We have 2 facilities with EdgeRouter X, both connected with VPN site to site. Via the forum instructions, the VPN is up and working perfectly. We also setup L2TP server for our remote user to connect to the first facility. It also works perfectly and we can ping and access to all nodes within that facility. We would like for that L2TP connection to be able to access the second facility also, but we just don't know how. Can anyone guide us?

I'm attempting to go from moderate to open Nat.

I need to forward ports

TCP: 80, 443, 14000, 14008

UDP: 6015

So I add 5 rules right? Under the "Port Forwarding" tab in the GUI

So I need to know what goes where:

Original port Protocol Forward-to address Forward-to port Description

80?                      TCP              My IP?                            ???                      

Hello

I'm wondering if and how it is possible to setup QoS to a destination IP or IP range.

I know how to setup QoS for VoIP phones but a customer is using a web application (CRM) to make calls, so the calls are made from a Mac/PC and not a SIP phone. Therefore setting the DSCP value on the device (if at all possible) would tag all the traffic to prioritize (I guess).

The idea is to prioritize all traffic to the VoIP provider server or server public IP ranges. Searching the web/forum I did not find if this was possible, hopefully it is and someone can tell me how.

Regards

Fr.

I tried to install build-essential package on OS v1.9.1 from wheezy repository. But always I recieved message "libc6-dev required". I tried to install libc6-dev too, but system said that libc6 2.19-18+deb8u7 installed and libc6-dev in wheezy repositories only 2.13-38+deb7u10. So I can't install libc6-dev because versions of libc6 and libc6-dev are differrent. I can't find libc6-dev deb file for MIPS too. Tell me, please, how can I to install build-essentials on OS v1.9.1? Thank you.

Hello Professional,

I setup 2 Windows servers 2003 and 2008 for NLB, this setup for NLB is working. these 2 servers are placed into different locations and connected with 2 EDGEMAX routers.

I followed the below instructions to setup 2 routers.for the bridge-over-GRE-tunnel, but the NLB does not work, if 1 server power off, it would not switch to the NLB IP.

https://help.ubnt.com/hc/en-us/articles/204961754-EdgeMAX-Layer-2-bridge-over-GRE-tunnel

Please help !

Many Thanks,

Alfred

Hi all,

I have an EdgeRouter X SFP and I am regularly (every few days) observing the fiber connection to go down and then back up in few minutes. What would be the best way to gather info on it? Both dmesg and syslog do not contain anything interesting.

dmesg:

Port5 Link Down
Port5 Link Up

syslog:

Mar 23 11:18:11 ubnt kernel: Port5 Link Down
Mar 23 11:18:11 ubnt netplugd[317]: eth5: state ACTIVE flags 0x00011043 UP,BROADCAST,RUNNING,MULTICAST,10000 -> 0x00001003 UP,BROADCAST,MULTICAST
Mar 23 11:18:11 ubnt netplugd[23039]: /etc/netplug/netplug eth5 out -> pid 23039
... then usual dhcp release messages

Mar 23 11:20:13 ubnt netplugd[317]: eth5: state INACTIVE flags 0x00001003 UP,BROADCAST,MULTICAST -> 0x00011043 UP,BROADCAST,RUNNING,MULTICAST,10000
Mar 23 11:20:13 ubnt netplugd[23176]: /etc/netplug/netplug eth5 in -> pid 23176
Mar 23 11:20:13 ubnt kernel: Port5 Link Up
Mar 23 11:20:14 ubnt dhclient: DHCPDISCOVER on eth5 to 255.255.255.255 port 67 interval 3
Mar 23 11:20:14 ubnt netplugd[317]: eth5: state INNING pid 23176 exited status 0

It doesn't seem to correlate with anything, except maybe when I start using the Internet more intensively (multiple tabs after some time), but it might be a red herring. 

My setup is pretty simple - SFP @ eth 5, other ports are NAT-ted, eth0 has a desktop connected to it, eth4 has the POE enabled and connects to UniFi AP-AC-LR (another UniFi AP-AC-LR is is wirelessy linked to it).

Any suggestions on debugging / investigating are welcomed.

Thanks in advance.

