Hacker News Reader

Comment by comboy | Hacker News Reader

Argh, why do I learn about this from HN when they pretty much force me through the cloud login with UDM-Pro. Nothing in the dashboard. Also I think http://unifi/ is crap from a security standpoint. Their threat management also seems to be just some kind of a bad joke.They could for example do a nice hardware based honeypot that you have to untrigger with physical access. They could offer so much more for prosumers providing sane defaults for a common case of having multitude of devices at your home which can be categorized as intruder but expect to be on the same network as your phone.

Is there a better alternative? When I tested multiple routers mostly regarding low latency, network stability and reliability a few years ago nothing came close, especially when having multiple access points.

View on HN

I’ve become a big fan of MikroTik routers and 10G/SFP+ router/switch hardware in the last few years. Their web UI and SSH console are a bit quirky but the performance is pretty great for the price.

My primary use case for their gear at home was to have a router that can handle a LACP WAN bond for my fancy cable modem as well as connecting to a 10G Ethernet switch via copper or direct-attached SFP+ to a CRS-305 10G switch. Their RB-4011 was a perfect fit, without any of the Ubiquiti SSO/controller stuff to worry about.

I haven’t explored their WiFi products yet (still using an old router as an AP) but their product range is pretty broad. Might look into it this year though.

My primary use case for a home router is solid set and forget qos. fq_codel and cake were recently added to routeros v7 beta, which means I will be plugging in my hEX again after a few years of happy edgerouter x usage.

Also interested in what access points (besides unifi) people pair with mikrotik routers. Any wifi 6 recommendations?

The standalone Ubiquiti access points are still great IMHO. It's just their recent prosumer gateway/router product line that's really struggling. I've had a great experience with the older UAP-HD-PRO. Their newish $100 Wifi 6 U6-Lite AP is tempting but haven't tried it.

If you just need one AP you can set it up in standalone mode and forget about it. If you want more monitoring and control you'll need to have a Ubiquiti controller running to manage things. (can run one in docker, on a rasp pi, or just buy their "Cloud Key" product.)

Their Edgerouter VyOS products are awesome too. I won't touch their Unifi stuff but I can't find anything that's even in the same price ballpark as the EdgeRouter 4.

> If you just need one AP you can set it up in standalone mode and forget about it

unless you need any feature besides wifi at all. then you need a controller and usg at all times.

For awhile I was actually using a UniFi NanoHD for my AP. Performance and stability were great but running a Docker container for a Ubiquti Controller (for a single AP) was annoying enough for me to bail on it. My old Asus router with OpenWRT has been fine for now and doesn’t require me to run a container. :)

I’m still looking for a proper WiFi 6 replacement that can hook up to my 10G core, ideally via 2.5/5/10G copper or preferably SFP+ DAC. Nothing’s jumped out at me yet though.

If you just want dumb WiFi, you can provision and remove the controller. Nowadays you can even do this with the UniFi phone app (standalone mode let's you configure and update firmware).

I've had a UAP AC LR at home for a few years and we've got about 6 UAP AC HD at work. We used the phone app to provision and after that you can pretty much forget about it. Great for small startups that want great coverage and dont have someone who's supposed to mess around with it.

I'm curious as to what you are doing with qos in a home setup.

Late reply, and the other reply covered it really.

Up until around a year ago I was on adsl2 with a highly symmetrical connection. I work from home mostly as does my partner, with constant syncing to various cloud services plus large uploads and downloads for work.

Maxing out the puny 1Mb of upload would render the entire connection completely unusable. Yes, you can manually limit various apps but it so much easier just to throw an edgerouter x in front of everything running stock smart queue or cake.

I'm on a faster connection now so uploads are not so much an issue, but even still it works a treat for things like gaming / VOIP.

Not have VoIP or gaming get disrupted whenever a large upload runs.

On my previous ISP latency would reach 2000+ ms when I let Dropbox sync or downloaded a huge file. Even web browsing would time out. I used Tomato to prioritize DNS, my VoIP analog telephone adapter, the first 256KB of any HTTP(S) connection, and some 27000+ ports used by games.

My current WAN connection reaches 300 ms without fq_codel enabled. With it enabled there's no jump in latency.

Yes, I recommend MikroTik as well. Got two of their cAP wireless access points. All the features you would expect on enterprise level kit at 1/4 the price easily.

Because there are so many features the setup is not as easy as some alternatives I'm sure. But the value proposition is great.

Their "RouterOS" is standardised over pretty much all of their kit. So after you have worked it out once you should be set for anything else.

