I have the EdgeRouter X running v 1.9.0.  Similar to the posting titled: DPI "Other" Category.  I want to be able to track PCoIP usage.

Hey guys,

I have an interesting setup (relitively new) that I am trying to get working. 

To cut to the chase, I need to setup and configure the airMAX 8x8 Gb wireless radios to extend a LAN to another building down the street. The dishes are set up and aimed correctly... 

The issue I'm having is that I cannot seem to get the LAG on the switch to function correctly. Enter the EdgeMAX. I have two of them (one for either site) and need to bond eth1-eth4 into a bond group to get the combined bandwidth. I found the article and have completed it successfully. However, I can't get the two routers to see eachother. What needs to be configured so that these routers can see eachother and pass traffic?

Any help would be greatly appreciated. 

Thanks,

Mac

Hello,

I'm using UAP lite in conjunction with the ERL. Currently I have 4 zones - LOCAL, GUEST, LAN & WAN being my FW presented as follows:

 all-ping enable
 broadcast-ping disable
 ipv6-receive-redirects disable
 ipv6-src-route disable
 ip-src-route disable
 log-martians enable
 name GUEST-LAN {
     default-action drop
     rule 1 {
         action accept
         description "Allow established connections"
         state {
             established enable
             related enable
         }
     }
     rule 2 {
         action drop
         description "Drop invalid packets"
         state {
             invalid enable
         }
     }
 }
 name GUEST-LOCAL {
     default-action drop
     rule 1 {
         action accept
         description "Allow established connections"
         state {
             established enable
             related enable
         }
     }
     rule 2 {
         action drop
         description "Drop invalid packets"
         state {
             invalid enable
         }
     }
     rule 53 {
         action accept
         description "Allow DNS"
         destination {
             port 53
         }
         protocol tcp_udp
     }
     rule 6768 {
         action accept
         description "Allow DHCP"
         destination {
             port 67,68
         }
         protocol udp
     }
 }
 name GUEST-WAN {
     default-action drop
     rule 1 {
         action accept
         description "Allow all connections"
         state {
             established enable
             new enable
             related enable
         }
     }
     rule 2 {
         action drop
         description "Drop invalid packets"
         state {
             invalid enable
         }
     }
 }
 name LAN-GUEST {
     default-action drop
     rule 1 {
         action accept
         description "Allow all connections"
         state {
             established enable
             new enable
             related enable
         }
     }
     rule 2 {
         action drop
         description "Drop invalid packets"
         state {
             invalid enable
         }
     }
 }
 name LAN-LOCAL {
     default-action drop
     rule 1 {
         action accept
         description "Allow established connections"
         state {
             established enable
             related enable
         }
     }
     rule 2 {
         action drop
         description "Drop invalid packets"
         state {
             invalid enable
         }
     }
     rule 22 {
         action accept
         description "Allow SSH/SFTP"
         destination {
             port 22
         }
         protocol tcp
     }
     rule 23 {
         action accept
         description "Allow TELNET"
         destination {
             port 23
         }
         protocol tcp
     }
     rule 53 {
         action accept
         description "Allow DNS"
         destination {
             port 53
         }
         protocol tcp_udp
     }
     rule 80 {
         action accept
         description "Allow HTTP/HTTPS"
         destination {
             port 80,443
         }
         protocol tcp
     }
     rule 100 {
         action accept
         description "Allow PING"
         protocol icmp
     }
     rule 123 {
         action accept
         description "Allow NTP"
         destination {
             port 123
         }
         protocol udp
     }
     rule 6768 {
         action accept
         description "Allow DHCP"
         destination {
             port 67,68
         }
         protocol udp
     }
 }
 name LAN-WAN {
     default-action drop
     rule 1 {
         action accept
         description "Allow all connections"
         state {
             established enable
             new enable
             related enable
         }
     }
     rule 2 {
         action drop
         description "Drop invalid packets"
         state {
             invalid enable
         }
     }
 }
 name LOCAL-GUEST {
     default-action drop
     rule 1 {
         action accept
         description "Allow established connections"
         state {
