If you're planning on buying any Ubiquiti gear and want to support me use the affiliate links below :) ▶Ubiquiti USA Affiliate Link: store.ui.com?a_aid=MacTelecom ▶Ubiquiti EU Affiliate Link: eu.store.ui.com/?a_aid=MacTelecom
The equipment seems nice and their visual are great, but the way to configure them is a real nightmare, especially the firewall rules which must have been designed by someone who doesn't understand how access control works. And network security is the big thing for anyone now, that's the reason I replace Unifi networks for Fortinet since the last 4 years... The fact that the UDM "firewall" allows inter-vlan routing by default is not good - that tells me that this firewall is more a pimped layer-3 switch with a fancy interface than a real firewall that block everything by default, and thus secure your network without you having to go through all segment and block them. Great video still.
I love all of your videos, they are very informative and I appreciate all the great content that you make. ...that being said for demo videos like this where I'm assuming a lot of folks are following along with the video step-by-step with the management console open on one side of the screen and the video on the other side...you go CRAZY fast. I'm constantly having to pause and rewind. Might just be me, and maybe I'm a noob, in which case feel free to ignore.
Thanks for taking the time to make this video! Great resource! Its so much better when the video is as long as it needs to cover the subject, as opposed to trying to fit it into a certain predetermined time.
Thanks for the video. You really are a networking expert. Congratulations! You can tell me where I'm wrong: I own a UDM Pro and a USW Enterprise 24 PoE switch. I have configured 5 VLANs and OpenVPN server on the UDM Pro. As an OpenVPN client I can access all VLANs if I don't have L3 enabled on the switch. When I enable the L3 function on the switch for a specific VLAN, I can no longer access that VLAN from OpenVPN. From the local network I can access all VLANs.
Thank you Cody for producing an excellent resource for Unifi Network versions setup each year! Questions: 1. 2:56 - What is the drawing program you use for network diagrams? 2. Is there a way to document/print out (old school) the network/firewall setup settings so that you can "see" if you have missed anything for each new setup? Thanks again for all that you do!😊
Thank you so so much, and you increased to nearly an hour, a big thank you for this, you speak so fast, I'm happy this time around you spread it out longer..... for myself, I actually slow the video down by 25% 😅
Hi Cody, Thank you for your time to put together this tutorial. I saw you used Network version 7.5.162 and not 7.5.176, at least I thought I was this. The WiFi meshing setting has been moved to the 'systems' page from the WiFi settings page. Just to let you know. I might need to redo my setup here....
I don't understand why you need to create this group of gateways 24:30 since the LAN local (and you say it yourself) is for the UDM (= the UDM's gateways). I mean, you just have to create your rule (25:03) with destination any. No ? I tried and it works, I cannot ping any gateway's ip of the UDM.
So I have watched multiple videos from multiple people and yours are always spot on and the best. I am having an issue with having an IoT network be accessible by other networks. Some devices work others do not. I really am struggling with Apple AirPlay. I have Apple TVs as well as TCL TVs in our building that have AirPlay 2. I can see all IoT devices from my staff, childcare, and guest networks but when I go to actually connect it errors out. I've been trying to nail this down for about a month now and am tearing my hair out. Would you be willing to do a video showing firewall rule setup for these types of applications?
So I just spent almost 2k on Unify devices. Pray for me because I'm diving into something I've always wanted to get into but know nothing about. A home network such is this is way overkill for me, but I really want to learn about this stuff and I find the best way to learn is hands on. I purchased the dream machine special addition, switch pro max 24, Unifi cable internet modem, and the U6 enterprise access point. I do plan on buying the network video recorder and cameras to integrate into the system, but I decided to wait on that until I get this initial setup up and running. Like I said I don't know what I'm doing and don't want to do to much at once and overwhelm my good ole thinking machine (brain). So please pray I don't destroy a couple grand worth of networking equipment. I'm fairly tech savvy, but know nothing about this stuff.
I use Aggregation for my OS2 fiber links to remote building switches, it works really well. I currently have a OS2 fiber going across the side of the house, then ariel to a woodshed followed by going ariel to a guest building until I can get some conduit out there and power. The power I'll be using is low voltage, the guest building is manly just a small room, upstairs storage and Internet access. Hopefully the ariel fiber is ok until I get the conduit next spring, it's not even armored fiber just standard LC to LC OS2 indoor / outdoor use fiber I got off amazon.
Thanks a lot for this video. You clearly have a much better understanding of the ubiquiti firewall than I do. When I get home I'm going to see if I can make mine work. Attempting to block all traffic except RDP and File Sharing between my webserver VLAN and the Main LAN has been challenging for me. We'll see how it goes!
@@MactelecomNetworks it worked! In just a few minutes with your video I have the webserver isolated from the rest of the LAN. I can RDP into it from the default LAN and browse it's shared files but I cannot ping anything from the server itself so I think I'm in good shape now. To me their firewall is strange to use. In my mind one should block everything at the start and then start punching holes through it as needed. Anyway, thanks again, I really appreciate it!
