12 ms·
Argh, why do I learn about this from HN when they pretty much force me through the cloud login with UDM-Pro. Nothing in the dashboard. Also I think http://unifi
by comboy 6y ago
Argh, why do I learn about this from HN when they pretty much force me through the cloud login with UDM-Pro. Nothing in the dashboard. Also I think http://unifi/ http://unifi/ is crap from a security standpoint. Their threat management also seems to be just some kind of a bad joke.They could for example do a nice hardware based honeypot that you have to untrigger with physical access. They could offer so much more for prosumers providing sane defaults for a common case of having multitude of devices at your home which can be categorized as intruder but expect to be on the same network as your phone.
Is there a better alternative? When I tested multiple routers mostly regarding low latency, network stability and reliability a few years ago nothing came close, especially when having multiple access points.
- mesh 6y agoJust for reference, I did receive an email from them.
- cptskippy 6y agoI received one as well approximately an hour ago.
- killion 6y agoI still haven't received one, I'll update this comment if I do. -edit- I just received it at 2:42 pm pst
- novaleaf 6y agoi haven't got an email yet either
- novaleaf 6y agoFinally got it too (aprox 4pm PST). Make sure you turn off Remote access in your device. Probably can leave on local login (w/Ubiquiti acct) but should turn on 2FA
- cptskippy 6y agoI got an email for a secondary account I had forgotten about at 4PM PST.
- watsonkr 6y agoI’m running pfsense as my router and TP-Link access points. I run their controller in a container locally and everything works great together. Super happy. I think for some use cases this setup could be a nice alternative (and cheaper) to ubiquiti.
- dont__panic 6y agoDid you happen to write up the results of your router tests? I'd be really interested in reading up on them! I recently picked up an old Apple Airport Extreme so I could easily set up Time Machine backups on my network, but obviously Airports have their own host of issues so I'd be really interested in upgrading soon.
- ballenf 6y agoA second-hand Mac mini is an alternative that I've used for network Time Machine backup targets. Can also turn on caching iCloud/App Store/system updates for your home, if bandwidth is metered and/or slower than your local speeds.
- comboy 6y agoI don't, but it was a narrow case. Part of my home-made home automation runs on wifi so I was focusing on low latency and no packets lost when using wifi in my specific building. Top of the shelf routers all had some occasional hiccups. I think the good old WRT54GL did much better than them. Plus it was done with the set of wifi receivers available to me at the time (mostly cheapos connected to rpis & esp8266). This is not a common use case, I was not interested in high bandwidth. I did try to disable beamforming and all other fireworks when testing though (but did tests with default settings too)
- ViViDboarder 6y agoI turned off cloud login a while back. There’s a toggle in the settings for this.
- imposterr 6y agoI was confused by the parent comment too. Aside from the remote management features, if you turn off cloud login you still get everything else. Maybe it's something specific to the USG Pro? I've only used the smaller USG.
- comboy 6y agoNot USG but UDM-PRO. It was the first device from them that required me to make an ubiquiti account to set it up.
- imposterr 6y agoWell this is a disappointing development. I'm currently using EdgeRouter hardware, but was considering moving to their Unifi line for my next upgrade. Guess that's off the table till I can use these without cloud access.
- floatboth 6y agoOther comment seems to imply that only Unifi Protect really requires an account, not any of the networking functionality https://news.ycombinator.com/item?id=25737660 https://news.ycombinator.com/item?id=25737660
- altano 6y agoI recently invested in UniFi hardware with the UDM Pro and this isn't exactly correct. UniFi Protect (the video security line) requires remote access and Ubiquiti Cloud accounts or it will break in a million weird ways. If you disable cloud login you cannot reasonably use UniFi Protect.
- 6y ago
- p0p0bawa 6y agoI run a Netgate SG-5100 (PF-Sense) as the main router, the Unifi controller and Access points are al behind the Firewall. The AP and switches are really good, not the DPI/IPS/IDS solution (those suck)
- aborsy 6y agoGreat router! The only issue I have with Netgate is pricing!
- SparkyMcUnicorn 6y agoProtectli is a pretty common alternative.
- minorandromeda 6y agoProtectlii isn't paying for software development or testing, either.
- petrohi 6y agoHave you tried MikroTik gear?