One of the reason Uniquiti is so loved by techies is that you can recommend it to family/friends or set it and forget it for them (regular users also find the phone apps impressive and easy to use - it's an Apple like experience for network gear).

At this point there are probably 20+ home Unifi networks that i'm responsible for recommending or setting up, doing the same with MikroTik might turn me into a full time sysadmin :)

> connecting to a 10G Ethernet switch via copper or direct-attached SFP+

> RB-4011 was a perfect fit

Huh, isn't RB4011 the one with the very weird "you can't use a DAC in the SFP+ port" limitation?

> haven’t explored their WiFi products yet

They seem extremely underwhelming, especially in terms of software support :(

https://help.mikrotik.com/docs/display/ROS/WifiWave2 — they're finally barely rolling out WPA3, MU-MIMO/beamforming, 802.11w — in an optional beta package for a beta version of the OS, currently on 4 devices, breaking 2.4ghz on one of them, and breaking CAPsMAN (centralized management).

I had to get an active DAC cable (S+AO0005) for the RB-4011 because of the quirk you mentioned. Works great with the active cable, which was about $50 I think. I was glad I read the manual beforehand. :)

Thanks for the update on the WiFi side of things. Seems likely that I’ll be looking to another vendor for APs, but that’s fine.

Do you know how ubiquiti's "edge" line compares to mikrotik?

Ubiquiti has a polished interface that's relatively simple to use for something with enterprise-ish level features. They also have some pretty good docs. For example, their article on the harms of Broadcast/Multicast packet storms [0] is useful even if you're not using their products. Same goes for the RF Antenna patterns docs [1].

That said, my next router/gateway won't be from Ubiquiti. Though I'll keep using UI access points for now.

[0] https://help.ui.com/hc/en-us/articles/115001529267-UniFi-Man...

[1] https://help.ui.com/hc/en-us/articles/115012664088-UniFi-Int...

I'm a Mikrotik user, not a Ubiquiti user, but looks like the closest match would be Mikrotik's CRS (Cloud Router Switch) line. My home network is a CRS317-1G-16S+RM at the core and three CRS305-1G-4S+IN (one in each room), all running SwitchOS/SwOS instead of the stock RouterOS (they dual-boot, your choice), and I am very happy with them.

The Mikrotik CRS will work as a "gateway" right? That is, run a DHCP server, connect to my cable modem, provide local DNS, etc? Thanks!

If you can run RouterOS (you can) you can do all that stuff - switchOS is much more like a bare-bones packet switcher; RouterOS is a full-fledged network OS.

Check https://mikrotik.com/software for some demos and stuff.

Yep, that’s how they come by default, booting into RouterOS. I prefer my switches to just be switches, though, so I run SwOS and do all that service stuff jailed on a FreeBSD router PC.

What APs do you use with a MicroTik setup?

I like Aruba Instant APs, the kind that don't require cloud management or a separate controller, though it seems they've folded the IAP line into the regular AP line or something with their new Wi-Fi 6 gear.

I'm still using Wi-Fi 5 because it's fast enough and cheaper. My central AP is a IAP-315, an IAP-305 in the garage, and another IAP-305 at the wall by the back yard. They're all PoE and linked with wired backbone to form a single big coverage area using a single elected IAP leader as controller for the rest.

You shouldn't have trouble buying grey-market ones as long as you are careful to stick to the same regulatory domain for all of them. Aruba gear is available as USA/FCC, Japan, Israel, and RW (Rest of World) versions. I have operated RW units in FCC territory (proooobably legally but probably not worth the risk) by setting them to "US Virgin Islands" so they match FCC-allowed frequencies and power limits, but linking more than one AP still requires the hardware to be same regulatory domain.

Having owned several products from both, Mikrotik equivalents are generally way more feature packed but I find them hard to use. EdgeMax stuff is more polished, but has fewer features. Performance is comparable for the most part.

After having worked intensely with Ubiquiti Edge devices (their routers specifically), I'd recommend them time and again. Their Debian derivative EdgeOS is great to work with, both as an enabler for advanced administration, but also an approachable web ui (plausible to offload many issues to support desk without requiring insane amounts of dedication to the Craft).

For mad scientists though, the very open software stack is a good friend to have when 11th hour Requirements® dictate you must produce a rabbit without a hat, or rewrite your own domain-specific implementation to replace the Avahi service.

No experience with Mikrotic.

_On topic_: With cloud news like this, it's nice to know about the availability of Ubiquitis' Network Management System[1] which you can host and run wherever.