I have an issue with my UDM Pro with the blocking IoT stuff. Its been setup exactly as you've had it for awhile, but from my default network accessing cameras thats on my IoT network it takes SEVERAL tries to actually get access to the cameras. even in my logs it shows this "Reolink Parents Front 2K was blocked from accessing 192.168.1.3 by firewall rule: Block inter VLAN Traffic ." But 192.168.1.x should not be blocked. Its even always pingable. This may be a reolink issue since its showing the camera was blocked and not my PC thats trying to access it.
With the new implementation of the traffic rules, I'm a little confused about when we need to use a firewall rule or a traffic rule. Could you make a video explaining this?
Yes, even I found it confusing. Its similar to what is done in Azure cloud and called as NSG rules. But they were understandable but these arn't. I couldn't figure out the direction of the trafic and got confused.
Hi, I'm just starting with Unifi equipment and your video was very helpful. I noticed that you created three Wi-Fi networks. Which network do you and your family connect to on a regular basis? The Guest network? Or is it possible you did not include your own WIFI network in this video? Would you create a WIFI network for the Default network or do you only access the Default network on a wired computer? Thanks.
This is a great video as a beginner to Unifi. But I haven’t seen any videos deal with game consoles like the Xbox. They need multiplayer access to the Internet but also need remote streaming access from phones, tablets etc
What about IPTV and VLAN taging special for IPTV ? :) I would like to connect TV BOX to my network gear instead of ISP provider modem (in bridge mode atm). What WIFI do you use for your home use ? On Default ?
Hello, thx for your work, it could be nice not to do like all others 'youtube it guys" and going much more deeper in the config of the firewall rules !
Is your IoT Wi-Fi your main Wi-Fi you use for all your devices? Say, smartphone, thermostat, smart switch, etc? Im trying to figure this out by setting a Wi-Fi network for my main network, guest, and camera while comparing your video. Thanks!
I'm very thankful for your updated video and did subscribe and like. You did an awesome job of showing the newer interface. VLAN ? ... I have 2 U6 Pros and an Amplifi Gaming Mesh System. I turned the gaming system into an IOT system and want to use VLAN since the Ampifi is VLAN aware. How do I get the Amplifi on a separate VLAN and use the DHCP from the UDMSE, not the Amplifi? 😱
Great video it really covers 80% of major setup requirements. I'm struggeling with the network settings for the individual ports vs Firewall rules... If a Port is set for CAMera Network only , can IOTnetwork pass thru it because of FW rule ?? ... could you do a video on how to setup these ports vs FW rules?
Question for you: We both use Bell fibre, I currently have 1GbE. I noticed you have moved to 3GbE/3GbE, which means you're now on the "GigaHub" from Bell which doesn't allow for the SFP+ port to be removed. How do you like the Gigahub, were you able to move it to bypass mode easily? I can't stand having mandatory ISP hardware on my connection which is why I'm still on the 1GbE connection.
@mactelecomnetworks Amazing video and content. Been waiting for this UniFi walkthrough. Thanks for posting. Curious have you done a video on the kit you use to make videos? Camera, mic, lighting, software?
Thanks for watching. This would be the closest video I have to what you’re looking for Office and Network Rack Tour 2023 th-cam.com/video/qwqPQx6Npbs/w-d-xo.html
Great guide, just got my first Unifi setup this past weekend and new to follow this guide. Of course they just pushed out a new update! haha. Also, was getting an error on the RFC1918 part. any clues?
GREATTTT video ! Thanks a million! Quick question, I have both G4 and Wyze cams. Would you assign all cameras to your Cam network or IoT ? Just curious...
I have a question unrelated to this video but if you could help I would appreciate it. My question is On this Monday 1-15-2024 I am installing a new sliding glass doors and was wondering if there is a Unifi automatic door lock that I could install? If yes then what would you recommend? I will also run network cable to the new door while it is being installed and buy the Unifi lock setup after. Thank you
Hey Cody. Do you put all your client devices, including your wired desktops etc on the IoT network? Why do they belong on IoT rather than Default? Thanks so much!
Hi , I saw that you are with Bell like me , did you keep the 3000-4000 modem/all in one router that bell provide or not ? I didn’t built my network yet but I’m curious how can you bypass their modem with their spf+ fiber.
Hi Mac thx for your walk thourg of needed settings. could you do a extended versioner where set up firewall setting for PLex, HomeAssistent, google home devices?
This is an Awesome Video... Thanks so much for all your hard work on this Video. I have followed all the steps and now have a fully set up network. My only proble for now is SONOS. I think I have to be on the same WiFi Network as the Sonos products (currently moved to my IoT VLAN but my iPhone id connecting to a different VLAN/WiFi network. Any suggestions?
Nice Tutorial (at 3/4 speed). Skipping a lot that will impact operation. And a bit painful to watch when switching from the UI to the bright white boards.
