That lets you configure networking devices but it isn't the "full" Ubiquiti ecosystem (Identity, Site Manager/SD-WAN/Teleport).

Basically before you could run one "app" (the network management one) locally, but Unifi ship a grid of cloud "apps" that you see when you log into unifi.ui.com .

Now they're shipping the thing that hosts the grid itself (enabling multi-site stuff like SD-WAN and the firmware update server), some more of the apps (Identity) and presumably they'll roll out more apps in the future.

2. With the "UniFI OS" branding, the door is open to the possibility of being able to run Talk, Protect, Access, etc... on your own hardware in the future.

It has issues with 2.4Ghz speeds, it randomly restarts because their software is buggy as hell. Their Apple style UI sucks ass and they have a mobile app that you can barely do anything in so you may as well just go to the web interface.

They have no features like proper QoS (smart queueing does NOT count) and even just little things, like not being able to search clients by IP, or ordering by current speed never working quite properly.

It's a fancy UI over crappy code that's been duct taped together. As soon as I move house I'm moving to Mikrotik again. For APs I may keep unifi, as they're very good at that one thing, but their routers/switches suck imo.

Have they been perfect? No, but this has allowed me to control my network how I actually want to control it.

This has lead me to now having multiple Ubiquiti components (with more planned), my most recent was switching away from Synology to the UNAS Pro and it has been great.

Really the only thing I ever bought from them that I really regretted was the tooless mini rack. Was really cool but I have non ubiquiti things that I need to mount and I doubt they are going to actually make a server I can run k8s anytime soon.

From all I've been looking at, looks like it's the most straightforward setup. Fully centrally managed via the gateway, leaves me plenty of options for PoE-powered security cameras and other expansions in the future, can be upgraded on a component basis when desired, and integrates nicely in HomeAssistant. And with all that, not even really more expensive than what seems like much more fiddly alternatives like the TPLink Omada system and others.

So I've gone elsewhere for cameras, switching and routing.

This release is a nice point in their favour though but I can't see myself going back all in on Ubiquiti.

The gateways are awesome value.

IN all fairness, that hate is reasonable. Ubiquity has _some_ things done super well. As long as your needs are addressed by the config/options/UX/API that they expose, you'll have a pretty good experience. As soon as you need to do something that isn't easy, you're going to be fighting your core network infra the entire time and that's a miserable place to be.

Stick to unifi for switches and *basic* routing. Use their LED lighting / Cameras / Access Control and other side-projects at your discretion.

The problem with UBNT isnt that they aren't great for your homelab. They are.

The problem with UBNT is people think "Great for my homelab" is the same as "I can run important infrastructure on this"

The problem with UBNT/Mikrotik is that people bring homelab level skills to complex infrastructure projects and then make a shocked face when they get hacked.

https://help.firewalla.com/hc/en-us/community/posts/44144642...

To start, it seems to allow for the multi-site coordinated tools like MD-WAN to work with self-hosted OS installation, and they added Innerspace and Identity (which I suppose is necessary since I think that's how the login works) as "launch" apps. Presumably they'll roll more out in the future - ideally you could fully self-host stuff like Protect.

But yes, they still seem to be the best for small business / homelab type people who want something more than "the AT&T guy put a box behind the couch in 1998 and i don't know where it went after that" but also doesn't want to have to do opnsense or a bunch of that stuff.

And they've managed to regain my enthusiasm a bit by adding plain-ole wireguard (not even teleport, though i do like teleport for my phone) to their managed VPN options, and now by bringing back self-hosting.

My main gripe about lack of self-hosting is, I have a bunch of terabytes just sitting around i could put my video footage of my front lawn on, and it's free real estate. but since i can't (couldn't) self-host video on it, I would've had to pay like hundreds of bucks (or is it thousands?) to get the rackmount video server from them. But now that this is back, hopefully I can switch back to self hosting if my cloudkey ever dies. So that's nice.

Things like this get the information out there in human-readable form to be understandable, and error checking would be for the reader.

Or said another way, more like gist.github.com vs github.com/some÷project.git

Love it. Thank you kind sir for your work!

As others have said, UniFi had some tough years but that early stuff just works and my uptime is in years.

I've gotten a lot of mileage out of Ubiquiti gear in SMB space, but enterprise it is not. Ruckus, Aruba, and to a lesser extent Cisco (Meraki) own that space. I wouldn't trust Ubiquiti gear to handle the densities that Ruckus gear can, for example.

For your home frustrations some cheap Ubiquiti gear and spending the money to cable all your APs will do what you need.

Yes it has the whole UniFi Network piece, which is various unifi routers, switches, wireless access points, wireless mesh units, etc.

The self-hosted Unify Network can’t upgrade itself, but it does have a button to verify whether a release is available. I check that option once in a while. When an update is available, I ssh into the VM, execute the latest-release script, answer a few questions and let it do its thing. Done. It even updates the underlying Linux if you wish.

Until bugs in UniFi OS Server get ironed out, this script is highly recommended.

[0] https://community.ui.com/questions/UniFi-Installation-Script...

Ubiquiti has a pretty smooth setup that works well together, the recent years of reliability issues, updates, and data security issues however has been enough to stop buying Ubiquiti and protect it with other gear such as NetGate firewalls.

