Hi there
Got a strange scenario here. I'm trying to understand why this happens. I was doing two different MTR tests to two different international IPs, at the same time.
What I found was that while both are running my Edgemax shows packet loss. But if I do each of the MTRs one after the other, my Edgemax shows no packet loss.
Why would it show packet loss when I have two MTRs running? Is there some default rate limiting or something going on with regards to ICMP traffic or whats going on here?
Hi all,
I am setting up a couple of ER 5 PoE routers and I am facing a frustrating issue.
I can't connect to the GUI or ping to default address (or any configured address)
- Router is in factory default,
- updated firmware to .
- set up my NIC with fixed IP to connect to eth0; can't ping. Interface LED shows link but no response.
- login with console, and give eth1 an address; same issue.
- test eth3-4 and I don't even get an connected LED status on the interfaces.
when looking at an interface after pinging to router:
ubnt@ubnt:~$ show interfaces ethernet eth1
eth1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 80:2a:a8:8d:0b:4e brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
2432 38 0 0 0 0
TX: bytes packets errors dropped carrier collisions
0 0 0 0 0 0
I could configure one ER 5 PoE but I can't get a network connection to at least 2 other routers. Both in factory default.
Any ideas?
thanks in advance!
Brecht
Hi, all!
show version Version: v1.9.1 Build ID: 4939098 Build on: 12/14/16 07:33 Copyright: 2012-2016 Ubiquiti Networks, Inc. HW model: EdgeRouter Pro 8-Port set interfaces ethernet eth0 speed 1000 speed 1000 is not supported Value validation failed Set failed
Why failed?
Sorry if this is newb territory, but I cannot figure something out. I am trying to get port forwarding through an ERP-8 for a security camera DVR.
I have given the DVR a reserved address on the LAN. Per my research, the EdgeRouterPros are supposed to automatically put in any NAT and firewall rules when adding a port forward. When I look at advanced options in the GUI, enable hairpoin NAT and enable auto firewall are checked.
However, I add a forward for port 81 to port 81 on the appropriate LAN address, but I cannot get there.
The DVR is up and responding to web traffic on 81 from the inside address, but not from the outside address. Showing stats shows that no packets have been counted as hitting that rule. When I look at firewall config, I see nothing that looks like a hole for port 81.
Is there something easy I am missing?
Is it a problem to add multiple NAT MASQ entries? I only want certain private networks to go to the internet and only certain blocks of IP's in those networks. I thought I could solve with a MASQ rule for each group of IP's but I don't want to substantial slow the router. What is best practices?
Hi,
I'm having issues with my internet connection's download speed. My internet connection is Gigabit down, 50 up. It's a cable connection if it matters. Connecting the modem straight to my router I'm getting 820 down, 25up. When I connect it through the EdgeMax, my download speed drops to 116Mbps. Tried the offload, and still doesn't work. Can someone please shed some light on what is going on here...? Thank you.
admin@router# show
firewall {
all-ping enable
broadcast-ping disable
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
name WAN_IN {
default-action drop
description "WAN to internal"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
}
name WAN_LOCAL {
default-action drop
description "WAN to router"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
rule 21 {
action accept
description HTTPS
destination {
port 443
}
log disable
protocol tcp
}
}
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
}
interfaces {
bridge br0 {
address 192.168.168.10/24
aging 300
bridged-conntrack disable
description "Local Bridge"
hello-time 2
max-age 20
priority 32768
promiscuous enable
stp false
}
ethernet eth0 {
address dhcp
