Speaker A
Now, we're in 2026 and we have a new network release. I feel like it's time for me to do a deep dive from start to finish on getting your UniFi network set up. Now, this might be a slightly longer
Full start-to-finish UniFi network setup for 2026: factory reset, console setup via mobile app, WAN/static IP and DNS config, backups, VLANs, firewall rules, and guest access.
Key Takeaways
- A UniFi network can be set up end to end from factory reset through WAN, VLANs, firewall, and Wi-Fi
- Segmenting networks into trusted, untrusted, and IoT zones improves security
- Regular automatic backups of the controller are essential
- Firewall rules should be as restrictive as possible when opening ports
What the video covers
- Factory reset and initial setup of a UniFi console (UDM Pro Max) using the mobile app over Bluetooth, including naming and optional analytics
- Logging into UniFi OS at the default gateway address, enabling 2FA and dark mode
- Configuring WAN connections, including a static IP with VLAN tagging on one ISP line
- Setting primary and secondary DNS servers (Cloudflare 1.1.1.1 and Google 8.8.8.8) for IPv4 and IPv6
- Setting up control plane backups, with automatic weekly backups recommended
- Explaining spanning tree (STP) priorities in increments of 4096
- Creating separate networks and VLANs for management, trusted devices, and IoT/untrusted devices
- Configuring Wi-Fi channels, selecting less congested channels on 2.4GHz and 5GHz bands
- Port profiles for IoT devices, including blocking PoE, storm control, and port isolation
- Firewall rule configuration, restricting port access and tightening rules for specific services
Chapters
Full Transcript — Download SRT & Markdown
Speaker A
video, but I've broken it down into timestamps down below so you can choose the relevant sections that are for you.
Speaker A
So, the first thing I'm going to do is go to my console and I'm going to factory reset it. And what that's going to do is it's going to wipe all the settings. And let's start from the beginning. If you want to see how to
Speaker A
plug everything in, I have another video that I'll link down in the description below because I did this a little while ago and it doesn't hasn't really changed since then. So, we're first going to start by setting up the UniFi console.
Speaker A
So, it's plugged in. You've plugged your network cable into it. There's two different ways you can do it. You can do it via your computer, which you can see I'll show you right here. You type in UniFi and it loads up the UDM Pro Max
Speaker A
setup page or you can do it via your mobile app, which is probably the easiest way to do it. So, we can go we'll start by going here and we'll click setup. So it automatically finds it. We automatically click set up and
Speaker A
it's going to try and connect to it. So you need to be within the vicinity of the UDM cuz it connects via Bluetooth.
Speaker A
So you can see as I'm connecting now, it connects straight away. So we can give it a name. So this one I'm going to call home. You can send some analytics if you want. You can click next. If you want to
Speaker A
restore from a backup at that point, you can do it right there, but I chose not to. And it's givingven you a rough estimate in terms of what speed you are getting. So I have two internet lines set up. One of them has DHCP, one of
Speaker A
them is a static IP address. So, it's picked up the DHCP1 straight away and it's showing me as an internet connection. You can see there it's showing your latency, where your location is, your IP address, and then the call quality enhancements if you
Speaker A
wish for that to happen. So, that will be down to QoS, which we'll cover again later on in this video. We'll click next. It's checking for any new firmware and getting set up, and it's preparing your UniFi OS console. So, once it's
Speaker A
done this, we can then log into the computer where we're going to start doing some more changes and settings. A big thank you to today's sponsor, MS Dist, a name you can trust in networking since 2002. In fact, they were the first
Speaker A
to bring ubiquity to the UK back in 2008, setting a high standard for quality networking gear. MSDS makes it easy to find exactly what you need without the hassle. Offering a carefully selected range of wireless networking and security products, they offer
Speaker A
competitive prices and special pricing for their trade customers. Need help picking the right gear? Their team of experienced networking pros are always on hand to offer help, advice, and technical support. And when you order before 4:30 p.m., they've got your back
Speaker A
with fast, reliable next day shipping across most of the UK. With a strong focus on customer satisfaction, MSDS has built a reputation for quality products, quick delivery, and top-notch service.
Speaker A
Whether you're upgrading your home setup or rolling out a business network, they have got you covered. Check out the pinned comment and the description for your latest promo code for MS Dist.
Speaker A
Check them out today and see why so many people trust MS Dist for their networking needs. Once the UniFi console is all set up and finished, you can then go ahead to your computer. As you've plugged it into your UDM Pro or your
Speaker A
gateway, whatever you're using, we can now log in to UniFi OS. So 192.1681.1 is the default IP address that comes out of box as soon as you get it set up. So, you can type in your email address and
Speaker A
your password or your user account and password if that's what you've set up. And then we can click sign in. I already have authenticator enabled on my account. So, I'm just going to quickly go and authenticate. And the first thing
Speaker A
you ever want to do as soon as you go into the UniFi console is click this button in the top right hand corner and change it to dark mode. So, hopefully that's a little bit easier on your eyes
Speaker A
as you are watching. Now, this is the overall dashboard. You'll see I have devices plugged in. So, you'll see them popping up on the right hand side. We have a WAN one, WAN 2 setup. We have all the gateway information down here. what
Speaker A
devices are plugged in, what's happening, top clients, etc., etc. But again, we'll cover that in just a moment. The first thing you're going to want to get set up is making sure your WAN settings are correct. Now, to start
Speaker A
that, we go to settings, and we can go to internet. And you can see we have a couple of ISPs here. So, WAN one's not set up cuz I don't have the static IP details in there, but it does have
Speaker A
everything set up down here. So, the first thing we're going to do, we're going to click on Internet 1. I know that I need to set this up manually, and it has a VLAN ID of 911. My current ISP
Speaker A
is Oolo, so you can go and check out olo.co.uk if you want to have a look at their internet package. Everything else stays the same, but I do have a static IP address. So, I'm going to pop in my
Speaker A
static IP address. So, we'll pop in our main IP address, which is what's given to you by your ISP. This is what I have.
Speaker A
I'm blurring out obviously because I don't want you to be able to see it, but you can fill in all your details down here, and that will get everything set up. And because I have multiple static IPs, I can get this set up as well. We
Speaker A
have that configured. Now, this is where you would set up a primary DNS server.
Speaker A
So, if you're using an external DNS server or you're hosting an additional DNS service within your network, you could get this set up right here. For me, I'm just going to use 1.1.1.1 for now. And then my secondary is going to
Speaker A
be 8.8.8.8. So, for those of you that don't know, so 1.1.1 is Cloudflare's DNS service and 8.8.8.8 is Google's DNS service. I do also have a static IPv6 address. Again, alo give you all the flexibility you need with your package.
Speaker A
So go and check that out if you want to have a look at what they're giving you for the IPv6 DNS servers. So I'm going to just do DNS IPv6 Cloudflare and that gives me the Cloudflare DNS address which is right
Speaker A
there. And then if I do Google then I can get Google's DNS as well. I'm using Cloudflare and Google DNS for my IPv6 addresses as well. So we can apply those changes and you can see they've just hit
Speaker A
there and we'll see that turn green in just a moment. And there you go. You can see that's now turned green, which is it took about 30 to 45 seconds, maybe even 60 seconds, but that's done. If you're
Speaker A
running a serious home network, a home lab, or even servers at home, then you'll know not all ISPs are created equally. A Lilo is a UK-based ISP that are built for techsavvy users like you and me. People who actually care about
Speaker A
things like static IP, proper IPv6 addresses, no CGNA, and being able to bring their own hardware. They offer full fiber and multi- gigabit broadband with plans going all the way up to multi- gigabit speeds, even 5 Gbits, which is coming soon. And it's designed
Speaker A
perfectly to set up with your ubiquitous setup or even any home labs or servers that you have hosting services. What I do like about Alillo is they don't try and lock you into their own hardware or dumb things down. You get control,
Speaker A
flexibility, and transparency. So, if you're tired of fighting with your ISP for basic things like static IP addresses or just want no CGNA and want a connection that actually works with your network, check out Alo using the link down in the description to see if
Speaker A
they're available in your area. And a big shout out to Alillo for sponsoring this segment in this video. Now, you have all these configuration settings that you can set on your UDM Pro Max.
Speaker A
So, you can have as many as you require. On here, we have a whole bunch of unassigned items. So, we have one one and one two. So, if you want to change any of these ports for another WAN
Speaker A
setting, you can do. If you want to add additional WANs, there's this right here. So, if you have multiple and you can choose a port. For example, if I wanted to choose port six, I could click apply and we'll give this a WAN 3 name.
Speaker A
So, if I had multiple WAN addresses and then you can see that now has WAN 3 as an option. So, you can switch that around. So, if you wanted to add in more WANs, you can do. For now, I don't need
Speaker A
it. So, I'm just going to change it to unassigned and leave it as that. We can see WAN one and WAN two is set down here. I have my desktop that I'm using right here plugged into port 8. and then
Speaker A
my SFP going to my aggregation switch. Just further down below, you have two different options when it comes to your WAN mode. You can use failover or load balancing. So, because I have two different WAN settings, you can load
Speaker A
balance between the two if that's what you wanted. And you can set a percentage down here in terms of the waiting. And if you want to switch between three WANs, you can do. And also, you just have a failover. So, then you have your
Speaker A
primary, your first failover, and your second failover. For now, I don't need the third WAN. So, I'm just going to go to manage and remove that just to make sure that doesn't have a third WAN as an option. So, this is currently showing
Speaker A
WAN 2 as my primary and WAN one as backup, but that's not the way I want it. I want my WAN one as my primary and my WAN two as my backup. So, it is literally just a drag and drop and that
Speaker A
basically then changes that. And you can click apply. It's going to refresh. It will refresh your system and then you go again. The other couple of things worth highlighting is there's a create a new SLA. So if you want to set up certain
Speaker A
verifications or certain thresholds before your WAN fails over, this is how you would set it up. So you would give it a name, give it a condition, and then you can have a bunch of different verification servers. And the SLA
Speaker A
targets are as follows. You can use packet loss, you can use latency, you can use jitter. So you can use a combination of all three of these or you can use a single one if that's what you want. There's a threshold condition and
Speaker A
you can add multiple verification servers. So just in case for example you running a ping to Cloudflare.
Speaker A
Cloudflare's IP wasn't reachable for example then you could use another verification server just to make sure whether your internet connection is down. This is something you can configure as much or as little as you need. For me for my use case I'm happy
Speaker A
to use the default that's out of box which is just auto. Then we scroll a little bit further down. We have flow control. So this reduces network traffic. So flow control isn't something probably a lot of people are going to be
Speaker A
playing around with but generally we leave this unticked. And then we have the automatic speed test. So, if you want automatically speed tests happening on your network to make sure that you are getting the speeds that you should
Speaker A
be getting, you can go and set them up and you can choose when you want them to run daily, weekly, monthly. So, I'm happy to run mine at 1:00 a.m. on a daily basis. The next thing you want to
Speaker A
set up before you start deep diving into your networks is going to be the actual UniFi OS system and everything you're going to have configured within it. And there's two different places that you can have this set up. So, first we need
Speaker A
to go to system. And there's a few different things in here we'll take a look at. So, we can click country or region, what language you want it in, the time format, the NTP server. So, if you want something custom, you can use
Speaker A
that. Um, or you can just use auto, which is what I'm using for now. We have the side panel tabs, which is just a navigation setting within. So, you can choose to tick that if that's what you want. And if you're a professional
Speaker A
installer, what that allows you to do is change advanced settings such as antenna gain and stuff like that. So, that's not anything that's probably going to be within the scope of this video, but if you are, you can go and tick that. And
Speaker A
then we have email services. So if you're using your own SMTP relay or you want to use your own SSO or you want to use your own custom email server, you can do that just via here. But for now,
Speaker A
I'm leaving SSO email as it is and all the emails will come from Ubiquiti server. And then the next part is going into control plane. So control plane is pretty much where most of the settings are within the console itself. So we
Speaker A
have this initial page right here where we have the updates. So we're running version 5.0.10 on official and we're running 10.1.6. 68. So these are the two that we have set up. Now within them you have a few different options. You can
Speaker A
choose to click auto update. I personally like to control my updates. Some people like to automatically have them updated and you can say when that is going to happen. So I'm going to leave that off. And we also have the
Speaker A
same with the other applications. So you can choose a release channel if that's what you're after. So official is probably the best one to stay on. If you are wanting to test, you can use release candidate. And if you want to be part of
Speaker A
the early access program, there's a link on Ubiquiti's website where you can sign up to the early access program. Again, I don't want this auto updating. So that's that one. And then there's a final one which is device updates. So we'll come
Speaker A
back to that one shortly, but that takes you to the device pages. And then you can choose what sort of device updates you want, whether you want the early release channels for them, whether you want device auto updating, and when you
Speaker A
want them to be auto updated. So daily at 3:00 a.m. is perfectly fine for me.