The Dream Machine Pro had lost some critical advanced configurability from the ui and command line compared to it's predecessor, leaving a lot of users in no man's land. Some of it has been resolved from what I can tell. I own one and had to supplement it with another device in front of it temporarily. Once things are in production, we usually don't look for reasons to touch it.

If your internet is 1 gig or less, I'll still vouch for the trusty littel EdgeRouter X, there's a great guide on setting up a nice little home network on it to learn which direction your next steps will be like.

Hopefully this proves itself in a year and it's an easy decision.

From what I’ve seen, Unifi seems like the closest to an "Apple-like" experience - especially given how much more robust their capabilities are compared to most other providers.

As far as I can tell, this article has no actual link back to any Unifi press release, git repo, or other project page about this, the closest the author does is link the downloads from Ubiquiti's site (as in, literally, links to the files, and nothing else).

This is janky, yes, and I'm not gonna shill for Ubiquiti, but for lack of a legitimate source, I don't think this is a fair representation of the actual install steps.

I upgraded my venerable USG with the new UXG as I have gig service now. The gear is great, even supports IPv6, and uses much less power. But… no internal DNS is enabled. So now, I ended up buying a thin client on eBay to roll my own DHCP/DNS. Not fun. It is baffling to me because there’s lots of complex new features in the Unifi stack, and they already had an interface to configure static names in dnsmasq.

I went the Eufy route for cameras as the batteries were a big draw for me.

The £360 camera is the G5 Pro, which is a 4K camera with 3X optical zoom. I'm not aware of any Ring camera with optical zoom. If you don't need the zoom, the G6 Bullet is a 4K camera without zoom for £190, and the G5 Bullet is 2K for £126. As far as I know, Ring's highest resolution camera is 2K.

But Unifi isn't really trying to be a Ring competitor -- Ring caters to home users with little knowledge of networking, Unifi is more for small businesses (who use an integrator to install their system) or prosumers with more advanced network knowledge.

I've noticed a lot less Ubiquiti hate comments on HN since that one employee got arrested.

[1]: https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=11...

This is also for setups without an Ubiquiti gateway. Like a setup with just UI switches or APs.

* Required if not each should be a standalone, some devices won't work without UniFi OS AFAIK.

From what I've seen it looks far more modern.

Their security issues in the past. Their failure to make the EdgeRouter handle DHCP and DNS properly. Etc...

I've since moved to cheap switches that support all port vlan trunks and LACP bonding, then just plug Proxmox into them and run OpenWRT in a VM for routing all the vlans. The Proxmox+OpenWRT combo even supports hot-plug virtual interfaces as more VLANs are lit up, they just pop up nicely in the web UI.

For the APs, TP-Link is less expensive and better performance. WiFi 7 and 10gbit for less money. No need to run a management OS in a VM either.

https://community.ui.com/releases/EdgeRouter-3-0-0/33ee3852-...

But yeah they haven't released any new hardware in quite a long time. But nice to see they are still doing development work on the software.

We still use some Ubiquiti. Sometimes i use this script on a Debian VM:

https://community.ui.com/questions/UniFi-Installation-Script...

The router works still amazingly fine, only their software has some bugs.

I tried a Mikrotik router recently but conoared to the Ubi devices, configuration feels so clunky and complicated.

So I am confused by their Camera prices being so high.

I went with Reolink on cameras and NVRs and don't regret that decision. Probably spent a third of what it would have cost for Ubiquiti. There must be some benefit to the extra cost, but I don't think it's one I'll miss.

Now days, static routes, SNAT/DNAT, and DNS are all in the management interface. So.. things improve, and every time I’m back using EdgeRouters, Extreme, or Juniper elements I miss the low friction of managing UniFi stacks.

Agreed that if you need VRFs for example, DC power, and are working through similar complexity requirements, Ubiquiti is the wrong stack. I’d say Ubiquiti is not heavy weight, but it seems to address 90% of SMB setups.

While I don't like many of the shady things Ubiquiti did with respect to OSS and for a while I did try to move away from them. However what I found was the prosumer market riddled with less polished alternatives. Microtik does offer some interesting hardware for edge cases that UniFi doesn't cover, but when it comes to a unified system Ubiquiti have done an amazing job.

The pricing has gotten a bit outrageous. For example: trying to find a reasonably priced high wattage PoE switch in UniFi's line is no longer an easy task. It's tradeoffs all the way down. I have an original (SwitchOS) 48 port GbE & 4 SFP+, full L3 with a >250W budget and replacing it will be rather pricey or I'll have to make concessions.

But overall... There's no better prosumer option - good, bad or otherwise. They haven't enshittified the product with subscriptions / software upgrades and my guess is they're making this move back to self hosted options to actually save themselves money. A win on both sides.

[1] https://openwisp.org/

I've tried hosting the same container before but it never seemed to properly "marry" to my UniFi AP, or it would forget the AP the next day, etc. For now I just use the iOS app which is sufficient to update the AP firmware occasionally, but I wish I could get all the insights of the controller.

but yeah that was upsetting - I was hoping they’d push them to a registry and make them… more available.

I have a UCG-Ultra and was able to set up DNS just the way I wanted. My needs aren't extreme, but I was able to set up a wildcard entry (*.apps.domain -> 192.168.x.y) and fixed addresses and DNS names for various hosts.