When I change the switch network to camera and power cycle the PoE ports the cameras switch to the camera subnet but are no longer seen on Protect. What am I doing wrong?
With this setup does that mean your phones and wireless laptops would connect to the iot network via the Dolores ssid? I assume you could make another ssid that uses default network if you wanted
Looking at the setup after he creates Delores I’d say so,but that makes no sense to me as i wouldn’t be able to use a phone to connect to plex I think?
Thx, got it all setup and changed somethings from your previous setup but now with alle the VPN settings working like a charm. How to block vpn to gateways? is it still not possible?
Thanks for the great video. I have the Unifi Dream Machine Pro I got awhile ago. I thought there was a build in firewall/IDS/IPS? It's been running fine, but today I had an issue and it seems that I was backlogged on the updates and it shut down some functions that needed to be updated and restarted. I can't find firewall or DHCP server options for wired networks. Is this something I still need to reinstall or was it a subscription that expired? One other thing, why doesn't the DM Pro pick up a Cisco switch connected to it? The SG-200 doesn't show up in any of the options in the DM.
Thank you for a fantastic video 🤩 So annoying that the UDM does not support multiple sites administration/setup. How to handle this with an UDM, when having clients (on different locations/sites) without USGs (or UDMs)?
How would I go about offloading some of the firewall inter-vlan / subnet routing rules to a L3 UI switch (like a switch pro PoE)? If I remember correctly, these switches allowed access across subnets even though firewall rules were setup to block the traffic (i.e. the switch allowed the traffic prior to it hitting the rule located on the UDM SE). This was a problem for me in the past when hanging an AP off of a switch pro. The port profile needed to allow connections on that port to all networks / SSIDs, and the switch allowed the traffic across those subnets even though the UDM-SE blocked it (when the AP was connected to the UDM-SE, the firewall rules worked correctly). I think that in the past these rules needed to be applied to ACLs, which needed to be implemented via the SSH command line? Is this still the case or is there an easier approach? I'd love to see an updated video on that, specifically addressing these common IoT / NoT / Camera network routing rules. Unless I'm trying to go about this the wrong way lol.
Update: Apparently they no longer use the wildcard mask - the netmask (non-inverse) worked! Now if only I could make it persist through a reboot... I tried to use your older video as reference when trying this, and it isn't working for me: th-cam.com/video/QtVCyL1o260/w-d-xo.html I've come across a few older posts saying they can't get the ACLs to work in the Unifi Forum (I'm running Network version 7.5.176). I'm using a UDM-SE and USW-Pro-24-PoE. The only way I can successfully block inter-vlan traffic when connecting to my USW is by setting the router for the network as my UDM SE and setting the firewall rules there. I cannot get the ACL to block inter-vlan traffic. This is driving me absolutely nuts. Any help or insight would be greatly appreciated!
@MactelecomNetworks I realize this is a year old'ish, but I am hoping someone can shed some light on why the Block inter-vlan routing rule is blocking traffic I have allowed above the Block inter-vlan routing rule. Specifically, I have a port group defined, and a host group defined. The host group has 2 hosts in it that live on different networks. The firewall rule is a LAN In rule that allows all protocols from source host group / port group to destination host group /port group. This works great until I create the Block inter-vlan routing rule as shown. even though this rule is below the one I just described. I am probably doing something wrong lol
Solved this one lol - It was a huge DUH! moment today. One host could not resolve the other hosts IP address. I created an IP mapping in the application I was trying to access each host with, and it started working. It's amazing how computerized equipment only does explicitly what we tell it too 😂
HI Got a question for you CODY. I just got the UDM Pro and i have Bell Giga Hub 3 GB up and 3 GB down. How can I get the UDM Pro to work with the Giga Hub at the full 3GB? What I found was to use the 10GB from the UDM Pro to the 10 GB of the Giga hub but what other connections do I need to do. Maybe that can be a show for you since there seems to be a lot of people asking the same question. Please let me know if I should Return the UDM PRO and get the UDM Pro SE instead to make it work or if the UDM Pro will work fine and do the job.
Hello, your video is amazing! Any chance you could help me out with getting Chromecast working with inter vlaning? i see the devices to cast too but it fails to connect
I need some help with my VPN. I am able to connect to my home network, but it only gives me access to Unifi. I am not able to access the other local IPs on my network.
Like always, great video! Thank you for all of them. The PING block out of a VLAN to the VLAN sec. gateway does not work on my end. It makes no sense that it's not working. Any idea? Maybe I try the old interface and see if I can get it to work there.
After putting all my cameras and doorbell pro in a dedicated van like you did, the 2-way audio of the doorbell is not working. Audio from doorbell to Iphone is ok but from iPhone to doorbell is not working. When I try to talk to the doorbell, the icon on the doorbell changes showing that someone is speaking but there is no sound. Any idea? A firewall rule should be missing... Oh! and thanks for your excellent resources on Unify hardware!