Speaker A
Then we have an advanced section. Where's the device update schedule and there's no updates to cache. So I haven't adopted anything as you can see right there. We'll we'll come to that in a few moments. And then if you want to
Speaker A
set up SSH on your UDM Pro Max, you can do that. So you can set up device SSH authentication. It gives you a username and password. You can change this if you want. And your SSH keys can be set right
Speaker A
here. So let's go back to settings and we go back to control plane. And then we have the backups option. Now most probably the most crucial part of any network is the backup. So this currently does it auto at a weekly basis. So it
Speaker A
backs up every week. So you can click back up now if that's what you want. Or if you want to download or restore the backups, you can see from here. So download allows you to back up all the
Speaker A
applications and settings. And restore allows you to select an application. If you want to restore a specific application, you can do uh we'll cover this in a little bit more detail in a later section. Storage. There's no drives I've currently plugged into here
Speaker A
at the moment, but I will as soon as I get UniFi Protect set up. And then we have the console settings. With this, we have the site gateway. So, we have shadow mode. Again, I feel like I've said this a few times, but go down to
Speaker A
the chapters and we'll cover shadow mode in a later section. You can use the timestamps for that if that's what you want to see. We have the time zone, we have the screen brightness, we have the email services, we have analytics and
Speaker A
improvements, support files. So, if Ubiquity ever requests a support file, you can choose to download something.
Speaker A
You can download the full support file or you can select a specific device or application. You can add certificates here if you need remote access enabled.
Speaker A
So if you want to be able to access this through unifi.ui.com, you can do that.
Speaker A
And then we have the direct remote connection. If you want to set up incoming traffic through port 443 to be able to access this, you can set that up also as well. We have SSH if you want to
Speaker A
configure that. And then we have the controls down here. So restart, shutdown, transfer ownership if you're setting this up and giving it to someone else. Re factory reset about this console and compliance. Finally, we have push notifications. is again another
Speaker A
thing we will cover in a later topic around alarm manager and push notifications. So if you want to know what's happening there's some set features on here where you can either get a push notification or email or both. This is just for the console and
Speaker A
control plane. All the other applications have their own. So shadow mode events updates so if there was updates any admin activity or any backups or downloaded or created. So again all these can be done via email or they can be done via push notifications.
Speaker A
You can configure them how you see fit. And just to confirm how to configure them, you just click on it and it goes blue. You click on it and it goes blue.
Speaker A
But if you don't want it, you can just turn it off. So you can see we have a whole bunch of devices here. But for me, there's one change I want to make just before we get all the devices adopted.
Speaker A
Now, if we go to settings and then to networks, you can see we have our default network set up here and it's using a 192.168.0/24 network. Now, this is optional. You don't have to change this if you don't
Speaker A
want to. It's entirely up to you. But for me, I like to change my default network to 1011/24.
Speaker A
We'll leave this as it is in terms of the auto internet source IP net. So what that basically does, it takes your internal address, does an NAT, so network address translation, and then lets you go out to the internet. You can
Speaker A
set this up manually if you want. So I'm not going to go through all the settings. I'm just going to leave them as it is. When I go through to the network section, I will then go through this and explain everything that I am
Speaker A
doing within. So for now, I'm just going to click apply this. And now what I'm going to have to do is basically reboot everything in my network so it picks up a new DHCP address. Now because my computer is plugged in and it did have a
Speaker A
192.1681.x address. I'm going to go to the command prompt. So I go start type in cmd and open that up. And then type in IP config/renew that you can see right there. That's going to pick up a new IP
Speaker A
address. And we can see I now have a 1011224 address. So I can then go to here, type in 101111 or I can go to unifi.ui.com however I want to go through to it. I think just for now for ease of use I'm
Speaker A
just going to connect to this directly to make sure I can get access to this if the internet goes down. So we just do the authentication and then we're back in. And because it's a new IP address, let's change the settings. So let's
Speaker A
change it back to dark mode. And then if we go to UniFi network devices, which we can see here has now picked up all the new IP address, which is perfect.
Speaker A
exactly what we need. So what we're going to do, we're going to start by adopting these one by one. Now the easiest way to do this is literally to start with the way your network is. So we have the gateway which is set up. We
Speaker A
now have the aggregation switch which is underneath. So we'll go and adopt that and we'll give that a moment. While that adopts, we then have our three switches which is one two three and the flex outdoor. So four. So all of these are
Speaker A
getting adopted one by one. We're getting them all ready. And then we have one access point. We also have a 5G outdoor max. And the last one we want to do is the 2U UPS. So literally, you can
Speaker A
just go through them all and just click adopt uh one by one. Some of them will have updates, some of them might not. As you can see, there are some that are waiting to do an update. So it's
Speaker A
entirely up to you how you wish to update them, but I generally go in reverse order. So I would go with the things at the bottom of my list. So it would be things like the access points of things connected to the switches. And
Speaker A
then I go to the switches themselves. And then I go to the aggregation switch.
Speaker A
And now we have an access point. We also now have the UDB switch that showed up as well. So quickly show you that we'll get that adopted. So everything's up to date. So we can take a look at the
Speaker A
topology here. And you can see what that looks like. So we have the UDM Pro at the top. We have the USW aggregation which is SAT which all the other switches are connected into. I say all the other switches. is just two of the
Speaker A
switches and my NAS that's connected into there at the moment. We have the Flex which is plugged into the 24 Pro HD. I do need to move that to the aggregation. And then we have the 10 port which is on the desk next to me.
Speaker A
Again, another one I need to move to the aggregation. But for now, this is how my topology is set up. The Pro XGS and the Pro XG is set are going into each of the individual switches. And then we have
Speaker A
the UDB and the 5G Max outdoor connected there as well. Now, you'll see this little highlight at the top here saying multiple switches have the same STP priority. There's a link that you can click on which shows you about setting
Speaker A
STP priorities. This is just spanning tree. So what it basically says in a nutshell is you start at zero then the next layer you go to 4,96 then 8,192 and etc etc. You just keep going up in increments of 4,096.
Speaker A
So to do that you go to the aggregation switch you click on the settings and the priority we can set to zero and that's applied and you can see that priority zero. And then we go to the next set of
Speaker A
switches and we go to settings. Scroll down to the bottom. We'll change that to 4,96 as that's the next layer. And because this is set at another layer underneath, we're going to click on the flex right here. Go to settings and then
Speaker A
we're going to set this to 8,192. Same with the Pro XG8. Now, if you had more layers, you would continue going down the tree to set your STP priorities. But for me, this is what I have set up at the moment. when I move
Speaker A
my two switches up to my aggregation switch, then we'll change the priorities back to 4,96 because it's on that level.
Speaker A
So, we have the devices adopted. Next thing you probably want to think about doing is setting some static IP addresses. Now, if you come across any issues in terms of adoption, I'll leave a link down to this in the description
Speaker A
below, but the article is up here. The easiest way to adopt the devices is through the mobile app, but I've shown you also on here. It's just a click button. So, there are some other adoption scenarios just down here. if
Speaker A
you're in the same VLAN, different VLAN, different site, it gives you all the different options in terms of how to get that set up and connected. So, one thing I'm going to quickly do, again, I know I said I wouldn't go too much back into
Speaker A
here, but I'm going to look at DHCP reservations. So, we have a DHCP server down here, and this is the start and the end range. If you see the start and the end range is grayed out, we need to
Speaker A
untick autoscale network size. Apply that, and then we can go down, and we can allow this through. So what I generally do for this specific subnet range, I'll leave the first 50 sort of IP addresses and I'll start from 50 as
Speaker A
that will allow me a chance to set up a static IP address. So we can click apply just there. So the DHCP range that's giving out IP addresses will never go outside of the 50 to 254 range and we
Speaker A
can keep that there. So what that allows me to do is then go back to the devices one by one and we can start giving them a static IP. So we have this which is the aggregation switch which I'm going
Speaker A
to set at.2 two. We can keep everything else the same. So, the gateway, the DNS, subnet mask, and the gateway itself.
Speaker A
Then we can go to the Pro HD model. Click on settings. We can scroll down to the bottom. We can click on static again. And then we're going to change this one to three. Click apply. And then we're going to do the same with the rest
Speaker A
of the devices. So, now I'm going to show you how to set up all your individual networks. Now, the best way to set up your networks, and you've probably seen multiple videos that have told you about this, is to separate your
Speaker A
networks. So you can then lock down communication in between. So you can make this as complex or as simple as you want, but just keep in mind the more networks you have, the more rules you may need to create and the more issues
Speaker A
you may face in the future. Now if this is a home setup, sometimes you might be a bit more lenient with your rules, whereas with a business setup, you may be a little bit more strict. So let's take a look at everything we need to
Speaker A
know about this. So we go to settings and then we go to networks. So we're going to take a look at some of these settings down here. And the first thing I'm going to show you is the default
Speaker A
security posture. And what that basically does if we highlight over this is this will apply to all segments of the network including zones, VLANs, interfaces unless specifically overridden by custom rules. Now previously with UniFi network you used to be able to just talk between VLANs
Speaker A
and you had to create a rule to block traffic within all the VLANs. Now this does this out of box for you. So you can go and click block all and it says new VLANs created with Ethernet port
Speaker A
profiles devices will be isolated by default while the existing ones remain unchanged. So if you had some already there, it won't change them automatically. You would have to recreate them. But because we're setting this up at the start, everything that we
Speaker A
create is going to automatically be blocked between the networks. So we will have to allow them. And we'll show you how we go through that in a few moments.
Speaker A
We have the gateway mDNS proxy. And what this does is it forwards requests across VLANs to enable service discovery between networks. This is going to come crucial when we start setting up printing or AirPlay or stuff like that.
Speaker A
So we'll again come back to that in a few moments. We'll leave it as auto for now. But if you find that there's a lot, you may want to look at changing it to custom. We have IGMP snooping if you
Speaker A
want to set that up. L3 network isolation using ales if that's again something you want to set up. And device isolation as well. You can set that up.
Speaker A
We have radius servers, spanning trees, and rogue DHCP detection. If you want to set up Ethernet port profiles, you can do that here. 802.1x controls if again something you want to set up. And then jumbo frames as well. The first thing
Speaker A
I'm going to do is go to the default network. We're going to name this management as that's what I want this network to call. It's going to go into our internal zone. The auto internet source IP net basically translates your
Speaker A
address so you can go out to the internet. Autoscale network. I always untick this. This is not something I leave on as default unless there's a specific use case for it. But what that basically does is once your addresses
Speaker A
are used up, it then expands your network and expands your network. And you can see if you leave it on auto, this could go wrong quite quickly. So entirely up to you if that's what you want to do. the address space, any
Speaker A
additional IPs. So any additional IPs assigned to this VLAN, only the primary gateway IPs used by the DHCP server. If you want to add in additional IPs that you want to be able to get to, you can pop that here. You can block internet
Speaker A
access by default on the VLAN. So you can go and put that there. MP snooping again, MDNS, and then you have your DHCP range. So this is something I set up earlier. Again, I removed some IP addresses so I can keep some sort of a
Speaker A
range for static IPs. We have the auto default gateway. So, we can either specify a default gateway or we can make it auto. Same again with the DNS server.
Speaker A
This just basically uses what's set by the gateway itself. We have the lease time, which is 86,400 seconds in terms of how long the DHCP leases before it comes back to renew again. Then, we have a whole bunch of other settings down
Speaker A
here if that's what you want to use for your setup. We'll come back to IPv6 in just a few moments. For now, I'm going to apply those changes and I'm going to create a bunch of different networks. So
Speaker A
for management, I recommend keeping all your Ubiquiti devices on that network. We can then create a new one, which I'm just going to call as I'm just going to call this as my surname. We're going to keep it home. Again, use the internal
Speaker A
zone. We're going to turn off the autoscaling. We're going to call this 1010.10.1/24. If we scroll down here, I'm going to give this VLAN 10. And then we'll change this to manual. So, do you want additional IPs? Now, you'll see straight
Speaker A
away down here, we have isolate network. So isolating this network from other virtual networks using firewall rules in the unified gateway. Devices on this network are able to communicate with each other but not across the networks unless we allow the firewall rules for
Speaker A
this. We'll keep on mns proxy again. I'll allow myself some space for a static IP range. Probably don't need it as much on this one. So maybe I can go with a 20 for example. And then we have
Speaker A
all the other settings within. So create. So I'm going to quickly run through and create all my networks. So I'm just starting with my guest network and just to show you giving it a guest name. We're still using the router as
Speaker A
home and then we're setting this one up in the hotspot network. Now this zone is used for guest or untrusted networks that can have restricted access. If you want a landing page then you need to enable hotspot in the settings which
Speaker A
again we'll talk about a little bit later. We'll give this an IP uh VLAN ID.