The configuration is in a non-obvious place now and has moved around a bit over time. Currently it hides in Settings > Policy Engine > DNS. It shows entries that come from the per-host fixed IP/Local DNS configuration (you can't edit these here) and you can create new entries here (like my wildcard or some other random entry).

the founders are ex-Apple

Right now it looks like UniFi OS server doesn't do anything the prior self hosted stack does already. Presumably though they are planning to roll out some of the other parts that currently aren't in the fully self hosted stack.

It never went cloud-only. You could always self-host.

They've had different versions of cloud hosted offerings over the years. A few companies have also offered their own cloud hosted instances.

There's also been a container version for quite a while too.

Gen 1 cloud key: https://dl.ubnt.com/qsg/UC-CK/UC-CK_EN.html

Gen 2 cloud key https://store.ui.com/us/en/products/uck-g2

Container from linuxserver.io https://github.com/linuxserver/docker-unifi-network-applicat...

In order to configure, check what was going on I needed to run app on my Windows computer. I was looking into using docker or something like that, but I switched to another vendor.

I didn't like how they stopped supporting on-prem Unifi Video server, and only allow you to use it with a hardware appliance now.

They moved beyond "just build good product" and into unwanted cloud services and closed ecosystem.

If this is a re-opening of some of their self-hosting, then great. They're back to par, I guess?

Also there is the official announcement now: https://blog.ui.com/article/introducing-unifi-os-server

I ended up with a bunch of mildly compatible products that were a totally pain to manage. It was _amazing_ when it worked well. It mostly does, but on occasional when things went wrong it was a totally pain pain to fix.

My Tp-link Deco system works just as well for my use case. It occasionally decides to use a terrible channel, but that’s fixed with a quick restart or a few clicks in the app.

You could always do this. UniFi Network always had a self-install option.

[1] https://old.reddit.com/r/Ubiquiti/comments/1cifnut/unifi_pro...

[2] https://old.reddit.com/r/Ubiquiti/comments/1dbyvan/home_assi...

Want to create a VLAN with no Internet connectivity? Better test that it actually has no Internet connectivity because the setting doesn’t actually work.

Want to use the firewall? Better test all the rules — it’s amazingly buggy.

Want to change a WiFi setting without WiFi going down for a minute or two? Good luck — UniFi doesn’t seem to care about making it work.

Want to find information (MAC, switch port, DHCP reservation, etc) about a device that uses the same MAC address on multiple VLANs? Good luck — it looks like UniFi utterly flubbed either their database schema or whatever interface their front end uses to talk to their backend about it, and it’s very, very broken.

Want to find basically any setting based on online docs? Too bad — they keep moving the settings and not updating the docs.

Recently set up CCTV at my parents’ with a Cloud Gateway Max, set up a site to site VPN in 3 clicks and now I can support remotely and their Sony smart TV can see my Jellyfin server.

My childhood dream was to build crazy buildings, before that it was a space explorer. Not sure a home network rack ever made the list!

They promote their cloud controller pretty strongly, followed by the Cloud Key, which is their own preinstalled self hosting setup, but the self-hosted UniFi Network server has stuck around. (It changed names a couple of times; it was the "UniFi Controller", then "UniFi Network Application", and now "UniFi Network Server".)

Crosstalk Solutions, MacTelecom Networks, and Lawrence Systems all do youtube videos on UI's gear and setup - may help give you an idea of the experience before you commit to kicking off your addiction.

A while ago one update automatically enabled PMF (set to required, I believe) on all Wi-Fi networks. That didn't go great for me when half of my IoT devices stopped connecting and I wasn't available to fix.

That's why I moved off as well. Maybe some day SDN (at least so far as the ubiquity experience goes) will become an OpenWRT priority.

https://ui.com/us/en/cloud-gateways/compact

The cameras will upload jpegs and mpegs to a local FTP server based on configurable triggers, which include 'AI' detection of animal/vehicle/human, all running on-camera.

I wrote a simple script to put all the daily uploaded jpegs on a HTML webpage (each linked to the video) for review. Home Assistant also has an integration that can do streaming and grabs the detection triggers as well.

Hopefully the Unifi devices are better since I eventually replaced it with Cloud Gateway Ultra after dabbling with a second-hand MikroTik.

The Flint 3 just launched, and the headline feature is WiFi 7: that should be less of an issue if you're going with separate APs.

We use all Mikrotik hardware for routing. RouterOS is so flexible and capable. But it is absolutely not user friendly.

For large scale commercial deployments we use Ubiquiti equipment. There is always a Mikrotik router but the APs are all Ubiquiti. It’s just easier and cleaner for us to manage deployments that way.

I see no reason why someone just casually playing with their home network would use Mikrotik though.

We use Cambium for Point-to-Multipoint mostly because the price and selection is better than Ubiquiti but we use the wireless backhaul gear from Ubiquiti in a few spots.

To be perfectly honest if Ubiquiti had the right kind of hardware and management capabilities for us to serve as the root of any deployment I would probably use it everywhere.

I have a site that has 8 cameras and 2 of the 8 are original cameras that are >5 years old still getting firmware updates. Reolink does not do this and I have had much higher failure rate with them as well. Especially in outdoor cameras that have to handle snow/ice/extreme cold.