@@MactelecomNetworks I have all camera plugged to a UDM SE ( POE powered ). Can I put the cameras on the default network then? And why? Thanks for your reactivity !
Blocking IoT from the Internet doesn't seem like a good idea. A lot of these IoT devices phone home to update firmware and such. Just curious if you thought of this or if you have rules to allow this to still work.
16:33 that didn't work for me when I did this (trying to use my Adguard Home docker), I kept getting (on my wifi devices) " Connected without internet". I had to do this in the network section for each vlan. My devices are udmpro (v3.1.16) with network version 7.4.162 (I JUST got the prompt to update to 7.5.176) 31:03 any way known to be able to use a url for server address, say my DuckDNS link since I don't believe I have a static wan? 36:45 sweet wanted to look into this. Would like more detailed info though, for example do I look for a tcp or udp config file? Note for people reading: You can't use your normal login for nord, you have to go into the nord account and get the jumbled login credentials, then it'll work. With all your testing, how would I do that if I have 2 lan adapters on my pc connected, 1 main lan and 1 routed through vpn?
Hi Cody, Thank you for your effort to put together this tutorial. I did the Guest network accordingly, but when trying to connect it says: couldn't get IP address. Why is it?
Hi Cody, thanks a lot for your complete guide for Unifi network installation. I have setup my network following your video (+Chris - Crosstalk Solution) and it works great. Could you please do a video on inter-vlan printing for AirPlay (iOS) devices. With my current firewall settings my iPhone (IoT network) cannot print on Office network printer (AirPlay enabled). Thanks
Hold on, unless I missed something at 4 minutes and 17 seconds you said you put your pdu pro into your aggregation switch which I find impossible because it is only a 100 MB connection. The architecture I have set up also called for this but I ended up having to put it into my normal 1-gig side on the 48-port pro switch that I have in order for it to have 100 Meg connectivity. How did you get the pdu to work on the 28 port aggregation switch?
I have an question with Isolation on an VLAN, How do I prevent this VLAN from talking back to the other side, Reason for this is I want to run 2 seperate PXE systems and keep one seperate for the pcs that are going to be in the back room will have an seperate PXE server connected directly to this switch still want that network to get internet but do not want the existing network to get confuised and try connecting to the new PXE system or when i create this seperate vlan say 40.1 it wont be able to talk back to the other network
interesting im on the same os as you but for instance when creating a network guest right under isolation my option says network group BUT your says content filtering.......
![Business Analyst Full Course [2024] | Business Analyst Tutorial For Beginners | Edureka](/img/n.gif)
If you're planning on buying any Ubiquiti gear and want to support me use the affiliate links below :)
▶Ubiquiti USA Affiliate Link:
store.ui.com?a_aid=MacTelecom
▶Ubiquiti EU Affiliate Link:
eu.store.ui.com/?a_aid=MacTelecom
Hi Cody, I am in need of Unifi Express for my home network. Could you assist? Thanks
:)
it's still annoying that design center doesn't accommodate multiple floors since signal travels, you know, in all directions =_=
Hopefully one day ☝️
We need a 2024, the way to set up ports and vlans is way different, please 😢
You saved hours of research and thanks to you I could set up my home network. Great job! Greetings from Poland
The equipment seems nice and their visual are great, but the way to configure them is a real nightmare, especially the firewall rules which must have been designed by someone who doesn't understand how access control works. And network security is the big thing for anyone now, that's the reason I replace Unifi networks for Fortinet since the last 4 years... The fact that the UDM "firewall" allows inter-vlan routing by default is not good - that tells me that this firewall is more a pimped layer-3 switch with a fancy interface than a real firewall that block everything by default, and thus secure your network without you having to go through all segment and block them.
Great video still.
I love all of your videos, they are very informative and I appreciate all the great content that you make.
...that being said for demo videos like this where I'm assuming a lot of folks are following along with the video step-by-step with the management console open on one side of the screen and the video on the other side...you go CRAZY fast. I'm constantly having to pause and rewind.
Might just be me, and maybe I'm a noob, in which case feel free to ignore.
No some of us are slow! Just click the settings button in the video window, then you can change playback speed.
Thanks for taking the time to make this video! Great resource! Its so much better when the video is as long as it needs to cover the subject, as opposed to trying to fit it into a certain predetermined time.
Thanks for the video. You really are a networking expert. Congratulations!
You can tell me where I'm wrong:
I own a UDM Pro and a USW Enterprise 24 PoE switch.
I have configured 5 VLANs and OpenVPN server on the UDM Pro.
As an OpenVPN client I can access all VLANs if I don't have L3 enabled on the switch.
When I enable the L3 function on the switch for a specific VLAN, I can no longer access that VLAN from OpenVPN.
From the local network I can access all VLANs.