Setup a new customer on an EdgeRouter Lite.  WAN (eth0) is detected as full gigabit connected to the ISP modem.  LAN (eth1) connected to a Cisco SG300 POE switch and it's only showing up as 100 meg.  What's the deal here?  Tried different cable and different ports.  Clearly it's the ER not playing nice with the Cisco switch here.  Any workaround?

I've been using the advanced queue feature successfully for some time. I recently added load balancing to my setup, and am having some issues with the behaviour of my advanced queue.

I'm load balancing two 2500kbit connections on pppoe0 and pppoe1.

I want to ensure that each connection is never saturated past 2300kbit downstream.

What seems to be happing instead is that the sum of pppoe0+pppoe1 never exceeds 2300kbit. With qos disabled, the graphs will easily reach 4500kbit aggregate.

Load balancing is working, but total throughput never exceeds 2.5mbit

I'm trying to use a filter to match pppoe0 and pppoe1 and split them in to separate branches. I have a feeling there's an issue with these filters.

traffic-control {
    advanced-queue {
        branch {
            queue 10 {
                bandwidth 2300kbit
                description pppoe1
                parent 1
                priority 4
            }
            queue 20 {
                bandwidth 2300kbit
                description pppoe0
                parent 1
                priority 4
            }
        }
        filters {
            match 10 {
                attach-to 1
                description pppoe1
                interface pppoe1
                target 10
            }
            match 20 {
                attach-to 1
                description pppoe0
                interface pppoe0
                target 20
            }
            match 111 {
                attach-to 10
                ip {
                    destination {
                        address 10.0.0.67/32
                    }
                }
                target 101
            }
            match 112 {
                attach-to 10
                ip {
                    destination {
                        address 10.0.0.0/24
                    }
                }
                target 102
            }
            match 211 {
                attach-to 20
                ip {
                    destination {
                        address 10.0.0.67/32
                    }
                }
                target 201
            }
            match 212 {
                attach-to 20
                ip {
                    destination {
                        address 10.0.0.0/24
                    }
                }
                target 202
            }
        }
        leaf {
            queue 101 {
                bandwidth 200kbit
                ceiling 2000kbit
                parent 10
                priority 7
                queue-type Queue0
            }
            queue 102 {
                bandwidth 2000kbit
                ceiling 2300kbit
                parent 10
                priority 1
                queue-type Queue0
            }
            queue 201 {
                bandwidth 200kbit
                ceiling 2000kbit
                parent 20
                priority 7
                queue-type Queue0
            }
            queue 202 {
                bandwidth 2000kbit
                ceiling 2300kbit
                parent 20
                priority 0
                queue-type Queue0
            }
        }
        queue-type {
            fq-codel Queue0 {
                ecn enable
            }
        }
        root {
            queue 1 {
                attach-to global
                bandwidth 100mbit
            }
        }
    }
}

I have spend around 16 hours searching forum and trying set any dhcp option (66,150,242), and it just does not work on:

Version: v1.9.1
Build ID: 4939092
Build on: 12/14/16 07:02
Copyright: 2012-2016 Ubiquiti Networks, Inc.
HW model: EdgeRouter X SFP 6-Port

Any clue ?
here is my conf

cat /opt/vyatta/etc/dhcpd.conf
....
option tftp-server code 150 = { ip-address };
option tftp-server 10.10.10.5;

shared-network DATA_LAN {
not authoritative;
subnet 192.168.0.0 netmask 255.255.255.0 {
option domain-name-servers 8.8.8.8, 8.8.4.4;
option routers 192.168.0.1;
default-lease-time 86400;
max-lease-time 86400;
range 192.168.0.50 192.168.0.200;
}
}
shared-network VOICE_LAN {
not authoritative;
subnet 10.107.135.96 netmask 255.255.255.240 {
option ntp-servers 10.107.135.97;
# The following 1 lines were added as subnet-parameters in the CLI and have not been validated
option tftp-server 10.10.10.5;
option routers 10.107.135.97;
default-lease-time 86400;
max-lease-time 86400;
range 10.107.135.98 10.107.135.110;
}
}
admin@test:~$

Hi all,

Have an ER-8 installed at a client site. They have just had a PCI security scan completed and it has come back with the following advisory:

Port
22

Protocol
TCP

Service
ssh

Title
SSH Weak Algorithms Supported

Synopsis:
The remote SSH server is configured to allow weak encryption algorithms or no
algorithm at all.

