ago, bmartino1 said: Funny, you should say that I'm currently testing opnsense software on other hardware. Irony So why not. Having 10 years os ISP tier level 2/3 and otehr backgourd lets talk about opnsense. ATM its satisfying my needs of the experiment. Opnsense has a better IDS/IPS system built-in and in place. A Perfect implementation of DNS via (unbound/dnsmasq) and has integrated the ics dhcp with ikea fairly well. I did have to sideload and break into Freebsd quite a bit to fix some non opnsense things for my needs but it one of the better systems out there. My quick go to for something that just works is still ipfire... Lots of pros and cons with any networking/router os and systems... throw it in a VM and test it sometime... https://opnsense.org/download/ Better to follow some youtbue video to use opnsense... My 4 Major cons with opnsense atm is: Opnsense is freebsd. Was not a easy installer setup...(https://docs.opnsense.org/manual/install.html#installation-images) I would have prefered a better community or supported distro like Debian... alot of documentation is old referencing freebsd 11,12,13 its version 14 with 15 coming soon... *Con Other Personal reasons and issues with bsd / unix... more with community and unpatched CVEs... had to sideload and force a few fixes against cve that should have been default fix out of box... Opnsense will use FreeBSD packages but not maintain the actual distro packages. Hence, the side load of some common apps and other patches... *I would have ran pfSense to keep the underlying distro up to date and more secure knowing what i know now... Opnsesne doesn't have a good system for AP/Wifi...(https://docs.opnsense.org/manual/how-tos/interface_wireless_internal.html) ...https://srobb.net/fbsdquickwireless.html ... I have already submitted a few support and bug fixes... Openness doesn't have a good muti wan setup (https://docs.opnsense.org/manual/how-tos/multiwan.html) *Broken routing with muti wan fail over when it happens... https://www.tspi.at/2020/02/28/wlanethfailoverfreebsd.html --A manual assignment of the wan interface should fix that but doesn't... hence bug reports... added mimugmail(https://www.routerperformance.net/opnsense-repo/) repos to get/try os-unifi The unif 7 is stable and works. unfi 8 is a build behind and is not recommend to run to maintain current network application setups. IMHO BUT yeah... Opnsesne boxes... Sorry from similar comparison of multiple setups, installs and test, Unifi still has a leg up on them. If we are willing to talk true hardware its brocade(foundry) and MikroTik but thats ISP backend stuff. You should test zenarmor. Works great as layer 7 filtering.
July 14, 20241 yr 3 hours ago, PeteAsking said: You should test zenarmor. Works great as layer 7 filtering. I may have to revisit it. Its not quite on my to do list. I skimmed past it when following a youtube video for a custom ips/ids lists. They had a previous video that setup zenarmor. I didn't want to duplcate protect wan/lan https://docs.opnsense.org/vendor/sunnyvalley/zenarmor.html its more learning the opensene web ui xyz option is where. zenarmor: (older setup video....) So I took a stab at it... For my needs, trying the free edition only. It doesn't hit them... Edited July 14, 20241 yr by bmartino1
July 14, 20241 yr a bit off topic. FYI you talked me into trying it... will give it a few days to see... ATM Zenarmor is not worthwhile for me... It does have great metrics, logs, and nice dashboard, I didn't want to use api, cloud control or remote app. Had to disable some currently enable that I believe have had better protection with ids/ips that zenarmor can supposedly do if I pay for it...(15 day free trial...) I can manually add to ids/ips and block what I need for free. I'm not paying a sub for services that are available for free and already implemented... Similar to adguard/pihole one can get similar forever list that work with ids/ips... Ok, Zen Armor (Paid Version) Trial is a nice adaption and a great IDS/IPS. After the 15 days. I will go back to the free version. Zenarmor home $10 amount sub is not bad. unifi needs better ids/ips but otherwise unifi still has me for the ecosystem. Edited July 15, 20241 yr by bmartino1 zenarmor opnsense is great
July 23, 20241 yr Hi! I have just moved to this docker from the old version and although I had some adoption problems, all is working great now, thank you! I just have a question that I thought I would ask here if that's ok as my setup is using unraid. I have 4 Unifi AP's that I manage with this docker, my in-laws have bought the house next door and seeing as I have full fibre I thought it would make sense to let them share our internet. I will be adding a 5th AP for them that will be meshed from one of mine but my question is can I just provide them with internet? I do not want them to have access to my network. I am running OPNsense on unraid as well if that helps? Many thanks!
