7 ms·

I bought a Unifi Dream Machine last year because it was an all-in-one device that seemed like the simplest way to have multiple VLANs on my home network, in ord

• JamesBrooks 6y ago
  Something from Mikrotik, perhaps a hAP AC2? I'm a big fan of RouterOS for a home/prosumer use-case (I used a hEX myself)
  • enlightens 6y ago
    I think Mikrotik would be great as well. I'm currently running a RB2011UiAS-2HnD-IN and a RBcAPGi-5acD2nD-US (the cAP ac).
• floatboth 6y ago
  If you only need to VLAN-tag the 4 ports on that one device, you can do it with like… about literally anything? e.g. an Archer C1750 with OpenWRT does that easily. The benefit of UniFi is that you can centrally control a bunch of switches. It's definitely overkill and overpriced if you just want an all-in-one.
  • twblalock 6y ago
    I need to set up multiple wifi SSIDs, each on a distinct VLAN, and apply firewall rules to ensure things like: hosts in the "home" vlan can open connections to hosts in the "iot" vlan, but "iot" cannot open connections to "home".
    • nvr219 6y ago
      Look at Ruckus
      • xchaotic 6y ago
        would be good to see more argument behind this?
        • samoa42 6y ago
          as the name implies, that company made a ruckus in the prosumer segment like ubiquiti but since bought by Arris is declining same same (like you only get FW updates with registration).
    • jkaplowitz 6y ago
      OpenWRT supports that.
      • mlyle 6y ago
        Though you'll probably end up with Atheros wifi chipset on modern hardware... and I've found the OpenWRT drivers to be extremely unreliable when providing multiple SSIDs--- crashing every few days instead of weeks of uptime. I keep hoping that one of the OpenWRT snapshots will fix it, but this is something I've been fighting with for years on multiple pieces of hardware.
        • jkaplowitz 6y ago
          I bought a Linksys WRT3200ACM specifically for use with OpenWRT after a bunch of research. It's modern hardware and based on Marvell, not Atheros. I don't have lots of SSIDs, but I do have separate 5G and 2.4G SSIDs, and they're working well enough.
          • emiliosic 6y ago
            The Velop series, from my own inspection, seems to be based on a custom (neutered) version of OpenWRT
          • mlyle 6y ago
            Thanks for the info! Separate 5G and 2.4G SSIDs are no issue in my experience-- it's multiple SSIDs on one phy where Atheros goes wrong. I really want WiFi6 gear... but given that there's no real OpenWRT support yet, and how long it's taken 802.11ac to mature in OpenWRT (it arguably hasn't yet), it's kind of discouraging.
          • carlhjerpe 6y ago
            5G and 2.4G is usually not handled by the same NIC. So that'd be why they're not problematic.
        • samoa42 6y ago
          i have had different hardware running openwrt and never experienced problems regarding to multiple ssids... maybe you have a known-bad hardware in regards to driver support, but that is absolutely not to be expected.
    • emmelaich 6y ago
      Meraki does multiple wifi SSIDs. Probably does the firewalling too.
• gcblkjaidfj 6y ago
  Ironically you can do that with pretty much ANY access point. From TP-LINK, assus all the way to arruba ones (unleashed). BUT you can't do that with unifi ones alone. Go figure. You need a usg+key or the discontinued UDM you have.
  • dvcrn 6y ago
    The UDM is discontinued? I couldn't find anything on this, do you have a source?
    • gh02t 6y ago
      It's not, the parent is wrong. I'm not sure if I would 100% recommend one (it depends on your needs and how nervous Ubiquiti's recent business decisions make you), but it's not discontinued nor about to be.
      • ews 6y ago
        it's definitely not. I would still recommend the UDM, it is a very solid wifi 5 Gig device with good hackability.
  • gh02t 6y ago
    This is wrong. First, the UDM is not discontinued- it's for sale right now. Second, you don't need a USG+key to do VLANs. You do need to run a Unifi controller, but you can self host that anywhere like on a RasPi or in a VM. You don't need a USG to do the tagging and routing, either... the VLANs you set in the Unifi controller will work with any router/gateway it's just not all streamlined into the controller interface if you use a separate gateway. I know this because I do exactly that, I have a pfSense gateway and Unifi switches/APs.