Impact:
SecurityMetrics has detected that the remote SSH server is configured to use
the Arcfour stream cipher or no cipher at all. RFC 4253 advises against using
Arcfour due to an issue with weak keys. See also :
https://tools.ietf.org/html/rfc4253#section-6.3

Resolution:
Contact the vendor or consult product documentation to remove the weak
ciphers.

Data Received:
The following weak server-to-client encryption algorithms are supported :
arcfour arcfour128 arcfour256 The following weak client-to-server encryption
algorithms are supported : arcfour arcfour128 arcfour256

Is there a documented method to update ciphers? Ive had a root around the forums but no joy.

Thanks!

Nell

My equipment:

• EdgeRouter ERPoe-5 with 1.9.1 firmware
• Unifi Cloud Key
• Two UAP-AC-PRO access points
• Netgear ProSafe Plus JGS524PE Switch

My current setup:

I have multiple WAN connections from the same provider (though will utilize only two in the setup below), each with a separate static, public IP, but a shared gateway IP.

Right now I have everything up and running whereby I'm utilizing just a single WAN connection to eth0 of my EdgeRouter, and then DHCP running on the EdgeRouter to serve ports eth2-eth4.  eth1 is unused. eth2 is connected to a VLAN on my Netgear switch, which in turn, the two UAP-AC-PROs are connected to. I have a single SSID setup for Wifi and everything works. eth3 has Cloud Key, and eth4 is unused.

My main goal:

I have a second company moving into the office, and for security purposes, I want to create a second SSID that is segregated from my first SSID, so that not only are they on a separate LAN, but also use separate public WAN IPs.

Optional bonus goal:

I have a printer (can be wired or wireless) that I'd like both companies to be able to access.

I'm not a networking expert. Can anyone direct me on how to do this? Thanks!

EdgeRouter X v1.9.0

Eth0 = LAN 10.1.20.0/24

Eth1 = DMZ 10.1.30.0/24

Eth3 = WAN

Eth3 has 6 IPs on it. 10.1.10.0/24 to the cable modem plus 5 public static IPs

Static IPs are NATd both ways to machines on DMZ

Eth0 has regular nat

I'm unable to connect from lan to dmz or vice versa. Firewall policy for all ports, in and out, default to accept and there are no rules blocking in either direction. No firewall rules on any of the hosts are blocking.

Any suggestions would be greatly appreciated.

Duane

firewall {
    all-ping enable
    broadcast-ping disable
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians enable
    name dmz-in {
        default-action accept
        description ""
        rule 1 {
            action accept
            destination {
                address 10.1.20.5
            }
            log disable
            protocol all
        }
    }
    name dmz-out {
        default-action accept
        description ""
    }
    name lan-in {
        default-action accept
        description ""
    }
    name lan-out {
        default-action accept
        description ""
    }
    name wan-in {
        default-action drop
        description ""
        rule 30 {
            action accept
            description "established / related"
            log disable
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 40 {
            action accept
            description "10.1.30.3"
            destination {
                address 10.1.30.3
                group {
                    port-group 10.1.30.3
                }
            }
            log disable
            protocol all
        }
        rule 50 {
            action accept
            description "10.1.30.4"
            destination {
                address 10.1.30.4
                group {
                    port-group 10.1.30.4
                }
            }
            log disable
            protocol all
        }
        rule 60 {
            action accept
            description "10.1.30.5"
            destination {
                address 10.1.30.5
                group {
                    port-group 10.1.30.5
                }
            }
            log disable
            protocol all
        }
        rule 80 {
            action accept
            description "icmp ping 10.1.30.3 - 10.1.30.5"
            destination {
                address 10.1.30.3-10.1.30.5
            }
            log disable
            protocol 8
        }
    }
    name wan-out {
        default-action accept
        description ""
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
}
interfaces {
    ethernet eth0 {
        address 10.1.20.1/24
        description LAN
        duplex auto
        firewall {
            in {
                name lan-in
            }
            out {
                name lan-out
            }
        }
        speed auto
    }
    ethernet eth1 {
        address 10.1.30.1/24
        description DMZ
        duplex auto
        firewall {
            in {
                name dmz-in
            }
            out {
                name dmz-out
            }
        }
        speed auto
    }
    ethernet eth3 {
        address 1.2.3.153/29
        address 1.2.3.154/29
        address 1.2.3.155/29
        address 1.2.3.156/29
        address 1.2.3.157/29
        address 10.1.10.2/24
        description "WAN"
        duplex auto
        firewall {
            in {
                name wan-in
            }
            out {
                name wan-out
            }
        }
        speed auto
    }
    loopback lo {
    }
    switch switch0 {
        mtu 1500
    }
}
port-forward {
    auto-firewall enable
    hairpin-nat enable
    lan-interface eth0
    wan-interface eth3
}
protocols {
    static {
        route 0.0.0.0/0 {
            next-hop 10.1.10.1 {
            }
        }
        route 10.8.0.0/24 {
            next-hop 10.1.30.3 {
            }
        }
    }
}
service {
    dhcp-server {
        disabled false
        hostfile-update disable
        shared-network-name DMZ {
            authoritative disable
            disable
            subnet 10.1.30.0/24 {
                default-router 10.1.30.1
                dns-server 10.1.30.1
                lease 86400
                start 10.1.30.250 {
                    stop 10.1.30.254
                }
            }
        }
        shared-network-name LAN {
            authoritative disable
            subnet 10.1.20.0/24 {
                default-router 10.1.20.1
                dns-server 10.1.20.1
                domain-name local
                lease 86400
                start 10.1.20.100 {
                    stop 10.1.20.110
                }