description Internet
duplex auto
firewall {
in {
name WAN_IN
}
local {
name WAN_LOCAL
}
}
speed auto
}
ethernet eth1 {
bridge-group {
bridge br0
}
description "Local Bridge"
duplex auto
speed auto
}
ethernet eth2 {
bridge-group {
bridge br0
}
description "Local Bridge"
duplex auto
speed auto
}
loopback lo {
}
}
port-forward {
auto-firewall enable
hairpin-nat enable
lan-interface eth1
lan-interface eth2
rule 1 {
description xxxxx
forward-to {
address 192.168.168.252
port 9786
}
original-port 9786
protocol tcp_udp
}
rule 2 {
description xxxxss
forward-to {
address 192.168.168.252
port 9780
}
original-port 9780
protocol tcp_udp
}
rule 3 {
description dd4ds
forward-to {
address 192.168.168.252
port 4894
}
original-port 4894
protocol tcp_udp
}
rule 4 {
description dd444
forward-to {
address 192.168.168.252
port 5000-5001
}
original-port 5000-5001
protocol tcp_udp
}
rule 5 {
description c3434
forward-to {
address 192.168.168.252
port 5060
}
original-port 5060
protocol tcp_udp
}
rule 6 {
description fdt4345
forward-to {
address 192.168.168.252
port 8000-33000
}
original-port 8000-33000
protocol udp
}
wan-interface eth0
}
service {
dhcp-server {
disabled false
hostfile-update disable
shared-network-name LAN_BR {
authoritative enable
subnet 192.168.168.0/24 {
default-router 192.168.168.10
dns-server 192.168.168.10
dns-server 8.8.8.8
lease 86400
start 192.168.168.50 {
stop 192.168.168.199
}
}
}
use-dnsmasq disable
}
dns {
forwarding {
cache-size 150
listen-on br0
}
}
gui {
http-port 80
https-port 443
older-ciphers enable
}
nat {
rule 5010 {
description "masquerade for WAN"
outbound-interface eth0
type masquerade
}
}
ssh {
port 22
}
ubnt-discover {
disable
}
}
system {
host-name router
login {
user admin {
authentication {
encrypted-password passssword
}
level admin
}
}
name-server 8.8.8.8
name-server 8.8.4.4
ntp {
server 0.ubnt.pool.ntp.org {
}
server 1.ubnt.pool.ntp.org {
}
server 2.ubnt.pool.ntp.org {
}
server 3.ubnt.pool.ntp.org {
}
}
offload {
ipv4 {
forwarding enable
gre disable
pppoe disable
vlan disable
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
...skipping...
cache-size 150
protocol tcp_udp
}
rule 3 {
description 232323
forward-to {
address 192.168.168.252
port 4899
}
original-port 4899
protocol tcp_udp
}
rule 4 {
description 232323
forward-to {
address 192.168.168.252
port 5000-5001
}
original-port 5000-5001
protocol tcp_udp
}
rule 5 {
description sdfdfsdfs
forward-to {
address 192.168.168.252
port 5060
}
original-port 5060
protocol tcp_udp
}
rule 6 {
description fdsdfsdsdf
forward-to {
address 192.168.168.252
port 8000-33000
}
original-port 8000-33000
protocol udp
}
wan-interface eth0
}
service {
dhcp-server {
disabled false
hostfile-update disable
shared-network-name LAN_BR {
authoritative enable
subnet 192.168.168.0/24 {
default-router 192.168.168.10
dns-server 192.168.168.10
dns-server 8.8.8.8
lease 86400
start 192.168.168.50 {
stop 192.168.168.199
}
}
}
use-dnsmasq disable
}
dns {
forwarding {
cache-size 150
listen-on br0
}
}
gui {
http-port 80
https-port 443
older-ciphers enable
}
nat {
rule 5010 {
description "masquerade for WAN"
outbound-interface eth0
type masquerade
}
}
ssh {
port 22
}
ubnt-discover {
disable
}
}
system {
host-name router
login {
user admin {
authentication {
encrypted-password password
}
level admin
}
}
name-server 8.8.8.8
name-server 8.8.4.4
ntp {
server 0.ubnt.pool.ntp.org {
}
server 1.ubnt.pool.ntp.org {
}
server 2.ubnt.pool.ntp.org {
}
server 3.ubnt.pool.ntp.org {
}
}
offload {
ipv4 {
forwarding enable
gre disable
pppoe disable
vlan disable
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
time-zone America/Atikokan
}
I just got AT&T Fiber instaled in my house (1GB Up/Down). My current router (Netgear R7000) cant Handle all 1GB on the WAN port. It maxes out at 600Mbps on both up/down on the WAN port. So I decided to join the UBNT family. This is my plan currently;
Edgeroute Lite: ETH/0 = WAN ETH/1=LAN
I know that we cant use ETH/1 & ETH/2 because it slows the router connection on ETH/0.