- fivesixzero 6y agoI’ve become a big fan of MikroTik routers and 10G/SFP+ router/switch hardware in the last few years. Their web UI and SSH console are a bit quirky but the performance is pretty great for the price. My primary use case for their gear at home was to have a router that can handle a LACP WAN bond for my fancy cable modem as well as connecting to a 10G Ethernet switch via copper or direct-attached SFP+ to a CRS-305 10G switch. Their RB-4011 was a perfect fit, without any of the Ubiquiti SSO/controller stuff to worry about. I haven’t explored their WiFi products yet (still using an old router as an AP) but their product range is pretty broad. Might look into it this year though.
- ahepp 6y agoDo you know how ubiquiti's "edge" line compares to mikrotik?
- Lammy 6y agoI'm a Mikrotik user, not a Ubiquiti user, but looks like the closest match would be Mikrotik's CRS (Cloud Router Switch) line. My home network is a CRS317-1G-16S+RM at the core and three CRS305-1G-4S+IN (one in each room), all running SwitchOS/SwOS instead of the stock RouterOS (they dual-boot, your choice), and I am very happy with them.
- ethanpil 6y agoWhat APs do you use with a MicroTik setup?
- Lammy 6y agoI like Aruba Instant APs, the kind that don't require cloud management or a separate controller, though it seems they've folded the IAP line into the regular AP line or something with their new Wi-Fi 6 gear. I'm still using Wi-Fi 5 because it's fast enough and cheaper. My central AP is a IAP-315, an IAP-305 in the garage, and another IAP-305 at the wall by the back yard. They're all PoE and linked with wired backbone to form a single big coverage area using a single elected IAP leader as controller for the rest. You shouldn't have trouble buying grey-market ones as long as you are careful to stick to the same regulatory domain for all of them. Aruba gear is available as USA/FCC, Japan, Israel, and RW (Rest of World) versions. I have operated RW units in FCC territory (proooobably legally but probably not worth the risk) by setting them to "US Virgin Islands" so they match FCC-allowed frequencies and power limits, but linking more than one AP still requires the hardware to be same regulatory domain.
- hendersoon 6y agoUbiquiti let users disable the cloud logins with UDM Pro, after a pretty big backlash on their forums. You do need a Ubiquiti account to setup the hardware in the first place, but you can turn off cloud access and login locally after that. And you should.
- frisco 6y agoHow? I have been looking for this setting but haven't been able to find it.
- jaywalk 6y agoOn the landing page after you log in, click Users at the bottom. Then click Add User or Add Admin, and just set the Account Type to Local Access Only.
- frisco 6y agoOh but this doesn't actually disable remote access on the UDM side, does it? It's just a flag that the cloud host can choose to respect?
- hendersoon 6y agoYou need to go to the settings for the UDM/UDMP itself, not the network controller, and disable remote access there. It's a bit hidden.
- pimeys 6y agoJust ordered a Chinese box with 8th gen U-series i5, 8 GB of RAM and 120 GB of SSD. Has six ethernet connections, HDMI and COM. Planning to install OpenWRT to it, and with AES-NI the system should be easily able to push the full 1 Gbps of traffic through Wireguard. I've had whatever routers before, but mostly when using some VPN to hide the traffic from your home network, and if having fast enough internet, a good CPU is a must.
- unethical_ban 6y agoLink to the box you got? That sounds interesting.
- AndrewDavis 6y agoAlso curious, and wondering how much that cost.
- xvf22 6y ago$350-$400ish search AliExpress for "i5 7200U firewall"
- pimeys 6y agoOh, sorry! These are available from Europe, but I've heard good things from US about similar boxes, when I searched with "best pfsense computer". Not the same brand, but similar hardware. https://www.amazon.de/gp/product/B08JHKZMTN/ref=ppx_yo_dt_b_asin_title_o03_s00?ie=UTF8&psc=1 https://www.amazon.de/gp/product/B08JHKZMTN/ref=ppx_yo_dt_b_... Let's see how it works, but I expect it to be much faster than my current ARMv7 box. Of course if you have space for a rack, go with something actively cooled. In our apartment, we expect the router to not make any noise.
