Mesh router recommendations

[Cmaier]

OT, but the UNAS 4 in white is back in stock. Ordered one. Now I just have to order the Superlink for my door sensors.

wish they made an 8-bay tower. My synology’s are 12 bay (and really old), but when the day comes I need to replace them, i may go with one or two of the rack-style unifis.

So far my unifi setup is fine. A couple weird glitches - I replaced an edge switch with a unifi flex 2.5 switch, and now the unifi network app is completely confused about the network topology (everything still works - I think it’s just a reporting thing). And one of my synology NAS’s has 2 cat 6’s connected to a non-unifi switch. Both have fixed IP (192.168.1.21 and 192.168.1.22). For some reason, unifi decided that to report that they both have the same IP, and sometimes to report that they have different IPs but reversed from what they are fixed to be.). I went into the synology settings and set them to DHCP now, and then went into unifi’s network app and set them to have fixed leases with the proper IPs. It’s currently reporting the IPs are reversed. But everything works (I can even access via local DNS (set in unifi) via either port - each has its own local DNS entry).

I would say that these are just reporting errors, but at one point I did have trouble connecting to the NAS’s web interface for a few minutes while Unifi was reporting both ports had the same .22 IP address.

To be fair, some of these problems seemed to start when I enabled IPv6 on the local network. I turned it off, which seemed to help a bit. But since the NAS still reports it has IPv6 addresses as well, it may all resolve itself if I reboot the NAS (which I don’t feel like doing).

All of the IoT devices seem much more stable on unifi than they were on the synology network. Only glitch is an apple speaker that was having difficulty connecting to the internet until I moved it a foot away (there used to be a synology access point nearby, but I have one fewer access point with the new setup).

 

[Nycturne]

I had never given it much thought (until recently) but I remember being very surprised when I first realized that you can saturate a gigabit Ethernet link by reading from a single networked spinning disk. It'd probably still be fine for my needs, though I think I'm going to go with 2.5GbE backhaul just in case.

2.5GbE for backhaul makes sense IMO, yeah. But geez, 40% retry on 2.4? I feel lucky with my 17-25% now.

Sort of unrelated, but the other thing that surprised me about networking (now that I'm finally paying some attention ) is that there's basically no support for authenticating wired devices (IIRC Ubiquity doesn't support 802.1X on wired clients on any of their products).

A lot of us that are a little paranoid about that usually do MAC address filtering. The Nokia WAP that my ISP provides has security groups that you assign devices to. Despite the fact that I was using a ridiculously long wifi password one of my neighbours managed to get on my network (some kid or university brat thinking that they're being cute), so I changed the configuration, making the "Home" group that new devices are added to, to be a "honeypot" that has no internet access.

MAC filtering is good, but I also use VLANs. My WiFi by default drops folks into the Thunderdome VLAN. Effectively a guest VLAN with internet access only. I add an override for known devices to give them more access via firewall or changing their VLAN to protect them (IoT devices that can do things in the real world, like thermostat and 3D printer). So my phone can see the management servers and the user-facing NAS, but a friend won’t see them. The switches/etc also get their own VLAN, and even the management network only gets to talk to the router directly for now (the Unifi controller in my setup). But I run a couple home servers, so the isolation is there to slow down anyone who does get access and try to contain the damage.

Even my employer who used to be huge on 802.1x 20 years ago now does MAC filtering instead. Have to register a device to get access on the LAN. And they revoke it aggressively from lack of use.

 

[diamond.g]

wish they made an 8-bay tower. My synology’s are 12 bay (and really old), but when the day comes I need to replace them, i may go with one or two of the rack-style unifis.

So far my unifi setup is fine. A couple weird glitches - I replaced an edge switch with a unifi flex 2.5 switch, and now the unifi network app is completely confused about the network topology (everything still works - I think it’s just a reporting thing). And one of my synology NAS’s has 2 cat 6’s connected to a non-unifi switch. Both have fixed IP (192.168.1.21 and 192.168.1.22). For some reason, unifi decided that to report that they both have the same IP, and sometimes to report that they have different IPs but reversed from what they are fixed to be.). I went into the synology settings and set them to DHCP now, and then went into unifi’s network app and set them to have fixed leases with the proper IPs. It’s currently reporting the IPs are reversed. But everything works (I can even access via local DNS (set in unifi) via either port - each has its own local DNS entry).

I would say that these are just reporting errors, but at one point I did have trouble connecting to the NAS’s web interface for a few minutes while Unifi was reporting both ports had the same .22 IP address.

To be fair, some of these problems seemed to start when I enabled IPv6 on the local network. I turned it off, which seemed to help a bit. But since the NAS still reports it has IPv6 addresses as well, it may all resolve itself if I reboot the NAS (which I don’t feel like doing).