[1]: https://unms.com/

MT radios are inferior to UBNT for some outdoor non-WiFi applications. 802.11ac vs the proprietary AirFiber. Agree that MT is often a better option for wired scenarios.

Does it support Wireguard?

Also RouterOS does not seem open source.

Sadly RouterOS isn’t open source. They’ve received a bit of flak for their “available on request” stance on getting GPL sources too. The fact that their GPL patches aren’t readily available is pretty uncool.

WireGuard isn’t supported on RouterOS 6, which is the current stable version, afaik. RouterOS 7 (currently available in beta) did support for WG in August though, as part of 7.1beta2 [1].

[1] https://mikrotik.com/download/changelogs/development-release...

If you have any more details about the GPL issues with Mikrotik RouterOS, I recommend reporting them to the Linux developers via Software Freedom Conservancy, who have copyleft compliance projects:

https://sfconservancy.org/copyleft-compliance/#reporting

V7 supports Wireguard and UDP OVPN, it's in beta but reasonably stable, at least for home use.

finally! been waiting for any UDP VPN from mikrotik since ... 2008?

I use a Microtik hAP AC (Small little SOHO style router with an sfp and PoE). You can easily flash it with OpenWRT and use wireguard on that. All open source too.

It's great hardware but I'm no personal fan of RouterOS.

Huh. What's the experience like? Eg are there any driver issues, or edge cases with unimplemented/missing bits of functionality?

It's brilliant, everything works fine. I've even used the USB port with a smartphone for 4G backup tethering (just need to add relevant usb packages, the openwrt wiki details all this). Plus there's the luci web interface which runs like a charm. No complaints whatsoever.

Although it isn't OSS, it's based on Linux and therefore semantically comprehensible by someone familiar with iptables, iptraf, etc. Unlike say IOS which will explode your brain.

RouterOS is not, but Mikrotik added wireguard support to their firmware sometime in mid-late 2020. IDK if its out of beta yet.

No, still very shitty beta sadly. In mikrotik communities routeros7 is a meme (it'll never arrive). Even though its here, its not.

A few months ago when ROS 7's first few public beta releases were out (and before then), I'd agree with you.

However, MikroTik seem to be making slow but steady progress with new features. Stability is still an issue to an extent, but for home use I could almost make the jump.

In fact, if I didn't use CAPsMAN to centrally control the multiple access points in my home, I would make the jump purely for fq_codel/cake AQM, Wireguard and WPA3.

Mikrotik phones home too

I'm in the process of replacing my home Ubiquiti infrastructure. Here's what I've decided on:

Replace the US-24-250W PoE switch with an Aruba Networks S2500-24P (gigabit and PoE, 4x 10gig ports, quiet).

Replace the Cloud Key Gen 2 with BlueIris for camera controller. I expect this will be able to connect to the existing Ubiquiti cameras.

Possibly add one or more Ruckus R610 APs running in "Unleashed" mode to augment my Google WiFi. I'm happy with the Google WiFi, and in particular it has good tools for managing kids access to WiFi. But the Ruckus APs are quite good and so I may move parent and IoT access over to Ruckus, separate out IoT devices to their own network.

This is the end of phase 1. Then I plan to go on to:

Add an OPN-Sense router. Currently not using Ubiquiti for routing, the Google WiFi is our main router. Would like to gain additional capabilities like insight into what the kids are doing.

Replace the Ubiquiti Dome G3 with one of the less expensive 4K cameras if they seem to provide similar or better functionality. Also trying out the Wyse Cam v3, which seems ok and the price sure is right, but is more of an augment camera than a main camera, I prefer wired and PoE.

I've been doing some research and those are the options that seem attractive. In particular, going with old enterprise gear looks to be a huge win. You do lose that handy "single pane of glass" management. But considering the problems I'm having with Ubiquiti, and the upgrades I've already done to try to get past them, with only some success, I can't bring myself to go further in on Ubiquiti.

The reason most people go with Ubiquiti for home use is the price -- that Aruba switch costs $3500 new. The ubiquiti switch costs about 1/10th that at $399.

Can you get free firmware updates from Aruba or do you need a support contract?

I guess I could have pointed it out more clearly: I'm going "used enterprise" as the route for replacement. As you say, yes, this switch was $2500 new (that's what I saw when I looked), but I bought one for under $100 on ebay.

Similarly for the Ruckus R610 AP I mentioned: Those APs were a grand new, but you can get them for a bit over $100 on ebay. Linus Tech Tips did a comparison of it with other consumer units, doing heavy multi-device streaming, and Ruckus was the clear winner.