- pilsetnieks 6y agoDespite the name in the Amazon listing, it has nothing to do with Mikrotik; also a 1Gbit ARM Mikrotik router/firewall can be had for considerably less.
- second--shift 6y agoAnother endorsement for mikrotik here...spent a lot of time in the WISP space and doing CPE installations. Mikrotik all the way down - text config files (version control), ssh-like remote terminals on all endpoints, full feature-set on even the most basic hardware. I've taken them into other jobs and other engineers have been happy with them. The cons are that everything has one or more "mikrotik" way of doing things, and it may not be intuitive to the new user. Also, although everything is included, you have to set it all up yourself.
- rhodozelia 6y agoAnother con is never ending regressions between versions.
- linsomniac 6y agoI'm in the process of replacing my home Ubiquiti infrastructure. Here's what I've decided on: Replace the US-24-250W PoE switch with an Aruba Networks S2500-24P (gigabit and PoE, 4x 10gig ports, quiet). Replace the Cloud Key Gen 2 with BlueIris for camera controller. I expect this will be able to connect to the existing Ubiquiti cameras. Possibly add one or more Ruckus R610 APs running in "Unleashed" mode to augment my Google WiFi. I'm happy with the Google WiFi, and in particular it has good tools for managing kids access to WiFi. But the Ruckus APs are quite good and so I may move parent and IoT access over to Ruckus, separate out IoT devices to their own network. This is the end of phase 1. Then I plan to go on to: Add an OPN-Sense router. Currently not using Ubiquiti for routing, the Google WiFi is our main router. Would like to gain additional capabilities like insight into what the kids are doing. Replace the Ubiquiti Dome G3 with one of the less expensive 4K cameras if they seem to provide similar or better functionality. Also trying out the Wyse Cam v3, which seems ok and the price sure is right, but is more of an augment camera than a main camera, I prefer wired and PoE. I've been doing some research and those are the options that seem attractive. In particular, going with old enterprise gear looks to be a huge win. You do lose that handy "single pane of glass" management. But considering the problems I'm having with Ubiquiti, and the upgrades I've already done to try to get past them, with only some success, I can't bring myself to go further in on Ubiquiti.
- Johnny555 6y agoThe reason most people go with Ubiquiti for home use is the price -- that Aruba switch costs $3500 new. The ubiquiti switch costs about 1/10th that at $399. Can you get free firmware updates from Aruba or do you need a support contract?
- JaimeThompson 6y agoYou can get S2500-24P from eBay for 125 US or so each.
- linsomniac 6y agoI guess I could have pointed it out more clearly: I'm going "used enterprise" as the route for replacement. As you say, yes, this switch was $2500 new (that's what I saw when I looked), but I bought one for under $100 on ebay. Similarly for the Ruckus R610 AP I mentioned: Those APs were a grand new, but you can get them for a bit over $100 on ebay. Linus Tech Tips did a comparison of it with other consumer units, doing heavy multi-device streaming, and Ruckus was the clear winner. Yes, Ubiquiti looks like a good value and they make some very interesting products. I've used some of them to great effect over the years. But my experience with the NVR and cameras and switch and Cloud Key has been relatively bumpy. Enough so that I'm ready to ditch the convenience for up-front loading and hopefully day-to-day more realible.
- napkin 6y agoFitlet2 looks rather nice to me. Outfitted with an Intel J3455 CPU, and 2-4 Intel NICs, it is really power efficient for its performance class (idles at ~6 watts, for those that care). There are also some Chinese companies producing slightly cheaper boxes in this category- Qotom, Kettop, Protectli. When it comes to software, I'm conflicted. I like pfsense, but Netgate has gone a bit sour with the FLOSS community. I'd also consider OpenWRT, FreeBSD, OpenBSD.
- avtar 6y ago> I like pfsense, but Netgate has gone a bit sour with the FLOSS community I haven't kept up with pfsense. Any chance for a tl;dr?
- avtar 6y agoOkay this seems like a compelling reason to switch to OPNsense https://docs.opnsense.org/history/thefork.html#transparency https://docs.opnsense.org/history/thefork.html#transparency
- napkin 6y agoOk TBH I'm unprepared to back up my statement. I only vaguely recall second hand heresay in regards to their exchanges with OpenBSD developers.