Speaker A
Now automatically because I've unticked isolate network cuz previously it was ticked. I had to untick it because it's moving into a different zone. So, we'll keep that there. We allow the internet access. We'll keep MDNS as it is for the
Speaker A
time being. And then we'll click apply. Then the one that I'm sure a lot of you will be waiting for is the IoT network.
Speaker A
So, something like this. Again, we'll set it up as as we want. So, we'll keep it in the internal zone. We'll talk about zoning in just a few moments. So, I'm making things in the internal zone for the time being. We'll turn off the
Speaker A
autoscaling again. We'll go 10.1040.1 VLAN 40. Again, we'll isolate the network. We'll keep this as it is. This one we'll change to 50 because we might have some more static IP addresses on here. We'll create a couple more VLANs.
Speaker A
So we'll go with CCTV. We'll create another one called kids. So we'll keep that as VLAN 50. We'll click manual. The isolate network is still there. Okay. So that is all the networks that I need created. So you can create as many as
Speaker A
you want or as many as you need, but this is what I am setting up for now. So we have our network set up now and all the VLANs are created how we want them to be created. We have all the VLANs
Speaker A
blocking each other which is fine. We will go into a bit more detail in the networks as we start doing the firewall configurations for each network and we'll go through one by one and we'll show you exactly what we're doing in
Speaker A
each of them. Once we've done that, we want to create our Wi-Fi networks. Now, this is where it gets a bit more interesting because it's not just a case of creating an SSID and a password and leaving it. We're going to talk about
Speaker A
the channel. We're going to talk about the channel banding and width. I have already created one here already that you'll see. It's just for the purposes as I needed to get this set up straight away, but um we'll talk about that again
Speaker A
in a few moments. So, at the top is where you see the SSIDs. So, this is where they're created. We have channel plan just down here, which we'll come back to in a second. We have a bunch of
Speaker A
different settings down here. So, we have default Wi-Fi speeds. So, this sets the default radio settings for every new P, but it won't automatically apply to your current ones. So, if you want maximum speed, it will set this
Speaker A
accordingly. and then if you want conservative and then or if you want to make something custom, it's entirely up to you. Channel AI is a new feature that you can use within here. And what that does is it scans everything around and
Speaker A
sets the best radio frequencies for you. Then we have the 5 GHz roaming assistant. So this encourages devices with weaker signal strength to roam and find another AP. So we can set a threshold right there. Wireless meshing, which means if the network connectivity
Speaker A
dies between the access point and your switch, for example, it will mesh it to another network. So it will allow that mesh monitoring. So what monitors the mesh? Do you want a custom IP or the gateway? Unifi auto uplink. This is when
Speaker A
wireless cameras and IoT devices will associate automatically in order to streamline the adoption process. So they'll automatically connect to a UniFi wireless access point, Wi-Fi man support, and then default speed limits.
Speaker A
So when we have a little look at the channel plan, we have three different areas. We have the 2.4, we have the five and the 6 GHz. Green is what's currently being used. We have orange which is not
Speaker A
available in my region. So where I am, these frequencies are not available at this point. And then we have the gray ones which are enabled. We also have some striped ones just here which are all the DFS channels. So keep that one
Speaker A
in mind if you're near an airport or any radar scanners. They do take priority.
Speaker A
So your network will drop if those scanners are in use. So your Wi-Fi connectivity for the 5 GHz spectrum will temporarily go up and down while the scanning is happening in those areas. So just keep that one in mind. You've got
Speaker A
spectrums either side that you can probably use. So when you're starting to choose your channel selections, the best place for you to go is to go to air view and then we'll have radios just up here and then we have the channel AI view and
Speaker A
this shows you which ones are currently active and you can choose for all four spectrums and click optimize. So I'll show you what that looks like. So we click optimize. There's no improvements to apply but your channel is already
Speaker A
optimal. Same with the 5 GHz and you can do the same with the 6 GHz as well. We then have the airtime view. This is probably another one for another video.
Speaker A
We won't go too much into this. And then we have the environment. Now, if you have a U7 Pro XGS or an E7, one of the higherend access points, you can use something called the spectrum analyzer, which is using the dedicated radio
Speaker A
inside the U7 Pro XGS to do a real-time scan to see what's going on. So, we can see that what's going on here. So, this AP is sat in this channel, and you can see how busy it is. And you can see,
Speaker A
there you go. You can see the waveforms going up and down to see where the traffic is. and it shows you just up here where most of the traffic is happening. So that's the 2.4. Then we move to the five. We can see the five is
Speaker A
relatively clear, which is great. And then we have the 6 GHz, which we expect to be clear anyway. You also have the option to do an airtime scan, which we can pop just up here. So if we do a full
Speaker A
scan, so once you do a scan on those networks, you can see it's telling you what the utilization is like on those networks. So it gives you a rough idea how utilized they are. So it's relatively quiet in my area. So
Speaker A
definitely the the frequency up here which is channel one and two is good and something in the later frequencies which is which is 11 12 and 13 those sorts of channels are good to use and we can do
Speaker A
that with each of them. So it's done the scan we can see 5 GHz relatively clear this looks great and we do the same with 6 GHz. So for me where I am I have the option to pick whatever I need. Uh for
Speaker A
you in certain areas you may see some other ones that have slightly more utilization than the others. In that case, then you want to pick the ones that have less utilization. Along the channels, you can see we have width.
Speaker A
Width basically doubles the size of the channel as you go higher and higher. It allows more to go through, giving you a bigger throughput. When you widen the width, you may see other impacts happening on your wireless network. So,
Speaker A
choose it moderately and see what works best for you. You can start at 320 MHz if you want. And if you find your 6 GHz is not stable, drop back to 160. It could be because of the interference in
Speaker A
the area. It just really depends on how clear it is. For me, it's relatively clear. So, I can pick the big 320 MHz in terms of the spectrum. For six, I can pick the 160 or even 240 for five. I
Speaker A
also need to remember about the DFS channels as well. And then the 2.4, I could pick 40, but this is mainly going to be my IoT devices. I'm happy with the 20 MHz width. So, to set those up, we
Speaker A
can go across to the access point, pick what you need, go to settings, and then I can have a look here. So, I can set this as channel one, for example. I can see right here what these are actually
Speaker A
already set at. So I can set that to channel 11 and keep that there. Transmit power depending on how far you want this to use. Generally I stick to the medium in terms of transmit power. I have a
Speaker A
full video on optimizing your access point. I'll drop that down in the description below as well. So you can check that out if that's what you want to try and do. In terms of the 5 GHz channel, what do we have? So we have we
Speaker A
can choose the 160 width and we will go with the 40 MHz channel. And then again we'll have the transmit power of medium.
Speaker A
If you want roaming assistant, you can go ahead and tick that and set the threshold. That just encourages it. And then minimum RSSI, which again is a minimum threshold before it kicks it off the network and says go and find
Speaker A
somewhere else. Uh for 6 GHz, we'll go with 320. We'll choose channel 5 for now. Again, transmit power medium. We have the minimum RSSI settings on that as well. And then we have the mesh settings. So what this does is if you
Speaker A
want to enable, so this AP will be available to mesh down link child AP.
Speaker A
So, if you have something below that you want to connect to this, you can do. And then you have mesh connect. Mesh connect is basically you are the child and you're looking for a parent to connect to. I'm going to leave it as mesh parent
Speaker A
for the time being because I don't need it to be a child. We have some of the other settings down here too. So, we'll do the same on the XGS. We'll choose the medium. We'll go with channel one on
Speaker A
this one. Uh we'll choose the 160. And then we'll go with the other end of the frequency. So, we'll go with channel 120. We'll proceed again medium. And then we'll do 320 for the 6 GHz. Again, going with the other side of the
Speaker A
spectrum. Now, keep in mind when you do something like this, when you do change these settings, it does reset your access point in terms it will reprovision the settings within your access point. So, you may lose connectivity for a few moments. Okay.
Speaker A
So, back to the Wi-Fi settings then. So, we know now our Wi-Fi is now optimized, ready for us to set this up. So, let's go through and create some Wi-Fi networks. We can choose the name of the network and then the password for the
Speaker A
network. And this one we're going to put on the specific VLAN that we want. We can broadcast it to specific APs or group APs if you want. I want it to go to all of them, so that's no problem.
Speaker A
There we have a standard network. We have a hotspot if you want a captive portal or do a pass point. And we have the IoT network that basically only allows the 2.4 GHz band to be broadcasted. So, but again, we don't
Speaker A
want that. So, we're just going to go with standard. In terms of the multiccast filtering, we'll keep that as it is. We want the 2.4,5 and 6 GHz.
Speaker A
We're going to turn MLO off for the time being. And if you want some Wi-Fi speed limits, you can set them on here as well. In terms of the encryption settings, you can do WPA2, WPA3. If you can stick to just WPA3, go for it. But
Speaker A
keep in mind, there are some legacy devices that may not be compatible with WPA3. So therefore, using this mix gives me the best option. When I create my IoT network, I can select my IoT just there.
Speaker A
And this I'm going to specify for Wi-Fi optimization to be IoT. And what that basically does is it only broadcasts the 2.4 GHz as I mentioned earlier. And everything else we can keep as it is. It keeps the encryption type also as WPA2.
Speaker A
So we can go and create that. So we have our third network, fourth network. And those are the Wi-Fi networks I need set up for the time being. So at this point we have our Wi-Fi network set up. We
Speaker A
have the network itself set up. Now we start getting into the more interesting part of it. So we start looking at the firewalls. We've segmented our networks.
Speaker A
We've blocked everything in between that can go around and now we start looking at how we set up our firewall and our zones. Now this is something that can be talked to for a very long time because you can choose how complex or how simple
Speaker A
you wish to make this. So let's look at some of the definitions on here at the moment. So you can see these are the networks that we've set up so far. We have internal, external, gateway, VPN, hotspot, and DMZ. VPN is quite
Speaker A
straightforward. That will be your connections in and your sight to-sightVPNs. We have a DMZ which is your public servers. So anything that is internet facing, anything that's going to be coming in inbound you generally put inside the DMZ. You have your
Speaker A
external which is your internet connection. We have a gateway which is your UDM pro or any other gateway that you might be using. And then we have your internal where you have all your resources, your default network, your
Speaker A
identity users. So everybody else that's in and then your guests which sit inside the hotspot zone. So already you've got 1 2 3 4 5 six different zones that you're already dealing with. Now you can create as many zones as you might feel
Speaker A
necessary. Whether you're setting up something for a large enterprise where you need multiple zones or you need a few zones for your small business or even something that you're setting up at home. For me, the way I see this or the
Speaker A
way I'm going to be setting this up at the moment and you might see different opinions based on whoever's videos you are watching. For me, your internal zone will have all your devices along with your trusted devices per se. So that
Speaker A
would be like my computer or NAS drive or something like that that's in that internal trusted zone. And then you would have a secondary zone which would be probably what we would call an untrusted zone. So what I'm going to do
Speaker A
is this is an internal zone but it's untrusted, right? So and we can choose the networks that we want to put in there. So definitely we want to put our IoT in there and definitely we want to put our CCTV in there. So those we know
Speaker A
the cameras we can block internet access to them. So if we don't need internet access to them or if you're using third party cameras and you don't want them to have access to the internet, we can do that by this. So we can go and click
Speaker A
save there. So it does mention a little warning box at the bottom. It says move networks to zones. Please proceed with caution and view the policies applied to this zone to ensure traffic from devices not accidentally blocked. We know I'm
Speaker A
happy with that. So there you go. You've got your internal untrusted zone. Now if you want to separate this out, if you want to keep your management network where your ubiquity devices are completely separate in terms of zones as
Speaker A
well, you can do. But the way I see this is even in your internal zones, you can block traffic between networks. You can block management to your servers, block management to your kids network or whatever it is, you can block traffic in
Speaker A
between very easily. So for the sake of this example, I'm going to leave this as this is right here. But you can see now if I scroll down, we have our new internal untrusted network. So if our source is internal untrusted, it's block
Speaker A
all traffic to the internal network. Allow external, allow gateway access, block. So it's basically blocked everywhere else apart from external and gateway access. Now for me at the moment, that's going to be my IoT network and my CCTV devices. Now just to
Speaker A
show you at the moment what I have in terms of my IP address. So I had 1011224. So I'm actually on the management network at the moment, but I have my MAC behind me which I have set up on the IoT network for example. So I
Speaker A
have ping 10 10 1040.190 is the IP of that and you see I can't reach that but if I try the gateway you can see I can get to the gateway and the reason that works is because we have the
Speaker A
internal going to gateway is allowed. So just keep that one in mind. So when you're thinking of the default gateway it actually sits in the gateway column.
