EdgeRouter Content filtering

June 27, 2018, 11:23 am

≫ Next: allow dmz AP to internal cloudkey

≪ Previous: IPsec Site-to-Site w/ pfSense- ESP Not working

Hello,

We recently went through and changed some setting on our router to better solve a seperate issue, but now we ran into the issue that when the "Auto Firewall" checkbox is unchecked it disables our DPI filtering entirely. (we block Facebook and other social media sites).

To clarify, it worked previously when that checkbox was checked, but now nothing is being blocked. Running v1.10.3 (Have yet to update it)

If anyone has any advice pelase let me know.

Thank you,

Justin Smith

↧

allow dmz AP to internal cloudkey

June 27, 2018, 11:26 am

≫ Next: Use public IP to access multple devices on separate internal ports

≪ Previous: EdgeRouter Content filtering

hi guys. i need help allowing my cloudkey (sitting on LAN) to adopt an AP (sitting on DMZ).

i have a zone based firewall setup, and so far i have done the following, but something is not working.

traffic from DMZ --> LAN

accept stablished

allow 80,8543,11143 tcp

allow 3478 udp

traffic from LAN --> DMZ

accept stablished

i assume the ap is the client, and theh cloudkey is the "server"..

also, i am plugging in a ap lite straight into eth2 on my edgerouter if that matters.

could someone guide me what i could be doing wrong?

i got the port numbers from here:

https://help.ubnt.com/hc/en-us/articles/115000169007-UniFi-Port-Requirements-for-Cloud-Key

thank you

↧

Use public IP to access multple devices on separate internal ports

June 27, 2018, 11:47 am

≫ Next: Load Balancing - Policies Firewall or Routing

≪ Previous: allow dmz AP to internal cloudkey

I am trying to setup access to internal devices using just one of my public IPs as most of them are already in use.

currently i have public IPs A.x.x.90, B.x.x.92, and C.x.x.93 on WAN interface eth0. A.x.x.90 is for a vendor to have their own network access to their provided leased managed product. B.x.x.92 for general Web Access. C.x.x.93 for a private secured LAN.

i am trying to setup multiple port forwards for RDP access. I.E. 3389 for PC1, 3390 for PC2, 3391 for PC3 etc.....

also ports 4770,4880 for a NVR on Public IP D.x.x.94.

i have setup successful forward to single internal IPs but that accepts all incoming ports to a single internal IP. i know i am missing something on the forums here, but i can't seem to find the instructions on how to do this.

if anyone can help, it is greatly appreciated!

thanks,

↧

Load Balancing - Policies Firewall or Routing

June 27, 2018, 12:03 pm

≫ Next: L2TP/IPSec VPN working from home/office but not from other customer sites

≪ Previous: Use public IP to access multple devices on separate internal ports

Hi All,

I am very new to the EdgeRouter X SFP which I replaced our TP-Link LoadBalancer router.

I setup with 2 Interface WAN LB with one LAN Network

eth0 --> PPoE WAN1

eth1 --> DHCP WAN2

eth2/eth3/eth4 LAN 192.168.50.0/24 DHCP RANGE 192.168.50.51-245

All works perfectly well. But when I access our webmail service on browser I could see while login to page I could see
[ Your IP address has changed. Please log in again.]

This is because of LB frequently the request goes via either WAN1 to WAN2.

I able to resolve this issue in TP Link by policy Firewall.

Source 192.168.50.0/24 Destnation 143.36.145.1xx Port 1-65535 WAN1

How could I perform the same in Edge Router in UI or CLI.

I tried below command which they said it will resolve but still I could not able to achive even after I set this on the router

configure
set load-balance group G sticky source-addr enable
set load-balance group G sticky dest-addr enable
set load-balance group G sticky dest-port enable
commit
save

Whoever from my LAN try to access this 143.36.145.1xx it has to go via eth1

Thanks,

Keerthi

↧

L2TP/IPSec VPN working from home/office but not from other customer sites

June 27, 2018, 12:08 pm

≫ Next: Help with L2TP DNS

≪ Previous: Load Balancing - Policies Firewall or Routing

So, I have a client with 5 sites, A-E, that are interconnected with IPSec tunnels. All of them currently utilize the ERPro-8, firmware 1.10.3.