            }
        }
        use-dnsmasq enable
    }
    dns {
        forwarding {
            cache-size 500
            listen-on eth0
            name-server 209.222.18.222
            name-server 209.222.18.218
        }
    }
    gui {
        http-port 80
        https-port 443
        older-ciphers enable
    }
    nat {
        rule 1 {
            description "1.2.3.153 - 10.1.30.3"
            destination {
                address 1.2.3.153
            }
            inbound-interface eth3
            inside-address {
                address 10.1.30.3
            }
            log disable
            protocol all
            source {
            }
            type destination
        }
        rule 2 {
            destination {
                address 1.2.3.154
            }
            inbound-interface eth3
            inside-address {
                address 10.1.30.4
            }
            log disable
            protocol all
            source {
            }
            type destination
        }
        rule 3 {
            destination {
                address 1.2.3.155
            }
            inbound-interface eth3
            inside-address {
                address 10.1.30.5
            }
            log disable
            protocol all
            source {
            }
            type destination
        }
        rule 5001 {
            description "1.2.3.153 - 10.1.30.3"
            destination {
                group {
                }
            }
            log enable
            outbound-interface eth3
            outside-address {
                address 1.2.3.153
            }
            protocol all
            source {
                address 10.1.30.3
            }
            type source
        }
        rule 5002 {
            description "1.2.3.154 - 10.1.30.4"
            destination {
                group {
                }
            }
            log disable
            outbound-interface eth3
            outside-address {
                address 1.2.3.154
            }
            protocol all
            source {
                address 10.1.30.4
                group {
                }
            }
            type source
        }
        rule 5003 {
            description "1.2.3.155 - 10.1.30.5"
            log disable
            outbound-interface eth3
            outside-address {
                address 1.2.3.155
            }
            protocol all
            source {
                address 10.1.30.5
            }
            type source
        }
        rule 5004 {
            description "internal nat"
            destination {
                group {
                }
            }
            log enable
            outbound-interface eth3
            outside-address {
                address 1.2.3.157
            }
            protocol all
            source {
                address 10.1.20.0/24
            }
            type source
        }
        rule 5005 {
            description "dmz nat"
            disable
            log disable
            outbound-interface eth3
            outside-address {
                address 1.2.3.157
            }
            protocol all
            source {
                address 10.1.30.0/24
            }
            type source
        }
    }
}

I have 2 Mitel PBXs on either end of an MPLS connection.  The remote site is still running the Cisco RV325 router with the original, working configuration.  At the local site, I've replaced the old router with an ERP8, loaded a basic, apparently open configuration with the load balancing wizard, and then replicated the important details such as port forwards and static routes.  As far as I can tell, everything is now the same as it was before the change, but now my PBX's aren't communicating.

When you try to dial a remote extension, it fails with 'destination unavailable'. whichwould suggest the MPLS or static route, but all other traffic is fine.  Could be the PBX's, but they check out, so I suspect I've missed something in this firewall.