Yes, Ubiquiti looks like a good value and they make some very interesting products. I've used some of them to great effect over the years. But my experience with the NVR and cameras and switch and Cloud Key has been relatively bumpy. Enough so that I'm ready to ditch the convenience for up-front loading and hopefully day-to-day more realible.

That is a good price for the hardware, but what about the firmware? Do Aruba and Ruckus give free firmware updates?

Have you looked at the power consumption of the switch? I've run some enterprise gear at home in the past (my favorite was the E-450 Sun server which an ex-employer gave me for free), but when I started paying for my own power, I found that even if the hardware is free, the power consumption makes it expensive.

Looks like Aruba has the most recent firmware available for download here: https://h10145.www1.hpe.com/Downloads/SoftwareReleases.aspx?...

Most recent version is a couple years old, but it was EOLed 3 years ago.

Ruckus firmware seems to be downloadable from their main product page for the R610, updated a month ago.

Re power consumption, it looks like the Aruba pulls around 50W idle, and the Ubiquiti pulls 29W idle. Of course, if I can get rid of the second switch I've been running because the Ubiquiti keeps blocking the Google WiFi ports, that brings it even closer. :-)

You do have to sign up with an account at HP to get the firmware, and it won't let you use a gmail account, but once I signed up I was able to download the latest firmware and update to the latest. Just FYI.

You can get S2500-24P from eBay for 125 US or so each.

I hear these are great little boxes for running PFSence and OPNSense

https://protectli.com/

There's also Netgate hardware, which has the added benefit of supporting development of pfSense. I have the SG-3100 and have been very happy with it.

https://www.netgate.com/

Takes a bit of searching to find the hardware section (it's under products->appliances) https://www.netgate.com/products/appliances/

Do any of these pfsense setups allow an Orbi-style network? I’ve been really unhappy with my last several router purchases.

No, you'd still need a 3rd party like Orbi or Ubiquiti. I'm running a few Ubiquiti FlexHD's in mesh and have yet to have any issues.

we're happy you're happy!

I've never used those ones but I can recommend these ones (originally from the US, moved to Switzerland): https://pcengines.ch

Second these guys; really easy to set up (though I did have a nightmare getting a reliable USB-R232 converter for the initial bootstrap).

Not sure if you found a good one, this one has never failed me: http://amzn.com/B00425S1H8

With a male/male extension: http://amzn.com/B00QM8ZP5E

Will take a look at it!

My current one I've nicknamed a "Pirate" R232 adapter because it has an unfortunate and hilarious effect of duplicate the lowercase 'r' character for some reason (so I see Arrrrrrrrchlinux).

I mostly administer via SSH so it's all good at the moment.

That's hilarious.

Thanks for the pointer. I was planning on running under a VM. A dedicated box would be nice from just a reboot standpoint. I was looking at getting one or two of those HP COMPAQ ELITE 8300 boxes off ebay for $200, but they probably only have one Network interface, so I might want to add another.

I have two, and yes, they are freaking amazing. I run CentOS on mine.

I don't usually run any services since I prefer to dedicate boxes to things, but I have in the past run a number of services, including minecraft and minetest on it and it flies. Really pleased with it.

What will you do now that CentOS support is going away?

white label brand. You can get those boxes from alibaba for <$100. There are intel/amd/arm versions.

Blue Iris is a great piece of software and Ken the developer has constantly improved it. I think there's a way to get the RTSP stream from your existing cameras.

One of the slick things you can do is add machine learning to it and have motion alerts based on what is detected in the video (person, car, bear, those are some of the built-in options). That looks pretty slick.

I'm trying to recall, but maybe someone else can answer: do the UniFi cameras stream RTSP directly still, or do you still have to run their controller and re-stream it?

Log into the WebUI, set it to whatever the non-Unifi Video mode is, update the firmware, repeat, set your RTSP config, good to go.

I use Blue Iris with my Ubiquiti cameras. Works like a champ.

This sounds good, but are there any good alternatives to BlueIris that would run on a Linux server?

I'm not aware of one, but would be interested if there was. I'd prefer to run it on Linux. Zoneminder seems to be the common recommendation, but most discussions I've seen of it have not been very positive.

There's Xeoma and Blue Cherry, neither of which I know very much about. Never heard anyone mention either of them. So I figured BlueIris was what I'd try. Seems to be what everyone on YouTube is using...

I resisted for a long time, but after finding that there is no good home router that doesn't have major security drawbacks I decided to just build my own [1]. It's a bit of a chore to set up but works better than any off-the-shelf device I've ever owned. I run Debian, but I've heard other people using OpenBSD with great results as well; it's all about personal preference and what you're familiar with...