Speaker A
Don't think it sits in the internal untrusted network where you think it might be. If I tried to ping the MAC again you could see didn't go through because that's sat in the internal untrusted. But this is set in the
Speaker A
gateway. So let me just show you how this might work. So block ping to gateway. So I'm going from my internal network which is the management network and then we're going to block. Then we're going to the gateway. We're going
Speaker A
to specify the IP. So 1010.40.1. We can add that one. And whatever we want to block, whether we want to block IP versions, protocols, connection states, we can sis log it. So what I'm actually going to do is go to custom,
Speaker A
type in ICMP. We're going to click apply and we want any communication type. We're going to add the policy. You can see if we go to source internal gateway allow all. But we have block ping to IoT gateway. So block ipv4 ICMP from
Speaker A
management uh to this gateway. And if I go back here now and we try and ping it again, you can see I no longer get a response. I'm just going to keep a continuous ping running. If I go and
Speaker A
pause, we can remove this rule cuz we don't need it. If we give this a few moments, this should kick back into life. And there you go. Just like that, it's kicked back into life. So the firewall is fairly instantaneous. It
Speaker A
just takes a few moments for it to update. So this is what my network is kind of going to look like. So these are the four different areas that I have. So we have a main network where I have my
Speaker A
computers and a Naz, which is my UNAZ Pro setup on there. We're going to have a kids network, which we're going to set up, and we're going to have some blocking on there, so content filtering.
Speaker A
We have the IoT network, which is going to have all my IoT devices as we expect.
Speaker A
But along with this, we're also going to have a HomePod mini and a printer. So, we want to be able to AirPlay to this device. That's something that's going to be key for us. And then we're going to
Speaker A
have a guest network, too. If this video isn't too long and there's time towards the end, we'll throw in a guest portal setup as well. I know all of my Wi-Fi devices would have reconnected to their respective networks cuz I've kept the
Speaker A
SSID the same and I've kept the passwords the same. But in terms of the switches, we've had to make some changes. So, what you'll see out of box when you go to port manager, click on this one for example. You can click on
Speaker A
any switch and what you'll generally see when you go into port manager is the VLAN that's set on them. I've changed this one manually. The VLAN that is set on them is the native management VLAN.
Speaker A
So, when you're picking something up, like I know the Accara hub needs to be on the IoT network. So, when you click on the port, you can see it has port five. It says what the active is native
Speaker A
or management VLAN. So, I know that I want this on the IoT VLAN. I'm going to block all other tagged VLAN managements because we don't need any other VLANs on this. We're just going to have this single one. And then we have some other
Speaker A
settings down here. So, PoE++. And then we have some of the advanced settings. So, if you have Ethernet port profiles, the port isolation, storm control, loop control, spanning tree. This is some of this stuff we probably won't go into
Speaker A
this much detail in the video, but if you want to see something more specific on this, let me know down in the comments. And then we can click apply.
Speaker A
And we can see now we have an IoT network assigned to this. So we just need to give it a quick power cycle. So that's going to pull the PoE from it cuz it's running over PoE. So it's going to
Speaker A
cut that and then it's going to reboot and get a new IP. So the best thing for you to do is to go through your network and make sure you have everything set as you want. So same here. I know I have
Speaker A
this switch. I know this Neo hub is definitely needs to be on the IoT network. Uh again, the TA device. I'm focusing on the IoT network at the moment cuz that's what we're going to get set up initially. And I think that's
Speaker A
about it. I think those are the main few devices that need to be set up. One thing to also add, when you're in port manager, you're not going to want to go to every single one and make all the
Speaker A
settings that you need. So, when you go to manual, you can see you have an Ethernet port profile. Now, if I click on this and I can click new, it takes me to a new page. So, you can click new
Speaker A
from there, or you can simply go to settings, search port profiles, and it will bring you to Ethernet port profiles. Now on here you can click new and it will allow you to create a new profile. So this is going to be IoT
Speaker A
profile and what I want the IoT profile to be is this block all POE on auto and if I want to change any of these settings. So QoS voice VLAN uh loop control storm control port isolation or if I want to add 802.1x controls or link
Speaker A
speeds anything like that I now have the IoT profile. I can also create multiple profiles. So if I wanted my main network profile, so I can select my network which is Mamani. We can block all communications and again we can make all
Speaker A
the tweaks we need. So you can go through very quickly and easily and make multiple port profiles should you need.
Speaker A
When you go back to the Unifi device and you go to port manager, you can select multiple ports. Then if you click on manual, you can go to Ethernet port profile and then apply a profile should you need to do that. So it makes it
Speaker A
really easy to do multiple ports all at once. You may come to a point where you need multiple VLANs set up. For in this example right here, we have management and we have allow all tagged VLANs. So you have your native VLAN when you plug
Speaker A
something in and that will be the network you are connected to. But sometimes you need additional VLANs to be set up on there. So if I configured for example a phone and I wanted VLAN 10, I could choose VLAN 10 and then that
Speaker A
would then allow me to connect to that network. So allowing that is something that you would need to do. Again, this is where Ethernet port profiles will be quite useful for you. So you can select the type of network and instead of block
Speaker A
all because I'm not blocking all, you can choose to allow all the VLANs. So if I tagged VLAN 200, VLAN 50, 40, 30, 20, whichever, I could get access to those networks. Now, to make sure you're not leaving yourself too exposed, you want
Speaker A
to just change that to custom. And then this allows you to select the specific VLAN that you want. So I want management to be the native VLAN, but if there are any tagged VLANs, so if I tag VLAN 10,
Speaker A
it will then connect me to this network. So now back to the firewall rules and we're back here. So we have all of our different zones set up. I have changed the machine I'm on at the moment. So if
Speaker A
I go to IP config, you can see I'm now part of the 1010 network, which is my main network. So if I go to here now and if I try to ping 1011, which is the default gateway, I can I can get to
Speaker A
that. But if I try and ping something else on that network, for example, the USW switch, so we know that's 3. So, if I ping three, I get no response. That's again because I'm allowed to talk to the
Speaker A
gateway, but I'm not allowed to talk to other devices on that network. Now, the first bit we're going to be setting up is me on my main network being able to talk to the IoT devices. Let's start here and let's go to our policies. So,
Speaker A
if we go and create a policy and then we're going to say allow uh Mandani to IoT. Okay. Now, remember by default everything is blocked. So I don't need to worry about traffic coming back the other way because I'm not going to be
Speaker A
able to. The zone is internal and we're going to choose a network. So we're going to say anything on this network.
Speaker A
We want to allow the traffic. At the moment it says we're not allowed to use allow traffic because it's already set up. Policy is already in place. But that's because we're going to the external zone. We're not interested in
Speaker A
the external zone. We want to go to an internal zone. We select the internal untrusted zone. And then we select the network. And then we want the IoT network cuz I want to be able to get access to the IoT network. You can see
Speaker A
this action is autoall allow return traffic. So what that basically does is it creates a built-in policy for the opposite zone to pair to automatically allow return traffic. So if I'm going from zone A to zone B or from network
Speaker A
one to network two, I want the network two traffic to come back. However, when I'm in network 2, if I'm trying to initiate a connection to network one, it's not going to work. So you could keep this generic and allow everything.
Speaker A
So both IPv4, IPv6, all the protocols, all the connection states and IP sec match if that's what you're looking to do or you could lock down to some specific ports. So initially I'm going to do we're going to do HTTP HTTPS and
Speaker A
then what we're going to do is we're going to leave the port from the source side. We're going to leave it as any cuz it can go out on any of the ports. And then when we come to the return zone or
Speaker A
when we go to the destination zone, we want some specific ports. So if you click specific, you can only create one.
Speaker A
But if you go to a list and you create a new list, so we're going to do HTTP uh HTTPS. We can type in port 80 and click add. We can type in port 443 and click add. And then we can click create. And
Speaker A
now we have that list. So now I will only be able to communicate with that zone on port 80 and port 443. So if we click down here and go to CIS logging, and I'll tell you a lot about that
Speaker A
later. If you want to add in a description down here about what you've set up, you can type that in. And then you can click add policy. And that's now gone and create that policy. So we can see that right there. So if I try and
Speaker A
find a device, let's go to a client device. So we have a Shelly device that's right here. So 10 1040116.
Speaker A
Now from this network, can I ping it? I can't ping it. But if I go to the web browser, you can see I can get to that Shelly switch. So this is using a non-secure HTTP. So that's using port 80
Speaker A
and I'm quite easily and simply able to get to it. Another way you can check this, and I'll use this little tool right here, which is called MAPAP. So, I'm going to type in the target, which is 10 104116.
Speaker A
It's going to try and hit that IP and see what we can get to. So, if we scan, you can see I have 80 and 443 open, but they're not accepting devices on 443, but they are accepting 80. If you wanted
Speaker A
to allow ICMP traffic through, so if you wanted to be able to ping any device in that network, what you would simply do is to make it a little bit easier, I would go and find the rule, I would
Speaker A
click on it, go down to the bottom, click manage, click on this, and just duplicate the rule. And then what I'm going to do is just change this to ICMP.
Speaker A
And then we're going from the internal zone. We're going to allow. We're going to go to this network and we're going to go any. We're going to change this to IPv4. We're going to change the protocol to custom. And then we're going to type
Speaker A
in ICMP. So what that basically does, if we go through the rules again, so we're going from the internal zone, any port, we're going to allow. We're going to allow the return traffic cuz the ping needs to come back. We're going to go to
Speaker A
the internal untrusted zone. So IoT, we're going to choose any port. Again, we're doing IPv4 and only ICMP. Now, whereas before I wasn't able to ping that device, if we do this, it might still be processing in the background.
Speaker A
So, we'll just give that a second. And as we go through in a few moments, there you go. We're starting to get a response. So, hopefully you're getting the concept of how things are being locked down and how you can open things
Speaker A
up to be very granular for what you need. So we have our main network and we can now communicate with HTTP and HTTPS over to the IoT network. Now you can be a lot more granular with these rules and
Speaker A
you can choose specific IPs depending on what devices are. You don't need to allow a blanket rule. You can have a specific device right here. So you can choose a printer or you can choose an IoT network. It's entirely up to you. So
Speaker A
let's give the example of a specific device. So we have our ping running right here. So I know I have a printer that's on 40.2. So because I allowed ping across the whole network, I can see that ping responding. But we want to
Speaker A
allow printing only to that device. So how we would do that, we create policy.
Speaker A
We click allow network name to IoT and we'll put that down as printing. And we're going to go from the source zone internal. So we're going to choose a network. Again, I want any devices on this and my kids network. I want them to
Speaker A
be able to print. So that's fine. And then you can choose a specific port or list. You can click allow. And then we go to the untrusted zone. So with this we can choose a specific IP. So I know
Speaker A
it's 10.10.40.2. And we can click add. And then we're going to choose a specific destination port. Now you're probably going to ask me at this point, well, what port do you actually need? Now the best thing you can probably do if I don't have it in
Speaker A
this video or you're not sure is to do a quick Google. If I just Google firewall ports for printers and you can have a look and find some sites. The firewall rules are generally the same across all firewalls. It doesn't really matter
Speaker A
which one you're using. So find one that it does. And I've got an AI overview that's set up right here. So we have core printing. So we can see the ports right here. And also have a little read
Speaker A
of what these actually says. So this we need to keep in mind that this is TCP.
Speaker A
So we can click create. And those are the list of ports that we're going to be going to. So keep in mind any device across these two networks on any port can travel to the untrusted network for this specific IP on these specific
Speaker A
ports. So we can change this just for TCP cuz we know these are TCP. You can select just IPv4 cuz we know it's IPv4.
Speaker A
Click the SIS log. So we can then apply that policy. One thing you need to keep in mind is firewalls are read from top down. So it will go through the rules and as soon as it finds a rule it can
Speaker A
work with it will go. The traffic will use that rule. If you have a block too higher up and it blocks the traffic first, you need to look at the list to make sure that it's not blocking something that it shouldn't be. So, just
Speaker A
keep that one in mind also when you're doing it. So, again, I'm going to choose the IoT printing. Uh, I'm going to go down to manage. I'm going to tick this one and I'm actually going to duplicate it because we don't need to change too
Speaker A
much. And if we find the copy just here, which is this one, you can see IoT printing copy and we're going to change this one to UDP. This is the same. What we're going to change though are the
Speaker A
list of ports. So, we're going to choose new printer. Printer discovery. And then we're going to go 53 is just for DNS, not necessarily needed. 5353 is for MDNS. So, printer discovery. We click apply. That should now all work. Except
Speaker A
I just realized I made one tiny mistake. We need to change this also to UDP. So, we need to make sure that that is also set up. So, speaking of NDNS, we can go to networks. And you can see there's
Speaker A
this right here, MDNS proxy, which is auto, and then off or custom. I'll probably cover this in a little bit more detail a little bit later, but we'll leave it on auto for now, which basically applies the MDNS proxy across
Speaker A
all your networks. You don't necessarily need this on all your network, so you can use custom and switch it off on some, but we'll leave it as auto. So, there we go. So, now we have that. We can still ping the printer. The printer
Speaker A
is still alive. So, now we're going to go to Windows. We're going to go to printers and scanners, and we're going to click add device. So, hopefully if those rules are kicked in, there we go.