             established enable
             related enable
         }
     }
     rule 2 {
         action drop
         description "Drop invalid packets"
         state {
             invalid enable
         }
     }
     rule 53 {
         action accept
         description "Allow DNS"
         destination {
             port 53
         }
         protocol tcp_udp
     }
     rule 100 {
         action accept
         description "Allow PING"
         protocol icmp
     }
     rule 6768 {
         action accept
         description "Allow DHCP"
         destination {
             port 67,68
         }
         protocol udp
     }
 }
 name LOCAL-LAN {
     default-action drop
     rule 1 {
         action accept
         description "Allow established connections"
         state {
             established enable
             related enable
         }
     }
     rule 2 {
         action drop
         description "Drop invalid packets"
         state {
             invalid enable
         }
     }
     rule 53 {
         action accept
         description "Allow DNS"
         destination {
             port 53
         }
         protocol tcp_udp
     }
     rule 100 {
         action accept
         description "Allow PING"
         protocol icmp
     }
     rule 123 {
         action accept
         description "Allow NTP"
         destination {
             port 123
         }
         protocol udp
     }
     rule 6768 {
         action accept
         description "Allow DHCP"
         destination {
             port 67,68
         }
         protocol udp
     }
 }
 name LOCAL-WAN {
     default-action drop
     rule 1 {
         action accept
         description "Allow established connections"
         state {
             established enable
             related enable
         }
     }
     rule 2 {
         action drop
         description "Drop invalid packets"
         state {
             invalid enable
         }
     }
     rule 22 {
         action accept
         description "Allow SSH/SFTP"
         destination {
             port 22
         }
         protocol tcp
     }
     rule 23 {
         action accept
         description "Allow TELNET"
         destination {
             port 23
         }
         protocol tcp
     }
     rule 25 {
         action accept
         description "Allow SMTP"
         destination {
             port 25
         }
         protocol tcp
     }
     rule 53 {
         action accept
         description "Allow DNS"
         destination {
             port 53
         }
         protocol tcp_udp
     }
     rule 80 {
         action accept
         description "Allow HTTP/HTTPS"
         destination {
             port 80,443
         }
         protocol tcp
     }
     rule 100 {
         action accept
         description "Allow PING"
         protocol icmp
     }
     rule 123 {
         action accept
         description "Allow NTP"
         destination {
             port 123
         }
         protocol udp
     }
     rule 2021 {
         action accept
         description "Allow FTP"
         destination {
             port 20,21
         }
         protocol tcp
     }
 }
 name WAN-GUEST {
     default-action drop
     rule 1 {
         action accept
         description "Allow established connections"
         state {
             established enable
             related enable
         }
     }
     rule 2 {
         action drop
         description "Drop invalid packets"
         state {
             invalid enable
         }
     }
 }
 name WAN-LAN {
     default-action drop
     rule 1 {
         action accept
         description "Allow established connections"
         state {
             established enable
             related enable
         }
     }
     rule 2 {
         action drop
         description "Drop invalid packets"
         state {
             invalid enable
         }
     }
 }
 name WAN-LOCAL {
     default-action drop
     rule 1 {
         action accept
         description "Allow established connections"
         state {
             established enable
             related enable
         }
     }
     rule 2 {
         action drop
         description "Drop invalid packets"
         state {
             invalid enable
         }
     }
     rule 6768 {
         action accept
         description "Allow DHCP"
         destination {
             port 67,68
         }
         protocol udp
     }
 }
 receive-redirects disable
 send-redirects enable
 source-validation disable
 syn-cookies enable

Alhought I'm able to ping the GUEST zone from the LAN and also able to ping my LAN from LOCAL. I'm not able to ping my GUEST network from LOCAL despite the allowance of ICMP on the firewall LOCAL-GUEST:

 rule 100 {
     action accept
     description "Allow PING"
     protocol icmp
 }

The tcpdump on one of of the hosts in the  GUEST network shows me that the echo request is arriving from the router and the host is replying with the echo reply as expected:

01:09:43.795723 IP 172.16.2.1 > 172.16.2.11: ICMP echo request, id 3331, seq 1, length 64
01:09:43.795920 IP 172.16.2.11 > 172.16.2.1: ICMP echo reply, id 3331, seq 1, length 64
01:09:44.799955 IP 172.16.2.1 > 172.16.2.11: ICMP echo request, id 3331, seq 2, length 64
01:09:44.800153 IP 172.16.2.11 > 172.16.2.1: ICMP echo reply, id 3331, seq 2, length 64

On the LOCAL (router) end when I ran the tcpdump I see that the echo reply is not reaching the router:

01:17:28.864902 IP 172.16.2.1 > 172.16.2.11: ICMP echo request, id 3789, seq 1, length 64
01:17:29.866648 IP 172.16.2.1 > 172.16.2.11: ICMP echo request, id 3789, seq 2, length 64
01:17:30.866650 IP 172.16.2.1 > 172.16.2.11: ICMP echo request, id 3789, seq 3, length 64

So I assume that probably a return path is needed from the GUEST-LOCAL policy, which made me add this config  to the policy

 rule 100 {
     action accept
     protocol icmp

However this hasn't produce any results. The reponse is still not reaching the router. The only other possible culprit is the UAP lite, but before I start to diagnose this I want to be sure that I'm not missing anything.

Is anyone able to confirm if that's the case?

I have the same configuration as in:

http://community.ubnt.com/t5/EdgeMAX/1-8-0-Documentation-Basic-Bidirectional-Forwarding-Detection-BFD/m-p/1339200#U1339200

But I need to provide Internet access for sites 1 and 2 using site 3.



I added the following lines:

R1

set protocols static route 0.0.0.0/0 next-hop 1.1.0.3 description default
set protocols static route 0.0.0.0/0 next-hop 1.1.1.2 distance 100

R2

set protocols static route 0.0.0.0/0 next-hop 1.1.1.1 distance 100
set protocols static route 0.0.0.0/0 next-hop 1.1.2.3 description default

R3

set protocols static route 0.0.0.0/0 next-hop 2.2.2.1 description default

When everything is connected it works OK, but when I disconnect the eth2 cable from R3 I can not access the Internet from R2.

ubnt@r3:~$ show bfd session
Sess-Idx Remote-Disc Lower-Layer Sess-Type Sess-State UP-Time Remote-Addr
1 2 IPv4 Single-Hop Up 00:43:13 1.1.0.1/32
2 2 IPv4 Single-Hop Admin-Down 00:00:00 1.1.2.2/32
Number of Sessions: 2

I have the following routing information from R3:

ubnt@r3:~$ show ip route
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
> - selected route, * - FIB route, p - stale info
IP Route Table for VRF "default"
S *> 0.0.0.0/0 [1/0] via 2.2.2.1, eth0
C *> 1.1.0.0/24 is directly connected, eth1
S *> 2.2.0.0/24 [1/0] via 1.1.0.1, eth1
S 2.2.0.0/24 [100/0] via 1.1.2.2, eth2 (recursive via 2.2.2.1 )
S *> 2.2.1.0/24 [1/0] via 1.1.2.2, eth2 (recursive via 2.2.2.1 )
S 2.2.1.0/24 [100/0] via 1.1.0.1, eth1
C *> 2.2.2.0/24 is directly connected, eth0
C *> 127.0.0.0/8 is directly connected, lo

If I execute a traceroute to R2, the traffic goes to the defaut route instead of going through R1:

ubnt@r3:~$ traceroute 2.2.1.2
traceroute to 2.2.1.2 (2.2.1.2), 30 hops max, 38 byte packets
1 2.2.2.1 (2.2.2.1) 0.647 ms 0.801 ms 0.489 ms
2 * * *
3 * * *

What is the proper way to configure the default route to the Internet ?

thanks

So I have this https://www.verizonwireless.com/home-office-solutions/verizon-lte-internet-and-home-phone/#sku=sku1980155 and I want to have it work using the WAN. I eventually will have this be the failover, but I cant even get this thing to route out the network, the internet just seems to not want to work on the EdgemaxPro , i'm not sure why. Anyone have any suggestions?

Hi guys, I want use the IPv4 and IPv6 fullbogons Cymru with eBGP session in my Ubiquiti Edge Router... Someone know working with that?