Thank you Cody for producing an excellent resource for Unifi Network versions setup each year! Questions: 1. 2:56 - What is the drawing program you use for network diagrams? 2. Is there a way to document/print out (old school) the network/firewall setup settings so that you can "see" if you have missed anything for each new setup? Thanks again for all that you do!😊
Draw io
Thanks, wanted to ask the same.
@@ezekialsa its lucidchart
Thanks Cody for this tutorial. I am waiting for the new one for this year :) Greetings from Romania !
Thank you so so much, and you increased to nearly an hour, a big thank you for this, you speak so fast, I'm happy this time around you spread it out longer..... for myself, I actually slow the video down by 25% 😅
I try and slow my speaking but always forget sorry 😂 thanks for watching
Hi Cody,
Thank you for your time to put together this tutorial.
I saw you used Network version 7.5.162 and not 7.5.176, at least I thought I was this.
The WiFi meshing setting has been moved to the 'systems' page from the WiFi settings page.
Just to let you know. I might need to redo my setup here....
I don't understand why you need to create this group of gateways 24:30 since the LAN local (and you say it yourself) is for the UDM (= the UDM's gateways).
I mean, you just have to create your rule (25:03) with destination any. No ? I tried and it works, I cannot ping any gateway's ip of the UDM.
So I have watched multiple videos from multiple people and yours are always spot on and the best. I am having an issue with having an IoT network be accessible by other networks. Some devices work others do not. I really am struggling with Apple AirPlay. I have Apple TVs as well as TCL TVs in our building that have AirPlay 2. I can see all IoT devices from my staff, childcare, and guest networks but when I go to actually connect it errors out. I've been trying to nail this down for about a month now and am tearing my hair out. Would you be willing to do a video showing firewall rule setup for these types of applications?
HI !!!! Looking forward for a 2024 update. Many many changes since this excelent-at-the-date video . Thanks
Amazing video; thank you, thank you, thank you!!! Just got my UDM Pro up & running as a result!
So I just spent almost 2k on Unify devices. Pray for me because I'm diving into something I've always wanted to get into but know nothing about. A home network such is this is way overkill for me, but I really want to learn about this stuff and I find the best way to learn is hands on. I purchased the dream machine special addition, switch pro max 24, Unifi cable internet modem, and the U6 enterprise access point. I do plan on buying the network video recorder and cameras to integrate into the system, but I decided to wait on that until I get this initial setup up and running. Like I said I don't know what I'm doing and don't want to do to much at once and overwhelm my good ole thinking machine (brain). So please pray I don't destroy a couple grand worth of networking equipment. I'm fairly tech savvy, but know nothing about this stuff.
I wish you the best luck lol have a fun time learning
I use Aggregation for my OS2 fiber links to remote building switches, it works really well.
I currently have a OS2 fiber going across the side of the house, then ariel to a woodshed followed by going ariel to a guest building until I can get some conduit out there and power.
The power I'll be using is low voltage, the guest building is manly just a small room, upstairs storage and Internet access.
Hopefully the ariel fiber is ok until I get the conduit next spring, it's not even armored fiber just standard LC to LC OS2 indoor / outdoor use fiber I got off amazon.
Thanks a lot for this video. You clearly have a much better understanding of the ubiquiti firewall than I do. When I get home I'm going to see if I can make mine work. Attempting to block all traffic except RDP and File Sharing between my webserver VLAN and the Main LAN has been challenging for me. We'll see how it goes!
Wow thanks so much that was very kind. Let me know how your config goes :)
@@MactelecomNetworks it worked! In just a few minutes with your video I have the webserver isolated from the rest of the LAN. I can RDP into it from the default LAN and browse it's shared files but I cannot ping anything from the server itself so I think I'm in good shape now. To me their firewall is strange to use. In my mind one should block everything at the start and then start punching holes through it as needed. Anyway, thanks again, I really appreciate it!
Really great guide. I used it for adding a new vlan for IOT and it works great
Thank you! I was waiting for this to drop! Woo!
Awesome Video Cody !! I see some light at this tunnel !
Mac - can you do a video with a full factory reset of the OS Console and then setting everything back up. This would be very helpful. Thanks!
I have an issue with my UDM Pro with the blocking IoT stuff. Its been setup exactly as you've had it for awhile, but from my default network accessing cameras thats on my IoT network it takes SEVERAL tries to actually get access to the cameras.
even in my logs it shows this "Reolink Parents Front 2K
was blocked from accessing 192.168.1.3 by firewall rule:
Block inter VLAN Traffic
." But 192.168.1.x should not be blocked. Its even always pingable. This may be a reolink issue since its showing the camera was blocked and not my PC thats trying to access it.
With the new implementation of the traffic rules, I'm a little confused about when we need to use a firewall rule or a traffic rule. Could you make a video explaining this?
Please do a video with diagrams outlining In/Out/Local! It's hard to grasp and seems counter intuitive! :)
Yes, even I found it confusing. Its similar to what is done in Azure cloud and called as NSG rules. But they were understandable but these arn't. I couldn't figure out the direction of the trafic and got confused.