[1] https://nbailey.ca/post/linux-firewall-ids

What about mikrotik? I've got the RB4011 and found it to be the perfect home/small business router

I used a RB750Gr3/hEX router for nearly a year, and I wasn't terribly impressed by the software. The hardware seemed neat, but even as somebody very familiar with routing & switching I found the UI to be rather obtuse.

The other reason I decided to 'roll my own' was an in-line IDS. There seem to be 'hacky' ways to get Snort installed on the RouterOS platform, but the CPUs aren't really powerful enough to run DPI with a sufficiently large ruleset.

I also like the ability to use Ansible to manage my router/firewall. There are modules available to do this with RouterOS, but they don't seem nearly as robust and mature as the built-in Linux utilities.

Just ordered a Chinese box with 8th gen U-series i5, 8 GB of RAM and 120 GB of SSD. Has six ethernet connections, HDMI and COM. Planning to install OpenWRT to it, and with AES-NI the system should be easily able to push the full 1 Gbps of traffic through Wireguard.

I've had whatever routers before, but mostly when using some VPN to hide the traffic from your home network, and if having fast enough internet, a good CPU is a must.

I still put the important part of my network behind my own router similar to yours (and in terms of security I think ubuntu server + whatever you need has likely much smaller attack surface than OpenWRT which is a piece of software just too tasty not to be exploited).

Outside that, wifi part is hard to get right and smart switches are nice to have, but they are PITA if the firmware is never updated and there's no single place to nicely manage it all.

Can you expand on the security of an Ubuntu server (acting as firewall, router and vpn), versus a dedicated router hardware and software (eg pfsense or OpenWRT)?

openwrt contributor's focus is consumer hardware support.

I don't think the distro was ever security audited.

I'm having already Unifi's AP's, the controller running in my NAS and a good switch for the current setup.

Do you have some better suggestions for the router software? I'd love to run Opnsense, but a native Wireguard client is a must, and so is a good web interface for the setup.

Link to the box you got? That sounds interesting.

Oh, sorry!

These are available from Europe, but I've heard good things from US about similar boxes, when I searched with "best pfsense computer". Not the same brand, but similar hardware.

https://www.amazon.de/gp/product/B08JHKZMTN/ref=ppx_yo_dt_b_...

Let's see how it works, but I expect it to be much faster than my current ARMv7 box. Of course if you have space for a rack, go with something actively cooled. In our apartment, we expect the router to not make any noise.

Despite the name in the Amazon listing, it has nothing to do with Mikrotik; also a 1Gbit ARM Mikrotik router/firewall can be had for considerably less.

I can't read German, but maybe it's a bare Mikrotik router board in a custom enclosure?

That said, it also says 'Pfsense', so I suppose more likely it's a typical 'Chinesium' listing.

How fast are the ARM CPU they have in their routers, do they support AES-NI and how much data you can push with VPN encryption through their boxes?

The current ARMv7 I have goes to about 100 degrees Celsius and loads in the level of 4 to 6 when downloading a bunch of data full speed.

I'm not sure if they support AES-NI on ARM. I found some changelogs indicating that they do support it on x86 and x64, and most ARM routers list "hardware IPsec" encryption, so maybe?

$350-$400ish search AliExpress for "i5 7200U firewall"

Also curious, and wondering how much that cost.

similar boxes are on amazon, with worse(ish) specs under the brand "Protectli "

Raspberry pi 4 compute module might be good for building your own router too. You can attach a pcie network extension or usb to Ethernet for local usage. All of that would cost under $70.

https://www.raspberrypi.org/products/compute-module-4/?varia...

https://www.zahradnik.io/raspberry-pi-as-a-home-router

Edit: You would be better served by other boards from this benchmark repo for vpn usage: https://github.com/ThomasKaiser/sbc-bench/blob/master/Result...

It's worth noting that the Unifi gateways have hardware offload for traffic routing.

While a Raspberry Pi might work for some folks, it's worth noting that these are two very different performance classes.

How is it great with one NIC?

Ethernet adapter and USB speeds seem less than ideal.

I don't need many ethernet ports so it works for me. My home network speed is less than a gigabit.

It's definitely not for people like OP but may work for other people who don't want to pay much and still have something decent that they can hack themselves.

I have tried to flash open firmware on my router before but it didn't work out. I had a raspberry pi already so I decided to convert it into a router and use it.

A Pi 4 can handle about 1 Gb without issue. It is a great option for consumer workloads at consumer prices. I've certainly seen far worse consumer gear.