The router is the EdgePro

Here are my Fullbogon session details by Cymru Team:

SESSION #1

Your IP: 200.16.XX.XXX
Your ASN: 264XXX

Our IP: 38.229.66.20
Our ASN: 65332
MD5 Password: XXXYYYXXX

IPV6 SESSION #1

Your IP: 2800:XXX:0:X::XX:XX
Your ASN: 264XXX

Our IP: 2620:0:6B0::26E5:4207
Our ASN: 65332
MD5 Password: XXXYYYXXX

I just set up an ERL with the WAN+2LAN2 wizard (which the userguide says is the same as the Basic Setup wizard). During the config I selected DHCP for the WAN IP address from my ISP. I just noticed that under the Routing tab, eth0 (WAN) is showinng "static" under Route Type. Is it supposed to say that? Thanks!

I've come across this tutorial for guest network isolation using VLANs: https://help.ubnt.com/hc/en-us/articles/218889067-EdgeMAX-How-to-Protect-a-Guest-Network-on-EdgeRouter

If I want to isolate a particular port on the ERL, so that all traffic through that, including anything through any APs or switches connected to that port, is isolated, can I just follow that tutorial but just use the physical interface (e.g. 'eth2') instead of a vlan (e.g. 'eth2 vif 10') at step 4?

Hi we have a bit of an emergency and have 3 days to get IPV6 Dual Stack running. We have our edgemax ER8 pro connected to our ISP and have both IPV4 and IPV6 conectivity from the CLI  to the web, however while clients get an ipv4 address they cannot get an ipv6 address from the edgemax. We are using EdgeOS 1.9. ISP WAN service is dual stack and we desire example dual stack EdgeOS configurations.

Thanks

Bob

Is there a bug with the EdgeRouterX and Frontier FiOS? Anyone aware? This is whats been happening. Every day I lose internet connectivity. When I come home and log into the router, I renew the IP manually and everything works fine. The IP didnt change or anything. The WAN port just has no IP for no reason at all. Ive heard from a Friend there is an issue where the Frontier DHCP servers arent responding reliably to ARP requests. 

Here is the only thing the /var/log/messages say, not sure where else to look.

Oct 10 18:25:18 ubnt dhclient: dhclient.c:2164: Failed to send 300 byte long packet over fallback interface.

Oct 10 18:25:32 ubnt dhclient: send_packet: Network is unreachable

Oct 10 18:25:32 ubnt dhclient: send_packet: please consult README file regarding broadcast address.

Oct 10 18:25:32 ubnt dhclient: dhclient.c:2164: Failed to send 300 byte long packet over fallback interface.

Oct 10 18:25:39 ubnt dhclient: send_packet: Network is unreachable

Oct 10 18:25:39 ubnt dhclient: send_packet: please consult README file regarding broadcast address.

Oct 10 18:25:39 ubnt dhclient: dhclient.c:2164: Failed to send 300 byte long packet over fallback interface.

Oct 10 18:37:31 ubnt dhclient: send_packet: Network is unreachable

Hello everyone!

I need some assistance/advise from the UBNT Rock Stars around here.

I have a client whose Security/DVR setup appears to have been designed in the stone age. The vendor for the DVR equiptment is being very rigid and will not change or budge on the network config. The client has been with them forever and is not willing to force the issue. So it looks like I'm the one who gets to be flexible... or breakable.

Here's the deal - they have a /28 from the ISP and are using just about all of the 13 IPs running through a Fortinet in 'Transparent Mode'. The Fortinet died and I'm trying really, realy hard to get them into an ER-8.

The way it's set up now - 7 or 8 DVR machines (PCs) are all connected to a dumb switch and the switch is connected to the Fortinet. The DVRs are all set up with Static IP addresses using the ISPs Public IP address block. Example below:

ISP Gateway: 50.1.1.1

Fortinet: 50.1.1.2

DVR1: 50.1.1.3

DVR2: 50.1.1.4

etc, etc, etc.

There is NO 'internal' network. Everything is static, and using the public IPs.