I'm load balancing eth6&7 and bridging eth1, 2, and 3. Could it be because br0 is missing the firewall{} statement the , say eth0 has?  Any suggestions would be awesome.

Ken

firewall {
    all-ping enable
    broadcast-ping disable
    group {
        network-group PRIVATE_NETS {
            network 192.168.0.0/16
            network 172.16.0.0/12
            network 10.0.0.0/8
        }
    }
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians disable
    modify balance {
        rule 10 {
            action modify
            description "do NOT load balance lan to lan"
            destination {
                group {
                    network-group PRIVATE_NETS
                }
            }
            modify {
                table main
            }
        }
        rule 80 {
            action modify
            description "do NOT load balance destination public address"
            destination {
                group {
                    address-group ADDRv4_eth6
                }
            }
            modify {
                table main
            }
        }
        rule 90 {
            action modify
            description "do NOT load balance destination public address"
            destination {
                group {
                    address-group ADDRv4_eth7
                }
            }
            modify {
                table main
            }
        }
        rule 100 {
            action modify
            modify {
                lb-group G
            }
        }
    }
    name WAN_IN {
        default-action drop
        description "WAN to internal"
        rule 10 {
            action accept
            description "Allow established/related"
            log disable
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
    }
    name WAN_LOCAL {
        default-action drop
        description "WAN to router"
        rule 30 {
            action accept
            description "Allow established/related"
            state {
                established enable
                related enable
            }
        }
        rule 40 {
            action drop
            description "Drop invalid state"
            log disable
            state {
                invalid enable
            }
        }
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
}
interfaces {
    bridge br0 {
        address 192.168.2.1/24
        aging 300
        bridged-conntrack disable
        hello-time 2
        max-age 20
        priority 32768
        promiscuous disable
        stp false
    }
    ethernet eth0 {
        address 192.168.20.1/24
        description "Local Admin"
        duplex auto
        firewall {
            in {
                modify balance
            }
        }
        speed auto
    }
    ethernet eth1 {
        bridge-group {
            bridge br0
        }
        duplex auto
        speed auto
    }
    ethernet eth2 {
        bridge-group {
            bridge br0
        }
        duplex auto
        speed auto
    }
    ethernet eth3 {
        bridge-group {
            bridge br0
        }
        duplex auto
        speed auto
    }
    ethernet eth4 {
        address 192.168.21.1/24
        description "Local NAS"
        duplex auto
        speed auto
    }
    ethernet eth5 {
        address 192.168.22.1/24
        description "Local Other"
        duplex auto
        speed auto
    }
    ethernet eth6 {
        address dhcp
        description "WAN 2"
        duplex auto
        firewall {
            in {
                name WAN_IN
            }
            local {
                name WAN_LOCAL
            }
        }
        speed auto
    }
    ethernet eth7 {
        address 123.123.123.123/24
        description WAN
        duplex auto
        firewall {
            in {
                name WAN_IN
            }
            local {
                name WAN_LOCAL
            }
        }
        speed auto
    }
    loopback lo {
    }
}
load-balance {
    group G {
        interface eth6 {
        }
        interface eth7 {
        }
        lb-local enable
    }
}

I'm soon to be installing the following:

Edgerouter X-SFP

Unifi US-24 Switch

Unifi US-16-150W Switch

And I've bought 4 Ubiquiti SFP modules and 2 fibre cables (not really necessary for my setup, but I figure why not, and it'll free up some ports).

This gives me two options for setup as far as I can tell:

1.  SFP out from the Edgerouter and in to the US-24 SFP and

     Out from the US-16-150W and in to the 24 port SFP

or

2.  Regular ethernet out from the Edgerouter to the US-24 and

     LACP the two switches together

This is a home network with just your typical home network stuff going on (bluray rip streaming around the house, couple of AC-Lite access points, 3 G3 Cameras) so it's not crazy by any means, but I figure I may as well set it up in the most efficient manner, even if I'm not likely to need the efficiency

What would you suggest?

Thanks!

Hello community.

I would like to do the following:

My OMV-server with nextcloud is asleep. I am at work and want to access data. I open a browser or app and try to access my server. My Edgerouter gets the traffic on the specified port and automatically sends a magic packet to wake up the server, so that I cn access it.

Is there a way to do this? Does anyone have a script?