The CM4 can hit up to ~3.4 Gbps for one interface over PCI-E, and 4.15 Gbps if you also use the onboard Gigabit interface. Use a 1, 2, or 4-port network card and you can do some interesting things at 1+ Gbps: https://pipci.jeffgeerling.com/#network-cards-nics

It misses AES-NI though, so missing encryption hardware and would be subpar if running a VPN client for the network...

FWIW, I tried using OpenWRT on a box with similar specs to yours and it was a nightmare. Ended up using FreeBSD instead and it was a vastly better experience. I think OpenWRT might only be worth it on very low-spec hardware.

Hey! Could you please share what you think didn't work so well with OpenWRT? I'm currently running a Turris Omnia with their custom OpenWRT that I know how to use and it's been working quite well. What's missing is a better CPU to run Wireguard encryption full speed through our fast internet connection.

I'm seriously thinking about pfSense or Opnsense, but FreeBSD still misses native Wireguard support, leaving the encryption to the go implementation, which is subpar for our use cases. But, I'd be happy to run Opnsense, with jails and all those goodies from FreeBSD.

Since Netgate (the company behind pfSense) paid for the Wireguard work, you can make a good bet that same will appear in a near-future release of pfSense.

Wireguard has been merged into upstream FreeBSD almost a couple months ago.

FreeBSD 13 is out in March 2021 and opnSense with that system much later. Might be a bit complex to go that route right now, but it might be a great choice one year from now...

"with AES-NI the system should be easily able to push the full 1 Gbps of traffic through Wireguard"

You were probably thinking of OpenVPN? Wireguard is not based on AES and thus has no use for AES-NI.

i've got this on my todo list of projects. looks super interesting. there seem to be a lot of flavors of these boxes and i'm having a difficult time figuring which one will work best. i don't know anything about the manufacturers.

Another endorsement for mikrotik here...spent a lot of time in the WISP space and doing CPE installations. Mikrotik all the way down - text config files (version control), ssh-like remote terminals on all endpoints, full feature-set on even the most basic hardware. I've taken them into other jobs and other engineers have been happy with them.

The cons are that everything has one or more "mikrotik" way of doing things, and it may not be intuitive to the new user. Also, although everything is included, you have to set it all up yourself.

Another con is never ending regressions between versions.

> Argh, why do I learn about this from HN when they pretty much force me through the cloud login with UDM-Pro. Nothing in the dashboard.

They’re still sending out the email. Mail chip will be rate-limiting the send rate to prevent email providers from block listing them.

Give it a couple of hours and no doubt you’ll have an email as well.

Just for reference, I did receive an email from them.

I received one as well approximately an hour ago.

I still haven't received one, I'll update this comment if I do.

-edit- I just received it at 2:42 pm pst

I got an email for a secondary account I had forgotten about at 4PM PST.

i haven't got an email yet either

Finally got it too (aprox 4pm PST).

Make sure you turn off Remote access in your device.

Probably can leave on local login (w/Ubiquiti acct) but should turn on 2FA

Ubiquiti let users disable the cloud logins with UDM Pro, after a pretty big backlash on their forums.

You do need a Ubiquiti account to setup the hardware in the first place, but you can turn off cloud access and login locally after that. And you should.

How? I have been looking for this setting but haven't been able to find it.

On the landing page after you log in, click Users at the bottom. Then click Add User or Add Admin, and just set the Account Type to Local Access Only.

Oh but this doesn't actually disable remote access on the UDM side, does it? It's just a flag that the cloud host can choose to respect?

You need to go to the settings for the UDM/UDMP itself, not the network controller, and disable remote access there. It's a bit hidden.

I turned off cloud login a while back. There’s a toggle in the settings for this.

I was confused by the parent comment too. Aside from the remote management features, if you turn off cloud login you still get everything else. Maybe it's something specific to the USG Pro? I've only used the smaller USG.

I recently invested in UniFi hardware with the UDM Pro and this isn't exactly correct. UniFi Protect (the video security line) requires remote access and Ubiquiti Cloud accounts or it will break in a million weird ways. If you disable cloud login you cannot reasonably use UniFi Protect.

As someone who uses UniFi Protect and refuses to use cloud-login: I disagree somewhat. It works fine, but the mobile apps become non-functional even on the same LAN. I haven't ran into any other problems.

> a major feature within my own infrastructure is completely broken

> can't see why disabling cloud login is a problem

I was responding to "will break in a million weird ways" which is FUD to my eyes.