Admittedly it's still not as awkward/bad as Draytek.

I have an ansible playbook that creates the image and I run it on a cheap fanless x86 box....

Try making a multi-homed IPv6 network with Ubiquiti gear. Easy (I might even say trivial) to do with an OpenBSD router and PF, but impossible with Ubiquiti because of how they broke the DHCPv6 client so that it can't accept leases from multiple interfaces and assign them to `radvd` for SLAAC.

You want to do anything other than the most basic task of advertising a single prefix from your ISP? Like advertise the same ULA on multiple VLANs for local services? Well, fuck you for wanting to do that. (Even EdgeOS could do that.)

All of your modern (anything from the last 10 years) phones, computers and tablets already know how to handle multiple IPv6 SLAAC addresses from different subnets and route packets appropriately. All you need is a not-braindamaged router.

The firewall in Unifi is a huge regression compared to EdgeOS, and completely brain damaged compared to PF.

Oh, and the MDNS reflector... why is it so bad?

Ok, I think I need to stop now.

Unifi still doesn't have great IPv6 support in 2025 and that's insane for anything that's trying to position itself even remotely near professional grade gear.

It appears to have changed recently but at least around the beginning of covid, you still had to SSH into their gateway/router thing and manually edit a JSON file to configure even basic S/DNAT rules. When the whole selling point of the gear is SPOG MGMT web ui, it's fair to consider "SSH in and edit files" as fighting your gear.

The number of times that I have had accurate, timely, correct, competent support experiences is zero.

The number of times I've been gaslit, lied to, misled or otherwise asked to repeat the same basic diagnostics and troubleshooting that I had already done in the opening ticket message... Is high. Something I would expect from D-Link or any other cheap gear. Not at all acceptable at ubiquity prices.

Speaking of garbage quality support, dead links!

case in point: https://help.ubnt.com/hc/en-us/articles/215458888-UniFi-How-...

That used to be my reference or how to access the config file I needed to edit for basic Nat. Now who knows where that information is. Maybe the way back machine?

I haven't looked inside any of the latest gen 7 access points but I remember not being impressed with there overpriced gen 6 access point using last generation chip from Qualcomm... Which is unacceptable at their prices.

I stand by my point: if you buy their older switching gear, you can get a really good deal. Don't use them for routing unless your needs are relatively straightforward

Thanks, they really seem like good alternative.

Cheers!

Ubiquiti's routers to me just seem to be prosumer routers with an "enterprise" UI on top. Whereas Mikrotik genuinely offer an enterprise experience (also still great for home) with the boring, drab, absurdly functional UI to back it up.

Ubiquiti looks beautiful; but you can't do anything with it.

For our house I tried a Mikrotik, a TP Link and a Ubiquiti AP. The only one that really works in our case is the Ubiquiti. Also for a home that's mostly Apple hardware, you kinda need a manage wifi solution, because Apples WIFI stack have issues switching between APs and needs a controller to kick you off (I don't know if that's still the case). Ubiquiti have one of the only routers that will force Apple hardware to switch APs. Mikrotiks CAPsMAN isn't even really a WIFI/AP controller, it's just provisioning.

For all it's flaws, I still really want to just run 100% Mikrotik gear.

That's a very charitable and positive spin on "was expensive the day you bought it and got all the functionality you expected years later".

I'm fine with things getting better over time. I am a lot less understanding when you ship a device in 2024 and it still has trash IPv6 support but don't worry because "we'll fix it via an update coming soon!"

That is something that should have been there from day 1.

  Maybe if one doesn't actually understand networking nomenclature or interop, sure.

They're cheap and nasty, but they mostly worked.

Mikrotik maybe?

I run both ubiquiti and mikrotik stuff. The mikrotik definitely has... a learning curve, but you can do some stuff with it that's pretty difficult with ubiquiti.

Think of it more like a vendor distro

(I do notice people on forums love to use Early Access update channel where... YMMV).

this is such a pet peeve of mine lately. companies are doing this all over the map now, from cars (especially self-driving), games, network equipment, entire software suites… and on and on.

i absolutely did not opt in to be a beta tester as a random human on public ways. i did not opt in to be a beta tester for your search engine results. i did not opt in to be a beta tester for the games i spend $90+ on. i did not opt in to beta test your company’s network equipment which we paid full price for.

build and closed test your products with interested parties who explicitly opt-in and quit forcing and charging us to be experiments in your company’s r&d.

I also have struggled with this, and spent many hours bashing my head against a specific setting in PFSense that requires a plugin to enable.

Then, I thought to try updating the firmware on my Unifi WiFi AP, and have had (almost) no problems ever since. It has taught me to think twice about spending $100+ on a piece of niche electronics that can only be controlled if it is compatible with your WiFi...

Hardwire the one closest to your gateway, remotely adopt the others, and youre good to go. Also, double check your frequencies. 1, 6, 11 for 2.4 Ghz. No DFS for 5 Ghz. Scan the environment and try your best. Wifi 7/ 6 Ghz must be same frequency though which is another plus since no ones really has it yet.

Unofficially (and therefore not supported), you can just take their binaries and run it on your own hardware. But since they only support their own hardware and it's arm64 hardware, you only get arm64 binaries: https://github.com/dciancu/unifi-protect-unvr-docker-arm64

With them adding generic onvif camera support, I might try it again because the other options aren't amazing either.

