Ubiquity EdgeRouter X - Configuring to Isolate Surveillance Networks

[Arokcrwlr]

This is a great tutorial on the EdgeRouter X configuration. Thank you very much for posting it. My house, that's been under construction for several months is about finished, so I am thinking a lot about my network. I understand every thing that you described and I don't want to muddy the water here, but I have a couple of questions...

I had planned on using Ubiquity equipment all along and have purchased a USG, Cloud controller, APs, and a US-8-60W switch. If I modify directions a bit based on this excellent tutorial, I am trying to figure out where the equipment that I already have plays. I suppose I could use the US-8-60W switch as one of my LAN switches... Where could the USG be used? Can it be used in conjunction with the ERX like the diagram below?

 

[guykuo]

I have not worked with the USG. Rather than cascading the two routers as you diagram, the USG would be used instead of the ER-X in terms of being the router and firewall. You would implement the equivalent of what I have done on the ER-X within the USG. The USG only has two LAN ports. You will need to use VLAN's if you want more than two LAN's.

Someone else would need to help with setting up the USG. That should probably be done in a separate thread. I would like to keep this thread ER-X only. Adding different router instructions would make things confusing.

 

[Arokcrwlr]

Yes, I agree not to confuse this great tutorial with another router. You have confirmed what I was thinking about using one or the other. I was going down the path of configuring the USG for VLANS - if I continue down that path I will document and post a tutorial for it like this (unless it's already been done). However, I may sell the USG and get the ER-X since you've done all of the heavy lifting.

Thank you for the response!

 

[Thoran]

Just wanted to say thanks a ton for taking the time and effort to post your configuration here!

I'm fairly technically-minded, but a noob when it comes to security cameras and systems. So I'm on the receiving end of some self-induced firehose learning regarding this stuff.

I initially just wanted to go old-school on my home network and wire it up vs having it on 24/7 wireless. I serendipitously bought an ER-X just looking for a solid edge router, not realizing what a huge community Ubiquiti has. As I was pulling ethernet cable through my house I decided it would probably be more efficient in effort to knock out running cables/installing some hardwired cameras... so I ventured down another project rabbit-hole and jumped into the deep end of the pool of IP camera setups.

I had already configured my ER-X for my home network, but didn't really care for having the eth1 LAN default with the standard 192.168.1.1. I started researching other configurations, preferably one that allowed for an IP camera LAN. I found a few good ER-X network configs but none specifically addressed adding a PC/server for a security camera system.

Meanwhile, I had decided to go with Blue Iris, pulled the trigger on an HP workstation off eBay and also bought a smattering of IP POE cameras to get going (along with a couple POE+ switches) when I came across your configuration.... which is perfect for what I'm trying to do!

I would post a network diagram but it would be a little pointless since I simply used your configuration verbatim. I blew out my initial configuration (which was working fine) on the ER-X and happily replaced it with yours. I very much prefer the 4 separate LANs vs ports 2/3/4 all clumped together on sw0. The only ever-so-slight difference on my setup is that I found an old NIC in my computer parts box so decided to put it to good use for a 2-NIC NVRPC configuration... I figured I might as well add a physical separation for the camera farm since I have the part on hand and it's a fairly quick-kill task.

I currently have 4 cameras mounted and online with another 3 that I've tested out as good but haven't mounted yet. Loving BI and of course still learning more of it every day.

The main setbacks I have been having is remote connectivity with the Blue Iris box.

I initially tried out using Stunnel for a remote connection into BI. It seemed a bit wonky and fiddly to get to work (which I didn't), so I punted and then tried out the BI app (for $10) and got it running, but not without having to use port forwarding of course (I simply modified your ER-X sample rule with port 8081). Once I got the app running I shut down the port forwarding and set my sights on a bigger prize: OpenVPN.

I hunkered down the next morning and configured the OpenVPN server on the ER-X as per your instructions (again: THANKS!). Created all the client certs as well for my laptop, cell phone and iPad. I then spent a few hours last night scouring ipcamtalk for all things BI, Stunnel, OpenVPN and UI3 related. That's when I stumbled upon the proverbial common-use marriage of OpenVPN + TeamViewer for remote access to BI.

I have been able to fire up OpenVPN connections on my laptop (using Tunnelblick) and my cell phone (OpenVPN app) [still trying to load my certs on my iPad, in neanderthal fashion I'm sure...]. I was also able to access BI using TeamViewer over VPN on my laptop and on my iPad (sans VPN).

The last standing issue I have is UI3. I cannot get it to work on any device and suspect it may have something to do with my LAN1 access into LAN2? (Or maybe it's a browser config issue?) On my LAN1 office Win10 PC I can ping both eth2 192.168.92.1 and the NVRPC 192.168.92.20, but then on my LAN1 Mac laptop --that's hanging off the same unmanaged switch as the office PC-- all pings outside LAN1 time out... which I'm not understanding why. Not sure if this is enough provided info to help in troubleshooting, but any assistance is greatly appreciated.

At the risk of sounding redundant, just wanted to offer up another HUGE THANKS for posting your ER-X configuration! Simply AWESOME! Moreover, it allowed me to get up and running within a mere couple of days.