ETH/0 = Hook up to a PACE 5268 MODEM/ROUTER will setup up DMZ/pinhole for the port 1 where the Edgerouter Lite will be hooked up.
ETH/1= 24 Port Netgear Gigabit Pro-Safe Switch (JGS524)
Need some help with the following or advice;
I have a Synology Server. It runs my Plex Server / Personal Cloud Server / Picture Back Ups from my phone. I also have a security camera system that I use to monitor my house remotely. Garage doors openers are hooked up online to remote control them. I would enable UPNP on the R7000 and everything would work. What would you guys recomend on the EdgeRouter Lite?
I will setup my Netgear (R7000) as an AP. Will use that for my wireless portion until I buy a new unit. This will be hooked up directly to the Netgear Switch.
Please let me know what you guys think and any advice from you all would eb welcome.
Thanks
Hi,
I'm switching ISP's and will need to change my LAN IP addresses from 192.168.1.x to 10.0.1.x.
beyond the WAN+2LAN2 wizard, i've configured OpenDNS, pnp2, and an upload smart queue QoS.
From a working configure (ER-X, fm 1.7), what's the best way to change the LAN IP address? I'm not good with the CLI, but am getting more comfortable with the GUI and the config tree.
Thanks,
jeff
Has anyone used the ER8-Pro in largish-scale NAT deployments? I'm looking to possibly use in an MTU with around 200 users, each with 100Mbps connections. Peak data rate is around 300Mbps total.
I understand NAT is offloaded, but not sure if there would be any limitations applicable to the number of users here. Currently, VyOS is handling this with no problems - I just like the idea of using "black boxes" for spare/replacment purposes.
Hello Group,
I am setting up a edgemax so i can have a fallback system at my location.
I have two internet sources coming into the unit. Unfortunately, the edgemax gateway is the same as one of my sources 192.168.1.XXX
Im wondering if there is a way to change the default for the edgemax because the secondary source is a lower end device. Thank you!
Hi everyone, I would like to replace a RB3011, but I'm not finding the features I use in EdgeMax.
Static ROUTE only
Example:
One of 0.0.0.0/0 with two gateway 1.1.1.1, 1.1.2.1 in this already balances 50% of traffic for each interface.
And to the other 2.2.2.0/24 router with two more gateways 3.3.3.1, 4.4.4.1
Then this router has two outgoing links 0.0.0.0/0 and two routes to get to the client 2.2.2.2/24.
How would you do it in ER?
I've managed to hook up my home and remote office edgerouters through a peer-to-peer ipsec/l2tp connection using the GUI. Thanks to all who helped with that.
192.168.1.1 local edgerouter and LAN
192.168.100.1 remote edgerouter and LAN
I'd like to be able to access the remote edgerouter's GUI, but I can't access 192.168.100.1 from the local LAN. I can of course access all my remote servers (192.168.100.10 for example) but not the router through the IPSEC connection.
Is there a way to configure the remote edgerouter to accept GUI and ssh connections from the 192.168.1.x LAN?
Hello!
I am currently trying to achieve the following - parts of a subnet to go through provider A, other parts to go through provider B.
- We have established sessions with both providers, receiving full table. For the sake of this example - AS100 and AS200
- We have a subnet announced. For the sake of this example - 10.0.0.0/24 .
What I am trying to achieve:
10.0.0.0/25(vlan1) - via AS100
10.0.0.128/25(vlan2) - via AS200
Is such a setup doable? If so, how can it be achieved?
Generally, trying to achieve this for INCOMMING connections mostly.
Thank you in advance!
Hi All
Before the UniFi controller became so full featured I had to code many functions I needed into a Mikrotik RB750UP. Now I have added a USG, this required port forwarding, which enabled firewall rules,which has forced me to move these functions (DHCP, bridging, VLan tagging etc) to the UniFi controller.
All is up and running EXCEPT 'netmap' redirection. I redirect users accessing our website over the WiFi to a local webserver based on which SSID/network they are connected to. This allows the QR Codes/NFC Tags on site to link staff, visitors, students and teachers (4 different SSID's) to different content;
- staff get animal records
- visitors get animal names
- students get education programme material
- teachers get answers to student material
Attached is the original Mikrotik RB750UP RouterOS and my attempt at the equivalent in EdgeOS (colour coded for equivalence). I imagine this is a quick task for those regularly handling EdgeOS but I havent had to look at firewall config in the six years since I wrote this!