ATT fiber pass through -> UniFi Security Gateway -> UniFi 8 port Witch w/ PoE -> UniFi AC Pro WAP

Awesome combo with uptime in years.

Even this only reviews "Smart Detections" and I have smart detections turned off on my Unifi cameras, because it enables cloud AI. Having the ability to have an AI key to process detections locally would be great.

Also, having to buy extra hardware kinda stinks. Would love to be able to have a self hosted Unifi OS server that can do AI key abilities if the hardware supports it.

I have complete control over my kids network access, can block specific types of traffic by app type or time based rules. I have high visibility into my WiFi setup and everything is on prem and self hosted and integrated with home assistant…

That said I've only used the wired bullet cams so maybe other models are not so nice.

Really the only downside I've seen is about 5ish years ago, all the bullet cams I bought would die after about .75 -> 3 years. All died with the same issue and I had 100% failure rate with any bought during that time frame. Ubiquiti replaced the ones that died during the warranty period but most died just after that expired.

The ones bought before or after that have been great so the issue was solved but I have a nice stack of dead ones that would work great as fake cameras, especially as their IR leds still light up.

It’s great for pointing a livestream at a fish tank. It’s useless if you’re trying to record the outside of your house at night.

[0] https://community.ui.com/releases/UniFi-Network-Application-...

I've at least never experienced it (and I stick to the Stable/Release channel).

I have 4 AP, 9 cameras, NVR and Dream Machine - I guess I got lucky over the 2.5 years I've had Unifi.

I appreciate you linking these, though, as well as the extra context.

Just turn on cloud access, accept the t&cs and then turn it off again. If you are really scared then you can isolate that device in a vlan or DMZ temporarily.

I run many commercial and residential networks, and this is definitely a non issue for me.

If you change the schedule of a WiFi network your entire network (wired and everything) goes down for two minutes.

Just a simple admin policy change… full network outage.

Clown. College.

But UniFi has serious limitations when it comes to anything beyond the basics. An off the self Asus all in one home router actually has more features and capabilities.

My current setup is Mikrotik for wired and Ubiquity APs for wifi. Their wifi devices have great specs and are difficult to beat. Mikrotik has decent wifi devices but not only they have a footgun minefield - not exactly their fault since Wifi is difficult to get right, so the more settings you expose, the worse it gets. Mikrotik also logs behind in features (they are still at wifi 6). It's an odd combination of philosophies but seems to work, all the vlan logic is offloaded to Mikrotik. And so are firewalls, etc. Then the voodoo Wifi stuff gets handled by Ubiquiti.

> Want to change a WiFi setting without WiFi going down for a minute or two? Good luck — UniFi doesn’t seem to care about making it work.

I am with you on that. It's things like that that prevent adoption by larger businesses and contribute to the perception that they aren't a serious contender. I previously had an Aruba InstantOn setup(which is focused on SMB), and got really accustomed to being able to tweak (most) settings without any interruptions at all. I could even do things like change channel widths (in one direction) without losing connectivity. What was really surprising on Unifi is that I lost connection when I changed settings for a _different_ SSID, for like a minute. That isn't really acceptable.

They still do a lot of things right though, and it shouldn't be too difficult to get their act together. The devices are pretty decent and at a surprisingly low price point.

Literally couldn't connect to my mobile phone, and after a lot of troubleshooting (which Unifi does pretty much nothing to help you with) I found that when the phone had roamed to the mesh'd AP, ARPs for it wouldn't get answered. If I forced it back to a wired AP or manually added it to the table... all worked fine. Went unfixed for years, heck, I still don't know if it is...

And all the "alerts" about malicious traffic that a bunch of prosumers seem to love? It's not very actionable for figuring out if it's really a problem nor digging deeper...

Oh, and when they had a firmware update that changed the SSID maximum length from 32 (the spec) to 31. My SSID is 32 characters and after that I could no longer edit the network without a UI error. That sucked.

I'm now on OPNsense and Ruckus APs and while it's not as integrated, I couldn't be happier.

I run OPNsense now with a Ruckus standalone AP, and it has been bulletproof.

I did a lot of jobs when I was very young. I wouldn't want someone to draw conclusions about me today based on my failed stint at Burger King, for example.

Terrible little underpowered device that frequently wouldn't come back up after losing power.

I switched to Aruba because of the cloud key and haven't looked back.

When I last looked into openWISP, it was a pretty good effort but has a very hard dependency on openWRT. If your entire network is not made up of hardware that has "good/stable" openWRT support then you're going to have a bad time.

I don't think there are any 10g switches that run openWRT well yet, for example. [0]

[0]: Yes, I know openWRT runs on amd/intel but those devices have a few NICs at most. There are no 48 port 1/10gig switches that run openWRT as far as I know...

I have a separate tower that's a old 9th gen intel that provides the large ~50TB ZFS NFS server. It used to be an intel Atom, but that finally died after 10 years so I moved the drives to a gaming PC I had lying around. Over the years, nicest thing about ZFS and Proxmox is the drives are fully independent of the hardware and the software OS they're attached to. Now, I just pass the devices through Proxmox to a Debian VM and they come up just like they did before.