Hi, I'm just starting with Unifi equipment and your video was very helpful. I noticed that you created three Wi-Fi networks. Which network do you and your family connect to on a regular basis? The Guest network? Or is it possible you did not include your own WIFI network in this video? Would you create a WIFI network for the Default network or do you only access the Default network on a wired computer? Thanks.
Thank you Cody, I look forward to the follow up on firewall rules and vlan part!
Great video! Im currently setting up a UDM SE and a UDR, this video will help me a lot
This is a great video as a beginner to Unifi. But I haven’t seen any videos deal with game consoles like the Xbox. They need multiplayer access to the Internet but also need remote streaming access from phones, tablets etc
Thank you so much bro for this. Really appreciated it. This going to help for my summer house build. Love you bro. ❤️🙏🏽
What about IPTV and VLAN taging special for IPTV ? :) I would like to connect TV BOX to my network gear instead of ISP provider modem (in bridge mode atm).
What WIFI do you use for your home use ? On Default ?
You absolutely nailed it, good job man!
@mactelecomnetworks can you do an updated video of this in the new UI as well as talk about allowing WireGuard vpn server traffic to other subnets
Hello, thx for your work, it could be nice not to do like all others 'youtube it guys" and going much more deeper in the config of the firewall rules !
Great Video, exactly what I needed!!!
Am I the only one who finds Ubiquiti's way of understanding firewall rules TERRIBLE? 🤯🤢🤮
Would you recommend the SE over the Pro for a home network with U6e x2 install? Does the SE warrant the extra cost?
Is your IoT Wi-Fi your main Wi-Fi you use for all your devices? Say, smartphone, thermostat, smart switch, etc? Im trying to figure this out by setting a Wi-Fi network for my main network, guest, and camera while comparing your video. Thanks!
Thanks! Great guide and keep rockin'🤟
Thank you so much for the super chat :)
I'm very thankful for your updated video and did subscribe and like. You did an awesome job of showing the newer interface. VLAN ? ... I have 2 U6 Pros and an Amplifi Gaming Mesh System. I turned the gaming system into an IOT system and want to use VLAN since the Ampifi is VLAN aware. How do I get the Amplifi on a separate VLAN and use the DHCP from the UDMSE, not the Amplifi? 😱
Great video it really covers 80% of major setup requirements. I'm struggeling with the network settings for the individual ports vs Firewall rules... If a Port is set for CAMera Network only , can IOTnetwork pass thru it because of FW rule ?? ... could you do a video on how to setup these ports vs FW rules?
Question for you: We both use Bell fibre, I currently have 1GbE. I noticed you have moved to 3GbE/3GbE, which means you're now on the "GigaHub" from Bell which doesn't allow for the SFP+ port to be removed. How do you like the Gigahub, were you able to move it to bypass mode easily? I can't stand having mandatory ISP hardware on my connection which is why I'm still on the 1GbE connection.
You do PPPoE passthrough.
@@Nabroloi tried the pppoe passthorugh and saw a 1gbps hit in speed. So to keep the speed I didn't use the spf port
Has much changed with the UIs since this video was put out? I just got a UDM SE and was looking for a guide to help set it up.
Great stuff!
Thank you for sharing this video.
@mactelecomnetworks Amazing video and content. Been waiting for this UniFi walkthrough. Thanks for posting. Curious have you done a video on the kit you use to make videos? Camera, mic, lighting, software?
Thanks for watching. This would be the closest video I have to what you’re looking for
Office and Network Rack Tour 2023
th-cam.com/video/qwqPQx6Npbs/w-d-xo.html
Could you share your Ubiquiti "Shapes" Library for Lucid Chart? (Even if it's just a bank of images that would be super helpful)
Great guide, just got my first Unifi setup this past weekend and new to follow this guide. Of course they just pushed out a new update! haha. Also, was getting an error on the RFC1918 part. any clues?
Excellent explanation. Does anyone know what program they use for the simulation environment?
Is Unifi proprietary software?
Hi There, can you perhaps make a video on how to replicate an DMZ network on a UDM SE if possible?
GREATTTT video ! Thanks a million! Quick question, I have both G4 and Wyze cams. Would you assign all cameras to your Cam network or IoT ? Just curious...
I have a question unrelated to this video but if you could help I would appreciate it. My question is On this Monday 1-15-2024 I am installing a new sliding glass doors and was wondering if there is a Unifi automatic door lock that I could install? If yes then what would you recommend? I will also run network cable to the new door while it is being installed and buy the Unifi lock setup after. Thank you
Hey Cody. Do you put all your client devices, including your wired desktops etc on the IoT network? Why do they belong on IoT rather than Default? Thanks so much!
Hi , I saw that you are with Bell like me , did you keep the 3000-4000 modem/all in one router that bell provide or not ? I didn’t built my network yet but I’m curious how can you bypass their modem with their spf+ fiber.