    • beepboop43 6y ago
      Same here but with opnsense instead of pfsense. It would be great to have all of the info in the controller's dashboard, but I wasn't thrilled with what ui had available over the last year and figured I'd punt buying a usg or similar down the road a few years.
• kyrra 6y ago
  The recommendation I've seen around is to run opnsense or pfsense for the router, then unifi APs. (I first found out about it from a YouTube channel as being a way. https://youtube.com/user/TheTecknowledge https://youtube.com/user/TheTecknowledge . They are PFsense resellers, which is why they talk about it. But they could go straight unifi but they don't. After running PSNs myself for the last 4 years, I like opnsense being a little more open to community involvement, versus the control that PFsense has.). Opnsense forums have lots of recommendation for hardware, which is the path I went recently. I went with https://protectli.com/ https://protectli.com/, which are just some rebranded hardware sold on Alibaba, but they provide support ontop of the hardware.
  • giobox 6y ago
    I've been down this path before. I'd argue strongly pfSense is non-trivial and will require significant time investment for most people coming off Unifi stuff to learn the ropes, and should not be considered a serious alternative for most people. They have very different target markets and this is reflected in the software. Unifi is much closer to a "plug and play" user experience in comparison to pfSense. The customization options for pfSense are of-course fantastic. I actually reversed this choice and am back to using the Unifi Controller again - pfSense is superb in production or more-networking-enthusiast style environments, not so nice for "average" home. I used a 5-ethernet port fan-less Intel Atom box almost identical to the one you linked for my homemade pfSense router while it was running, for that purpose it was pretty good.
    • kyrra 6y ago
      Point taken. I've been running linux with iptables since 1999. I also spent a few years at Cisco doing network security stuff. So PFsense was a minimal learning curve for me. But at the same time, I run Google WiFi points as I don't want to deal with them. :)
• grahamburger 6y ago
  I would go with MikroTik. Or just one if the cheaper Ubiquiti devices, like the EdgeRouter series.
  • novok 6y ago
    MikroTik feels like rolling your own linux router box, a bit overkill and high maintenance.
    • grahamburger 6y ago
      It's definitely overkill, but what is a homelab if not overkill? It's not really high maintenance, though. Once it's in and running you'll never have to touch it.
      • NegativeLatency 6y ago
        Until you do and then you’ve forgotten how and what to do.
        • chessmango 6y ago
          Not to mention software updates to ensure your credentials aren't leaked in plaintext...
        • ComodoHacker 6y ago
          Isn't this true for any advanced technology?
          • novok 6y ago
            With Ubiquity, it wasn't, and you get a nice mobile app to see the status of everything.
    • carlhjerpe 6y ago
      The MSP I work at maintain some 500 MikroTik devices, I wouldn't call it particularly high maintenance. Once they're set up they'll just keep working. I've been auto upgrading my stuff at home with beta software for the last 4 years without encountering any issues. (ROS6, 7 is another story).
• dehrmann 6y ago
  You could always suck it up and get a managed switch.
• Seich 6y ago
  I have a Mikrotik Audience I can wholeheartedly recommend. The performance is great, it had a great price and doesn’t look half bad. The UI is very much “pro” in the sense that you get all the options you might ever want to play with which for 90% of the time is just too much. The wiki is good and the community is really friendly. If you have networking experience or want to something to tinker with it’s a nice deal. If you want something you can set and forget I’d look elsewhere though as the UI is not friendly at all.
• pmlnr 6y ago
  Give AVM and their Fritz!box products a go.
  • cabraca 6y ago
    fritzboxes are everything but certainly no "prosumer"-type devices. Most of their "mesh" is still dual band. only the latest repeater "FRITZ!Repeater 3000" is tri-band and afaik there is no router yet available that supports tri-band.
    • pmlnr 6y ago
      Compared to ordinary consumer products, I'll keep listing them as prosumer. They aren't mikrotik, or barebones openwrt, rather like dd-wrt. The hardware is indeed a bit lagging, I'm not arguing there, but it's not always (only) the hardware that makes prosumer.