- floatboth 6y agoProtectli seems to be a US company rebadging these Chinese devices. But apparently also putting coreboot on them now, which is nice. I wonder if their coreboot board configs are open source.
- natenatenate3 6y agoI had a fitlet2, was super excited about it, and took awhile to find one. I had to do some work to get it to boot properly, and it worked great for a year or so, but then it just died one day, and I could never figure out what its problem was. Out of warranty by the dead date, never bought another. Been using a $100 HP 8300 SFF with an i7 since, it's a bit overkill, but the price was right. Just purchased a Lenovo M90n iot when it was on sale for $215, will see how it works out once I get it.
- avianlyric 6y ago> Argh, why do I learn about this from HN when they pretty much force me through the cloud login with UDM-Pro. Nothing in the dashboard. They’re still sending out the email. Mail chip will be rate-limiting the send rate to prevent email providers from block listing them. Give it a couple of hours and no doubt you’ll have an email as well.
- colordrops 6y agoSpeaking of security... I fell for their marketing and slick Apple-like design and decided to add a UDM-Pro router and access point to my pre-existing network. I thought I was doing something wrong when the UDM-Pro ignored everything on my network that wasn't connected directly to a Unifi device. I asked about it on the Ubiquiti subreddit and basically got blackballed for "whining". Opened a support ticket with Ubiquiti and they confirmed that you can't work with any clients on non-Unifi hardware. So basically all you need to do is plug a laptop into a non-Unifi switch on someone's Unifi network and are able to breach the firewall. Needless to say I was flabbergasted at the vendor lock-in strategy worse than Apple, and asked for a refund. Thankfully they complied. I now have a hand-rolled OPNsense router that does everything I need, and with MUCH more configurability.
- ywei3410 6y agoHi, Could you elaborate a bit more about your previous network setup? This sounds awful.
- colordrops 6y agoSee my response above.
- gog 6y agoI am not sure I am following, can you elaborate? The way you wrote it sounds impossible.
- colordrops 6y agoSee my response above.
- NickNameNick 6y agoI'm not clear what you were trying to achieve? You had unmanaged switches on your network, and were trying to manage thier downstream connections? What exactly do you mean by 'breach the firewall'?
- Spooky23 6y agoAruba is a few notches up. But any of the cheaper companies use merchant silicon, open source services, etc. Honestly, unifi is great for what it is. What kind of IPS do you expect for $100? If you want less risk, you need to move up the $ ladder.
- yabones 6y agoI resisted for a long time, but after finding that there is no good home router that doesn't have major security drawbacks I decided to just build my own [1]. It's a bit of a chore to set up but works better than any off-the-shelf device I've ever owned. I run Debian, but I've heard other people using OpenBSD with great results as well; it's all about personal preference and what you're familiar with... [1] https://nbailey.ca/post/linux-firewall-ids https://nbailey.ca/post/linux-firewall-ids
- merlinscholz 6y agoWhat about mikrotik? I've got the RB4011 and found it to be the perfect home/small business router
- yabones 6y agoI used a RB750Gr3/hEX router for nearly a year, and I wasn't terribly impressed by the software. The hardware seemed neat, but even as somebody very familiar with routing & switching I found the UI to be rather obtuse. The other reason I decided to 'roll my own' was an in-line IDS. There seem to be 'hacky' ways to get Snort installed on the RouterOS platform, but the CPUs aren't really powerful enough to run DPI with a sufficiently large ruleset. I also like the ability to use Ansible to manage my router/firewall. There are modules available to do this with RouterOS, but they don't seem nearly as robust and mature as the built-in Linux utilities.
- dboreham 6y agoI received an email notification before the HN article fwiw. However when I reset password for the email address they notified...crickets. I don't use UBNT for anything other than forum posts though..
- dboreham 6y agoSecond miracle: less than 1h after posting on HN I received the reset email.
- aspaceman 6y agoYeah I originally bought their hardware after being recommended it here. Really regret that now, as I realize it was just marketing doing work. We are just as susceptible to the stuff haha.
- WillPostForFood 6y agoThe HN story is a link to the Ubiquiti email sent via MailChimp. You may not be on their mailing list, but Ubiquiti is actively letting people know. I got the email at 2:31pm PST.