Regarding the rest of the network, let's move from the edge in toward the 3x 1U servers and NFS storage box. I have 1gig symmetric fiber from Ziply. The ONT has cat5 running to 1 of the 4 gig ports in an Intel Atom C2758. The other 3 ports are bridged together in Proxmox to act as a switch. It kind of looks like an EdgeRouter-4 if you squint at the ports. This C2758 only runs a single VM, OpenWRT. The nice thing is I can take snapshots before upgrades, and upgrade or replace the hardware easily.

The OpenWRT VM is the most critical thing in the whole network. I try to manage it simply, I have some shell scripts that copy the /etc/config files into place and restart services for a simple IaC setup.

The main services OpenWRT provides are:

1. WAN DHCP client, my ISP doesn't offer static IPs. 2. One minute cron job that makes sure the A record for home.example.com is correct. *.home.example.com is a CNAME to home.example.com, this simplifies configuration and TLS cert management. 3. HAProxy runs on OpenWRT listening on 0.0.0.0:80 and 0.0.0.0:443 Extremely valuable for SNI routing of TLS connections. I moved the LuCI web UI to alternate ports, which is simple to do via config. 4. dnsmasq provides dhcp and dns for the main and guest VLANs. 5. OpenWRT is configured as a WireGuard server. Each wireguard client device is allocated an dedicated IP in a separate 192.168.x/24 subnet. This has been great for source based IP access control which I'll cover below. Wireguard clients connect to home.example.com.

That's it for OpenWRT. The key lesson I learned is it's been incredibly valuable to run haproxy on OpenWRT. All L4 connections terminate to it, but crucially it does not handle TLS certificates. It only forwards TCP connections based on the SNI in the client hello. HAProxy is also configured to use the PROXY protocol to preserve source IP addresses, which has been great for access control.

Most TLS connections are forwarded to a single node Talos VM running on another Proxmox host. This VM runs Cilium, Istio, and the Gateway API. The istio envoy gateway is configured to accepts PROXY protocol connections, which means AuthorizationPolicy resources work as expected. By default, only connections coming from the local subnets, or the wireguard subnet are allowed. OpenWRT does hairpin NAT, so this works just fine, all sources connect to the WAN IP regardless if they're internal or external.

I don't do much with Kube yet, most of the traffic is forwarded on to another VM running Portainer. Most of my backend services are in Portainer. The Kube VM does handle Certificate and AuthorizationPolicy resources though, using cert-manager and Istio. This has been nice, I don't need to configure each service for TLS or access control in bespoke way, it's all in one place.

The only other thing to note is the Dell 1U servers have 3 of their 4 gig nics aggregated into LACP bonds. Similar to the Atom router, they're configured as a bridge in Proxmox and I use them for the Ceph data plane. 9 of the 16 ports in that TL-SG1016DE are just for Ceph and I'm able to get close to 600 MiB/sec reads (yes megabytes) which is pretty neat given 1gbit interfaces.

That's about it. Overall I'm trying to eliminate VLAN's, but it still makes sense to have them for Ceph and for a Guest wifi network.

Edit: Lastly I've maintained a home lab for 25 years and this is the best iteration yet. All of the trade-offs feel "right" to me.

I would agree with the desire for full feature sets out of the gate, but UniFi stack is hardly expensive. Further, you know the balance of limitations and advantages when you opt to purchase it instead of more traditional mainstays with decades of compounding feature buildout.

I don't have any mikrotik hardware new enough to support it so I haven't tried it myself yet and documentation is (as usual) pretty lacking, but like you I want to believe.

That’s why I just had to buy new Ubiquity gear two weeks ago after an update bricked an older ubiquity switch and router (purchased in 2019). Spent a ton of time on the console but both were stuck in some sort of boot loops and were not salvageable.

Ended up buying replacements from ubiquity, but I feel pretty dumb buying new stuff from the company that just screwed my weekend and wallet. I could also swear that I had auto updates off for firmware but maybe that part was on me.

Raspberry is godsent

Thank you!

https://www.unihosted.com/blog/how-to-set-inform-in-unifi-a-...

But EdgeOS was not the only fork, another one was VyOS (vyos.io). Pretty sure, that EdgeOS has done larger steps forward, especially, since it was bound to the hardware's developer.

There's no central management of these records that I'm aware of though.

Absolutely love my Unifi setup, recently upgraded my USG to the UXG as the old was EOL and not performant enough for gigabit routing with SPI.

That said though, do I really need these features? The biggest draw was having a proper AP to put on my ceiling instead of my old google wifi pucks. The upgrade from wifi 5 to 6e was not noticeable in any way. I spent 3x the money and really have nothing tangible to show for it aside from a cool UI to log into, which was never necessary prior because everything Just Worked.

Also- this may be my fault for not reading the fine print, but the IDS stuff on the UDM only works at 600mbps, and I have a gigabit connection. People in Unifi forums will tell me I am the idiot for assuming that, but it has gigabit ports, its 2023... I just ass/u/me/d that everything would work without issue at line speed and wouldn't have to read the spec sheet like a lawyer.