I'm still on EdgeOS 1.8.0 but does anybody know if this has been fixed yet? I would love to reset ("Clear Data") the counter on the first of the month manually, then keep a running counter throughout the month of how much data is being used by what hosts but this thing resets sorporadically on it's own it seems like. I went in last night and the traffic counter was 50GB and I go in today and it's 45GB which means it had to have reset throughout the night. By the way, I'm not utilizing DPI, only "Hosts only". If the feature is in EdgeOS, I would like to shy away from setting up a dedicated CACTI server with SNMP (although I could probably do it on a raspberry pi? You think they're powerful enough?) and I definitely don't want to install any extra packages on top of EdgeOS on the router as this is a production unit. Any help is greatly appreciated! Thanks! 
My ER-X was working fine. I tried to upload a new firmware and it failed twice (just upload the file, not apply it), so I decided to reboot it. Now I can no longer access it. I've tried a runtime reset and a power-on reset with the same results. I plug it in and the status lights show up for the ports with things plugged in. I am unable to connect to the router via the IP. Every minute or so the computer thinks it losses connection to the device (it reports a cable unplugged) then it reconnects and says its an unidentified network. However I get no response from 191.168.1.1 and am unable to ping it.
Hi.
I have an Edgerouter Pro set up in a datacenter where we receive 32 public IPs and we're doing 1:1 NAT. Everything is working well in that all VMs inside the network are able to be seen via their public IP address and traffic is flowing in and out. However, all queries for domain names which are inside the network simply will not work. Every request terminals at the router login screen.
I've been working on this for two days and I'm really frustrated with it. Every guide I can find talks about port forwarding, but we're not doing that and the rest I've tried and it still doesn't work.
We currently have 10 or so public IPs on eth0. Source nat rules have the source (private ip) being translated to each machine's public ip and are working. Destination nat rules have the destination (public ip) being translated to the private IP and are working. The only thing that doesn't work is when something inside the network needs something else inside the network and it looks it up via its domain name.
Anything anyone can do to help would be greatly appreciated -- I've already lost two days on this.
Thank you,
Matt
Hi
I have a Edgerouter-Poe.
Where i have a Wan, LAN1, LAN2 and LAN3 network.
WAN: 7.7.7.7
LAN1: 192.168.1.0/24
LAN2: 192.168.2.0/24
LAN3: 192.168.3.0/24
I want to block access between all the LANS execpt for port 85 which should be allowed for LAN2 and LAN3 to access on LAN1. All the LANS have access to the internet. LAN2 should only be able to go out to the wan on port: 80. 443, 20, 21, 53
I can't find a guide explains this. terminal commands are much appreciated
Hi,
I have a EdgeRouter PoE-5 with firmware v1.9.1.
I can not get NAT Hairpin working.
My ISP is Ziggo Business, it delivers a DHCP IP adress to eth0.
I configured DDNS, example http://myddns.nl
All my devices are connected on sw0.
I have several camera's in my house.
When I am on my Wi-Fi this doens't work: http://myddns.nl
ort
When I am external everything works perfectly.
I enabled the 'hairpin NAT' checkbox but it isin't working.
Who can help me? Thank you!