Their security company can then use the public IPs and connect directly to the DVR they need and do whatever it s they do. They've had this setup in place forever, and like I said, are unwilling to make netowrk changes because thier vendor is not being flexible (or in this centtury for that matter).

Trust me, I know the multitude of reasons why this isn't a good idea, not secure, yada, yada. I'm trying ot help out an elderly office building owner and get him out of a jam. I remember back in the day connecting a dumb switch directly to a Covad wireless T1 router and setting up machines in the 'DMZ' and it worked great! IT looks like they don't build circuits like that any more and you can't just connect a dumb stich to the ISPs router any more ( I tried).

So, to my question... Is there a configureation for the ER-8 that will allow me to keep this guys current setup? I know it's been called 'Transparent Mode' or 'Transparent DMZ' depending on the vendor, but i haven't been able to find much on the forums. I found some older stuff that stated it was not avaialable YET, but those posts were 2-3 years old now.

Any help you can give, is greatly appreciated!

-Rob

New on UBNT

I have problems to access our websites located on DMZ from LAN, from the outside it works fine but from the inside we always come to the router interface.

We have 5 public iP on the WAN interface, 4 of them are NATed to internal servers.

Everything else works fine, I have tryed the hairpin NAT but there was no differance. probably did something wrong...

Any suggestions of what i have missed here?

I was planning on using EdgeOS firewall group "Security Updates" to throttle the speed of windows updates on our network,but it seems that Windows 10 updates are not tagged as security updates, but rather as Web File Transfer. Is there any planned FW update on improving this group? 

Btw, I already disabled the "Updates from other PCs" as I want them from Microsoft directly and should be seen by the EdgeOS as such - "Security Updates"

Greetings, is it somehow possible to pull two DHCP IPs to the same physical interface?

Something like this, but the router won't allow it.

Thanks ....



Hi,

I need help to configure a edgerouter pro as the schema in attachement.

I have a voip pbx on my network (3cx) and the cisco 1900 is from the telephony company

This pbx must be connected to internet on VLAN 200 (in order to registrate the pbx licence)

But the sip registration must occured on the VLAN 100 on the ip 1.3.5.8.

So normally, all traffics must go to ETH0 but when it try to reach 1.3.5.8, it must go to ETH3.

Can someone explain how to do that on the edgerouteur?

Regars,

Thomas

Hello,

Does anyone know step by step instructions on getting another wan port to take over in the event the primary wan fails? I can figure out the additional firewall rules and/or port forwarding later. I can configure the additional wan port. I imagine it's the same way you config the first wan port, but just using a different port. I saw a load balance wizard in the edgemax, however I didn't see anything for failover.

My situation is a little unique in that I'd like to have wan1 run voip only and wan2 do data only. However, if wan1 fails then voip goes over to the data circuit and if wan2 fails then data goes over to the voip circuit (I already have traffic shaping on the wan1 voip circuit so data can run on it but it's limited to allow headroom for voip).

So basically, I dunno where to start.

Thanks,

Brendon

Below is my current setup configeration. i can ping the 98.190 number and the 184.188 number from outside the connection. and that computer can ping anything and connect to the outside internet just fine but i need to be about to use the other 12 static 184.188 numbers that have been assined to me by cox and rout them to differance servers. rigjht now all i have configured is the two network eth interfaces and a DHCP server issuing out the other 184.188 numbers so i have a laptop issued with another static number from cox but i can not ping it from outside that network configeration. i just upgraded the firmware on the edge router lite to version 1.9.0 its a 3 port router. i have been trying to figur this out for a while and getting no where any help would be great and appreciated.

i have tried to follow the post from https://community.ubnt.com/t5/EdgeMAX/Multiple-IP-on-WAN-with-two-LAN-NAT/m-p/755942#M25566 but will no luck still can not reach the other static numbers.

Hello, I have an EdgeRouterX, I have configured a server vpn conection through PPTP.
I can to establish a succesful conection to another computer on another site, i can browser on internet but i can't to use Microsoft Outlook, I only can to send emails but i can't to receive emails with my pop3 account on port 110... I tried to create rules but doesn't work....
I think i have to create a new ruler but i don't how to....
Thanks for your help!