Using the guide to setup L2TP/IPSec VPN on the Edgerouter and client I previously setup a VPN to an isolated network used by a vendor, on Site C. Recently someone internally asked to use the same process to connect to those vendor systems there rather than drive over to the other site. So, I created a new internal user name and password and tested the VPN. Not a problem, or so I thought.

I tried to configure it for him, remotely and it wouldn't work. He works at Site B. So, I tried to configure a spare computer at another site (Site A) and it wouldn't connect. I configured a seperate machine at my office and it had no problem. So, at my next onsite to Site B I tried to connect to the L2TP/IPSec VPN at Site C with my laptop (which worked from my office and home) and like previous attempts from company sites it failed to even establish the connection. It never got to the authentication part.

Is it possible this has something to do with the L2TP and IPSec offloading? IPSec offloading is currently enabled.

↧

Help with L2TP DNS

June 27, 2018, 1:59 pm

≫ Next: Setting up my first fail over network!

≪ Previous: L2TP/IPSec VPN working from home/office but not from other customer sites

I'm losing my mind trying to get DNS up and running properly on my VPN. I want to connect to the VPN using my Android phone and view a page served by octopi.local, which is 192.168.2.134 on the LAN. At this point when I connect I get the following behavior:

Phone- connects to VPN, can ping the IP, but does not load the web page using the IP or domain name

Laptop- connects to VPN, can ping the IP, will load the web page using the IP but not the domain name

I originally had the vpn on 192.168.3.x, but have moved the client pool into the LAN subnet with no change in behavior.

This is on an ERL running 1.10.3. LAN is eth0, WAN is pppoe. Any insight would be greatly appreciated!

Sanitized config:

firewall {
all-ping enable
broadcast-ping disable
group {
address-group Trusted {
address 108.59.4.79
address 96.246.158.84
address 192.168.2.0/24
address 192.168.5.0/24
address 207.38.86.27
address 192.168.3.0/24
description "Trusted networks"
}
network-group BOGONS {
description BOGONS
network 10.0.0.0/8
network 100.64.0.0/10
network 127.0.0.0/8
network 169.254.0.0/16
network 172.16.0.0/12
network 192.0.0.0/24
network 192.0.2.0/24
network 192.168.0.0/16
network 198.18.0.0/15
network 198.51.100.0/24
network 203.0.113.0/24
network 224.0.0.0/4
network 240.0.0.0/4
}
}
ipv6-name Internet-To-LAN {
default-action drop
description "Internet to LAN"
rule 1 {
action accept
description "Drop Incoming IPv6 unless related"
state {
established enable
related enable
}
}
rule 2 {
action drop
state {
invalid enable
}
}
rule 3 {
action accept
description "allow ICMPv6"
protocol icmpv6
}
}
ipv6-name LAN-To-Internet {
default-action accept
description "LAN to Internet"
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
state {
invalid enable
}
}
}
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
name GDD_Guest {
default-action accept
description "Isolate eth2"
rule 20 {
action drop
description "Block eth0"
destination {
group {
address-group NETv4_eth0
}
}
log disable
protocol all
source {
group {
}
}
}
rule 30 {
action drop
description "Block eth 0.5"
destination {
group {
address-group ADDRv4_eth0.5
}
}
log disable
protocol all
}
}
name VIDEO {
default-action drop
description "Video VLAN blocking"
rule 1 {
action drop
description "Block eth0"
destination {
group {
address-group NETv4_eth0
}
}
log disable
protocol all
source {
group {
}
}
state {
established enable
invalid disable
new enable
related enable
}
}
}
name WAN_IN {
default-action drop
description "WAN Inbound"
rule 10 {
action accept
description "Accept Related"
log disable
protocol all
state {
established enable
invalid disable
new disable
related enable
}
}
rule 20 {
action accept
description "Accept established"
log disable
protocol all
state {
established enable
invalid disable
new disable
related disable
}
}
rule 30 {
action accept
description "Accept FTP"
destination {
address 192.168.2.2
port 21
}
log disable
protocol tcp
source {
group {
address-group Trusted
}
}
}
rule 50 {
action drop
description "Drop Invalid"
log disable
protocol all
state {
established disable
invalid enable
new disable
related disable
}
}
}
name WAN_LOCAL {
default-action drop
description "Internet to router"
rule 10 {
action accept
description "Accept Related"
log disable
protocol all
state {
established enable
invalid disable
new disable
related enable
}
}
rule 20 {
action accept
description "Allow L2TP"
destination {
port 500,1701,4500
}
log disable
protocol udp
}
rule 30 {
action accept
description "Allow ESP"
log disable
protocol 50
}
rule 40 {
action accept
description "HE ICMP allow"
log disable
protocol icmp
source {
address 66.220.2.74
}
}
rule 60 {
action drop
description "Drop Invalid"
log disable
protocol all
state {
established disable
invalid enable
new disable
related disable
}
}
rule 70 {
action drop
description "drop bogon source"
log disable
protocol all
source {
group {
network-group BOGONS
}
}
}
}
name WAN_OUT {
default-action accept
description ""
}
options {
mss-clamp {
interface-type pppoe
mss 1452
}
}
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
}
interfaces {
ethernet eth0 {
address 192.168.2.1/24
address 2001:470:b:146::1/64
description Local
duplex auto
ipv6 {
dup-addr-detect-transmits 1
router-advert {
cur-hop-limit 64
link-mtu 0
managed-flag false
max-interval 600
other-config-flag false
prefix 2001:470:b:146::/64 {
autonomous-flag true
on-link-flag true
valid-lifetime 2592000
}
reachable-time 0
retrans-timer 0
send-advert true
}
}
speed auto
vif 5 {
address 192.168.5.1/24
description "Video VLAN"
firewall {
in {
name VIDEO
}
}
}
}
ethernet eth1 {
description Internet