Anyway, its fine in the end. I would never buy anything cutting edge from them again, I want anything to bake for at least 6 months after release, which is usually how long it takes for their "shipping" stuff to become actually available anyway. I will stop whining now :)

You'd have to poke around in the forums. I'm not sure what the best keywords to search with would be. The gist of it is only AT&T ONTs can connect, because it's using certificate fuckery, but there was a guy buying those up for $1 or $5 or something on ebay, jtag-ing the certs off of those, and selling them for $10 each. There were instructions for how to program the sfp module to use those, and when I got mine those modules were only about $50 each (no idea what they're now with the tariff nonsense). You'd need a router that can accept those, I've got a Mikrotik. I think Ubiquiti has a prosumer router with one too that's not too crazy.

At the time (3 years ago-ish), no one had figured out a way to do it with AT&T 5gig service. But for that you'd need something with SFP+ slots, and those are seriously pricey.

It’s real classy.

Reading this thread I’ve been using unifi equipment for over a decade why are people tinkering with their networks on a daily basis?

I have more issues with enterprise equipment than with unifi equipment because it just works, and it’s 1/5th of the price, and I can buy a replacement the same day. My spf modules on junipers cost more than most of the products in the entire unifi catalog and can’t support being downlinked to 1GB on one port without the whole module being set 1gb and the entire core rebooted.

The amount of hate is simply unwarranted, people are afraid to patch enterprise switches because historically that meant driving out and a call with TAC, when did we start pretending that enterprise network equipment works flawlessly?

And we have things like indeed no WiFi (all networks down) if you dare to change WiFi settings, or mdns having a hard limit of five networks because the underlying Perl script is 10 or 15 years old.

The cameras and viewports should not be writing data at all after an initial configuration if designed properly and killing power should present no problems to any system with a read-only filesystem. As someone who designs systems like these it absolutely baffles me.

OPNsense, a cheap fanless Brocade switch, and two Ruckus enterprise-grade APs from eBay and boom. Stuff Just Works, and when I want to do anything fancy (I did a /lot/ of weird network setup to troubleshoot users' WFH scenarios during COVID times) I just could.

The UPS remark is such an non sequitur. Sure, it's prudent to have one but this doesn't make the bug go away.

But yes.

https://en.wikipedia.org/wiki/Robert_Pera#Apple

https://help.ui.com/hc/en-us/articles/18930473041047-Best-Pr...

I ended up connecting everything with a wired connection and disabling WiFi. Thankfully I have cat6 to every room so it wasn't an inconvenience.

It's worked perfectly since.

https://community.ui.com/questions/U6-IW-how-to-trunk-all-5-...

It's been awhile since I used Unifi, but regardless of the label they put on their binaries, things felt like beta. That doesn't mean I had issues per se, or things I couldn't work around. But it may be missing things, almost certainly missing promised features, rough around the edges, etc.

And the HassOS you mention had to go through a lot of work from HASS team to allow for full container runtime so it gets the functionality UniFi's approach has out of the box.

Because that's how it was years ago, and then they tried to make the cloud account compulsory, and the last time I asked around it was sort of not compulsory but you still needed to create one for the initial setup and only then put your AP somehow in standalone mode.

This is just not true at all. I agree unifi can be buggy at times, and their super clean interface means they need to hide stuff all over the place, but I havent found any network configuration I couldnt do on Unifi yet.

Care to elaborate on exactly which functions standard asus routers have over Ubiquiti gear?

Maybe the later EdgeRouters are total trash, but the ERL could (and did) totally handle what you're describing.

So even though VyOS exists as the modern day Vyatta fork that is active and fully-featured, you can't really run it on the EdgeRouter hardware and since Ubiquiti stopped development, they're basically e-waste.

I still run one in a network but really shouldn't, since Ubiquiti are very rarely shipping security updates...

Got a link? I'm curious about which profile(s) and does this mean that it's still proprietary between the NVR and camera but from the NVR I can get an onvif profile compatible feed?

A neighbor has a bunch of Unifi devices and he just has his on autoupdate and never has issues. I definitely am scared to give them that much control.

I am not GP but I can provide my perspective. I currently use 5 of their switches and 2 of their APs in my house. You do not need a UI account to use the network server locally to manage the devices. I run my server on a debian 12 box.

I locally return nxdomain for several domains they try to lookup. I setup a firewall rule to log any packets from their macs trying to send anything outbound. Apart from my test packets they haven't done so. If you don't nxdomain the domains they lookup then you will see that traffic.

I have not tried the new Unifi OS Server this post is about.

The only way to approach certain stability is by removing variables and making the environment as predictable as you possibly can. Containers partially address this issue by shipping a predictable user-space environment, but that still leaves the kernel.

Other examples would include OpenMediaVault, TrueNAS, Mikrotik CHR, VyOS which are all distributed as VM appliances (or host system installs) even though technically, I'm sure all of them could be distributed as containers (and I think VyOS can be used this way, but I don't believe it's meant for production usage).

And personally I want a much thicker security boundary that VMs provide when it comes to critical services like network controllers. Of course that would require a slightly different setup to begin with, i.e. having UniFi in one VM, and having random containers in another VM which is how I prefer to run things at home (in general, I don't use UniFi products).

So everything still works as it used to.

https://www.bleepingcomputer.com/news/security/ubiquiti-user...

However a UDM pro is a router (as well as other things). The expectation is that it is connected to WAN.