Hi Mac
thx for your walk thourg of needed settings. could you do a extended versioner where set up firewall setting for PLex, HomeAssistent, google home devices?
Thanks for the new video!!
Hi great tutorial. I noticed that you did not create any WIFI for the defaukt Netwok. Any reason for that ?
Awesome video lots to digest 👍
This is an Awesome Video... Thanks so much for all your hard work on this Video. I have followed all the steps and now have a fully set up network. My only proble for now is SONOS. I think I have to be on the same WiFi Network as the Sonos products (currently moved to my IoT VLAN but my iPhone id connecting to a different VLAN/WiFi network. Any suggestions?
Nice Tutorial (at 3/4 speed). Skipping a lot that will impact operation. And a bit painful to watch when switching from the UI to the bright white boards.
When I change the switch network to camera and power cycle the PoE ports the cameras switch to the camera subnet but are no longer seen on Protect. What am I doing wrong?
With this setup does that mean your phones and wireless laptops would connect to the iot network via the Dolores ssid? I assume you could make another ssid that uses default network if you wanted
Yeah same question I have.
Looking at the setup after he creates Delores I’d say so,but that makes no sense to me as i wouldn’t be able to use a phone to connect to plex I think?
What app is that being used to create the network diagram with UniFi device icons?
Nice work as always!
G3 Flex cameras are 1GbE max. Why do your G3 Flex cameras show up as 10GbE at 7:30?
Thx, got it all setup and changed somethings from your previous setup but now with alle the VPN settings working like a charm. How to block vpn to gateways? is it still not possible?
Thanks for the great video. I have the Unifi Dream Machine Pro I got awhile ago. I thought there was a build in firewall/IDS/IPS? It's been running fine, but today I had an issue and it seems that I was backlogged on the updates and it shut down some functions that needed to be updated and restarted.
I can't find firewall or DHCP server options for wired networks. Is this something I still need to reinstall or was it a subscription that expired?
One other thing, why doesn't the DM Pro pick up a Cisco switch connected to it? The SG-200 doesn't show up in any of the options in the DM.
Thank you for a fantastic video 🤩 So annoying that the UDM does not support multiple sites administration/setup. How to handle this with an UDM, when having clients (on different locations/sites) without USGs (or UDMs)?
What do you use to create the network diagram you're using?
Nice content! I still use the legacy interface to change the default LAN name. You can't do it in the new one.
How would I go about offloading some of the firewall inter-vlan / subnet routing rules to a L3 UI switch (like a switch pro PoE)? If I remember correctly, these switches allowed access across subnets even though firewall rules were setup to block the traffic (i.e. the switch allowed the traffic prior to it hitting the rule located on the UDM SE). This was a problem for me in the past when hanging an AP off of a switch pro. The port profile needed to allow connections on that port to all networks / SSIDs, and the switch allowed the traffic across those subnets even though the UDM-SE blocked it (when the AP was connected to the UDM-SE, the firewall rules worked correctly).
I think that in the past these rules needed to be applied to ACLs, which needed to be implemented via the SSH command line? Is this still the case or is there an easier approach? I'd love to see an updated video on that, specifically addressing these common IoT / NoT / Camera network routing rules. Unless I'm trying to go about this the wrong way lol.
Update: Apparently they no longer use the wildcard mask - the netmask (non-inverse) worked! Now if only I could make it persist through a reboot...
I tried to use your older video as reference when trying this, and it isn't working for me: th-cam.com/video/QtVCyL1o260/w-d-xo.html
I've come across a few older posts saying they can't get the ACLs to work in the Unifi Forum (I'm running Network version 7.5.176). I'm using a UDM-SE and USW-Pro-24-PoE. The only way I can successfully block inter-vlan traffic when connecting to my USW is by setting the router for the network as my UDM SE and setting the firewall rules there. I cannot get the ACL to block inter-vlan traffic.
This is driving me absolutely nuts. Any help or insight would be greatly appreciated!
@MactelecomNetworks I realize this is a year old'ish, but I am hoping someone can shed some light on why the Block inter-vlan routing rule is blocking traffic I have allowed above the Block inter-vlan routing rule.
Specifically, I have a port group defined, and a host group defined. The host group has 2 hosts in it that live on different networks. The firewall rule is a LAN In rule that allows all protocols from source host group / port group to destination host group /port group.
This works great until I create the Block inter-vlan routing rule as shown. even though this rule is below the one I just described. I am probably doing something wrong lol
Solved this one lol - It was a huge DUH! moment today. One host could not resolve the other hosts IP address. I created an IP mapping in the application I was trying to access each host with, and it started working.
It's amazing how computerized equipment only does explicitly what we tell it too 😂
20:56 What would happen if you left the destination here at any instead of the defined private addresses?
My main staff WiFi is failing tracert and nslookup when on vlan. When I take it off vlan and go straight to udm, i get internet. Can you help?