All of the IoT devices seem much more stable on unifi than they were on the synology network. Only glitch is an apple speaker that was having difficulty connecting to the internet until I moved it a foot away (there used to be a synology access point nearby, but I have one fewer access point with the new setup).

How do you like the Zone Based firewall?

 

[Andropov]

MAC filtering is good, but I also use VLANs. My WiFi by default drops folks into the Thunderdome VLAN. Effectively a guest VLAN with internet access only. I add an override for known devices to give them more access via firewall or changing their VLAN to protect them (IoT devices that can do things in the real world, like thermostat and 3D printer). So my phone can see the management servers and the user-facing NAS, but a friend won’t see them. The switches/etc also get their own VLAN, and even the management network only gets to talk to the router directly for now (the Unifi controller in my setup). But I run a couple home servers, so the isolation is there to slow down anyone who does get access and try to contain the damage.

My concern with MAC-based VLAN assignment is that if I'm not mistaken all you need to do to get into a restricted VLAN is to spoof the MAC address of one of the devices that is already inside. And while not entirely trivial to scan for those MAC addresses from a different VLAN, MAC addresses aren't really treated as sensible information.

For a while I had the WiFi set up to authenticate with EAP-TLS (with UniFi's built-in RADIUS server) + VLAN assignment based on that. It worked great except I couldn't get my Apple devices to trust the profile automatically based on the CA root (I had to manually trust the downloaded profile), and on the Apple Watch there's no button in the UI to do it.

I now have it set to WPA3 Personal again, but it was an interesting experiment.

 

[Nycturne]

My concern with MAC-based VLAN assignment is that if I'm not mistaken all you need to do to get into a restricted VLAN is to spoof the MAC address of one of the devices that is already inside. And while not entirely trivial to scan for those MAC addresses from a different VLAN, MAC addresses aren't really treated as sensible information.

Which is fair, and I wouldn’t consider it a security barrier per se, just another hurdle someone has to deal with which makes a drive-by exploit less likely. As I said, the goal is to slow an attacker. One way to do that is make them expend effort just to see if there is anything juicy to target in the first place.

Everything in restricted VLANs is still protected with logins/firewalls/etc, there are no unencrypted HTTP services in use, and the internal SSO stack requires a passkey to login. So jumping to the privileged VLAN is just the start.

 

[Cmaier]

Replaced the intermediate switch with the Unifi 16 pro and now the system correctly understands the network topology. It also means that many of the key traffic flows are upgraded to 2.5gbe now. I will replace the root switch next, and then try and selectively update the most important 2 stretches to 10gbe, assuming I find good spf adapters and there are no surprises in my wiring - I *think* the main run is under 30m, but who knows.

Things definitely are faster now, and everything is still stable.

I probably need to update my main NAS, though, and add a network card with a faster interface.

 

[Nycturne]

Yeah, the topology graph is probably the weakest feature, and only ever works if the network infra is all Unifi stuff.

 

[Cmaier]

I just realized that my MBP has been connected continuously via wifi now to my NAS for at least two weeks, without disconnecting itself; while OS updates had made it more stable, it looks like switching to Unifi made all the difference.

 

[diamond.g]

Is anyone else rocking Unifi cameras?

 

[Citysnaps]

My system is kind of a hodgepodge. Ceiling mounted UniFi access points, a UniFi Edge Router, UniFi and NetGear switches, a MacMini, a CableMatters patch panel, a Tripp-Lite AC power distribution unit, and a couple drawers for manuals and extra cables. All rack mounted in (what used to be) a coat closet. Cameras are all HikVision.

 

[diamond.g]

My system is kind of a hodgepodge. Ceiling mounted UniFi access points, a UniFi Edge Router, UniFi and NetGear switches, a MacMini, a CableMatters patch panel, a Tripp-Lite AC power distribution unit, and a couple drawers for manuals and extra cables. All rack mounted in (what used to be) a coat closet. Cameras are all HikVision.

Are you using RSTP into Protect? Or you using a separate NVR.

 

[Citysnaps]

Are you using RSTP into Protect? Or you using a separate NVR.

For my cameras... I use a program (running 24/7 on a Mac Mini) called Security Spy, by Ben Software. I set it up so that each camera has an active area (that I define - along with sensitivity) that's monitored. If someone walks into the active area when it is armed, it immediately starts recording images, and also sends them to my phone (when I'm away and/or at home). I can set it up so that an alarm is immediately activated, or from my phone after examining the images.

Though a bit pricey, it's an outstanding program with a ton of flexibility. I've been using it for around 10 years now. Customer service is great, with frequent updates.