Hacker News Reader

Comment by basch | Hacker News Reader

>Assign static IPs for infrastructure like access points. This makes them easy to reach when reconfiguration is needed

Am I missing something, or did they buy consumer routers to use as access points?

Triplebyte, I can save you a ton of management, troubleshooting, and learning time: switch to Ubiquiti Unifi or an equivelant now, youll have one pane of glass to reconfigure every device. The devices will talk to each other, to help hand off clients between them. All channel management will be by the devices working together, they can throttle down power if they are causing each other interference. I cant even begin to list all the different benefits with a single set of settings vs devices that dont work together. Even an asus aimesh network would likely be better. Youre asking for a troubleshooting nightmare.

You can either pay a couple hundred a year for the management interface, or $80 for an on prem tiny little stick that hosts it. (paying for the cloud hosted one, has its benefits, and is my recommendation.)

Access Point - https://unifi-hd.ubnt.com/

POE Switch - https://www.ubnt.com/unifi-switching/unifi-switch-poe/

Management Interface - https://www.ubnt.com/unifi/unifi-cloud-key/ OR Cloud Management https://unifi.ubnt.com/

Router - https://www.ubnt.com/unifi-routing/usg/

You should never need to track down or log into individual devices to configure them.

I dont mean to be a complete ballsack, but isnt it weird for a company thats mission is matching talent to problems, to fail to find the talent to adequately address their problem, and to be giving authoritative (mis)advice on something they are not remotely domain experts in. It doesnt seem like the best advertisement.

That said, this is the KIND of post companies should be making when their seo expert says to use keywords. Good job writing about improving the internals of your company, and not just what your company does. Write a V2 of this post once you upgrade, and rename the old one, "How we Created (and then mitigated a Device Management and Troubleshooting Nightmare)

View on HN

Fine, I'll say it: Ubiquiti is not suitable for a business environment. They don't have a good track record of pushing out security fixes. They've blatantly violated the GPL (and introduced security vulns in the process). Their "enterprise" features don't work well (e.g. hardware acceleration, WPA+Radius). Depending on what you buy the PoE may be non-standard passive or it may not.

Unfortunately because they're primarily in the business of slapping a slick web interface on Vyatta they don't have the skill required to debug the hardware acceleration. They don't have a single clue how to get RADIUS to work with their fork of Vyatta. And their support is fine for a home lab situation.

And let's not speak of the chronically overheating stuff.

Note that nearly all of Ubiquiti's offerings are running modified OpenWRT, with a handful running a fork of VyOS which happens to be Debian plus some packages.

> Note that nearly all of Ubiquiti's offerings are running modified OpenWRT, with a handful running a fork of VyOS which happens to be Debian plus some packages.

EdgeOS is a Vyatta fork. Has Ubnt abandoned EdgeOS? It's been a few months since I've looked, but the version of Debian that's being used was end-of-lifed on MIPSLE hardware a while back so security updates are entirely incumbent upon Ubnt. There is no upstream support.

Which offerings are on OpenWRT?

The next version of EdgeOS , 2.0 that is currently in alpha, was rebased to Strech so this should be fixed soon enough.

Their Unifi APs have option of a LEDE based firmware option, but think it is just beta at the moment. You can choose between the LEDE version and the regular version.

On the one hand it's good they're updating to a supported version of Debian. On the other, how is it still in alpha? Wheezy was EOL'd on all architectures in May.

All of their wireless gear is OpenWRT based, EdgeOS is only used on the switching hardware. Their wireless gear has been mmuch more popular and has significantly more variety than the switches/routers Ubiquiti offers.

I've always so far heard a lot of good for ubiquiti on HN.

What would you suggest instead?

Which network vendor has better security updates? Can you point to a specific example of them not fixing a security issue that was addresssd by others?

How would you compare Microtik to Ubiquiti?

> Which network vendor has better security updates?

I'd imagine pretty much any network vendor doing business in the enterprise sector (e.g. HP, Cisco, Juniper, Dell, etc, etc)

> Can you point to a specific example of them not fixing a security issue that was addresssd by others?

I haven't looked recently, but when I last updated my ER-X I noticed that the latest available packages included a large number that were not up-to-date with the latest available security fixes.

One of the problems is that the version of Debian that the hardware (MIPS) Ubnt uses is end-of-lifed on the old version of Debian that EdgeOS is based on. Where most vendors could simply track the official Debian repositories, Ubnt is stuck rolling their own packages. If Ubnt has finally moved on to an officially supported version of Debian then this is less of an issue.

This is one of those I wish I had a better solution moments. For the home user this may not pose a challenge, but in a business environment I'd say that it's probably worth spending the big bucks on a vendor with a better track record. That's not to say there aren't other bad vendors, but it is to say that Ubnt gear does not belong outside of a home lab.

I haven't evaluated Mikrotek because the Ubnt stuff works well enough (but certainly not great) for me in the two locations I've got it deployed.

Cisco has not been having a good year, https://www.bleepingcomputer.com/news/security/hardcoded-pas...

Ubiquiti EdgeRouter Lite (not ER-X) is apparently supported by vanilla OpenBSD.

This is actually good news. Cisco has been doing real security audits, where they go through the source code with a fine tooth comb and look for hidden backdoors. And even better they're actually telling us about them instead of turning them off silently. You can bet that a significant number of competitors have similar issues with backdoors. This is a case where a vendor is actively looking for security problems and putting in place processes to prevent them vs the normal vendors who just respond to security reports.

Oh please.

The issue has more than one dimension. Apart from them being nice and auditing now, there is still the fact that their internal processes have allowed (and probably encouraged) stashed passwords in such a manner that 6 of them has been found in a really short time. Unless your process is total garbage you don't end up with 6 backdoor passwords like that without knowing it.