HI Got a question for you CODY. I just got the UDM Pro and i have Bell Giga Hub 3 GB up and 3 GB down. How can I get the UDM Pro to work with the Giga Hub at the full 3GB? What I found was to use the 10GB from the UDM Pro to the 10 GB of the Giga hub but what other connections do I need to do. Maybe that can be a show for you since there seems to be a lot of people asking the same question. Please let me know if I should Return the UDM PRO and get the UDM Pro SE instead to make it work or if the UDM Pro will work fine and do the job.
When you say you never leave auto scale on, is that just for new networks or the default one as well? If so could you confirm why? Thanks!
Why doesn't the default network have a wifi network? Thank you for the great video.
Love this!
17:30 Why all these firewall rules are not functioning on my UDM Pro SE?
For devices such as cell phones. Do you join those to the IoT network so Chromecast and airplay will function or is there a better way to do this?
Well done, Cody.
Hello, your video is amazing! Any chance you could help me out with getting Chromecast working with inter vlaning? i see the devices to cast too but it fails to connect
just a heads up make sure your trunk links allow all connections or you will have a hard time getting the correct assigned vlan to your ports :)
Thats correct. The default all ports are trunks and allow all traffic
I need some help with my VPN. I am able to connect to my home network, but it only gives me access to Unifi. I am not able to access the other local IPs on my network.
So now when changing ports to a new VLAN they just loose connection back to the system.
Like always, great video! Thank you for all of them. The PING block out of a VLAN to the VLAN sec. gateway does not work on my end. It makes no sense that it's not working. Any idea? Maybe I try the old interface and see if I can get it to work there.
After putting all my cameras and doorbell pro in a dedicated van like you did, the 2-way audio of the doorbell is not working. Audio from doorbell to Iphone is ok but from iPhone to doorbell is not working. When I try to talk to the doorbell, the icon on the doorbell changes showing that someone is speaking but there is no sound. Any idea? A firewall rule should be missing... Oh! and thanks for your excellent resources on Unify hardware!
Are you hosting the camera on the UDM pro or UdM se? If so you can just have in your normal network
@@MactelecomNetworks I have all camera plugged to a UDM SE ( POE powered ). Can I put the cameras on the default network then? And why? Thanks for your reactivity !
Blocking IoT from the Internet doesn't seem like a good idea. A lot of these IoT devices phone home to update firmware and such. Just curious if you thought of this or if you have rules to allow this to still work.
16:33 that didn't work for me when I did this (trying to use my Adguard Home docker), I kept getting (on my wifi devices) " Connected without internet". I had to do this in the network section for each vlan. My devices are udmpro (v3.1.16) with network version 7.4.162 (I JUST got the prompt to update to 7.5.176)
31:03 any way known to be able to use a url for server address, say my DuckDNS link since I don't believe I have a static wan?
36:45 sweet wanted to look into this. Would like more detailed info though, for example do I look for a tcp or udp config file? Note for people reading: You can't use your normal login for nord, you have to go into the nord account and get the jumbled login credentials, then it'll work. With all your testing, how would I do that if I have 2 lan adapters on my pc connected, 1 main lan and 1 routed through vpn?
Thanks.
hi Cody, do we need to turn on IGMP snooping for the IOT vlan ? Thanks !
Cody are you using ADMZ for your bell gigahub or bypassing ?
Hi Cody,
Thank you for your effort to put together this tutorial.
I did the Guest network accordingly, but when trying to connect it says: couldn't get IP address. Why is it?
Hi, is it possible to have the Unifi controller on one vlan and the AP U6 on another vlan? I am struggling to make this work. Thank you. Great video!
Hi Cody, thanks a lot for your complete guide for Unifi network installation. I have setup my network following your video (+Chris - Crosstalk Solution) and it works great. Could you please do a video on inter-vlan printing for AirPlay (iOS) devices. With my current firewall settings my iPhone (IoT network) cannot print on Office network printer (AirPlay enabled). Thanks
Cody u da man.
Hold on, unless I missed something at 4 minutes and 17 seconds you said you put your pdu pro into your aggregation switch which I find impossible because it is only a 100 MB connection. The architecture I have set up also called for this but I ended up having to put it into my normal 1-gig side on the 48-port pro switch that I have in order for it to have 100 Meg connectivity. How did you get the pdu to work on the 28 port aggregation switch?
I have an question with Isolation on an VLAN, How do I prevent this VLAN from talking back to the other side, Reason for this is I want to run 2 seperate PXE systems and keep one seperate for the pcs that are going to be in the back room will have an seperate PXE server connected directly to this switch still want that network to get internet but do not want the existing network to get confuised and try connecting to the new PXE system or when i create this seperate vlan say 40.1 it wont be able to talk back to the other network
interesting im on the same os as you but for instance when creating a network guest right under isolation my option says network group BUT your says content filtering.......
Are you using the Key Gen2?
Thanks!
Thanks so much for the super chat :)