I do agree it is a big limitation, and I am looking for alternatives as Ubiquiti do not seem to be prioritizing getting their app to work without remote login which is truly unfortunate, since the predecessor, UniFi Video, supported this.

Good catch. Since USG is Unifi Security Gateway, I kinda just mixed it up with Unifi Protect. Still a troubling development IMO.

Not USG but UDM-PRO. It was the first device from them that required me to make an ubiquiti account to set it up.

Well this is a disappointing development. I'm currently using EdgeRouter hardware, but was considering moving to their Unifi line for my next upgrade. Guess that's off the table till I can use these without cloud access.

Other comment seems to imply that only Unifi Protect really requires an account, not any of the networking functionality

https://news.ycombinator.com/item?id=25737660

Fitlet2 looks rather nice to me. Outfitted with an Intel J3455 CPU, and 2-4 Intel NICs, it is really power efficient for its performance class (idles at ~6 watts, for those that care). There are also some Chinese companies producing slightly cheaper boxes in this category- Qotom, Kettop, Protectli.

When it comes to software, I'm conflicted. I like pfsense, but Netgate has gone a bit sour with the FLOSS community. I'd also consider OpenWRT, FreeBSD, OpenBSD.

I had a fitlet2, was super excited about it, and took awhile to find one.

I had to do some work to get it to boot properly, and it worked great for a year or so, but then it just died one day, and I could never figure out what its problem was.

Out of warranty by the dead date, never bought another.

Been using a $100 HP 8300 SFF with an i7 since, it's a bit overkill, but the price was right.

Just purchased a Lenovo M90n iot when it was on sale for $215, will see how it works out once I get it.

Protectli seems to be a US company rebadging these Chinese devices. But apparently also putting coreboot on them now, which is nice. I wonder if their coreboot board configs are open source.

> I like pfsense, but Netgate has gone a bit sour with the FLOSS community

I haven't kept up with pfsense. Any chance for a tl;dr?

Okay this seems like a compelling reason to switch to OPNsense https://docs.opnsense.org/history/thefork.html#transparency

Ok TBH I'm unprepared to back up my statement. I only vaguely recall second hand heresay in regards to their exchanges with OpenBSD developers.

I’m running pfsense as my router and TP-Link access points. I run their controller in a container locally and everything works great together. Super happy.

I think for some use cases this setup could be a nice alternative (and cheaper) to ubiquiti.

The HN story is a link to the Ubiquiti email sent via MailChimp. You may not be on their mailing list, but Ubiquiti is actively letting people know. I got the email at 2:31pm PST.

Did you happen to write up the results of your router tests? I'd be really interested in reading up on them! I recently picked up an old Apple Airport Extreme so I could easily set up Time Machine backups on my network, but obviously Airports have their own host of issues so I'd be really interested in upgrading soon.

I don't, but it was a narrow case. Part of my home-made home automation runs on wifi so I was focusing on low latency and no packets lost when using wifi in my specific building. Top of the shelf routers all had some occasional hiccups. I think the good old WRT54GL did much better than them. Plus it was done with the set of wifi receivers available to me at the time (mostly cheapos connected to rpis & esp8266).

This is not a common use case, I was not interested in high bandwidth. I did try to disable beamforming and all other fireworks when testing though (but did tests with default settings too)

A second-hand Mac mini is an alternative that I've used for network Time Machine backup targets. Can also turn on caching iCloud/App Store/system updates for your home, if bandwidth is metered and/or slower than your local speeds.

Aruba is a few notches up. But any of the cheaper companies use merchant silicon, open source services, etc.

Honestly, unifi is great for what it is. What kind of IPS do you expect for $100?

If you want less risk, you need to move up the $ ladder.

I run a Netgate SG-5100 (PF-Sense) as the main router, the Unifi controller and Access points are al behind the Firewall. The AP and switches are really good, not the DPI/IPS/IDS solution (those suck)

Great router!

The only issue I have with Netgate is pricing!

Protectli is a pretty common alternative.

Protectlii isn't paying for software development or testing, either.

I received an email notification before the HN article fwiw. However when I reset password for the email address they notified...crickets. I don't use UBNT for anything other than forum posts though..

Second miracle: less than 1h after posting on HN I received the reset email.

Yeah I originally bought their hardware after being recommended it here. Really regret that now, as I realize it was just marketing doing work.

We are just as susceptible to the stuff haha.

Have you tried MikroTik gear?