So for any company that prides themselves with having a device in the middle of LOTS of networks, its a very poor track record to figure out security and backdoors don't really mix in 2018.

> Ubiquiti EdgeRouter Lite (not ER-X) is apparently supported by vanilla OpenBSD.

The ER-L is what I spoke of when I referred to the chronic overheating problems. From a different reply to my comment it sounds like there may be other Ubnt devices that suffer the same fate. The ER-L also has issues with reordering UDP packets.

The downside of the vendors you listed (and Cisco) is they require a support contract for software updates. If you lack said contract, you do not receive security updates.

Imo ubiquiti works fine for smaller offices. If you don't have enough people to justify an IT org it makes sense.

> If you don't have enough people to justify an IT org it makes sense.

Disagree, and not just because of the GPL violations and security issues. There are enough subtle bugs (e.g. data corruption with hardware acceleration) and design flaws (e.g. overheating) that you are setting yourself up for intermittent bugs (a.k.a. trouble) if you don't have someone well versed in diagnosing network issues. It's powerful enough to do fun things in a home lab, but it's way too complex for a professional setting where there's nobody around with the skills to troubleshoot it.

Enterprise gear is expensive, yes.

_Thank you_. I'm constantly astonished to see folks extolling UBNT gear for anything other than WISP purposes (where it admittedly fits a price profile that's unmatchable). Read about the first ~10 months of the ES16-XG DAC support issues. Read about how EdgeRouters could never approach even 40% of line rate with fq_codel running. Read about how they lied about the future of the mFi line for 8+ months before abandoning it entirely. Not to mention the GPL stuff you note, the inconsistent and semi-nonfunctional PoE, and general lack of support or consistency.

At some level, you really do get what you pay for. They are great for people who want to set up a "homelab" without learning anything about actual networking, though.

Or $1000 switches that fail outside of warranty with no replacement power supplies available. https://community.ubnt.com/t5/UniFi-Routing-Switching/Failed...

Whats the better alternative to fit the needs of a shoestring startup (say 5-10devs)?

I have had good experience with MikroTik products. The are at a similar price point, but with a less refined interface but a lot more flexibility.

Mikrotik suffer from a gross amount of "Not invented here" reinventing existing open source protocols such as OpenVPN, a custom sshd and web server, and it shows with their amount of issues (how many years has it taken to add UDP to their OpenVPN server?). In some ways I think their no better then UBNT in some ways.

Tell you what. I used to have a Mikrotik CRS125 switch in my home office, and by default if you have a set of ports where one has no VLAN assigned, and the others have untagged VLAN assignmnets, any broadcast traffic on the untagged port(s) without a VLAN leaks to the ports with an untagged VLAN. This isn't well documented in the manual, and to fix it you either disable "Invalid VLAN Forwarding" (I think) and/or move said ports without a VLAN to a VLAN.

Many of Mikrotik can be loaded with debian or openwrt, its hardware is solid

My CRS issue suggests otherwise (could just be CRS), but ignoring OpenVPN I haven't had many issues with RouterOS. It's good to have the option though.

I have run it at 2 startups and it works great. Current startup is all Unfi stuff including 3 switches and 8 APs for with around ~150 devices connected to Wifi. We use RADIUS just fine for auth for the users. No issues at all. We do not use their firewalls, we use PFSense. I do use a USG at home with no issues.

RADIUS support is a well known issue. In my case it works better with some Apple hardware than others. Conversely, the Cisco gear at megacorp has never given me any authentication problems.

https://community.ubnt.com/t5/UniFi-Wireless/UniFi-AC-AP-iss...

Really depends IMHO, at least when it comes to the APs. Yes, it's not enterprise-grade, but their APs are also way cheaper than anything enterprise and do the basics well enough. Average small business office use doesn't require much in the way of features, although how long various RADIUS features took was a bit embarrassing (I seem to remember putting clients in different, RADIUS-controlled VLANs wasn't possible for a long time).

Never really trusted their other product lines.

How much does the price difference really matter? An Ubiquiti AC HD is $300. You can get an equivalent Ruckus AP (R710) for about $815. In a small office, that might add up to a couple of thousand dollars extra for APs. That's like a week's rent for a Bay Area office.

>And let's not speak of the chronically overheating stuff.

Some-time wireless installer here, I bring a snippet of anecdata.

A recent client had the full Unifi experience for an outdoor network, including 3x EdgeSwitch XP (formerly known as ToughSwitch) in a single IP65-rated, largely airtight enclosure.

The network would go offline on summer afternoons. It was overheating, those models run hot and are not recommended for low ventilation areas, but they weren't convinced.

I fitted a thermometer, went back three days later and checked the logs. The temperature peaked at 143 Celsius.

143 Celsius??? That's 289.4 Fahrenheit, which I find difficult to believe. Not impossible... just difficult. That's quite impressive.

The heat problems are real. I mounted one to the underside of a cabinet, and it melted the plastic lining on the opposite side of the wood. They run extremely hot.

If memory serves the ER-L idles at around 40C exterior temp. That was the primary reason I went with the ER-X despite hooking it up to a gigabit uplink.

In fact if it was actually reaching 143 C, I'd say that ironically I'm more positively impressed by the fact the hardware works at all at that temperature than I am negatively surprised by the fact that its thermal controls are that bad.

For completeness, that was when the summer sun was shining directly on the enclosure in the hottest part of the day, during a country-wide hot spell. Still, no airflow, heat generation, etc.

Every day, cut out. When it cooled down, it worked again. This continued for about two months, then they failed.

Sure that's kind of a worst case scenario there. One of the bigger problems with the ER-L design, IMO, is that they don't have any sort of temperature measuring device inside the case itself. They run hot even without extreme ambient temperatures so you'd think there'd be some baked in way to monitor the temperatures, but no.