duplex auto
speed auto
vif 201 {
description "Centurylink VLAN"
firewall {
in {
}
}
pppoe 0 {
default-route auto
firewall {
in {
name WAN_IN
}
local {
name WAN_LOCAL
}
out {
name WAN_OUT
}
}
mtu 1492
name-server auto
password <SNIP>
user-id <SNIP>
}
}
}
ethernet eth2 {
address 192.168.10.1/24
description "GDD Guest"
duplex auto
firewall {
in {
name GDD_Guest
}
}
speed auto
}
loopback lo {
}
tunnel tun0 {
address 2001:470:a:146::2/64
description "HE.NET IPv6 Tunnel"
disable
encapsulation sit
firewall {
in {
ipv6-name Internet-To-LAN
}
local {
ipv6-name Internet-To-LAN
}
}
local-ip <SNIP>
multicast disable
remote-ip 216.218.226.238
ttl 255
}
}
port-forward {
auto-firewall enable
hairpin-nat enable
lan-interface eth0
rule 1 {
description "Synology admin"
forward-to {
address 192.168.2.2
port 5001
}
original-port 5001
protocol tcp
}
rule 2 {
description Cloudprint
forward-to {
address 192.168.2.32
port 5222
}
original-port 5222
protocol tcp_udp
}
rule 3 {
description Cloudstation
forward-to {
address 192.168.2.2
port 6690
}
original-port 6690
protocol tcp_udp
}
rule 4 {
description "Synology HTTPS"
forward-to {
address 192.168.2.2
port 443
}
original-port 443
protocol tcp
}
rule 5 {
description "Syno WebDAV"
forward-to {
address 192.168.2.2
port 5006
}
original-port 5006
protocol tcp_udp
}
rule 6 {
description Simplehelp
forward-to {
address 192.168.2.5
port 8008
}
original-port 8008
protocol tcp_udp
}
rule 7 {
description "Synology HTTP"
forward-to {
address 192.168.2.2
port 80
}
original-port 80
protocol tcp
}
rule 8 {
description "Syno FTP"
forward-to {
address 192.168.2.2
port 21
}
original-port 21
protocol tcp_udp
}
rule 9 {
description "Syno SSH"
forward-to {
address 192.168.2.2
port 6001
}
original-port 6001
protocol tcp_udp
}
rule 10 {
description "UNMS HTTP"
forward-to {
address 192.168.2.5
port 9080
}
original-port 9080
protocol tcp
}
rule 11 {
description "UNMS HTTPS"
forward-to {
address 192.168.2.5
port 9443
}
original-port 9443
protocol tcp
}
rule 12 {
description "UNMS WS"
forward-to {
address 192.168.2.5
port 9444
}
original-port 9444
protocol tcp
}
wan-interface pppoe0
}
protocols {
static {
interface-route6 ::/0 {
next-hop-interface tun0 {
}
}
}
}
service {
dhcp-server {
disabled false
hostfile-update disable
shared-network-name GDD-DHCP {
authoritative disable
subnet 192.168.10.0/24 {
default-router 192.168.10.1
dns-server 8.8.8.8
dns-server 8.8.4.4
lease 86400
start 192.168.10.5 {
stop 192.168.10.10
}
}
}
shared-network-name LAN-DHCP {
authoritative disable
subnet 192.168.2.0/24 {
default-router 192.168.2.1
dns-server 192.168.2.1
lease 3600
start 192.168.2.100 {
stop 192.168.2.199
}
static-mapping AERBook-Pro {
ip-address 192.168.2.78
mac-address
}
static-mapping AERBook-Pro_DOCK {
ip-address 192.168.2.80
mac-address
}
static-mapping Airport_Express {
ip-address 192.168.2.64
mac-address
}
static-mapping Allens_Pixel {
ip-address 192.168.2.14
mac-address
}
static-mapping BluRay {
ip-address 192.168.2.45
mac-address
}
static-mapping Chromecast_ETH {
ip-address 192.168.2.36
mac-address
}
static-mapping Chromecast_WIFI {
ip-address 192.168.2.35
mac-address
}
static-mapping DS1517_VM {
ip-address 192.168.2.6
mac-address
}
static-mapping DVR {
ip-address 192.168.2.61
mac-address
}
static-mapping Ecobee {
ip-address 192.168.2.15
mac-address
}
static-mapping Edgeswitch {
ip-address 192.168.2.200
mac-address
}
static-mapping ElPerroGrande {
ip-address 192.168.2.192
mac-address
}
static-mapping HarmonyHub {
ip-address 192.168.2.48
mac-address
}
static-mapping KaliPi3 {
ip-address 192.168.2.134
mac-address
}
static-mapping Kerrys-iMac {
ip-address 192.168.2.4
mac-address
}
static-mapping Kerrys_MacBook {
ip-address 192.168.2.43
mac-address
}
static-mapping Kerrys_Pixel {
ip-address 192.168.2.42
mac-address
}
static-mapping Kerrys_iMac {
ip-address 192.168.2.50
mac-address
}
static-mapping MX922 {
ip-address 192.168.2.32
mac-address