Speaker A
We can find the printer. It's showing up, and we can click add device. So, it's using the MDNS proxy. It's found the device and it's now going to go off and install the drivers that we need.
Speaker A
One good thing worth thinking about when you're setting this up and just keeping an eye on what's happening. So, this is where the traffic flows come in. You can either look into the insights and flows and we'll look at that in just a second.
Speaker A
Or you can click on the actual device. When you click on the actual device, you can go to insight. It's giving you the latest flows of what's happening. So, you can click on view all flows and it will take you to there. And you can see
Speaker A
this is what the desktop is trying to reach. This is everything that's going on. Which is why when I tick the SIS logging, we want it to appear in here.
Speaker A
And if you see anything being blocked, you can click the block. And you can see there's one piece of traffic where it was trying to go to the management network. That's probably when I was trying to ping or something. And that's
Speaker A
been blocked completely. So, if I go back to printers and scanners, you can see I have the HP printer, which is ready. So, if I click on that, I can go down and click a print test page. And we
Speaker A
can see the printer pop up here. This is the test page, and it's printing. So, that's now gone and printed off. So, just to show you, there's the test page.
Speaker A
It has printed. So, that definitely did work and that did uh print out straight away. So, going back to our diagram. So, we have our main PC. We're connected to now a printer, which is great. So, the kids and the main network can now print.
Speaker A
Then, we're going back to the IoT network where we want to be able to AirPlay. So, this can be used for TVs.
Speaker A
This can be used for any other devices that use the AirPlay streaming protocol. Now, Google is your best friend when it comes to looking for ports if you don't know off the top of your head. So, there's a couple of links. I mean, you
Speaker A
can go to Apple's website directly and it tells you everything that you need. So, if you just search for AirPlay, so you can see we need port 80, we need 443, we need 554 and it tells you whether you need TCP or UDP, we need
Speaker A
3689, we need 5,000, we need 6,000, 7,000, and you can see we need 49,152 to 65,535.
Speaker A
Now something like this is when you are specifying something directly, you want to be as restrictive as possible when you're opening such a wide number of ports. So what we can do right here, so let's go back to the firewall. Just
Speaker A
before I finish that one, I also found this article which gives you a whole list just here. So I mean feel free to pause and take a look at this article right here if you want to see what ports
Speaker A
there are. I'm just going to use the Apple ones for the time being and then if there's any others I need to open, we'll come back and take a look. Before we go to the firewall rules, you can see
Speaker A
here's my HomePod Mini. It's connected to the IoT network. So, we have got that one set up. And to keep things a lot easier, you can't set a static IP on this. So, I'm going to give it a fixed
Speaker A
IP address. And you can click that just by doing that. And then this will get assigned that IP anytime it signs onto the network. So, we can go to settings.
Speaker A
We'll go to policy tables. And then we want to go to internal to the untrusted network. And then we're going to create a new policy. Now, you can just copy these if that's something that you want to do, but or you can start again from
Speaker A
scratch. So, what I'm actually probably going to do is click manage. Click on one of these and just duplicate it. And then that's the copy. You can see it's got a copy name in there. We're going to call this one AirPlay. So, we're going
Speaker A
from our internal zone again. We want the Mandanian kids, which is fine. And then we want to allow the return traffic and we're going to the internal untrusted network and we're going to a specific IP. So, this is going to be 10
Speaker A
1040.123. We can click add and we can remove the 2 as we no longer need that. Now, it's going to ask for the list of ports. So this is where we want to specify all of the AirPlay plus the bonjour service.
Speaker A
And if we go back to the link, we'll have a quick look. So we can go 554. Now you can see that range right there is quite a high number of ports. So again, you want to make that as specific as
Speaker A
possible. So this is the TCP and UDP version. So make sure your protocol is ticked accordingly. AirPlay rules IoT.
Speaker A
And then that's going to be TCP/UDP. And then we're going to click apply to that one. So that's that one done. Now the good thing about this is all of these are all allowed. There's no blocks on here yet, so I don't really need to
Speaker A
worry about anything being blocked or moving any of the firewall rules around. So then we add the AirPlay Bonjour one.
Speaker A
And I realized I made a slight mistake in the TCP one. So we're going to change that in just a second. I've put some wrong ports in there. So we'll get that updated where you have these set up. We
Speaker A
can go to overview and then scroll down. And then you'll see all of these that are created right here. Now you'll see the mistake I've made just there. We have TCP and UDP the same. So I've put the wrong ports in TCP. So let's remove
Speaker A
these. Let's clear all of those out. We'll apply the changes there. So that gets applied to that rule automatically.
Speaker A
So should you need to change any of this, you can do. And then also I needed to add the high ports that we have in here. So 49152 to 65535.
Speaker A
So we need to add those. So all of those are now added. So we can apply those.
Speaker A
There you go. We'll see those appear right there. In theory, this should allow me. So I can use my scanning tool.
Speaker A
I know I've used this again previously, but I'm just going to try this again one more time. So we're going to try and scan to this port again. And if you want this application, there's a link down in
Speaker A
the description for this, so you can check that one out. And it's going to go off and scan to see what it can see on this port. Bear in mind, I'm on another network. This is on my main network. And
Speaker A
it's just using this tool to scan this across the network. And you see that's completed in the background. And you can see all of those ports are open. The only thing to keep in mind with this tool is it just tests for TCP. So now,
Speaker A
if I go to YouTube, I find Inside Wires, I'll find my own channel. And if I pick a video for me to watch. So if I pick a video for me to watch, we can see that's coming through there. And if I do an
Speaker A
AirPlay, you can see it's looking for air. Select Air Play and Bluetooth devices. You can see that that's found that network. And if I show you, I'm on my main Mani network. So we are going to try this now. That didn't quite go to
Speaker A
plan. So I'll show you exactly what's happening. So, when I click play a video and then I click studio, it plays and then just stops. Now, I spent the last little while looking through some traffic rules and seeing
Speaker A
what's happening. Uh, only to realize that, and I'm sure I'm hoping you have picked this up already, that when I set this up, so I had TCP UDP, I had TCP, and on the UDP one, I seem to have just
Speaker A
selected TCP instead of UDP. So, I'm hoping that this is actually going to fix it. I've not tested this yet. So, let's go and play.
Speaker A
And hopefully now there is more. No, it's still stopping. It wasn't the UDP that fixed it either.
Speaker A
So, I went through some capture logs. So, the best way to do this is to go to the access point and click on packet capture and then download the relevant files that you need. This is probably a little bit more in-depth of a
Speaker A
troubleshooting session. You can download the packet captures here by clicking on packet capture and then choosing your wireless or uplink port and then the network and then you can go through using Wireshark to figure out what was going on. But in a nutshell, we
Speaker A
weren't seeing port 320 going from the IoT network to my main network. And the reason for that was because we have blocked explicitly. We were only allowing traffic back. But when it was initiating from the HomePod, it wasn't
Speaker A
allowing through. So there was one rule that we skipped off. So I have added in a few additional ports. So, I'm going to quickly pop down here so you can take a look at what some of these ports are.
Speaker A
So, I've created a new one called PTP ports 31920. I've added in a few more ports. So, feel free to pause and have a little look at what these ports are. And I've also added a new network list for
Speaker A
the PTP ports. And I'll show you why in just a second. So, we go to zones. We go to source internal untrusted and then internal. And then I've created a new rule called PTP traffic. So, from here I've chosen the specific device cuz this
Speaker A
is the device that I need to be talking back. You can set this as your whole IoT network if you want or number of devices that you're planning to air play to, but for me, this is perfectly fine. The list
Speaker A
is the PTP ports. We're going to allow and then allow return traffic even though we've allowed it the other way.
Speaker A
So, you don't necessarily need the autoallow return traffic. We have network. We're going across two different networks. So, we have the main network mamani and kids and then again PTP ports. So, for this I've done IPv4 v6 and all the protocols as well and
Speaker A
stuck in syslog. And that's the only rule that I've created. And then what's happened from there? If we go to YouTube for example, if I go to my channel again and then we just play one of the videos
Speaker A
for example, you can see that this is playing. Introduce to you superlink straight from the hope mini. And that's all it was. That was the one rule that was stopping everything flowing through.
Speaker A
So it would go stop go stop. That was the one rule that was stopping it. So the PTP traffic was not going back through. And just to show you from the insights, if I show you the block traffic, I actually saw this earlier on
Speaker A
right here where you can see the iPhone connecting to the studio, but you couldn't see the studio traffic going back to the iPhone. So, you couldn't see that initiation. But for me, that was the rule that fixed it. So, now we know
Speaker A
AirPlay comfortably works on this network. Now, I have two more places I want to be able to get to from my main network. So, one is 101040.246 8123. You can see I can't get to Home Assistant from here. and the other one
Speaker A
will be 10 10 40 8006 and that is my Proxmox server. You can see I can't get to either of those from here. But if I bring up my command prompt again and if I ping 10 1040.40 I get a response. And if I 40.246 I also
Speaker A
get a response. So we know those two definitely are working. So again let's go back to the firewall rules. We're going from our internal to our untrusted network. So, we're going to create a policy. We're going to allow IoT. And
Speaker A
then we'll choose Proxmox. And then we're going to go from our internal network. So, this one right here. So, just like everything else, Google is going to be your best friend. So, we know for Proxmox, definitely our main
Speaker A
one is going to be 8006 cuz that's the web interface. Then, if you want to open up things like SSH, we can add in port 22. And then, if you're using a Spice proxy for VNC or whatever that might be,
Speaker A
you can add in that port, which is 3128. I'm not an expert on Proxmox, so if there are any additional ports that you need, let me know down in the comments.
Speaker A
There are stuff for things like clustering and VNC and all the rest of it, but for VNC, but I'm just adding these in for now and see where I go. I created that in the wrong location. This port needs to be any from that network.
Speaker A
And then we need to allow and then allow to return traffic. And then we're going to go to a specific IP. So I know this is 10 10.40.
Speaker A
It's got a static IP on it. So we can add that. And then in terms of lists, we can see we've already created the Proxmox one. So we can click that. Leave it as TCP UDP all return traffic. And
Speaker A
let's allow the SIS log. So let's add that in. So we have Proxmox right here.
Speaker A
So hopefully once this gets set up or once the firewall changes go through, we should be able to get to this. And there we go. Just like that in the background that updated and we can get to Proxmox.
Speaker A
Now we're going to do the same with Home Assistant. I'm hoping this is kind of starting to understand of how you would create your firewall policies and what you need to look at to make this happen.
Speaker A
So for this I am I'm going to copy it because it's going to make it a little bit easier. So duplicate the prox copy and then this one we want have home assistant. So again our internal network we're going to go from here going to
Speaker A
change the IP this time. So we're going to go 10 10 40.246. Click add. And then we're going to do some home assistant ports. And then we're going to do 8123 for now as that's the web interface. And then again, if
Speaker A
you want SSH, you can SSH into it as well. We can add that. Great that. And then everything else is the same. We click apply. And if we go to this side now, we'll give it a minute. And that
Speaker A
should refresh and allow this through. There we go. We're straight into Home Assistant. So, just like that, we've created our main network to be able to access everything. Now, I do have a NAS as well, but it's on this network, so I
Speaker A
don't really need to change any ports on there, but we're going to want other people to be able to get access to this network. Primarily, it's going to be the kids network. So, I'm going to change this, but that's just simply allowing
Speaker A
port 445 and allowing the SMB connections if that's what you're using. So, I'm not going to do that one within this video, but I'm going to do that in the background after. I think the final one you're probably going to want to
Speaker A
know about is probably the guest network. So, what can your guests do? Can they access the IoT? Can they access the main? Can they access this? And we're going to put that to the test right now. So, I've now got this machine
Speaker A
set up. And if I give you a quick IP config, we have 10.10.20.224, which is my guest network. Now, if I try and ping something like ping 101040.246, which was my home assistant, I can't get to it. 10 1058,
Speaker A
which was a device, I can't get to that. So you can see I can't get to anything in any other network. So to make this a little bit simpler and to show you how to read the zonebased firewall rule, we
Speaker A
have the hotspot network which is right here. Uh so this is our source and we want to go to the internal untrusted but I can't get to anything at this point.
Speaker A
So it's all blocked. Making life a little bit easier. I'm going to go back to here. I'm going to manage these and I'm going to say we're going to allow ICMP. We're going to allow printing.
Speaker A
We're going to allow the two sets of core printing rules. We're going to allow air play and we don't need the proxmox. So, I'm just going to duplicate one, two, three, four, five, six rules.
Speaker A
So, we're going to duplicate those. And you'll see them just pop up down below.