Hey, just a little ysk: it's anecdote / anecdota from the greek word meaning "unpublished", nothing to do with data! :)

"Anecdata" is usually online shorthand these days for saying, "I know the plural of anecdote is not data, but fwiw here's my experience."

^ This is what I meant by it. Not corroborated by any scientific study, just a field report.

> Not corroborated by any scientific study, just a field report.

But that's exactly what "anecdote" means already, why change it?

It’s a joke, derived from the saying “the plural of anecdote is not data.”

> The temperature peaked at 143 Celsius

Most electronic devices say operate between x and y degrees and if in full sunlight the temp may have exceeded y, which in a device that generates heat itself led to runaway overheating?

Either way plastic could melt at that temp and you'd definitely burn your hands touching it. Pretty crazy.

The housing of the switch is metal with rubberised feet and bumpers. Thankfully I wasn't handling it when it was offline (and hottest), but the rubber was completely destroyed after the fact

I assume the soldered innards failed, though I never did open it up to check properly.

Outdoor network + airtight enclosure + summer + full sun ... 289 degrees doesn't surprise me.

This sounds like unrealistic expectations and a poorly designed implementation.

Ubiquiti is not suitable for a business environment

I'd say that Ubiquiti is perfectly suited for a small business environment -- definitely a big step up from discrete consumer Asus routers throughout the office with no central management (and probably haven't been patched since the day they were installed).

Ubiquiti may not be suitable for a mid to large sized business, but for up to a ~100 person office or so, they come in at a great price point and have decent performance and manageability.

Asus-Merlin firmware is regularly patched and is available on many models

But can you easily roll out that new firmware to 20 Wifi nodes spread over 3 offices in 3 different cities?

Just because patches are available, doesn't mean that someone's going to take the time to apply them. Having a central management console makes this much easier. Upgrade one node, make sure it works, then roll out to the rest of the nodes one by one with one click.

I loved the ubiquiti stuff for years. Then one day two years ago macs suddenly could no longer reliably connect to the outside world even with a strong wifi connection to the AP. I would send pings and have 40% packet loss. Weirdly I could ssh into any of the APs and ping with 0% packet loss.

We could never fix it and switched over to google appliances. We rarely have over 20 people in the office.

I've heard great things about Ubiquiti's products, so I recently evaluated both their USG security gateway and EdgeRouter4 products using only wired gigabit ethernet.

I found it weird that the UniFi line of products and the EdgeMAX line of products while very similar in terms of specs and their target markets, use completely different remote management systems (UniFi vs. UMNS).

While some really folks like their management GUI, I found that once you wanted to do anything not bog standard with it, you were on your own. I had to SSH into both devices and enter EdgeOS (Vyatta) commands for even relatively simple things like disabling NAT on the ER4 or configuring mutual TLS with OpenVPN. With IpSec there are so many different possible parameters that the GUI just didn't have enough widgets to cover them all.

I found the USG security gateway too underpowered for my purposes. I wanted a device I could use for IDS/IDP as well as a dedicated VPN. With hardware offloading disabled (which you need for IDS/IDP) the throughput of the USG is limited to around 130 Mbps.

Using IpSec on the USG (ESP:AES-128-SHA1) I was able send (encrypt) data at 70 Mbps and 56 Mbps on receive (decrypt). Don't even think about using OpenVPN with this device, as it's single-threaded and can't take advantage of any crypto offload -- only managing around 14 Mbps of throughput.

If you are using the USG for a VPN you can get much better performance with WireGuard. I managed to get 90 Mbps encrypt, 111 Mbps decrypt with it, which is likely good enough for a lot of folks.

The EdgeRouter4 was faster, but it had a weird issue with IpSec. I was able to get it to encrypt at 631 Mbps, but only decrypt at 229 Mbps. On encrypt (send) I could see that the CPU was 376% utilized (it has 4 cores) with most of that spent dealing with software interrupts. On decrypt (receive) it only 167% utilized -- so something was wrong there.

The EdgeRouter4's OpenVPN single core performance was more than 3x faster than the USG, clocking in at 43 Mbps, and best with WireGuard at 636/597 Mbps encrypt/decrypt.

I used iperf3 on a remote host on my simulated WAN for measuring throughput like:

    iperf3 -c host_behind_router -P4 -t120 # decrypt
    iperf3 -c host_behind_router -P4 -R -t120 # encrypt

Ultimately I found the whole dance of having devices being adopted by the controller software and then being provisioned by it to be tedious and unnecessarily faffy -- especially considering how often I had to drop into EdgeOS to get things done.

You were using the $100 USG?

https://unifi-xg.ubnt.com/usg-xg-8

https://www.ubnt.com/unifi-routing/unifi-security-gateway-pr...

Yup. The network engineer in me would never recommend Ubiquiti for any scenario. Maybe it works for WISP because of the price point; I'd have to be convinced.

They run an embedded Mongo DB on their UniFi hardware that (at least in the deployment I've inherited) requires occasional direct interventions[1] to keep running. That's just one example of the many baffling/wrong things they do.

I know Mongo gets quite a bit of undeserved hate, but it really just doesn't seem suitable for this use case.

[1] https://help.ubnt.com/hc/en-us/articles/360006634094-UniFi-S...

My IT MSP solely sells and supports unifi WAPs, and I have no idea what you're talking about.

We have dozens of WAPs under management across the city and state, and I've never seen any of the issues you guys are talking about. We don't have issues with database crashing or overheating. The wap controllers are configurable for automatic firmware updating, so I don't know what the issue is with patching. They definitely support wpa-e/radius because I've configured it and we use it in my my office.

A personal goal of mine is to buy a unifi wap and a modem (already have a router and firewall) and divorce from ISP equipment altogether. Then I can start posting on /r/homelab :)

I have an office with a few of those and they are not great and do overheat. I am quite surprised you having been exposed to a great number of them never had an issue.