Unifi switches and access points etc do not have the same online requirement.

The cameras should reassociate almost immediately after regaining a connection. It shouldn't take hours for them to try and connect again. I won't fault the camera for going down when the power dies, I will fault it for not coming back immediately after the power comes back though!

I guess if you have strict privacy requirements then you would be looking more at enterprise gear anyway.

I would not want to have to carefully optimize settings to get that third nine of uptime for a small business.

If you're not careful you can end up with the "best" path between two switches going over the sonos-to-sonos wifi.

   the one key point was that the EdgeRouters had hardware acceleration

The main problem with the EdgeRouters was that Ubiquiti was basically just assembling off the shelf stuff. They didn't have the ability to fix SoC issues (or motivate the manufacturers to fix them). For years they didn't have the ability to do much Linux dev work either so the ER families languished on an end-of-lifed'd version of Debian. That experience and realization only motivated me to avoid future Ubiquiti products.

They may get some money from me then and I'll finally have wifi 6(E?).

> Tell me about the Trunk VLAN issue with the UW6-IW

The built-in 4-port switch in the U6-IW has significant limitations when it comes to VLAN trunking. etc...

> Did Ubiquiti fix the VLAN TRUNK issue?

Based on my research, No, Ubiquiti has not fixed the fundamental trunk VLAN issue with the U6-IW's switch ports as of early 2025. etc...

EdgeRouter 3.0.0 [1] adds official wireguard support (I've been using the "wireguard-vyatta-ubnt" package from Github [2]), UI changes and some other improvements/fixes. I haven't tried it yet but will. I have an Edgerouter3-lite and an ER-X.

[1] https://community.ui.com/releases/EdgeRouter-3-0-0/33ee3852-...

[2] https://github.com/WireGuard/wireguard-vyatta-ubnt

This meant for instance if your WAN required VLAN like New Zealand you couldn't actually set it up without another router. Their fix is to add 1 more option to the WAN configuration options rather than the full suite of WAN configuration options you get once it's talked home.

The partial fix does make it clear that the philosophy of "you must talk to the mothership" is a guiding one that ubiquiti sticks to.

That's a bad expectation.

When I moved houses, I was without home broadband for almost 2 months. I bought a Cloud Fibre Gateway as everybody recommended Unifi. I intended to set my local network up, have Home Assistant running, as well as my NAS and other self-hosted apps.

Couldn't do any of that until I figured out a way to tether my phone to my OpenWRT router that the Unifi was supposed to replace, and wire them together over ethernet.

Not the final straw that made be give up on it but a truly atrocious first experience.

I use auto settings and I was stunned to see it recently. APs see each other so it's not like it's completely meaningless.

Im glad I dont emply you!

The new GUI looks nice and Wireguard is great! Not all good news sadly though, users in the comments there are pointing out that the kernel has hardly been patched from the versions two years ago... At least some packages like OpenSSH, dnsmasq etc. have had updates.

Using a pi4 for last 4 years on poe running their management docker container. So solid! I’d recommend the pi over buying their hardware device mamager, its way slower.

Here's a random example I found:

https://www.asus.com/networking-iot-servers/modem-routers/al... | https://web.archive.org/web/20250704161852/https://www.asus....

[0] It’s an endless source of fascination to me that it always seems to be non-elites that have the inside scoop on what the elites are thinking and deciding. I’d love to know where they get that insight if not from their own hyper-pattern-matching imagination.

Do you really think there is some magical network gear out there which provides easy full security, but is only available to buy for a specific group of people?

So do many smaller organisations. The market for prosumer/SOHO/SME tech is in a sorry state lately with many being pushed towards what is essentially consumer level junk with a slightly different finish on the case and a different badge.

There is an irony here in the UK that we're finally seeing widespread availability of FTTP broadband with gigabit+ speeds and the latest WiFi standards but trying to find decent routers, switches, and access points that support 10G internal networking and the full rates of the available broadband and WiFi standards is a nightmare. It's like the only conceivable options are extremely expensive "enterprise" products and consumer junk that you control with a mobile app (until it becomes unsupported at some indeterminate future date presumably) that phones home to the manufacturer's servers (until they get shut off at some indeterminate future date presumably) and only works with an account on the manufacturer's system (until it deliberately or accidentally gets disabled for any reason presumably) and possibly a subscription payment (that can increase arbitrarily in future years presumably). It seems like literally no manufacturer that has previously provided reputable mid-level equipment still trying to compete in this segment of the market any more and that is both sad and potentially dangerous.

https://www.asus.com/us/support/faq/1049415/

[0] People who are used to getting fucked by people higher up in the economic food chain are pretty used to seeing, with their own eyes, the actions "the elites" take. See, we get to live in the world they create. Whereas they get to live in a much, much nicer world, without rules or restrictions. To call the average person's lived experience "hyper-pattern-matching imagination" is just plainly being shitty.

Perhaps next time it would be more useful to point out exactly who you’re referring to in a given discussion rather than lazily refer to “the elites”.

I’ll also add that in my view, most of what seems like the concerted actions of a global conspiracy is merely the result of very simple human heuristics. Mostly functions of greed (for money, power, or both). Just like the amazing structure in fractals arises from very simple math, so too the workings of our politics and economies through simple human heuristics played out at scale.