Speaker A
And it does start to begin to look like a mess. But, uh, we can start renaming some of these. So, we have this one right here, which is a copy. So, we can go guest. I won't make any changes just
Speaker A
in them just yet. Just change the name of them so they're a little bit easier to read. So, we have these now set up.
Speaker A
So we can go through them one by one and just change the network. So go to hotspot, go to network, select the correct network and change. And the rest of it you can leave it as it is. You
Speaker A
don't need to change everything else. Maybe just some of the namings and the descriptions. But um that's about it.
Speaker A
You don't need to. And you'll slowly see them disappear away from here just because we're selected in another section at the top. Right. So you can see they've all disappeared from this section. And if I scroll up and look at
Speaker A
the zonebased firewall and then if we go back to hotspot and then internal, you can see all the rules have appeared here because this is where the source network is. So the other thing that we're probably going to have to do is go from
Speaker A
trusted to hotspot. You can see we have the P2P traffic here at the moment which goes from the studio to the two networks. So we want to make sure we duplicate this rule as well. So duplicate because this is the issue that
Speaker A
we had. So P2P traffic guest and then we go from internal. So we'll change that to hotspot network select and we'll have the guest network just there. So we'll click apply to that. So that's now set up. So whereas we go to internal and
Speaker A
trusted and then if we go to hotspot we can see the P2P guest traffic is right there. So we now have this open up and in theory if I ping 101040.2 which is the printer we should get a
Speaker A
response. However, we're getting a request timed out. Now, when you set up in the hotspot zone, and this is where the gotcha comes. So, when you set up in the hotspot zone, you have the captive portal, which gets set up automatically
Speaker A
for you. And if we go to client devices and then hotspot, you can see we have two devices that I've authorized. Then we go to the landing page settings. If you scroll down to the bottom, you can see you have post authorization
Speaker A
restrictions. And in here, if we highlight over this, restrict guests from accessing specific host names or subnets even if they have been authorized. And then just above it, we have the pre-authorization allowances.
Speaker A
So we can add some IPs there. So 1010.40.2, we're going to add that one. Then we're going to add 1010.40.123.
Speaker A
So we can save that. And now if we go back here, we try and ping again once this updates. He says we have a response coming from that device. Now, it's just those authorization allowances. So, within the firewall rules, just to show
Speaker A
you what's happening there, there's this pre-authorization allowances, these two IPs to any, and then there's four blocked subnets. You have two rules that are down here. The pre-authorization allowances, which are those two IPs that we just specified. And then we have the
Speaker A
post authorization restrictions, which is all of these. Now, for some reason, this seems to take precedence over all of this, despite there being a top- down ruling like this. But now, if I go to my device, let me show you. So, we can go
Speaker A
to YouTube now and pick a video. So, I'm just picking one of my videos. And then, just like before, we go here and we can see Air Play and Bluetooth devices. We can see the studio. And that's now being
Speaker A
playing through here. So, it's a little bit on the quiet side, but it it definitely is playing through here. And just to show you what happens when I turn around and I pause these firewall rules right here. We'll leave the ping
Speaker A
open. We'll pause those firewall rules and then we'll click done. Give that a few moments and then I'm going to show you that the AirPlay option disappears.
Speaker A
So if I try and play to this now, it's not loading and it's not playing against this. So you can see the firewall rules still come into play even when you do something like this. And just to show
Speaker A
you the printer part, we can see the status is idle. So it's picking up a status. I'm not going to do a test print, but rest assure it definitely does print. Next, we'll take a look at the CCTV option. Now, I don't have
Speaker A
anything on this network. I can move my PC to it just to show you what's actually happening in there. The main thing you're probably going to want to do is stop your internet access on this.
Speaker A
Now, you can do this just by going to the network itself, allow internet access. You can untick that. That's no problem. That will then add the rule in.
Speaker A
Or I'm sure there's going to be some devices that you are going to want to have internet access. For example, if you have an MVR and the NVRs come through the updates, for example, your Ubiquiti MVR, the updates come through
Speaker A
that. So, I don't actually have an MVR, so I'm just going to show you the rules at this point. We would go to firewall.
Speaker A
We'll go down here. So we're looking at the internet untrusted and we're going to external. So at the moment it's block invalid traffic and then allow all traffic. So what we're going to actually add in here is block internet outbound
Speaker A
and we're going to do this. We're going to the external zone and we're going to block and then we're going to do all the settings on here. And this is just going to be block internet traffic. This is
Speaker A
just going to be block internet traffic. And we're going to add that policy. This blocks internet access. So please proceed with caution. So we definitely are. Just make sure you are selected the CCTV network. So go to network and CCTV.
Speaker A
I did almost miss that. So do make sure you add the CCTV network into there. We can add this. And you can see that's block internet outbound. Now we can create another rule which is allow internet CCTV. And in this instances we
Speaker A
can add the list of devices that we want. So we can select the devices in here if it's an MVR whatever it is or we can put in an IP. So for now I'm just going to do 10 1030.20.
Speaker A
Click add. And then that has internet access. So we can allow external. We'll go outbound. We'll allow everything for the time being. Add the SIS log and allow internet. So for me to show you how that actually works, you can see
Speaker A
just at this point that the block is before the allow. So the block will always take precedence because it reads it from top down. So we're going to reorder that and bring it back up and click done. So now if I have an IP
Speaker A
address of 10 10 30 20, I should be able to access the internet. So let's put that to the test. So client devices, let's find my desktop, which is right here. Let's go to port 18 and we can
Speaker A
change that to CCTV. So let's apply that change right there. If I do an IP config slashre, that's going to release my existing IP and you can see I've dropped my internet connection. If I click renew, I now picked up an IP address of
Speaker A
10 1030224. You can see I can still get to the gateway. So if I type in 10 1030.1, I can still get to my Unifi gateway. If I go down here and we go to untrusted and go to external, you can see I have
Speaker A
that my IP address was 10 1030224. Just going to set a ping off to 1.11.1.
Speaker A
You can see that doesn't work. So if I update this rule, we edit this. Let's go 1030224.
Speaker A
Click save changes. Click apply. That's now updated. So we can see my IP address 1010224.
Speaker A
And with any luck, in just a few moments, we should be able to get internet access. There you go. And just like that, I'm able to ping out to the internet. So, you can block and allow traffic very easily. So, we're blocking
Speaker A
everything else on the network and allowing one device to have internet access. That's how you would set that up. This final bit is kind of going to encompass the kids network. So, I set up the SMB share earlier and um I can show
Speaker A
you this just now. You can see my IP address just here, 10105200. My network file share is 10. There you go. 1010.1010.2. So that works. I can get to these folders. And obviously it already prompted me for a username and
Speaker A
password to get into it. So I don't need to pop that in again. So that basically works. And we've just allowed the SMB ports. You can do a quick Google of them. I think I've shown you enough examples for you to be able to do this.
Speaker A
So that would be something you can carry out on your by yourself. So, the first thing we look at when we look at the kids network is we don't always want it broadcasting, right? So, when we go to
Speaker A
the Wi-Fi settings and we scroll down to the bottom, you can see we have a Wi-Fi blackout schedule. So, specify times when you want it to be on and off. So, you can go through here and just highlight what you need. So, you can
Speaker A
just click through here. Now, you can just click on it once and then just click on it and edit it, or you can just keep adding them in increments. I'm just doing this here just for the sake of
Speaker A
showing it. And then you click apply. And then obviously when it's no longer available or it's no longer in that time zone, it obviously just turns the SSID off. So we can turn that off for now.
Speaker A
But that's how you would set that up. The other thing I was going to show you is around cyber secure. So we have content filtering. Now this isn't just restricted to kids, but it kind of flows within the category that I'm doing. So
Speaker A
we can do kids block, right? We choose the source, which is the kids network, which is right here. And uh we can do an ad block if that's what you want to add onto there. We can do a safe search. So
Speaker A
filters explicit content results in search engines which we definitely want. You have a few different options in terms of the filtering. So you can choose off have no filtering at all. You can have enhanced. However, this is a
Speaker A
paid for service by cyber secure which is powered by proof point and cloud for there. And if you want to see this itself, this is what it costs. It cost £79 per year for my device. And then if
Speaker A
you select the enhance, you have all these different ones down here where you can tick and untick. And these definitions are updated automatically.
Speaker A
So something you don't need to worry about for now. We can just choose the basic adult or malicious filtering. And if you want to make your own allow list.
Speaker A
So if there's something that's being blocked but you need to allow it, you can add that in here. And then it's the same with the block list. So if for example I block google.com, we can add that to the block list. And you can
Speaker A
choose a schedule. So you can maybe have something for the weekdays and something for the weekends if that's how you want to see. You can have a couple of different schedules. And we can click allow. So you can see now we're blocked
Speaker A
here. So I quickly added a few more in here. So we have google.com, google.co.uk and bbc.co.uk. So if I just try for example bbc.co.uk, you can see I can no longer browse that website. And if I go to google.com, if I
Speaker A
try and go to Google again, it's not something that works. So I'm not able to browse that. So just like that, by using these filters, if for example you had the enhanced enabled and you needed to unblock something specifically, you
Speaker A
know, a website wasn't working, you can just go ahead and add this to the allow list and then that will allow you to go through and use this. The one thing I will add though is it does take a couple
Speaker A
of minutes for this to become active. So you might just try and add it and you'll wait straight away. You might just need to wait a few moments for it to kick it into action. Then you should see the
Speaker A
websites are being blocked. Now, the other thing you may want to do on here is add in some Wi-Fi speed limits. So, we can go to back to the Wi-Fi, click on kids network, and you can see down the
Speaker A
bottom just here, we have Wi-Fi speed limits. So, this isn't something that I have any profiles that have been created. But if you want to, you can go and click new profile. And then we'll leave without saving. And it will take
Speaker A
you to create a new Wi-Fi speed limit. So, we'll call this kids network. And then we'll go and choose a bandwidth.
Speaker A
So, if we wanted to test, one thing to keep in mind, though, is you're not able to go above 100 in terms of the limit.
Speaker A
So, if you wanted to set a 200meg limit or 150 meg limit, that's not something you can do with the Wi-Fi speed limit at this point. So, now we can go back to the kids network. We can go down to
Speaker A
Wi-Fi speed limit. And then we can click right here and click the kids network.
Speaker A
Now, there is another way that you can do it. This is just for Wi-Fi. There's something you can use called QoS, which we will cover in just a few moments.
Speaker A
Again, the chapters are down below if you want to skip ahead to that section, but we can get that set up. But just like that, we have the Wi-Fi restricted to 800 megabits per second. So, the final bit of this part is the
Speaker A
object-oriented networking. And this is where we'll cover a bit of the QoS. This is something Ubiquiti have just introduced recently where you can go and create everything all in one go. So whether it's a device, whether it's a
Speaker A
network, whatever you want it to be, you can go and set some rules up specifically for that device or network.
Speaker A
You don't need to go through the individual firewall rules. Now, which way do I go? One or the other. One thing to keep in mind, though, is this does not support any thirdparty equipment.
Speaker A
So, you need to make sure you have a fully unified deployment before something like this works. I have another video where I do a bit more of a deeper dive in this, but I'll give you some examples as to what you can do with
Speaker A
this. So, we have my device that I have right here, which is a desktop. So, if I just search desktop, it's this one right here. And in the first section, you can secure the device. So you can set up a
Speaker A
block list, an allow list. One thing I'll mention on the allow list is if you click something on the allow list, it's only that that will be allowed.
Speaker A
Everything else will be blocked. You have the no internet list if that's what you want. But the block list, you have everything. So you can block all internet traffic if you want. You can choose a specific app or a domain.
Speaker A
Sometimes when you're using a phone, for example, you might find that YouTube still works. But if you block the app and the domain of YouTube.com, you can make sure that both of those have been blocked. You have an IP. And if you want
Speaker A
to block a specific region as well, you are welcome to do that too. You can set the schedules and then you have the local rules. So this is just the external rules and these are the internal rules. So I'm going to create
Speaker A
this for the time being just to show you exactly how this works and I'm just going to tick both of these just in case there's one or the other. So we don't need to block any IP addresses. We'll
Speaker A
keep it as always. We'll inherit the local network ones at the moment. So I'm happy with that. So you would select the route and if you want all traffic going through there, you can. If you want specific domains, so for example, if you
Speaker A
want google.com to go through to a specific another connection, you can do that right there. And that's there. You can choose IP addresses or even a specific region. Again, you have those options. And you have a kill switch down
Speaker A
the bottom. So prevents the client from connecting to the internet if the interface is not available. So should WAN 2 go down, for example, this will kill the internet and it will no longer work. So let's do google.com and let's
Speaker A
send that out tunnel 2. So for now, if I just do what's my IP? So if I do this website for example, what is my IP address? So at the moment I can quickly show you. So you can see I have 158173.