They have a lot of models and we usually sell ac-pros and ac-lrs. Maybe there are issues with higher/lower grade versions...

You have dozens of devices in what sounds like small locations across your state. I have 11k users online in North America and I would never trust Unifi for any part of my network. They have their place but enterprise is not one of them. SMB is not the same.

I agree fully, its not enterprise grade. Triplebyte is a 30 person office.

All parents and responses to my posts are probably right, and I'm probably wrong!

My experiences aren't wrong, of course, but it's an apples to oranges comparison. My IT MSP is only small to medium sized businesses (as I think all IT MSPs are since Enterprise level environments don't contract out it and hire their own department - this is an educated guess). We do very little Enterprise work and have no single client with more than 300 users.

However, I will defend my position and consumer grade ubiquitis on a (significant) technicality. Higher models beyond what my company sells are not cost effective. Buying higher grade waps at no less than double the price is more expensive than just running cables. If you WANT to make everyone get 200mbps wifi, you will pay for it, but that's a convenience you pay for, not a requirement. UAP-AC-Pros are perfectly capable of handing out up to 50mbps pipes to multiple endpoints without huge (or even medium) upfront capital investments, overheating or DB problems. In my opinion, just run cat6 lines. Itll be cheaper than spending thousands on Enterprise waps for only 30 people.

Maybe he hasn't had overheating problems because he is kryogen1c.

(I'll see myself out...)

> They definitely support wpa-e/radius because I've configured it and we use it in my my office.

Sure, and problems with RADIUS auth have been well documented. How much of the not seeing issues is simply a matter of users assuming your setup (or their phones or computers) is flakey? Issues with Mongo are also pretty well documented.

https://www.google.com/search?q=ubnt+mongo+issue

> The wap controllers are configurable for automatic firmware updating, so I don't know what the issue is with patching.

The issue with patching is that Ubnt is in a bad position. They're on their own completely to create and issue patches even for stock packages. That's just what happens when you distribute EOL'd software. So, sure, it's not that hard to apply patches* from Ubnt but it's a lot more work for Ubnt to generate these patches — and last I checked they were pretty well behind with the excuse of "there are no known exploits for ABC in the wild".

* Let's not forget the ER-X bootloader for which end users are entirely on their own. Ubnt has a patch but hasn't applied it to the devices they ship. It's just lazy and sloppy.

Sources for all of these claims? I have and recommend their products wholeheartedly. This isnt something that is opinionated. Their pro products are amazing. Maybe you are referencing outdated or consumer level product offerings? Giving you benefit of the doubt and just going to say, right and roll my eyes.

Yup, all of this. Their HW really is that good for the cost.

Ars' article[1] was the thing that pushed me over the edge and don't regret it at all. Rock solid APs, central management, isolated vlan+ssid just for IoT, just all around good. Was about $300 to get all setup and outstripped all my "pro-sumer" gear by miles.

[1] https://arstechnica.com/information-technology/2018/07/enter...

This a thousand times.

The very start of a strong network is a solid Dynamic DNS + DHCP setup. The only IPs that should be static are the router's.

In a small office, using your firewall/router is not a bad choice to DNS+DHCP. For companies < 100 and WAN connections <1gig pfsense is perfect.

Segment your APs and servers etc into different VLANs with distinct IP pools, bonus point for different subdomain. This allows your to firewall it off to prevent prying eyes. It also means that if something were to get into your VPC, and then over the VPN, they can't fiddle with your APs quite so easily.

As for ethernet always buy in cables, but get good sockets and patch panels. It is worth the money to hire a wireman/woman to do that for you. Unless you've been practising its a long boring slog, time you should be spending doing your real job....

Ubiquity again is a solid choice for wifi. I've deployed ~50 to cover 1800 person office. Beware, the non "pro" versions of the APs don't use proper PoE, so you'll be stuck either using their injectors(ok for small places) or buying their switches.

SOme of the pro APs have built in speakers (https://www.ubnt.com/unifi/unifi-ap-ac-edu/) which might be fun. They have proper PoE too, so you can use a real switch.

Looks like the UAP-AC-EDU is PoE+

I agree though, all my APs run on DHCP.

The UAP-AC-LITE used to be only 24V passive PoE but has supported real 802.3af PoE for a while now.

The above may sound like an Ubiquiti ad, but I've tested a few top specs routers about 2 years ago and settled with unifi for my home installation. I needed a good coverage and reliability for my home automation, e.g. when I switch lights on/off I want a consistent few milliseconds latency.

One of the FEW downsides for smaller installations, is them not selling a Cloud Key, Gateway, and Switch in a single box.

I agree. Right now I have the edge router lite. I have it setup so 4 ports are switched together and then I use poe pass-through to power my access point. Then I run the unifi software on a raspberry pi.

I would love at least a gateway/cloud key combo to simplify things. The separate switch doesn't bother me as much though.

one more thing to go wrong in the field, one more cable to get unplugged. a key/gateway/24portPOEswitch would be a single device people can run ethernet to for APs, and plug their office pcs into. If you have a rack its irrelevant, but for some kind of trailer where its sitting on the floor... or mounted to a wall.

That's not happening any time soon.

The gen2 cloud keys don't do that, although the gen2 plus model merges the cloud key and NVR appliance into one device.

What are you talking about? There’s https://amplifi.com/ for, let’s say, less sophisticated home installations.

which tends to fair poorly compared to orbi, asus, velop and others. a bottom of the pack product at the moment. its also not part of the unifi family, and doesnt have the advanced management interface.

Amplifi is apples to oranges with their full setup.

I installed an Amplifi AP/Router at my parent's house. It works absolutely phenomenally for their use case, but is basically plug and play. The Ubiquiti gear is worlds more configurable.