}
static-mapping Nixon_Mission {
ip-address 192.168.2.196
mac-address
}
static-mapping Nvidia_tablet {
ip-address 192.168.2.7
mac-address
}
static-mapping Roku {
ip-address 192.168.2.31
mac-address
}
static-mapping SPA112 {
ip-address 192.168.2.52
mac-address
}
static-mapping SebNetPro {
ip-address 192.168.2.109
mac-address
}
static-mapping Simplehelp_VM {
ip-address 192.168.2.5
mac-address
}
static-mapping Stereo {
ip-address 192.168.2.17
mac-address
}
static-mapping UNMS {
ip-address 192.168.2.113
mac-address
}
static-mapping Unifi {
ip-address 192.168.2.38
mac-address
}
static-mapping kali_wifi {
ip-address 192.168.2.135
mac-address
}
}
}
shared-network-name Video-DHCP {
authoritative disable
subnet 192.168.5.0/24 {
default-router 192.168.5.1
dns-server 8.8.8.8
dns-server 8.8.4.4
lease 86400
start 192.168.5.1 {
stop 192.168.5.254
}
static-mapping Back_camera {
ip-address 192.168.5.4
mac-address
}
static-mapping Front_camera {
ip-address 192.168.5.3
mac-address
}
static-mapping MacBook_Pro {
ip-address 192.168.5.200
mac-address
}
static-mapping Synology_2 {
ip-address 192.168.5.2
mac-address
}
}
}
static-arp disable
use-dnsmasq disable
}
dns {
dynamic {
interface pppoe0 {
service dyndns {
host-name <SNIP>
login <SNIP>
password <SNIP>
server <SNIP>
}
}
}
forwarding {
cache-size 150
listen-on eth0
listen-on eth0.5
listen-on "l2tp*"
options listen-address=192.168.2.1
}
}
gui {
http-port 80
https-port 443
older-ciphers disable
}
mdns {
reflector
}
nat {
rule 2 {
description FTP
destination {
port 21
}
inbound-interface pppoe0
inside-address {
address 192.168.2.2
port 21
}
log disable
protocol tcp
type destination
}
rule 5000 {
description "NAT Exclude"
destination {
address 192.168.3.0/24
}
exclude
log disable
outbound-interface pppoe0
protocol all
source {
group {
address-group ADDRv4_eth0
}
}
type masquerade
}
rule 5001 {
description PPPoE
log disable
outbound-interface pppoe0
protocol all
type masquerade
}
}
ssh {
listen-address 192.168.2.1
port 22
protocol-version v2
}
unms {
connection wss://<SNIP>
}
upnp {
}
}
system {
conntrack {
expect-table-size 2048
hash-size 32768
modules {
sip {
disable
}
}
table-size 262144
}
host-name aerouter.local
login {
banner {
post-login "Welcome to EdgeMAX"
pre-login "\n\n\t UNAUTHORIZED USE OF THE SYSTEM\n\n\t IS PROHIBITED! \n\n "
}
user <SNIP> {
authentication {
encrypted-password <SNIP>
plaintext-password ""
}
full-name Allen
level admin
}
user <SNIP> {
authentication {
encrypted-password <SNIP>
plaintext-password ""
}
full-name "Allen Rowand"
level operator
}
}
name-server 8.8.8.8
name-server 8.8.4.4
ntp {
server 0.ubnt.pool.ntp.org {
}
server 1.ubnt.pool.ntp.org {
}
server 2.ubnt.pool.ntp.org {
}
server 3.ubnt.pool.ntp.org {
}
}
offload {
hwnat disable
ipsec enable
ipv4 {
forwarding enable
gre enable
pppoe enable
vlan enable
}
ipv6 {
forwarding enable
pppoe enable
}
}
static-host-mapping {
host-name aerouter.local {
inet 192.168.2.1
}
host-name <SNIP> {
inet 192.168.2.200
}
host-name <SNIP> {
inet 192.168.2.2
}
host-name <SNIP> {
inet 192.168.2.5
}
host-name octopi.local {
inet 192.168.2.134
}
host-name unifi.local {
inet 192.168.2.5
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
task-scheduler {
task update_dpi {
executable {
path /usr/sbin/ubnt-update-dpi
}
interval 24h
}
}
time-zone America/Los_Angeles
traffic-analysis {
dpi enable
export enable
}
}
traffic-control {
advanced-queue {
root {
}
}
}
vpn {
ipsec {
auto-firewall-nat-exclude enable
ipsec-interfaces {
interface pppoe0
}
nat-networks {
allowed-network 192.168.0.0/16 {
}
}
nat-traversal enable
}
l2tp {
remote-access {
authentication {
local-users {
username <SNIP> {
password <SNIP>
}
}
mode local
}
client-ip-pool {
start 192.168.2.240
stop 192.168.2.249
}
idle 1800
ipsec-settings {
authentication {
mode pre-shared-secret
pre-shared-secret <SNIP>
}
ike-lifetime 3600
lifetime 3600
}
mtu 1400
outside-address 0.0.0.0
}
}
}