Speaker A
So just remember that one for the future and we'll go and add this as well. And we're going to send that out of our WAN 2 socket which is not the IP address that I just showed you. We'll keep the
Speaker A
kill switch there. And again this is where the QoS traffic comes in. Whether you want to give specific preference to an application or you want to limit the speed limits on the network. Again you can do that all here. Say YouTube for
Speaker A
example. Again, and I'm overlapping some of these. So some of these will obviously not work. But for example, if you wanted YouTube and you wanted to limit how much traffic it gets, you can go and say, "Okay, I want to give it 25
Speaker A
meg." Same with an upload limit. I want to give it 25 meg. And it will limit that traffic. But on the flip side of that, if you had some apps where you've got Teams, uh, FaceTime, WhatsApp calls, something that needs real time traffic
Speaker A
that needs the priority, you can click prioritize, and then that will prioritize that traffic over everything else. So there's a couple of different ways you can do that. And if you add something like this, let's give it a
Speaker A
name. So we'll just call this one YouTube demo for the time being cuz I will delete this one off after. I just want to show you how it appears in the firewall. If we go back to the firewall
Speaker A
list, you'll see we have one rule just here which what we can do there is if we scroll down, it has all the firewall rules in it, all the policy based roots, QoS, and that's all set up within this
Speaker A
one rule. Now for you to be able to edit any of these, you need to go to the object and then play around within the object. And just to show you, obviously Google is working now cuz we had it
Speaker A
blocked before. So if I search what is my IP address and we go here you can see my IP address has now changed. So again you can see just like that without doing anything going through any individual rules we've changed where this
Speaker A
connectivity or where this website goes through. And I'll quickly show you another example of where I've done that one in terms of routing. So this is something I set up earlier. So I have a Virgin Media set top box but I have two
Speaker A
internet connections. Virgin Media only like you going through their network to reach their servers. They don't like you going through any other network. So, I had to route all of those boxes out of that specific connection. So, I made a
Speaker A
dedicated network for it. Gave it that device. You select where you want it to go. And then you can choose a destination if that's what you need or an IP or a domain or region, whatever it might be. I just did any cuz I don't
Speaker A
care where that Virgin Media box goes out. As long as it goes out of that connection, that's all that matters. So, that's something that I'm doing in real life. So, you can see how that works.
Speaker A
Since we were already in cyber secure, we can go and now start talking about how to secure some parts of your network. So we've spoken about the firewall which is one element and then we want to talk about this part just
Speaker A
here. So there's two parts to this. So we'll talk about the protection in cyber secure and see what you can and can't do. So first thing as we spoke about was the content filtering. So we have that we can get that set up. But there's also
Speaker A
simple app blocking as well. So you can block one or more apps on either device or network or some sort of category you can choose from there. Say for example, we want to do test app block. You might
Speaker A
find with some devices that you're not able to browse the website, but you might find actually with some mobile devices that the app is still getting through in some instances. So you want to go from here and go and use this app
Speaker A
blocking to make sure you are blocking everything that you need. So we can test the app block for this. We can choose a network or a device. So for the time being, we can choose, for example, like an iPhone if that's what we want. So
Speaker A
let's pick one of these. We'll click save. So that's my iPhone. We can choose a specific app. So, let's go YouTube.
Speaker A
And then it doesn't matter what network I'm actually on. That's actually going to go and block that app for me. So, what we'll try and do is we'll try and access that in a few moments and we'll we'll see what happens. After that, you
Speaker A
can use something called region blocking. So, you can block or allow connections from a specific region. So, we can tick on this again. You got block or allow. You can choose either both directions, outgoing or incoming. And then you can choose the country or
Speaker A
territory. So, I'm not going to select any specific countries, but you feel free to block any countries you feel that might be at a risk to you. We then have encrypted DNS. So, if you want to use DNS over HTTPS, you can do that's
Speaker A
something you can choose as auto, which means it will no longer be configured on your WAN. You have predefined if that's what you want to do. So, Google and Cloudflare's DNS's you can use there if you wish, or there's a whole bunch in
Speaker A
here by the looks of it. And you can choose a custom one if you want. So, you can choose a server name and use the DNS stem. We have a honeypot. And what that does is it detects logs and requests
Speaker A
made to a specific IP address in order to find malicious clients in your network. So within your network, if you have multiple devices, if someone is trying to contact you maliciously, this then picks it up. All you need to do is
Speaker A
select the relevant network and give it a free IP that's available. So if I choose this one, it needs to be out of the DHCP range. So if we can go 19, for example, 10 101 19, we can create. We
Speaker A
now have a honeypot created on that network. We have identification, which inspects your traffic for you. So you can disable this completely. You can do device and traffic inspection or traffic only. For me, I would leave this as
Speaker A
traffic and device. The more data you have, the better from what I see in terms of the block page. So when you saw the block pages earlier, there was a HTTPS error, but you can install the SSL certificate and you won't get that
Speaker A
certificate error and it will show you the ubiquity block page. Finally, probably the most important one, which is the intrusion prevention. So in here, we want detects and prevents threats with signature updates, deep packet inspection, ensuring real-time network
Speaker A
security. This is going to be one of the key ones for you. You can see when the last signature updates are, and you can add in cyber secure. We'll talk about that in just a few moments. You can
Speaker A
choose the networks that you want it all to be active on. You probably want it to be active on all of them. You want to notify and block. And then you can choose what you need to have set up. So
Speaker A
you can have everything set up. You can have them all ticked. So you could even choose ICMP if you want. And even on here you can choose online games. And then should you wish to create any exclusions you can create a new one
Speaker A
here. Traffic incoming, outgoing, IP address, network, subnet. That way you can add some exclusions if you want. We can go and apply changes to there. And that's pretty much everything you have set up on the protection. Now cyber
Speaker A
secure is something that is a yearly thing. This is not ubiquity starting to introduce subscription. This is just a cost that comes to them as part of using proof point and cloudfare to update all of these signatures. So you can see we
Speaker A
have detect and block advanced threats up to 55,000 signatures. It filters harmful unwanted web content which is what we saw on the previous part with the content filtering 100 plus content filtering categories 30 to 50 new daily signatures and then dedicated proof
Speaker A
point threat research team and Microsoft active protection program coverage. So you can go and just activate that and it's £79 per site. And I think if you have the one of the enterprise gateways it costs a little bit more. And if you
Speaker A
wanted to see the enhanced, this is the cybercure enhanced list that comes with final bit we'll just talk about is the logging here. So we have the different types of loggings that you can have set up. So we have the net flow. If you want
Speaker A
to tick that and give it an IP address for the collector, you can do that and select the networks that you want to collect. Additional flows. So you can have block traffic only or you can have all the traffic. For me, all the traffic
Speaker A
is always useful. And then we have these tick boxes that we can do. You can store it internally. You do need to install a hard drive or an SD card in the unit. So you can make sure you can store the logs
Speaker A
or you can send it off to a seam server. So Splunk, Sentinel or even IBM Q radar.
Speaker A
You can add in the debug logs and what that does it generates more verbose logs on the unified devices. So it does say this substantially increases the number of logs that come through. So only use this if you are trying to troubleshoot
Speaker A
an issue. We have the data retention which you can set for however long you want. 90 days is good enough for me. And you can collect historical data as well.
Speaker A
Then we have SNMP monitoring and logging levels. So if you wanted something at the moment it's all on normal but if you wanted something a bit more verbose or debug on a device or management or remote access or even the system you can
Speaker A
enable those. So for now I will leave them all on auto. Now I showed you everything that it is to set up the firewall but what do you do when something's not quite working right or something that you're not sure how to
Speaker A
figure out what's going wrong. So we have something in here called flows under insights. And what this does is it gives you a log of everything that's going on in your network. So you can look at the flows and then if you click
Speaker A
on activity at the top we have a bunch of traffic data but this isn't really relevant for this point. Right here along this left hand side you have a full filter list that you can use and choose different things. So you can
Speaker A
choose the source device zone network address IP source region and the same in the destination, you can choose the service, the protocol, the interface, the policy, the policy type. Narrow down everything that you need to filter this log to get the information that you
Speaker A
need. So, for example, if I just went to the top and clicked on all blocked threats, you can see there's 774 blocked, what's blocking it the most, the most affected clients, and then the regions. So, for example, this is going
Speaker A
to Google services.com United States, and it's being blocked. And you can see this is currently being blocked and what it's being blocked by.
Speaker A
So, if I just look at this, we can see the source, the destination, the service type, the direction, what network it was in, the policy that's being blocked. So, YouTube demo is being blocked, and that's the firewall. You can see the
Speaker A
kids network is being blocked for the the YouTube demo policy. And again, we have a whole bunch. This is the computer that I've been testing with. So, this is going to have the most block. You can see the desktop is trying to talk to the
Speaker A
CCTV network, which is being blocked. So, there's a whole bunch of things. Obviously, there's stuff on the CCTV network that's trying to get outbound, but we've blocked the internet traffic.
Speaker A
So, it's not available to go out there. So, it's blocking everything within. Now, along with this, we have the logs.
Speaker A
And along here, there's a whole bunch of information that you can see. So, there's general or there's audit. So if we click on general and we can look at the type of events we have AP changes, firewall blocks, adopted devices,
Speaker A
hotspot guest, policy base finished. This is what I was doing earlier. The Virgin TV stops sending traffic through internet 2 and when it starts also as well. So you can see there you go.
Speaker A
Policybased routing started through there. So there's a whole bunch of things that you can try and do to try and figure out what's going on with the network. This is the first place I would generally look if I was having issues
Speaker A
with getting traffic to go through or it's being blocked or where it's being blocked. you kind of want to look in these kind of areas. Next, we have alarm manager. And again, this is something that can notify you with stuff that's
Speaker A
going on on your network. So, to create stuff within your alarm manager, you can click create alarm. And there's a few different things that you can choose to be alerted on. So, there's a monitoring.
Speaker A
So, a client connected or disconnected. This doesn't work in terms of Wi-Fi to be notified if something connects to your network. But if you have a client that already exists on the network, then yes, you can be notified for it. So it
Speaker A
can be client connected and client disconnected and there's a continuous monitoring for there trigger every x amount of time. High traffic. So if you're seeing high traffic from a device, you can be alerted. So if there's any port anomalies on the
Speaker A
ubiquity devices, you want to be alerted about it. Internet, so internet disconnect, high latency, packet loss, data limits. We have power, so insufficient POE power, UPS battery in use, UPS power restored, UPS capacity exceeded. So all these can be notified
Speaker A
with those devices or power supply failure. We have security, blocked by firewall, honeypot triggered, threat detected. Depending on how much you want to have set up, just keep in mind these can obviously if you have these notifying your phone, these can build up
Speaker A
very quickly. And then we have the system. So VPN, devices, admin, networks, Wi-Fi. So you can set these up however you see fit. So you want to know when someone's on the VPN or disconnected from the VPN or if you want
Speaker A
to know when stuff is happening to certain devices or admin or network or even Wi-Fi. You can then choose who you want to be alerted and then you can choose a default or a custom context.
Speaker A
Entirely up to you. You can choose notify, you can choose web hook or you can choose to recycle the power depending on what you are selecting. So for me the ones that I created was internet and packet loss detected,
Speaker A
threat on a network, VPN user connected and the network's been accessed. So an admin has accessed the network. So those are the things that I'd want to be notified about. Now you can do a lot more but it's what you see is going to
Speaker A
be useful for you. Let's take a look at the admins that we can have set up. So we'll go to manage roles first. So we have our users and admins along here which you can create a new one and then
Speaker A
we have manage roles. So we can create manage ro. We have a super admin which has full management of everything. So we can go to create new roles. So if I want to use protect view only. So we can turn
Speaker A
off everything else. So we don't want them to be network. We don't need them to access anything else at this moment.
Speaker A
So we can change them to none. And we can change that to view only. And we can go and create which is just a view only with protect. And then apply those changes there. And then there's a view
Speaker A
only. So we did protect we'll do network only. And again we can change that to view only in here. So if we want we can allow people to have a view only access into just network or you can make them a
Speaker A
hotspot manager or site owner. It's entirely up to you. So if we want to create a new user, we can go and give them a name. You can make them an admin and then give them a predefined role. So
Speaker A
we have the protect view only or we have the admin view only. And then we can go and click save. And that creates the user within Unifi. This is probably diving a little bit deeper into the protect side, but I'll show you it
Speaker A
anyway. So we manage ROS. We can also do a bit more customization on protect. So if I just call this one protect limited, we can see what they're able to see. So the other one was literally view only,
Speaker A
but you can actually choose to specify the devices that they're able to see. So you can choose them and then you can choose whether they want live stream, playback, edit device settings, what you want them to do. So we just want the
Speaker A
live stream, if you want the audio or not, or PTZ control. You might just want them to have a look at it and if you want the playback. So playback audio, playback download, and delete footage.