This drives me insane! I get that in a commercial environment those are typically treated differently, but at home I want one device that I can manage everything from.

I'm currently commandeering a R-Pi as a controller, but I tend to misplace it when it gets pulled into other projects.

I just ran both UNMS and the UniFi controller on a gcp instance (free credits). Their software is unconsistent though (the fact that there’s separate UNMS for the edgerouter and UniFi for the aps should already tell you that) but for example: the UNMS container sets up letsencyrpt etc but unifi does not.

Had to modify it to mount bind a shared cert location.

I installed Ubiquiti at home and it was a terrible experience. I really wanted it to work, but my wife teased me long enough about my "professional grade" installation that I gave up. She was right.

The biggest issue was range, which was much worse than what I got with I had with a traditional consumer access point (I had a TP-Link Archer C7.) It was not even close.

The handover didn't work very well either. Much older UniFi products used Qualcomm wifi chipset which had excellent hand-over, the later versions used Broadcom which didn't have that yet.

I replaced everything with Eero, which just worked.

The AmpliFi product line of Ubiquiti supposedly offers similar features as Eero, but that didn't exist yet when I made the switch.

The problem with UniFi is people read about how great it was for someone who somewhat haphazardly flung a few APs around their house and lived happily ever after... and for many it's just not going to work out that way.

A lot of work can go into making WiFi work well.

With multiple APs you've got to adjust the Transmit power (defaults to Auto, which means High, which is generally bad). For good roaming, increasing the minRSSI is critical. 5G and 2.4G have very different propagation characteristics so they need to be optimized individually. With several APs you may even want to disable 2.4G on some of them.

Band Steering may or may not play nicely with the devices you have. Some devices have trouble if they can see many APs advertising the same SSID -- Ring Doorbells are notorious for not being willing to associate to an SSID at all if many APs are advertising the same SSID.

At my old house I got away with one AP placed centrally in the attic and another in my detached garage. At my new house, at about 2.5X the size, I'm running 5 APs and it has taken me a solid month of fiddling to get my devices consistently associating to the best AP and roaming appropriately.

> For good roaming, increasing the minRSSI is critical.

This! I thought the UAPs sucked until I played with transmit power and especially min RSSI.

I’ve been using the UniFi line for about a year now, covering the whole property and house in rock-solid WiFi. It took a few hours of walking around with a laptop and tinkering with settings/placement but I couldn’t be happier now.

I love my Ubiquiti gear. Range isn't great, but in range it's absolutely rock solid. The only time I have downtime is when I upgrade or tinker too much an mess something up. I've had it for 3 years and don't see it petering out anytime soon. 3 to 5 years is the most I've had my consumer grade stuff last.

The fact that I can run VPN/Wireguard/Basic Network apps on my router is fantastic. If I ever get tired of the range (which is only an issue in my garage on the other side of the house), I'll simply get another AP.

Came here to say this. No networking engineer would ever buy consumer hardware for an office of this size. It will cost a lot more in management, debugging, and downtime. Spend the slightly more it will cost for devices that are able to work together.

And its even bad advice for a small home network vs an Orbi, AiMesh, or Unifi setup.

I use Unifi AP at home and a Fritzbox router.

At work I have a two sites of Unifi with cloud keys and an edge router. All visible on one management screen and super easy to configure.

Fabulous kit. Make sure you take a backup of the cloud key btw, they can get corrupted by a power interruption, and then you have to install from scratch. You can do this from the browser.

I wanted to caution people who are choosing Mikrotik at home. A lot of network engineers find their interface a bit weird, and by default they have way too much open on their public interfaces. I have seen one in the process of being brute-forced from ssh, that was installed by a qualified Mikrotik installer. If you want to plug and play the Unifi routers are a better option. Many have packet inspection features built in too.

The vast majority of peoples' houses don't have WAN connections that need the capabilities of the higher-spec mikrotik routers anyways. An RB3011 or RB4011 is overkill for a residential cablemodem or VDSL2 based last mile service, in terms of pps and Mbps capacity, and NAT pps ability. The ubnt ER-X ($48) is good for up to about 700 Mbps of traffic, and comes with sane defaults.

If you have truly symmetric 1 Gbps full duplex at home maybe you need the capabilities of an RB4011. But you should learn how to lock down its WAN facing interface.

The ubnt EdgeOS based devices are based on a fork of Vyatta. Ubiquiti hired most of the Vyatta software development team years ago when Brocade acquired Vyatta (the corporation). Ultimately they are little tiny Debian based boxes, since that's the foundation vyatta was built on.

Why an edge router over unifi, for smaller setups (Triplebyte is what, 30 office people?)

I wouldn't recommend an edgerouter for a small office, maybe something a bit more serious. I was describing what I'd recommend for a residential/personal small home office setup. Mine is basically a 32x8 capable DOCSIS3.0 cable modem that is a dumb L2 bridge to the cable ISP's CMTS, an ER-X router, a managed mikrotik fanless L2 switch for the LAN, and several $79 UAP-AC-Lite (802.11ac not wave2, 2x2 MIMO, dual band APs).

>residential/personal small home office setup.

Home/Offsite - https://www.ubnt.com/unifi-routing/usg/

Office - https://www.ubnt.com/unifi-routing/unifi-security-gateway-pr...

Large Office - https://unifi-xg.ubnt.com/usg-xg-8 (sweet 1U screen!)

$110, and same management interface as the AP's and switches. As you can tell, im prioritizing all-in-one management very heavily. One, managed, cloud, location for all my devices (minus sdwan, hosted by that vendor.) But the USG can do Auto IPSEC, so if you have 5 of them, you can tell all 5 to automatically keep connections to each other open. I havent fully tested a complex mesh of USG's yet, but id like to. It's getting close to even sdwan being expensive, compared to what these things can do.