July 23, 20241 yr Author 8 minutes ago, mbc0 said: Hi! I have just moved to this docker from the old version and although I had some adoption problems, all is working great now, thank you! I just have a question that I thought I would ask here if that's ok as my setup is using unraid. I have 4 Unifi AP's that I manage with this docker, my in-laws have bought the house next door and seeing as I have full fibre I thought it would make sense to let them share our internet. I will be adding a 5th AP for them that will be meshed from one of mine but my question is can I just provide them with internet? I do not want them to have access to my network. I am running OPNsense on unraid as well if that helps? Many thanks! If you create a vlan then you can segregate their network from your network. You need to have a unifi switch if you want to be able to do it via the unifi controller.
July 23, 20241 yr Hi, thanks for your reply, I do not want to add hardware, I can create a vlan with OPNsense I just cannot work out if it would be possible with my existing hardware as the Unifi AP would be meshed as I cannot get a physical wire to my in-laws AP
July 23, 20241 yr Author 1 hour ago, mbc0 said: Hi, thanks for your reply, I do not want to add hardware, I can create a vlan with OPNsense I just cannot work out if it would be possible with my existing hardware as the Unifi AP would be meshed as I cannot get a physical wire to my in-laws AP If you are plugging every AP into Opnsense it is possible. If you have other equipment in between its not possible. Meshed is fine also. What is impossible is having an ap plugged into a non vlan aware switch or port somewhere in the chain. Every device along the way to the client must be vlan aware for vlans to work and be configured correctly. When the client communicates with another device or out onto the internet via its gateway, the traffic is tagged by the first upstream vlan aware device (ie an AP in your case). From then on every hop must be via a device that is vlan aware, ie next hop is another AP where the tagged traffic is passed then to Opnsense. Then Opnsense reads the tagged traffic and decides what to do based on firewall rules and so on. If a packet passed a device that was not vlan aware it would be dropped at that point. Edited July 23, 20241 yr by PeteAsking
July 23, 20241 yr OK, thank you very much for the detailed reply! I need to have a think about the best & easiest way to do this as it is not my strong point!
July 23, 20241 yr 20 minutes ago, mbc0 said: OK, thank you very much for the detailed reply! I need to have a think about the best & easiest way to do this as it is not my strong point! You can use any brand of switch that support VLAN’s though. Doesn’t have to be Unifi. I know Microtik makes some fairly reasonably priced switches.
July 23, 20241 yr Thank you, I do have a GS1900-24 managed switch but I am using it as a "dumb" switch currently, everytime I have tried to configure a vlan on it, I end up factory resetting (almost certainly due to my lack of understanding) but it looks like I am going to have to try again! :--)
July 23, 20241 yr If I were to configure a "guest" Wifi within the unifi controller for my in-laws, would that still allow access to the rest of my network?
July 23, 20241 yr Author 10 minutes ago, mbc0 said: If I were to configure a "guest" Wifi within the unifi controller for my in-laws, would that still allow access to the rest of my network? Vlan is the most configurable option. Other options will prevent things like their being able to print to a wifi printer or use airplay and things like that. Best to do it properly with a segregated network.
