Ubiquity EdgeRouter X - Configuring to Isolate Surveillance Networks

Blue65 said:
My gosh thank you so much for taking the time and effort to put all of this together. I want to get started on this right now! I have my system already installed and I have it wired in physically, but want to isolate each LAN like you have them isolated. However, one of my questions is I have the Edge Router X and it is being powered by the POE In piece. I think the reason I initially set it up like this was that my ubiquiti Long Range AP is in the ceiling. I am using the POE out to give it power.

How would you recommend getting around this? I am completely open to buying some hardware if needed. What I was thinking would be to power the Edge Router with standard AC 12V plug in. Then get a POE switch for LAN1 and that would then power the ubiquiti AP that is in the ceiling. What would be your suggestions?
Click to expand...

There are different ways to achieve what you want to do, have a look at the specs:
You mean your AP is powered by port 4 on the ER-X? You can indeed put that port in a specific vlan. If your ER-X is powered by its port 1, you can indeed switch that "power in" towards the provided wall power supply.

So which path do you want to "change"?
 
I power my Edgerouter via 12 volt plugin. All my POE devices are powered via POE+ switches. Depending on the model of Ubiquity access point, powering via a POE switch may or may not work. Some of them use "passive" POE which is not the kind of POE supplied by switches.

See the table UniFi - Supported PoE Output and Input Modes. Hopefully yours is not a passive POE model.

If passive POE, then you are stuck with the EdgeRouter X acting as the passive POE pass through and probably have to wire the ports differently than in my setup.
 
guykuo said:
I power my Edgerouter via 12 volt plugin. All my POE devices are powered via POE+ switches. Depending on the model of Ubiquity access point, powering via a POE switch may or may not work. Some of them use "passive" POE which is not the kind of POE supplied by switches.

See the table UniFi - Supported PoE Output and Input Modes. Hopefully yours is not a passive POE model.

If passive POE, then you are stuck with the EdgeRouter X acting as the passive POE pass through and probably have to wire the ports differently than in my setup.
Click to expand...

I could not find my 12V power supply for my EdgeRouter X, so I just ordered another on of those. Then I checked the model number of my AP it is indeed the UAP-AC-LR so it looks like from the specs you sent over it does support POE 802.3 af. So I went ahead and ordered the Ubiquiti US-8-US Unifi Switch. Once the AC power supply comes in and the switch I can start mimicing the setup that you have completely. I just feel like a complete mimic will make my setup a bit smoother. Is there anything that I might be missing on the setup to duplicate yours please let me know. Thank you again for posting this, I am really looking forward to getting this thing setup correctly!
 
catcamstar said:
There are different ways to achieve what you want to do, have a look at the specs:
You mean your AP is powered by port 4 on the ER-X? You can indeed put that port in a specific vlan. If your ER-X is powered by its port 1, you can indeed switch that "power in" towards the provided wall power supply.

So which path do you want to "change"?
Click to expand...

Due to my feeble mind I am trying to copy @guykuo setup on the Edge Router X. I do not mind purchasing another POE switch to to mimic the setup. I think the dog at the last 12V power supply so right now I am using the POE passthrough. So I just ordered a new replacement 12V power supply and also a ubiquiti 8 port switch with POE to power the AP in the ceiling. Once those things come in I can do all the physical connections and then move on to the configuration. At least that is what I am thinking at this point.
 
As you explore the EdgeRouter and its rules, it really helps to keep in mind....

All rules are relative to the router.
Inbound rules are for packets entering the router.
Outbound rules are for packets exiting the router.
Local rules are for packets accessing the router's internal services.

The rule directions are NOT relative to your internet outside connection nor your LAN. They are relative to the router itself. Keep that foremost in your mind and things are less confusing.
 
10/4, it is going to take a fee days to get everything in. The switch was not in stock so it might be a bit on it.
 
guykuo said:
Change User Password and Create User Accounts

The pre-configuration file has a default admin account defined. You should immediately change its password.