One of the things I like the least about the Unifi management interface, is having to edit each site separately. If i want to make a router or ap/ssid change, I have to open each site.

From what I understand, some features on the USG aren't available unless you manipulate some JSON files, whereas they're exposed in the UI in the Edge Routers.

> by default they have way too much open on their public interfaces

They used to. Since about a year or so ago, the public interface is so completely locked down by default that I've heard people wondering if they've bought defective units (because they're trying to access management through eth1.)

> isnt it weird for a company thats mission is matching talent to problems, to fail to find the talent to adequately address their problem, and to be giving authoritative (mis)advice on something they are not remotely domain experts in.

SEO at its finest.

> All channel management will be by the devices working together, they can throttle down power if they are causing each other interference.

UniFi does not do this. At all. The Auto settings are the same as basically every other commodity AP out there -- look for the least noisy channel at boot, transmit full power, allow any client to remain associated regardless of signal strength.

UniFi has an ok tool for on-demand RF scans. It has all the appropriate knobs to tweak for optimizing coverage and encouraging devices with weak signal to associate with a better AP. But you have to do all of that yourself. Manually. Trial-and-error. There's absolutely no magic there.

yeah, I knew that and forgot thinking there was some kind of magic. too bad i cant edit these comments. by bad.

I have a full UniFi setup in my home office/house and it is glorious. It Just Works!

Well, with the one exception which is the Cloud Key. I’ve yet to see it run for more than 24 hours before soft rocking and requiring a total re-setup of the network.

I have my unifi controller running on a raspberry pie and it has been very reliable. Might be worth a shot.

I’m looking into hosting it on DigitalOcean, seems easy enough.

Having spent too much time on HN today, I’m going to try put a PiHole on the same Pi as a home controller that is especially under taxed. Will see if this combo works. https://news.ycombinator.com/item?id=18075159

The new (but not widely available) Cloud Key Gen 2+ model is much more stable. It also has a battery so it can gracefully shut down mongodb after 10 seconds of no power. The + model replaces the cloud key and nvr. There is a non-plus model coming as well but that hasn't been released yet.

I need a wireless bridge and am a bit overwhelmed with the various Unifi offerings. Can you recommend a setup?

Same as this , except with one change. For the router, use the (cheaper and more powerful) Mikrotik Routerboards. We don't use a Poe switch - we just use cheap Poe adapters and connect directly to the routerboard.

For those who have never touched a Ubiquiti, configuring it could be a little iffy . I normally advise setting up DHCP 43 advertisement on the router before trying to setup the access points.

But seriously, this stuff scales.

which router is iffy for you, Edge or Unifi? The Auto VPN tunnel being right in all my other network and wireless settings is nice. its fairly obvious from my posts im awarding a lot of value to consolidated management.

If you buy the APs individually, they come with power injectors, if you buy a 5 pack, they dont and its easier to home run back to a single switch. Less things to get unplugged.

I'm currently using Mikrotik happily for AP and router needs, but considering switching to a Ubnt setup for ease of management that does not depend on Windows/Wine and without having to write my own configuration management tooling. As central management is somewhat lacking.

What are your considerations for not choosing Ubnt for routing?

I'm not GP, but what drove me towards MT and away from Ubnt was Ubiquiti's history of violating the GPL [1].

[1] https://news.ycombinator.com/item?id=9331512

Is the Mikrotik any better in this regard? Has anyone taken them up on the offer of a GPL source code CD?

It seems they comply https://github.com/robimarko/routeros-GPL

the mikrotik cli is wonderful. you can script it all out. the UI is a little complicated, but oh well.

quick question - why do you need windows/wine for mikrotik ? we use the cli commands through the web console.

in fact we dont have windows in the office. granted you may be doing something more advanced than us, but curious to know.

I mostly manage my device setups with CLI/webfig. Sometimes winbox in wine as it is a little more reliable in mac-telnet then 'non-official' clients. But I long for some centralised configuration management. Even on small networks. Its just nice to come back to a complete overview instead of spread out configuration and out-of-date documentation for stuff you did months back for a friend or family. I don't know if Ubnt will fill this need, but what I've been hearing about it should.

I'm not the OP but I moved from UBNT to Mikrotik for two reasons:

- When it comes to SFP, UBNT's wired gear is unreliable. See https://community.ubnt.com/t5/EdgeRouter/EdgeRouter-X-SFP-le... for an example.

- My only experience with UBNT's support was exceptionally poor. When I ran into the above issue, I was using a third party SFP module and support stonewalled me, saying I had to buy one of their modules. They wouldn't loan me one or guarantee a refund if the module didn't resolve the issue. Unsurprisingly, buying their module didn't help at all (though they finally let me RMA the equipment).

Mikrotik's gear has been solid for me. Zero problems whatsoever.

Windows? The MT RouterOS web interface works very well in both Chromium and Firefox on Linux for me.

The web interface works fine for me on macOs, as well as the CLI. But it's far from centralised configuration management. Sometimes you want to tinker, but sometimes you just want to deploy something (at friends/family) that works and when you return to it in a few months, to continue where you left off without going through every device's configuration or the documentation that is obvious not there as those side projects often don't allow you to 'allocate' time for that.

Haven't the Mikrotiks had lots of serious vulnerabilities recently?

Those that weren't updated for a year.

There was a 0-day winbox bug this year that was being actively exploited in the wild. They definitely have their share of security issues, and more are likely to come since they write their own versions of httpd, sshd, smbd, etc instead of using well tested open source versions.

As long as you aren't exposing the device itself to the internet, you should be safe from most exploits if your LAN is semi-trusted.

Mikrotik routers were just hacked pretty badly. I'm not so sure they are competent enough with the security of their routers now, even if their routers are otherwise good value.