/* Warning: Do not remove the following line. */
/* === vyatta-config-version: "config-management@1:conntrack@1:cron@1:dhcp-relay@1:dhcp-server@4:firewall@5:ipsec@5:nat@3:qos@1:quagga@2:system@4:ubnt-pptp@1:ubnt-udapi-server@1:ubnt-unms@1:ubnt-util@1:vrrp@1:webgui@1:webproxy@1:zone-policy@1" === */
/* Release version: v1.10.3.5082526.180426.1554 */

↧

Setting up my first fail over network!

June 27, 2018, 3:41 pm

≫ Next: "Leaky NAT" with zone based firewall policy

≪ Previous: Help with L2TP DNS

Good Afternoon Everyone!

I just got my new Edge Router X In the mail today. I started to set it up and felt a little overwalmed for some reason. So i thought i would post my config here before implementing it and see what everyone thought.

Please see attachment.

↧

"Leaky NAT" with zone based firewall policy

June 27, 2018, 4:17 pm

≫ Next: EdgeRouter Content Filtering

≪ Previous: Setting up my first fail over network!

It seems that all rfc1918 addresses that do not belong on my LAN are being routed through my default gateway and actually quite a few hops due to how my isp seem to (not) handle rfc1918:

$ traceroute 10.0.0.1
traceroute to 10.0.0.1 (10.0.0.1), 64 hops max
1   192.168.0.1 0.184ms 0.101ms 0.073ms
2   <isp default gw> 1.705ms 0.473ms 8.484ms
3   <isp router> 19.848ms 21.455ms 20.527ms
4   <isp router> 21.082ms 20.942ms 21.058ms
5   <isp router> 18.696ms 18.613ms 19.373ms
6   <isp router> 21.509ms 22.091ms 21.628ms
7   <isp router> 18.668ms 18.471ms 18.469ms

While reading through some VyOS documentation this appears to be quite common and the solution is to drop invalid packages in the firewall (https://wiki.vyos.net/wiki/User_Guide#NAT).

I assume they are suggesting a rule like this:

     rule 2 {
         action drop
         state {
             invalid enable
         }

The thing is, my firewall is zone-based and I actually have a rule like that for each zone and in all directions.

I wonder if someone can shed some light on this?

↧

EdgeRouter Content Filtering

June 27, 2018, 6:14 pm

≫ Next: IPv6 Prefix Delegation on second router?

≪ Previous: "Leaky NAT" with zone based firewall policy

Hi Experts!

I did some firewall rules on my EdgeRouter Lite for website filtering using DPI and seems perfectly working on clients using desktop and laptops.

Blocked Social Media Sites and Top Adult Sites if they are using web browser but when they use facebook app, twitter app, IG app, it bypasses the firewall and continue to load contents.

My question is, is it possilble to block those applications on the firewall of Edge Router Lite?

TIA,

↧

IPv6 Prefix Delegation on second router?

June 27, 2018, 7:31 pm

≫ Next: Port forwarding - firewall rules for multiple IP's

≪ Previous: EdgeRouter Content Filtering

Curious if this is even possible at the moment. I have 2 Edgerouters, an Edgerouter 4 acting as my Edge to the internet, and I have another edgerouter lite behind that segmenting my VMs. Is there a way to use prefix delegation to get a couple /64s for my Edgerouter lite?

ATT --> Edgerouter 4 -----> Edgerouter lite ---> VMs

Comcast---

↧

Port forwarding - firewall rules for multiple IP's

June 27, 2018, 9:39 pm

≫ Next: Edge series real reset to get license agreement message back

≪ Previous: IPv6 Prefix Delegation on second router?

Hello group Man Happy

How would this best be done with Edge OS. Trying to duplicate some rules in a Sonicwall which has a different approach. In SW you specify the service (define port to a name, like RDP to 3389), then in access rules you can specify both sides IP's ranges.