July 23, 20241 yr 8 hours ago, mbc0 said: Hi! I have just moved to this docker from the old version and although I had some adoption problems, all is working great now, thank you! I just have a question that I thought I would ask here if that's ok as my setup is using unraid. I have 4 Unifi AP's that I manage with this docker, my in-laws have bought the house next door and seeing as I have full fibre I thought it would make sense to let them share our internet. I will be adding a 5th AP for them that will be meshed from one of mine but my question is can I just provide them with internet? I do not want them to have access to my network. I am running OPNsense on unraid as well if that helps? Many thanks! Unless your trying to remove the lan with the same ssid/wifi in a true mesh.... I don't see why you wouldn't run a cable and setup the AP for the house next door in guest mode. ? https://help.ui.com/hc/en-us/articles/115000166827-UniFi-Hotspot-Portal-and-Guest-WiFi you can target the one ap and set it up to do that, no vlans required. to clarify the ap next door would be connected to the mesh you would add a second guest ssid out of the same ap in this setup. just poe lan(for power only_) and ap is required in this case... Edited July 23, 20241 yr by bmartino1 youtube link to help(old interface may be need for some settings)
July 23, 20241 yr 4 minutes ago, bmartino1 said: Unless your trying to keep the same ssid/wifi in a true mesh. I don't see why you wouldn't run a cable and setup the AP for the house next door in guest mode. ? https://help.ui.com/hc/en-us/articles/115000166827-UniFi-Hotspot-Portal-and-Guest-WiFi you can target the one ap and set it up to do that, no vlans required. to clarify the ap next door would be connected to the mesh you would add a second guest ssid out of the same ap in this setup. just poe lan and ap is required in this case... This sounds interesting! I have 4 AP's connected directly to my switch on POE, the 5th one would be in my in-laws house but connected wirelessly as we are detached, there is no realistic way of running a cable. I just want to provide internet to them, nothing else! I will have a read of that link, it sounds perfect if compatible with my setup!
July 23, 20241 yr sorry Trying to explain... I know it possible I have set that up before. I think the guest does use a built in vlan to accomplish it. The ap would broadcast both the mesh network and guest. Client devices next door would connect to guest only... guest would use the mesh for connection. you can even set a differnt subnet such as next door is 192.168.2.x while your lan and mesh is 192.168.1.x ... I will glady assist where I can as i have set this up before. A min of 3 AP is required to setup a mesh. you have 4 which is great, and the 5th setup next door. Side note, with a unifi pro you could get a lan cable as well. over there added to the guest network... https://store.ui.com/us/en/collections/unifi-wifi-flagship-high-capacity/products/uap-ac-pro the AC pro comes with 2 nics, i was setting wifi bridges for VOLO(volo.net) work back in 2010 and recently a few months ago between friends/neighbors.... Your mileage may vary. As we had a udm pro and USG using site magic and other to help set certain settings that may not be available with just the docker... (example the docker iwht out a unifi switch may not have access to certain network settings...) Proof of concept though this is feasible. With just the APs only... the mesh acts as a wifi bridge to the ap next door. the ap next door is alos added to the guest network and the geust network is accessible through the mesh. the guest network is isolated form your lan and is internet only. the guest can be its own home group/lan group on that guest wifi... Edited July 26, 20241 yr by bmartino1 devie info
July 23, 20241 yr 1 hour ago, bmartino1 said: Hey! I really appreciate your time in answering! I will glady assist where I can as i have set this up before. A min of 3 AP is required to setup a mesh. you have 4 which is great, and the 5th setup next door. - Very Kind!! Side note, with a unifi pro you could get a lan cable as well. over there added to the guest network... https://store.ui.com/us/en/collections/unifi-wifi-flagship-high-capacity/products/uap-ac-pro Not sure what you mean by this? I have a mixture of 2X U6 Pro, 2X Lite, 1X LR. I was going to connect the AP in the in-laws house to POE for their network, which only consists of 5 IP Cameras, 1 Laptop, 2 phones, 1 Tablet and a TV. Can only a Pro device manage this? the pro comes with 2 nics, - I have U6 Pro and they only have one NIC?
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.