The CVE-2018-14847 was responsibly disclosed and patched. However, the problem happened with routers that did not get updated. This is no different than any other unpatched software.

https://blog.mikrotik.com/security/winbox-vulnerability.html

You can also 'cloud' host a unifi controller on a VM somewhere and set up the APs for "layer 3" management, where when you originally provision them you tell each AP to register to a specific hostname. It's all done over TLS. Each AP just needs to be able to get a DHCP lease, default route out to the internet, and to resolve hostnames. A small Unifi controller can run on a $10/month VM if you don't want the 'cloud key' device on premises.

Or if you happen to have your own hardware on premises a unifi controller on debian can be a really small Xen VM that runs at an average load of 0.02, your xen or KVM hypervisor can be as small as an Intel NUC stuck to a plywood board on the wall of a telecom room in the building.

for comparison

UniFi Cloud Controller

$299.00/year for up to 10 devices

$498.00/year for up to 20 devices

$697.00/year for up to 30 devices

+ $199.00/year per 10 additional devices

When I include my time, one less things to break or be misconfigured, one less vendor involved, etc... $299+ a year is worth it vs $120 a year + AWS/Azure, but if youre trying to do it on the cheap, I agree with you.

Does the Unifi mobile app work with the setup you described?

For me, that's really overpriced, since the ongoing maintenance and updates on a debian stretch based unifi controller (which is just a JRE and a blob of ubnt provided software) is super simple and takes maybe 20 minutes of my time a year. I have a ton of things doing different network infrastructure purposes that are also based on debian stretch amd64 so it's barely any additional effort.

You can easily control 50 to 100 ubnt APs on the cpu, ram and disk resources of a $10/month VM. Big difference between like $700-900/year and $120/year.

Does the Unifi mobile app work with the setup you described? If you are outside the network? Do you use a vpn client to connect your phone back inside the network?

Yes, it should. Assuming you're running your unifi controller on a public ipv4 /32 somewhere on the internet (at some commodity VM host), it's entirely up to you how you want to lock down access to it. Some people do leave the TLS1.2 web browser admin control panel login exposed, but on a non standard port, other people set up iptables ACLs to only allow traffic from a certain IP range, other people set it up so that you can only reach the admin control panel login page over openvpn. Entirely up to you and depends on your level of experience with linux sysadmin/firewalling tasks.

However I am more in favor of having the unifi controller on the same premises as the APs, or at least in the same metro area network as the APs, in your own private network. Just throwing the L3 management option out there for people who truly want 'cloud' hosted everything.

>more in favor of having the unifi controller on the same premises as the APs

But when your premise is MANY sites across the country, and you are using a single controller, only ONE site gets the controller on prem, OR you have many controllers running.

>Big difference between like $700-900/year and $120/year.

At the end of the day, it comes down to what my time is worth doing other things (not how much im paid, but the opportunity cost of me managing management interface infrastructure, stability, and resources. Unifi cloud, for lack of a better phrase, just works.)

> But when your premise is MANY sites across the country, and you are using a single controller, only ONE site gets the controller on prem, OR you have many controllers running.

yes, totally agree, in that sort of scenario with many premises you would set up your own internal L3 management of the APs, in your own management VRF, in RFC1918 IP space.

I agree with this, I don't even use a VM somewhere I just run it on a system I already had at home and point a lot of other sites at it L3, no issues in a few years. Obviously it depends on the kind of uptime and home setup you've got, but the take home should be that running a Unifi controller doesn't inherently have to cost anything, not even for L3 adoption. There is zero cloud tie-in needed, or even colo/VPS or whatever, not via Ubiquiti and not for any other 3rd party either. You certainly can use any of those if you consider the advantages they offer (which can certainly be very real!) worth it, or just plain like to do it that way.

Unifi absolutely has flaws and missing parts that are easy to run into if you push into more powerful aspects of networking, but overall it's a delightful foundation, and critically to me was the feature of zero online dependencies. I feel like that's the Net at its best, a smooth progression from your own random kit all the way up to multi region failover hosting or whatever but purely based on bandwidth/uptime/maintenance/cost considerations, never any permanent ties. Can centralize/decentralize/move around/selfhost/colo/contract out at will. Unifi can match where you're comfortable with, is has pleasant pretty safe defaults, and they're great about long term updates and support. At the end of the day I can forgive a lot over that, particularly given the contrast it is with so many other offerings.

My home unifi controller doesn't even 'run' 99.9% of the time, it's not necessary to have the controller online once the APs are provisioned. It's just a debian stretch virtualbox VM that lives on my laptop, with its virtual ethernet interface bridged to the laptop's physical interface. I bring it up on the same L2 fabric as the APs if I need to make any changes, and then suspend it again.

>My home unifi controller doesn't even 'run' 99.9% of the time, it's not necessary to have the controller online once the APs are provisioned.

That's also a good point, the reliability is solid and things won't fall apart even without a controller. That said the controller is necessary for certain nice extras like stats, guest portal, etc. Granted the average HN crowd may have other appliances or systems to manage that, and plenty of people do use a controller locally installed on a notebook purely to adopt and setup APs and then never worry about it again, but given how cheap the minimal VM needed would be or Ubiquiti's local "cloudkey" (worst name ever, has nothing to do with the cloud, it's just a stick computer dedicated for this), I think it's worth considering having a controller running if someone was going that way anyway. Might as well have the management console up all the time. My only point was that running it is highly, highly flexible.

For the cost, I'd agree that Ubnt gear is quite good. I use it at home, and rarely have any problems.

That said, I'd like to provide one caveat: In my experience, they tend to not do great in very noisy RF environments. Twice now I've deployed Unifi APs in offices with RF spectra similar to what the OP has going on, and we had nothing but problems. In each case, we ripped out the Ubnt gear, replaced with equivalent Ruckus APs (with their cloud controller) and haven't had a single problem.