Speaking of security... I fell for their marketing and slick Apple-like design and decided to add a UDM-Pro router and access point to my pre-existing network. I thought I was doing something wrong when the UDM-Pro ignored everything on my network that wasn't connected directly to a Unifi device. I asked about it on the Ubiquiti subreddit and basically got blackballed for "whining". Opened a support ticket with Ubiquiti and they confirmed that you can't work with any clients on non-Unifi hardware.

So basically all you need to do is plug a laptop into a non-Unifi switch on someone's Unifi network and are able to breach the firewall.

Needless to say I was flabbergasted at the vendor lock-in strategy worse than Apple, and asked for a refund. Thankfully they complied.

I now have a hand-rolled OPNsense router that does everything I need, and with MUCH more configurability.

Hmm.. I’ve seen a few UDMP deployments with third party switches in place, which still have visibility into the clients connected through them. You can’t manage the switches obviously. If you’re trying to do client management functionality that would be handled at L2 (MAC whitelisting on a switch port, etc) UBNT’s management interface won’t abstract rando vendor’s functionality for you, but isn’t that expecting a bit much? Meraki deployments won’t do that either, if I understand what you’re after (and maybe I’m not).

As another comment said, your strategy about breaching the firewall is confusing but it sounds like a configuration issue. If your aim is to default deny outbound traffic, or traffic from or across the LANs except for approved devices, that’s an achievable aim regardless of what switches are in the mix. If you’re trying to do port level security, you’d need a managed switch, Ubiquiti or no.

I am not sure I am following, can you elaborate? The way you wrote it sounds impossible.

See my response above.

I'm not clear what you were trying to achieve?

You had unmanaged switches on your network, and were trying to manage thier downstream connections?

What exactly do you mean by 'breach the firewall'?

It's a basic home network. I had a simple netgear unmanaged switch and an apple airport extreme in bridged mode. The equipment works and i didn't want to add more trash to the landfill and spend money i didn't need, so I wanted to continue to use them.

There is no way to identify any clients on your network that are either behind the switch or behind the airport (even in bridged mode). I would expect at least some list of clients based on DHCP leases or the ARP table, but they are not accessible through the UI.

I have a robotic vacuum from china, and i want to stop it from calling home. There's isn't even a way to find out the IP or what traffic it's sending through the UDM pro, and no way to set blocking rules from the UI.

I understand if they want to provide wifi mesh support and other special wifi features for unifi devices only, but the supposed "enterprise grade" router and FW functionality should support standard network setups, since all traffic goes through the UDM-Pro, and it is certainly aware of the clients since it gave them DHCP leases, and they are in the ARP table (which is only accesible through the SSH command line) and are on the same subnet. It's unacceptable in my opinion.

This is not entirely accurate.

The default logging may not capture the individual child clients, depending on your configuration (eg double nat), sure... but those child clients are still entirely at the mercy of your configuration otherwise. Saying that the clients are completely invisible/invincible, and that the fault is the Ubiquiti product, is not true.

You need to read my comment again. The clients are behind either a bridged AP or a switch, i.e. all on the same subnet, all getting their DHCP addresses from the UDM-Pro, all in the UDM-Pro's ARP table. There is NO double NAT happening here.

Furthermore I didn't say they were invincible. I just said they were invisible to the UDM-Pro's UI. Unless you have a blanket ban on outgoing LAN traffic, which would be absurd, there's no way to block access for a particular client or a particular destination address for that client.

In the case I gave, a Chinese robot vacuum with no on-device interface, please tell me how to find the IP of this robot, then block outgoing traffic from it, without SSH'ing into the UDM and running scripts. That's right, you can't, because the UDM-Pro doesn't support it.

I never said you were using double nat, but noted it as an example in which you may have these issues.

> Unless you have a blanket ban on outgoing LAN traffic, which would be absurd, there's no way to block access for a particular client or a particular destination address for that client.

To the contrary; this is exactly what you should be doing. Isolated subnet for these untrusted devices. Block by default. (Whitelist only)

I used the word invisible to describe it missing in the ui. I used the word invincible to describe your lack of “management” (ie; blocking) of the device.

What I am trying to suggest, however, is that the UDM is likely not the root cause of these issues. I certainly don’t mean to suggest they are the best. The lack of compatibility of features between their product lines is a nightmare.

It's not just compatibility features. They are missing features that low end consumer grade hardware have, and I'll say what I was implying: It's because it's a vendor lock-in strategy, and they want you to replace ALL your equipment with theirs. Explain to me why I shouldn't be able to manage a list of DHCP clients in a piece of "enterprise grade" hardware.

Hi,

Could you elaborate a bit more about your previous network setup? This sounds awful.

See my response above.

Reply on news.ycombinator.com