So for example: source 65.123.321.12 , destination 192.168.1.5, service name RDP (which was set to 3389 in prev step), then set to allow. 'so only allows a certain public IP to access machine via RDP, all other requests dropped'.

I'm used to how Sonicwall sets these rules up but need to duplice with EdgeOS on an ER4 (with eth0 WAN and eth1 LAN).

↧

Edge series real reset to get license agreement message back

June 28, 2018, 1:05 am

≫ Next: Internet drop after 1 hour if cold boot/firmware update

≪ Previous: Port forwarding - firewall rules for multiple IP's

Greetings!

I need to reset EdgeRouter X to defaults. But usual ways does not reset to brand new factory state. I don't see license agreement message at first connect to device.

I know there is some ways to get it back with two resets in a row. But I don't know the correct sequence.

This concerns all Edge family.

I will try all your suggestion.
Thank you.

↧

Internet drop after 1 hour if cold boot/firmware update

June 28, 2018, 2:24 am

≫ Next: How can I block a mac address from getting to the internet - EdgeRouter Lite

≪ Previous: Edge series real reset to get license agreement message back

If I do a firmware update (currently 1.10.5) or a cold boot, my internet connection drops after one hour.

If I then reboot my EdgeRouter Lite (3p) everything works as should be.

I've got this problem over the past firmwares.

In the (external) syslog nothing is showed why the internet connection dropped.

Relevant information:

EdgeRouter Lite currently running 1.10.5

eth0: LAN1

eth1: Internet interface

eth1 VIF 34: Internet VLAN. IP by DHCP

eth2: LAN2

↧

How can I block a mac address from getting to the internet - EdgeRouter Lite

June 28, 2018, 5:04 am

≫ Next: Strange issues with DNS resolver/forwarder

≪ Previous: Internet drop after 1 hour if cold boot/firmware update

I need help blocking 4 specific MAC addresses from accessing internet while on my network. I can't seem to figure out how to do this basic task on the EdgeRouter Lite.

↧

Strange issues with DNS resolver/forwarder

June 28, 2018, 5:39 am

≫ Next: PSA: Please delete ubnt/ubnt user

≪ Previous: How can I block a mac address from getting to the internet - EdgeRouter Lite

Has anyone else experienced strange issues when using the Edgerouter as the DNS resolver/forwarder? Recently, we have had some Edgerouters spontaneously stop forwarding DNS. The fix is we had to login and explicitly define:

“DNS Forwarding DHCP Eth0“

Yesterday I upgraded my home ER-X-SFP to 1.10.5. When I did this, DNS resolution broke in a similar manner except in that case I had to explicitly define the name-servers for forwarding even though the output from DNS statistics showed the nameservers were being inherited from the system config.

↧

PSA: Please delete ubnt/ubnt user

June 28, 2018, 7:57 am

≫ Next: EdgeMax New Setup - Dual WAN with balance and one IP excluded

≪ Previous: Strange issues with DNS resolver/forwarder

It really should go without saying but setting up a good user with a strong password is not enough, you MUST remove the default user. An unprotected ubnt account and someone could wipe your settings or worse, redirect all your traffic over a VPN for inspection. It's trivial to get a connection to the ER which is not logged with a remote IP, you'll have no way to trace it down unless you catch them in the act.

delete system login users ubnt

This is an example of a normal ssh login. IP tracked

Username        Type    Tty      From                Last login
me        vyatta  pts/0    192.168.X.Y      Wed Jun 27 21:51:22 2018
monitor         vyatta                               never logged in

This is an example of another remote login... over the internet, that is not tracked. I've changed the name but have not removed the IP, it's not there. SSH need not be enabled for this to work.