ubnt@ubnt:~$ show configuration
firewall {
all-ping enable
broadcast-ping disable
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
name WAN_IN {
default-action drop
description "WAN to internal"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
}
name WAN_LOCAL {
default-action drop
description "WAN to router"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
rule 21 {
action accept
description "Allow L2TP"
destination {
port 500,1701,4500
}
log disable
protocol udp
}
rule 22 {
action accept
description "Allow ESP"
log disable
protocol esp
}
}
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
}
interfaces {
bridge br0 {
address 10.0.1.1/24
aging 300
bridged-conntrack disable
description "Local Bridge"
hello-time 2
max-age 20
priority 32768
promiscuous enable
stp false
}
ethernet eth0 {
address dhcp
description Internet
duplex auto
firewall {
in {
name WAN_IN
}
local {
name WAN_LOCAL
}
}
poe {
output off
}
speed auto
}
ethernet eth1 {
bridge-group {
bridge br0
}
description "Local Bridge"
duplex auto
poe {
output off
}
speed auto
}
ethernet eth2 {
description "Local Bridge"
duplex auto
poe {
output 24v
}
speed auto
}
ethernet eth3 {
description "Local Bridge"
duplex auto
poe {
output 24v
}
speed auto
}
ethernet eth4 {
description "Local Bridge"
duplex auto
poe {
output 24v
}
speed auto
}
loopback lo {
}
switch switch0 {
bridge-group {
bridge br0
}
description "Local Bridge"
mtu 1500
switch-port {
interface eth2 {
}
interface eth3 {
}
interface eth4 {
}
vlan-aware disable
}
}
}
port-forward {
auto-firewall enable
hairpin-nat enable
lan-interface switch0
rule 1 {
description QNAP
forward-to {
address 10.0.1.253
port 8080
}
original-port 8080
protocol tcp_udp
}
rule 2 {
description "Camera 221"
forward-to {
address 10.0.1.221
port 221
}
original-port 221
protocol tcp_udp
}
rule 3 {
description "Camera 222"
forward-to {
address 10.0.1.222
port 222
}
original-port 222
protocol tcp_udp
}
rule 4 {
description "Camera 223"
forward-to {
address 10.0.1.223
port 223
}
original-port 223
protocol tcp_udp
}
wan-interface eth0
}
service {
dhcp-server {
disabled false
hostfile-update disable
shared-network-name LAN_BR {
authoritative enable
subnet 10.0.1.0/24 {
default-router 10.0.1.1
dns-server 10.0.1.1
lease 86400
start 10.0.1.38 {
stop 10.0.1.243
}
}
}
use-dnsmasq disable
}
dns {
dynamic {
interface eth0 {
service dyndns {
host-name myddns.nu
login myusername
password ****************
}
web dyndns
}
}
forwarding {
cache-size 150
listen-on br0
}
}
gui {
http-port 80
https-port 443
older-ciphers enable
}
nat {
rule 5000 {
description "masquerade for WAN"
outbound-interface eth0
type masquerade
}
rule 5001 {
description "MASQ for hairpin"
destination {
group {
}
}
log disable
outbound-interface eth0
protocol tcp_udp
source {
address 10.0.1.1/24
}
type masquerade
}
}
ssh {
port 22
protocol-version v2
}
}
system {
host-name ubnt
login {
user ubnt {
authentication {
encrypted-password ****************
}
level admin
}
}
ntp {
server 0.ubnt.pool.ntp.org {
}
server 1.ubnt.pool.ntp.org {
}
server 2.ubnt.pool.ntp.org {
}
server 3.ubnt.pool.ntp.org {
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
time-zone Europe/Amsterdam
traffic-analysis {
dpi enable
export enable
}
}
vpn {
ipsec {
auto-firewall-nat-exclude enable
disable-uniqreqids
}
l2tp {
remote-access {
authentication {
local-users {
username myusername {
password ****************
}
}
mode local
}
client-ip-pool {
start 10.0.1.171
stop 10.0.1.180
}
dns-servers {
server-1 10.0.1.1
}
ipsec-settings {
authentication {
mode pre-shared-secret
pre-shared-secret ****************
}
ike-lifetime 3600
}
mtu 1492
outside-address 0.0.0.0
}
}
}
root@Edge2:/home/jacob# show vrrp
Physical interface: eth0, Source Address XX.XXX.XX.30
Interface state: up, Group 200, State: master
Priority: 1, Advertisement interval: 1, Authentication type: none
Preempt: true, VIP count: 1, VIP: XX.XXX.XX.28/29
Master router: XX.XXX.XX.30
Sync-group: ExternalGroup
Last transition: 15s
Physical interface: eth1, Source Address 10.0.3.7
Interface state: up, Group 100, State: backup
Priority: 1, Advertisement interval: 1, Authentication type: none
Preempt: true, VIP count: 1, VIP: 10.0.3.5/24
Master router: unknown, Master Priority: unknown
Sync-group: InternalGroup
Last transition: 51s
eth0 on both edge router pro's is direct to our ISP, eth1 on both routers go to our switch.
Why would it failover one group but not the other?
Thankyou