Log into ER-X at 192.168.91.1

default username = admin
default username = admin

Click on Users tab to see the list of current users.
Use Actions pull down menu to change admin password to a complex password. (Don't lose this password!!!)
View attachment 54279
I also recommend adding some other user accounts for...

  • admin level account as a backup admin
  • operator level account for viewing status of router

For purposes of this tutorial, I will keep using just the admin account, but DEFINITELY change the admin account password!!!
Click to expand...

Hi any chance you could post instructions on how to configure open VPN?
 
Details from Ubiquiti on setting up OpenVPN server on Edge router found here:

help.ui.com

EdgeRouter - OpenVPN Server

Overview Readers will learn how to configure an OpenVPN server on the EdgeRouter. NOTES & REQUIREMENTS: Applicable to the latest EdgeOS firmware on all EdgeRouter models. Knowledge of the...
help.ui.com help.ui.com

Looks pretty detailed.
 
windguy said:
@guykuo - Thanks for the reply and explanation. Ha, you added more info after I read your post last night. My head was spinning a bit before going to sleep trying to sort that out. But with your added explanation, things are gelling a bit more with a fresh mind. I reread Dean's post and your talk and I'm starting to understand the versatility of the ER-X a little bit better. Pretty cool product and for only $60.

Below is a network diagram of my proposed system. At the ER-X, I could setup ETH0 for WAN and SWITCH0 for ports ETH1-4 rather than add a separate switch since I only need one LAN network, unless you see a reason otherwise. This was my original design but not knowing that each port was configurable and not switched by default out of the box.

Regarding your proposal on how best to offer help in setting up OpenVPN, that sounds very reasonable. You definitely have a great knack for explaining complex concepts in plain understandable terms. That's very helpful for me and appreciated. I knew a while back that the ER-X was the best solution for me since I needed a wired router that has OpenVPN, but I was aware that the complexity of setting it up was beyond what I might be able to handle. Maybe now, with your help, I can integrate this device without pulling out what little remaining hair I have. I suspect there are others in this same position and your proposed tutorials and config files would help them. Many thanks!

View attachment 54261
Click to expand...
What program did you use to do this network diagram. I am trying to implement this tutorial but would like to share my network diagram before I get started. I know this will be a challenge for me but I am willing to try and take the time to get it down.
 
Blue65 said:
What program did you use to do this network diagram. I am trying to implement this tutorial but would like to share my network diagram before I get started. I know this will be a challenge for me but I am willing to try and take the time to get it down.
Click to expand...

Looks like excel
 
Well here is my rough rough draft of my home network. From reading the initial posts by @guykuo it looks like I need to add another physical switch to isolate the camera network completely. I think I have an unused non POE switch that I could implement. If I have a non POE switch, that is connected to a POE switch and then that POE switch is connected to the cameras that should be just fine, right? Meaning I do not have to connect one POE Switch to another POE switch to power the cameras. Surely I don't. Thanks for the help.
network diagram.JPG
 
I went ahead and re-worked the physical connections for this setup on the Edge Router. Now on ETH3 port of the Edge Router I have a POE switch that is then connected to my 4 cameras. So now I have the following physical connections on the Edge Router.

ETH0 - Nothing
ETH1 - Input from the Cable Modem
ETH2 - Switch0
ETH3 - Switch1
ETH4 - Nothing

In regards to the NVR do I put that on it's own port on the Edge Router or would that physical connection go onto Switch1? To follow this configuration should I move my input from the Cable modem to ETH0, and thus move everything down one port? I just want to get my configuration as close to the original as possible for ease of troubleshooting. I really appreciate the help guys.
network diagram.JPG
 
guykuo said:
As you explore the EdgeRouter and its rules, it really helps to keep in mind....

All rules are relative to the router.
Inbound rules are for packets entering the router.
Outbound rules are for packets exiting the router.
Local rules are for packets accessing the router's internal services.
Click to expand...