 

[guykuo]

This makes me very happy to see someone successfully use my work

 

[Arjun]

Excellent write-up, this should be linked in the Cliff Notes

 

[Thoran]

Thanks Arjun. With a tinge of snarkiness I quite often say to my friends that "it's better to be lucky than good!" And I feel that I lucked out big time with guykuo's post providing an entire virtual plug-n-play configuration for the ER-X.

Not being a network engineer, and having just enough knowledge to be dangerous, it would have taken me months of research, questions, sweat and tears to scratch out what guykuo provided in one configuration file.... and probably my own result would have been just enough to work (maybe) but without being nearly as optimized for security. For me personally this ER-X config is the exact right one for my requirements.

I'm glad you're happy guykuo that someone is using your work, because I know I'm certainly thrilled to be using it!

 

[Arokcrwlr]

Well, I'll update and say that I too went with guykuo's ER-X configuration. I am a network engineer and I know when not to re-invent the wheel. I was originally going to use a USG , but decided to simplify my original design and go with the ER-X. After reviewing guykuo's design I couldn't see anything that needed changing. We just moved in and I haven't installed my cameras yet, but everything else is working as it should.

A big THANK YOU to guykuo!!!

 

[windguy]

@Arokcrwlr and @Thoran - Thanks for the feedback on the ER-X. Congrats on getting it configured.
I haven't jumped in yet but am still committed to going with the ER-X at some point after the cameras are setup and running.

@wittaj and @Brad Strohfeldt - Are you up and running with your ER-X?

 

[Brad Strohfeldt]

@wittaj and @Brad Strohfeldt - Are you up and running with your ER-X?

Not as yet, been so busy recently and cameras haven't arrived yet, but I look longingly at my new ER-X every weekend sitting on my desk. I think I'll have a few questions when I get started, took me hours just to figure out how to login to the thing. LoL. I'm not the sharpest knife in the drawer.

 

[windguy]

Not as yet, been so busy recently and cameras haven't arrived yet, but I look longingly at my new ER-X every weekend sitting on my desk. I think I'll have a few questions when I get started, took me hours just to figure out how to login to the thing. LoL. I'm not the sharpest knife in the drawer.

Thanks Brad. Understand about getting busy. That's my excuse as I can't give the camera system priority over more timely tasks. It will get it done eventually. The thought of having to setup the ER-X still scares me a bit but it's a just a fear of the unknown and my lack of network skills. However, I do own a knife sharpener just in case.

 

[Brad Strohfeldt]

However, I do own a knife sharpener just in case.

Hahaha. for you or the router?

 

[znuady123]

Thank you for your great tutorials. I am new with Edgerouter X . I have main printer on main LAN1, I need to setup all other LANs and guest to share printer with MAIN LAN1. Would you please show me how to do this in setup rules. Thank you

 

[catcamstar]

Thank you for your great tutorials. I am new with Edgerouter X . I have main printer on main LAN1, I need to setup all other LANs and guest to share printer with MAIN LAN1. Would you please show me how to do this in setup rules. Thank you

"It depends". Make a drawing/diagram of your situation. Draw (eg in colors) which networks (vlans) are "important/secured" versus the "less secure" and the "no security" (for the advanced users: which zones do (not) allow outbound communications) . IoT devices, cameras and "guest wifi" should remain in the lowest security zones.

Now comes the trick: as a networking best practice: do not allow communications from lower security towards higher security. For example, if you would have an AWS cloud instance, you'll never let that VPN into your home LAN with your NAS. You do it the other way round: your LAN throws out an outbound communication towards the could.

Coming back to your use case of the printer.

The "easiest" part is to drop the printer in the lowest security zone. Wifi guests can immediately access the printer. But your "internal" vlan might require an additional rule to get into that vlan. But all this depends on how your drawing looks like, with all the IN/OUT rules enforced.

Hope this helps!
CC

 

[guykuo]

Sorry can't help with this right now. In the midst of designing a 3D printable PAPR system (a high isolation respirator). N95's are not adequate for some situations. Been at it continuously for days and hope to release to world in next few days.

 

[guykuo]

Go it released! Over a week of very little sleep while still do anesthesia care....

Bunny Science™ PAPR by BunnyScience

Bunny Science™ PAPR Respirator design by Guy Kuo, MD Anesthesiologist. Bunny Science™ PAPR Respirator is a specific embodiment of a patent pending Personal Protection Equipment. It is licensed strictly for non-commercial build for frontline workers who don't have access to commercial PPE. This...

www.thingiverse.com

 

[Arokcrwlr]

That's awesome - good work!

 

[TheE]

@guykuo, all your time and help with this thread is greatly appreciated. Thank you so much!

One quick question: with the Pre-configured file you provided, can I use any brand, unmanaged POE switch for LAN 2 Surveillance (ETH2) to connect my BlueIris computer/cameras to, and everything would still work correctly? Or do I need to use a Smart-managed or higher Ubiquiti POE switch for ETH2?

 

[guykuo]

Any brand POE switch. I recommend getting POE+ for future compatibility with PTZ.

 

[TheE]

Any brand POE switch. I recommend getting POE+ for future compatibility with PTZ.

Appreciate it greatly!