      • samoa42 6y ago
        avm is like the apple of home-networking. hardware stats and software features are severely behind the curve but it mostly just works and you dont really need those features anyway. certainly not prosumer
  • samoa42 6y ago
    FritzBox is way better than isp-provided or TP-Link-like boxes but certainly not pro-anything (no vlans or ingress-qos, guest-wifi but no real multi-ssid, severely limited dns-customization ...)
• 8fingerlouie 6y ago
  Has UI gone downhill ? or is it just because of all the negative feedback ? Data leaks happen! It shouldn't but that's just how the world is. UI has been honest about it, and informed every customer as a precaution. (I assume they're still investigating). I can't be sure, but since UniFi Video went offline at the same time the breach was announced, a week earlier than it was scheduled to, that might have been the entry point. In any case, the UDM (despite all the negative talk) is a fine machine, and does what it promises to do. If you want similar performance you're either looking at building something yourself, or paying twice of what you paid for a firewall appliance. The Netgate SG-3100 has less performance at twice the cost. You need a UI account to set it up, but that doesn't mean you have to allow managing it from the cloud. Disable the cloud controller access and any access to your firewall configuration will have to happen from your local network. I'm unsure if you can disable the UI account, but i have a spare UDM sitting around so i will test it.
  • tinco 6y ago
    I built up my companies network infrastructure on unifi gear the past two years. I did so because we don't have budget for a professional network engineer, but we do have some important network requirements that I needed to be able to set up with minimal learning curve. For the most part this turned out great, there's a powerful UI that lets you configure all of the basics. And lets you inspect everything without having to relearn a bunch of tools and concepts everytime. I'd say perfect for a situation where the CTO has to 'solve' the network. What disappointed me is that some aspects are really unfinished, and it looks like there's no intention of it to be fixed. For example we bought their pro firewall (which has been out for years), it's got 2 WAN ports for automatic fail over. To use the 2nd WAN port I had to switch over the UI back to legacy mode. Ok weird but I guess the new UI is still sort of new. But then it turned out that to configure automatic fail over in the most common way, I needed to ssh in and edit configuration files manually. It didn't turn out to be very hard, but it was just jarring. One of their flagship products, and of the 4 ports it has, 1 port is not supported in their main UI and it's most common use is not possible even in their legacy UI. Unifi Protect has similar incompleteness issues. I don't think there's a company that does it better than Ubiquity right now, just disappointed that it stops there.
• motiejus 6y ago
  I use Turris Omnia, which is stock OpenWRT + their (open source) addons. You can configure VLANs like you mentioned, I do the same. It is on the expensive side, but the hardware is beefy and you get vendor's support for OpenWRT out of the box.
• psidhu 6y ago
  I would suggest looking into Mikrotik. Bit of a steep learning curve and a prerequisite that you understand networking, but cheap, reliable, feature packed. Their WiFi APs are behind the curve (no mu-mimo even afaik), but you can just hook up some other wAP if you need the newer protocol features. What I do is keep a Mikrotik router that does all the heavy stuff and hang wAPs off of it as needed. I especially love capsman for wAP management. They do have all-in-ones of course, just not my cup of tea.
• victorhooi 6y ago
  For the routing/firewall side, I would encourage looking at either pfSense (as others here have suggested), or possibly VyOS. I used to have several Ubiquit USG devices as well as their EdgeRouter. I moved to pfSense as it's open-source, more stable, and gives you much better control/configurability on your hardware. There's a great ecosystem of packages on pfSense, that you can install via the web UI - making it a really feature-packed for a homelab. However, recently I've been moving to VyOS to pfSense, which is basically a stripped-down Linux distro, with a heavily tuned FRR routing stack built on top of it. VyOS is an open-source fork of Vyatta, which was previously owned/released by Brocade networks. It operates with a CLI, like many enterprise/commercial routing products. It takes a bit of getting used to, but it's really great to use in practice, and makes it easy to diff configurations, or rollback changes, or copy the same configuration across multiple devices. And of course, it implements with config-management software like SaltStack/Ansible (via Napalm), which is something that pfSense. If you have multiple pfSense devices, you basically need to point/click via the web UI on each one. For APs - Ruckus is great, as is HPE/Aruba (they have a new low-cost line that's targeting the Prosumer market) - they have both been leaders in the wifi field for ages, and have things like AP handover, RF tuning/optimisation, adaptive antennas etc down pat.