I may have missed it in the thread, but could you publish a sanitized version of your erx router config text file. I use an ERL and would like to incorporate a couple of your ideas, but I would need the actual text of the config to make some of the changes as I would have to modify my vlans instead of interface ports. Also, why didn't you strictly use Vlans instead of wired ports for your firewall rules--- you could then use one managed switch with its vlans acting per the rules that are set in the router.
 
Capture.JPG
I have been working on my physical configuration of my network to get ready to apply the config file to my edge router. I think I am pretty close, fingers crossed. The one question that I have is on my NVR. My Switch1 is physically located in the garage. Everything else is in my living room, including the NVR. Should I physically move the NVR into the garage and hook it up to the Switch1 instead of switch0? If that is the case, I could make that happen very easily. Thanks for the help.
 
There are advantages by having your NVR in the garage:
  • noise (especially the POE ones make buzzzz)
  • all camera bandwidth remains on the Switch1 and won't overload your ER-X. Do note that an ER-X is bad in switching, good in routing. Hey, it is a router after all.
  • vlanning may become easier (simply PVID may suffice and no need for trunking anymore?)

The only reason you may like it next to your ER-X if you have (for example) an HDMI screen hooked up to the NVR for quick video playback on it?
 
Thanks so much @guykuo for sharing your ER-X config. It has probably saved me days, if not weeks, of tinkering!
I am a NOOB at using the ER-X and perhaps an intermediate at networking skills.

I want to be able to access my DSL Modem GUI at 192.168.2.1 from my eth1 network.
Can you please guide me through what needs to be configured to do this with your config setup on the ER-X?

Thanks,
Randy
 
Last edited:
Odd request here. Someone from this thread really helped me out last year. We discussed my whole setup over the phone. Now I just can not find his contact information anywhere. If he stumbles onto this, could you shot me a PM when you get a chance. It would be really appreciated.
 
If you have not done so already, simply review the the thread for the familiar name.

Maybe you set-up the phone call via personal messaging to/from the other member. Click on the envelope adjacent to you username in the upper right, then choose "show all" to review the past conversations you've had.
 
Ubiquity has discontinued shipping the EdgeRouter X. It was an amazing little machine for its time, especially at $60.
Getting one now costs much more. I no longer recommend this pathway to network isolation.

I have since transitioned to PFsense on a fanless firewall appliance. The initial setup cost is more, but setup is much easier than with the EdgeRouter X. VPN is simpler to implement. Supports 2.5 gb speed network speed. PFsense is actively improved and PFblocker ad blocking has been very effective. Very happy with making the upgrade. The speed, ease of configuration, and enhanced capabilities easily justify the cost differential. On the other hand, paying inflated prices for rare, discontinued EdgeRouterX's is not worth doing.

To implement PFSense, I got a bare bones Mini PC with 2.5 gb ports, 128 GB mSATA drive, and 16 GB RAM. That's actually FAR more RAM and storage than needed, but going smaller capacity wasn't going to save many dollars.

$266 MOGINSOK Firewall Appliance Mini PC, Intel Celeron J4125 Quad Core 4xIntel I225 2.5G Ethernet VPN Router PC AES-NI HDMI VGA Barebone NO RAM NO SSD (Be sure to get one with AES-NI)

$32 Transcend 128GB SATA III 6GB/S MSA230S mSATA SSD 230S Solid State Drive TS128GMSA230S

$47 G.Skill Ripjaws SO-DIMM Series 16GB (1 x 16GB ) 260-Pin (PC4-19200) DDR4 2400 CL16-16-16-39 1.20V SO-DIMM Memory Model F4-2400C16S-16GRS

My PFSense firewall box is at about 2-3% CPU, 5% RAM, and 1% storage on average. It's a huge jump up in speed and capacity. Also, PFSense has a larger user base for support. Tons of how-to videos are on line.
 
As an Amazon Associate IPCamTalk earns from qualifying purchases.
You must log in or register to reply here.
Top Bottom