I admit this is not a large sample size, but thought it worth mentioning.

I've had similar issues with Ubiquiti in a noisy RF environment. The 2.4GHz spectrum was extremely saturated and people were frequently dropped whenever they were on it. Thankfully, the neighbors aren't using 5GHz too much--I just turned off 2.4GHz for our own WiFi and it seems to have solved the issue. Still, very annoying and took a long time to figure out.

Yes, we actually considered that. Unfortunately in our use case, there were many 2.4GHz-only IOT-type devices that needed to be on the network, so we couldn't turn off 2.4GHz. It helped a bit when we turned down the 2.4GHz Tx power - that seemed to encourage more devices to jump over to 6GHz, but even that didn't solve the problems altogether.

I'm not an RF design engineer, but for this type of equipment, I do feel like there's some truth to "you get what you pay for". It's plain to me that the Ruckus APs have superior RF front-ends that are better able to deal with the noise. They're more expensive than Ubnt for sure, but that extra cost was very much worth it for us, to avoid the frequent disconnects that the users were having to deal with.

I found vastly more expensive Meraki APs to deal with noise way worse than Ubiquiti (but that's all I've used so I can't compare to others).

I have seen the exact same thing, 2.4Ghz runs a little overpowered, causing interference. Turn it down a little, doesnt need to be off.

My company do a lot of Ruckus deployments and they are brilliant, they have a radio built in just for spectrum analysis so each point can choose the perfect channel, none of this manual setting stuff.

As a counterpoint, we run Ubiquiti gear at large conferences (NAB in Vegas, IBC in Amsterdam). Thousands of people, hundreds of WiFi networks - pretty much a nightmare.

At NAB we're often the only booth with functional WiFi. Not using anything special really, just well configured UniFi mesh APs.

We went also from Unifi APs indoor gear to Ruckus gear. The difference is like night and day. I don't understand why, but we never had luck with the Unifis or Ubnt indoor. The Ruckus units we deployed just work brilliantly from the beginning.

I wish OpenWRT came with easy-to-configure out of the box fast roaming and a centralized configuration solution. It’s otherwise excellent, and my home network based on OpenWRT works quite well.

Just DDGing now, I found this 2 year old thread:

https://www.reddit.com/r/openwrt/comments/515oea/finally_got...

Is this still valid? If so, it seems quite doable if your already comfy SSHing into your router.

Probably. But it needs manual key setup, and the debugging the author used required manually recompiling wpad.

>You can either pay a couple hundred a year for the management interface, or $80 for an on prem tiny little stick that hosts it.

…or download it (no cost), put it on a desktop/laptop running Windows, macOS or Debian/Ubuntu, and use it when it's needed.

https://www.ubnt.com/download/unifi

> You can either pay a couple hundred a year for the management interface, or $80 for an on prem tiny little stick that hosts it.

Or save more and put it in a Pi. If you have no idea what your doing it’s a great intro into the world of networking, ssh, Linux and docker, Ansible etc. But yes, this loses the cloud features.

IIRC, depending on your use case, you don't need the controller running 24-7.

Before I got deeper in the Unifi ecosystem, I just ran the controller on Windows when I needed to (when I only ran 2 APs -- in that case, you only needed an always-on controller if you wanted to run the captive portal).

I always second a Ubiquiti recommendation. They have a great range of products that can serve people wanting robust home networks up to small business scale networks. In college I setup our fraternity to run on a edgerouter lite and 4 UAP-ACs and we went through 2.8TB a month with no issues.

Yes, this is a really technical looking article, with exactly the wrong approach. I wrote up a quick thing a few weeks ago about how we set up our office WiFi (tiny office - ~25 people), on Ubiquiti: https://blog.uncommon.is/dr-ubiquti-or-how-i-learned-to-stop...

If you're in a position where you have a small number of AP's (less than 5) the ubiquiti product may appear to be overkill.

I've found that the threshold depends not so much on number of APs but on number of simultaneously active users/devices (arguably the ratio of those per AP, rather than total).

An office of 30 people sharing 3 APs will encounter problems even if those same APs would have worked just fine for a family of 4 living in the same space.

I've even found this to be true in a residential setting with consumer APs, where reducing the number of devices (by plugging into wired ethernet things that don't often move, such as media players and printers) tends to improve range and throughput for others, without adding more APs.

I sincerely question the value of a managed wifi system for less than 5 hotspots, I also am even more dubious of the need for a cloud service. wifi should function without the need to phone home.

> I sincerely question the value of a managed wifi system

I'm not suggesting that there's necessarily value in "managed", but your parent comment was about the Ubiquiti product being overkill, which is a much broader statement.

The GP certainly advocates for management, but that's neither the primary value delivered by the overall product, nor the majority cost (even with a single AP). IIRC, this may not hold for competitors, such as Ruckus, where even the lowest-end "controller" is quite pricey.

> wifi should function without the need to phone home.

AFAIK, Ubiquiti's products can be run standalone, only requiring management software for initial configuration.

> AFAIK, Ubiquiti's products can be run standalone, only requiring management software for initial configuration.

This is correct. I only power on the controller VM when I want to make a change. I do think a few features, like the captive portal require the controller to be online.

No, this is where they really shine. Ubiquiti is often referred to as “enterprise lite”, where if you really need scale usually other options are better. But at a small scale, they are excellent.

I'm curious: can the router you linked (https://www.ubnt.com/unifi-routing/usg/) run adaptive QoS with fq_codel on a 1Gbps/1Gbps connection?

I know it's not a common setup, but some of the ISPs that do fiber to high-rises offer that.

Usually these blogposts are written to raise the awareness of your company. In this case, not in a good way.

Reply on news.ycombinator.com