Username        Type    Tty      From                Last login
me        vyatta  pts/1                        Thu Jun 28 10:45:51 2018
monitor         vyatta                               never logged in

↧

EdgeMax New Setup - Dual WAN with balance and one IP excluded

June 28, 2018, 8:39 am

≫ Next: Feature Request : Enable POE on EP-R6 during switch mode wizard

≪ Previous: PSA: Please delete ubnt/ubnt user

Hi there,

I'm very new to the Edgemax but can see great potential as I learn it. I have a very simple setup with a PPPOE connection on eth0 and a static IP connection on eth1 (4G backup/balancing) which is for the most part installed and working, however I have one client which streams video all day which I would like to force to use eth0 and not use the 4g on eth1.

I've found and tried to follow this guide: https://community.ubnt.com/t5/EdgeRouter/Dual-WAN-with-some-hosts-using-only-one-WAN/m-p/703493#M22093 which is very much what I want, but as a day 1 user I'm not sure how to interpret this and enter via the CLI.

I have DHCP running and statically assigned IPs where needed. Local network is all on 192.168.100.X and it's 192.168.100.6 that I need to use exclusively eth0 for its connection.

Separately, can someone advise on how best to change the balance of the split (I'd like 70/30 between eth0 and eth1 for all other traffic)

Thanks in advance.

↧

Feature Request : Enable POE on EP-R6 during switch mode wizard

June 28, 2018, 9:15 am

≫ Next: Few things...

≪ Previous: EdgeMax New Setup - Dual WAN with balance and one IP excluded

hi all

it would be great if during the Configuration wizard for switch mode on the EP-R6

we can also enable POE using a check box per port.

right now we can define vlans , management IP but not we cant enable POE.

i have a EP-R6 in production with vlans addeds to the switch0 instead of using the advanced switch mode but i will have to go on site cause when the EP-R6 will reboot it will not have POE enable anymore on his ports...

thx Man Happy

↧

Few things...

June 28, 2018, 9:55 am

≫ Next: Troubleshoot Defective EdgeRouter X

≪ Previous: Feature Request : Enable POE on EP-R6 during switch mode wizard

I have a new ER infinity 8 port router that I am setting up. So far, pretty unimpressed. I need to do a few things that I cannot find documentation for:

1. How do I create a NEW loopback interface? I am wanting to have a loopback (or bridge or whatever) do use as a place to hang NAT IPs, management IPs and such. I know I can use the existing loopback, but I want a new loopback.

2. Is there a way to dump the config in a format that is easier to read? Like, for example, the commands I used to add the config would be nice.

3. Still working with DHCP, but a bit more documentation would be nice. If it exists, Google hasn't found it.

I have seen stories about BGP being flakey....I hope this is resolved in recent firmwares....

↧

Troubleshoot Defective EdgeRouter X

June 28, 2018, 12:13 pm

≫ Next: Edge Router ER-8 CLI

≪ Previous: Few things...

I purchased an EdgeRouter X six months ago. I am new to Ubiquiti level of products as I have only used consumer grade in the past. No problems setting it up after watching a few YouTube videos.

All was working fine until all internet traffic stopped today. I think the EdgeRouter X is defective but can someone review what I have done so far and recommend anything further before I try to return it under warranty?

So far:

1. I have contacted cable company and reset Motorola modem to factory deafults. A single laptop connects fine to the modem and is able to access internet.

2. I unplugged EdgeRouter and modem several times and waited up to 30 minutes. Still no access to internet.

3. I reset the EdgeRouter using the reset button, changed my laptop IP to 192.168.1.11, plugged laptop into the eth0 port and was able to connect to roouter. I was prompted for the basic setup wizzard which I ran with the firewall option checked. I applied changes and the router rebooted.

4. I plugged my computer into eth1 port, modem into eth0, changed laptop IP to obtain IP address automatically and restarted computer. Still no connection to internet.

5. I ran windows connection diagnostic and the results were "Ehternet does not have a valid IP configuration". I tried to connect to 192.168.1.1 with laptop using dynamic IP and static of 192.168.11.

6. I restarted everything several times by unplugging. I waited 30 minutes for anything to become stable. Still no internet connection using laptop and dynamic IP plugged directly into eth1 port.

Plugging the laptop directly into cable mdem still works fine.

What else can I try before sending it back as defective?

Thank you for helping...

↧