My setup:

Static internet IP connected to eth0 of my edgerouter X

edgerouter functions as my DHCP server

OMV-server with nextcloud on eth3 with static IP 192.168.2.190 supporting wol

Thanks in advance!

Hi,

if I enable DNSMASQ for DHCP and DNS, the traffic analyses panel does no longer display hostnames for dynamic DHCP hosts. Static DHCP hosts are displayed.

My DNS is setup correct. /etc/resolv points to 127.0.0.1 only. Also I can nslookup/dig these hosts and get the hostname returned.

Any idea, what might cause this problem?

For me it looks like the traffic analyses panel is not using the DNS system for reverse lookup.

Thanks and best regards,

dksoft

Hi,

This is my first post here - I've learned a lot by following along, but I have something I have not found yet to ask.

I have a dual WAN setup, with LOS Internet and ADSL.

The ADSL is for backup and includes a paltry 20GB or daytime use, but after 00:00 and before 08:00 it's uncapped and unrestricted. I have a 133GB/10day rolling cap on my LOS internet, so avoiding ging over that is important too.

Currently the ADSL (PPPoE) is set up as failover-only since the LOS sometimes has problems with wind etc, but I was wondering if I can have the router (ER-X SFP) dail PPPoE after midnight and then revert back to normal at 8am.

TL;DR: WAN + Failover between 08:00 and 00:00 and Dual WAN between 00:01 and 7:59.

So then I can schedule my downloads to take advatage of parallel streams and not worry about phone/computers syncing/updating etc.

-C

Hello everyone, 

I know there has been alot of questions around WISP setups and IP address etc - i have a few questions below around the EdgeRouter. 

I am in the process of setting up a WISP using Ubiquiti equioment, for the main reason of the software available (UCRM etc) which should hopeuflly make managment slightly easier. I would like to use all Ubiquiti including the main router. There will be a maximum of 500 users, but more realsiticly 250 users. I will have a range of /24 ip address.

Questions:

1. Can 2 EdgeRouter's be configured in a failover mode?

2. As standard each subscriber will share 1 IP address between 100 subscribers - can the EdgeRouter do NAT to set this up?

3. On request a subscriber can get a static IP address for their own connection - what would be the best way to set this up for the subscriber? I guess this would be called Multi subcriber NAT or Carrier Grade NAT

Thank in advance - I have some knowldge of routing and plan on getting on some trainign courses soon, but initialy i just want to know if it is possible and roughly how. 

First post ever, trying to establish remote mangement and access to home network while traveling. I've followed Ben Pin videos (many thanks!) but am getting tripped up trying to add L2TP VPN to my existing zone based firewalls (ZBF). The attached files show a working ZBF "config_pre.boot" prior to the attempted L2TP configuration (config_post.boot) that results in a loss of ability to reach any websites with the error "dns probe finished bad config" in Chrome.

Can anyone shed light on where I've gone wrong with the firewall configuration? I realize this is only the first step, but I've spent 3 days and am at a loss.

Mahalo! Blake

Getting very close to outgrowing my RT-AC68U running Merlin. I really like it But I'm nearly out of NVRAM and it lacks a few features I'd like to have.

I'm asking for input on if the EdgeRouter X router would be able to support this:
1. Site to Site IPSec VPN (to connect to an AWS VPC). Needs to support BGP. I've read that folks have gotten EdgeRouter X to work for this.

2. 80+ DHCP Static Reservations including host names (host name also displayed in GUI)

3. Ability to SSH to router from LAN and tunnel SSH through router (from outside) with certificate authentication

4. Ability to VPN to router (from iOS) via either IPSec or L2TP or IKEv2 and authenticate with a soft cert (I can install on iOS using the iOS management utilities) (Using OpenVPN today with a cert but would like to use standard OS VPN clients if possible)

5. Manual ad blocking/DNS blacklisting etc; if it can do pixelserv-tls like I have set up on Merlin that'd be awesome.

I may look at some Ubiquity Unifi gear in the near future for "campus style" wifi in my house (better coverage, same SSID with easy roaming). I especially like the in-wall access points that replace a current wired wall jack. Do these really reqire a Ubiquity PoE switch, or would a PoE injector work?  I understand the EdgeRouterX is not part of the Unifi line and they have a separate USG router but it is feature limited compared to the X.

Thanks all