Speaker A
So we can specify the cameras that we want. And you can even go as granular as specifying this per device. So you may want to give them access to certain areas, but that's also a really good feature for you in there as well. So we
Speaker A
can create that RO and then we can give people access that we need for that role. Now there's a couple of things I'll probably cover in another video cuz they need a bit more of a deeper dive into them. And the first one is the
Speaker A
captive portal. So when you go to networks and you set up your guest network, you can click on the hotspot page. And within here, I'll quickly go over some of the basics. You can choose a few different authentication methods.
Speaker A
You can choose more than one if you want. Should you not want to use the inbuilt one, you can go ahead and use an external portal server. You just need to populate with an address. But you can also you can also edit the one that's on
Speaker A
here. So this says unified guest portal. We can just do inside wire guest. Welcome to and then you can just rename it. So you can see where this is updated right here. We can say rename it to whatever we want. And we've said give me
Speaker A
internet. We have a terms of service and you can update that all by here. Uh the logo size. You can choose whatever logo.
Speaker A
There's just a U logo on there at the moment, but you can choose any logo and position it wherever you see fit, left, right, and then you have your colors in terms of your background. So, you can change the color if you want to a
Speaker A
different color and you can get this really set up how you want. In terms of these landing page settings, you have an 8 hour default expiration. So, they would need to reauthenticate. We have show landing page HTTPS redirection
Speaker A
support. Basically, what that means, any unauthenticated clients will be redirected to your hotspot portal even if they have HTTPS traffic. You have encrypted URL. So that's the client traffic will be encrypted with the URL when it's redirected to the hotspot
Speaker A
portal. So if you typed in google.com for example, it will be encrypted. You don't need to worry about that. Secure portal. If you want to use a secure portal which uses HTTPS instead of HTTP, you can choose to use that. And if you
Speaker A
want to populate a domain, you can use this to redirect to a host name instead of an IP address. We have some authorization access here, which is pre-authorization and post authorization. So keep in mind some of the stuff we spoke about earlier just
Speaker A
there. And then we have a custom URL if you want to redirect or you can just have a welcome message. So if you wanted to redirect you to my website for insidewire.co.uk, you could go and save that and then it
Speaker A
would redirect you to this page when you have successfully authenticated. The other one I was going to talk to you about was high availability. So this has been slightly updated in 10.1. And we have the shadow gateway VRRP which again
Speaker A
I'll cover in another video. I have done one previously but not in this new setting. So, we'll talk about this in another video, but essentially you have two gateways which you can set up identically to use in a shadow mode. So,
Speaker A
if one fails, the other one takes over. And it shows you in here step by step exactly how to get this set up. Let's talk about the VPNs and the different types that there are. So, when you go
Speaker A
into settings and then you go to VPN, you're greeted with a bunch of different options. The first one is a TeleportVPN.
Speaker A
Now, this is something you can use with the Wi-Fi man app. It's very easy, simple, oneclick to give you access back to your network. You simply generate a new guest invite. They get the link, they copy this link, and then they paste
Speaker A
into their phone and away they go. They're connected to your network. If you go into the app, you'll see there's a teleport button right in the bottom right hand corner. I have an invalid one that I was using previously. So, you can
Speaker A
remove that if you want. Click the three buttons at the top and you can paste a new teleport invite. So, if I show you how this works. So, I have the teleport link and we can just click, we can just
Speaker A
allow the paste from the email and then it will say, do you want to connect to your home? We click connect and that's it. My iPhone is now connected to my home network. If I go to client devices
Speaker A
quickly, you can also see the pop-up that's just come there. Someone's connected via TeleportVVPN. That's just a notification that I had set up. So, you can know that those notifications also work. And you can see just as the
Speaker A
client device has popped up here, M's iPhone. And you can see there's the IP address we've got. And that's all the settings that we have within. That's everything we know about it. And then to turn this off, you simply just press off
Speaker A
and it will disconnect you from your home network. Teleport is really that easy and simple to use. So there isn't really too much to it. So you want to get someone quick access to your network. That's all you need to do.
Speaker A
Let's go back to VPN now. And then we go to VPN server. And right here you have a VPN server that you can create. So to create a VPN server, we can click create VPN. You have three different options up
Speaker A
here. So you have WireGuard, OpenVPN, and L2TP depending on how many different types of VPNs you want to create or whichever one that you wish to use. So we have the WireGuard that we're probably going to use. So this is going
Speaker A
to be IW's WireGuardVPN. We have a private key and public key that's set up. We give a when an IP address so you can choose whichever one you want. So if we go I'm just going to choose 6 for example. So 51820 is
Speaker A
wireguard standard port. You can restrict the VPN to listen on that specified server address. So you can tick that if that's what you want or you can use an alternate address for clients. So this is for a public IP or
Speaker A
dynamic DNS address. You can use that. So we can click on here and it will give you the host name that you want to use.
Speaker A
So, if you're using if you do have a dynamic IP and you want to use something like dynamic DNS, you can go and populate that. Here we have a client that you can add, which we'll talk about in just a second. And then we go to
Speaker A
manual. So, we have you can give it an IP address range. So, I'm going to go 172.1650.1.
Speaker A
Uh, we don't need a /24. I think we're only going to need a SL28. We don't need that many IP addresses. Uh, DNS server, we'll leave that as auto. and maximum transmission unit and maximum segment sizes will also leave them as auto as
Speaker A
well. Now to add a client, you can go and give yourself a configuration file.
Speaker A
You can give the client a name. So every client that you want to use this WireGuard server will need their own client set up. So we'll call this IW demo. You can do this automatically. So you can either scan the QR code from the
Speaker A
client or you can just download the VPN config file. So I've downloaded that for now cuz we're going to be using this computer to test it. So multiple WG guard clients should not share the same VPN config file. So it needs to be
Speaker A
unique. When you go to manual, you have an interface IP, you have a public key, and then if you want to set a pre-shared key or remote network clients. So you can add a pre-shared key if you want.
Speaker A
This is just an additional authentication method that you can type in a password to. So you can pop that in there. Just another level of security if that's what you want. And then the remote client networks, you can
Speaker A
optionally add roots to the WireGuard server for remote subnets. So I'm going to leave that off for the time being.
Speaker A
I'm going to show you what we can and can't do with that setup. So, we can go and click add. And just like that, your VPN server is now ready to go. Right.
Speaker A
So, we have the WireGuard installed, and I'm going to unplug my network cable quickly. Uh, which will take away my connection from the device. So, you can see network is offline. And I'm going to just go down and connect to the Wi-Fi.
Speaker A
Just going to connect to my phone, which is on the 5G network. Let me just get that connected. There you go. We're connected. We now we're back online. And we're going to import the tunnels from the file. So, so we can just click the
Speaker A
IW demo which we'll click there and we can see this is the IP address. This is the DNS server allowed IPs and the endpoint. So, we can activate this.
Speaker A
Right, we have the WireGuard tunnel which is now active. So, let's open up our command prompt. Let's go to IP config. So, the wire guard is 172.1650.2.
Speaker A
So, we have that address. The default gateway is 0.0.0.0. So, if I try and let's see if we can ping 1011, we get a response from that one. And then if I try and ping my Naz 10 10 1022, I get a
Speaker A
response from that. If I open up my share, if I go to back slashback/10101022, I can get into it. So at the moment, we're able to get to everything. And this is where you can either lock it down from the WireGuard client or you
Speaker A
can start looking at the firewall. So at the moment, you can see if we go to the firewall, we have the VPN as the source.
Speaker A
We're allowed to go to all the internal traffic. We're allowed to go to external. We're allowed to go to the gateway. We're allowed to go to the hotspot DMZ, but just not the internal.
Speaker A
So, if we have a look at what was on the internal, the IoT network. If we try and ping my home assistant server, which was 10 1040.246, you can see I can't get to that cuz the firewall was blocking me. So, let's do a
Speaker A
couple of things. So, firstly, we don't want them accessing the internal network. So, VPN and then the internal.
Speaker A
So, let's create a new policy. Let's say block internal network sources anybody in the VPN. You don't want any specific that we want to block the traffic to internal network. So we're going to say we don't want you going to any of these
Speaker A
networks actually. So let's just block all of them for the time being. We want to lock down exactly what they're able to do. We want everything. We want to log that and we can add the policy. So there we've blocked all the internal
Speaker A
network traffic. So if I try and ping my NAS for example, you can see I can no longer get to my NAS. So, if we go and create a new policy, we'll do VPN Naz access. So, we have the VPN, we have
Speaker A
anybody from the VPN, or you can select I'm going to select the WireGuard client at this point because I don't want any other VPNs to be able to get to it. We can do an allow. We're going to do
Speaker A
internal, which we're going to do a specific IP 1010.2. We can add that one. We'll allow all ports for the time being, but if you wanted to lock down just to SMB, for example, you could do that, but we'll
Speaker A
allow all for the time being. We'll sis log this. Hopefully you've picked up exactly what I just did there. So you can see remember the firewall rules read top down. We want to reorder. We want to move the Naz one above and click done.
Speaker A
And hopefully in the background if we give that another a few pings. There we go. It's always that moment where you're testing this and you're like is it going to work? Is it not? But there you go.
Speaker A
You can see that 10.10.2 we can now get access to it. We also want to do the same with the internal. So where it's blocked all I actually want to allow access. allow access to HA and Proxmox.
Speaker A
Again, we can choose the server. So, we'll choose the WireGuard server. We'll choose the action to allow. And then we're going to internal trusted. We're just going to choose some IP. So, 10 1040.40 1040.246.
Speaker A
And then we can do that. And then we can click add policy. Now we have access to HA and Proxmox. So whereas previously before I wasn't able to ping this, let me just do this with a minus T. So we'll
Speaker A
keep the ping going. Now I'm hoping that the allow rule is above the block rule.
Speaker A
So we should be able to get to it. So now if I try 10 1040.246.
Speaker A
There we go. My home assistant loads up. So it's really that easy and simple to get something like this set up. Now if you wanted to add some specific routes, you can go back to the client, add remote client networks, and you can
Speaker A
optionally add roots to the WireGuard server for remote subnets that are located on the client. So you can also add that in too. Next, we have the VPN client. So if you want to send specific traffic out of a VPN client, you can do
Speaker A
that. So you can click create VPN client. This is a OpenVPN which we can just do PIA streaming US for me. We can upload the config file. Now I downloaded this from my VPN provider. So you can choose download this from your provider.
Speaker A
There's the US streaming one that I've got. So we can click that. You can use the device wizard. So you can select the source of the traffic being rooted. You can leave it off for the time being. You
Speaker A
can do a specific domain. And same with the content wizard. It's entirely up to you. pop in the username and password and then we'll click apply changes. So once you've added that information you can click apply and you can see it's
Speaker A
starting to connect there. So it should hopefully connect to that in just a moment. So as soon as it gets connected it says do you want to add a policybased route and I'm going to show you that manually in just a second. So we'll skip
Speaker A
that and then we'll go back. So you can see that tunnel is there. It's set up now. It's got an IP address. It's going to it. It's up. Now to set up the policy based route we can go here. Create a new
Speaker A
policy. Click on route and fill in the information just here or the other way.
Speaker A
I'll show you through the object-oriented networking. So, we can select a device. So, I'm going to just pop in my desktop for the time being, which is this one. We'll click add. So, this is Netflix redirect for example.
Speaker A
Click route. And we're going to choose a specific domain. So, we're going to do Netflix.com.
Speaker A
And then that will route that specific domain. And then what interface do you want to go out of? So, we want to go out of this. So, I'm also going to just add in Google just so you can see from this
Speaker A
side as well. So, Netflix and Google. We've done that. We'll click add. So, I've added Google, but I've realized that's not actually going to do what I want it to do for this specific demo.
Speaker A
So, you can see my IP address 158. So, we can see that's the IP address. So, I'm going just going to take what's myip.com and I'm just going to go back to here and I'm going to add that in as
Speaker A
well. We'll click add that. We'll click add. And then we click save. And then we'll give that a moment. And then hopefully, so if I show you now this website, what's my IP address? You can see my IP address. And you can see the
Speaker A
region. I'm now in the US. So just like that, it will route your traffic through specifically for that VPN. Now you can set things up like your Apple TV or any other device that you want routing through a specific network. Then the
Speaker A
last one that you can see here is the site to site. Now I don't have a site to site to set this up for you. Uh perhaps it's another video where we can go over the sight toight VPN and maybe site
Speaker A
magic at that point. So we can cover those. But within here you can use OpenVPN or IP sec. You can choose your IP, the tunneling method, policy based or rootbased, the tunnel IP, remote networks that you want to be able to
Speaker A
access, and all the information that you need for it. So, the sight to sightVPN is relatively simple to get set up. Now, I did say the VPN was going to be the last one, but I'm going to cover IPv6
Speaker A
quickly. Now, this is very high level. I'm still getting deeper into IPv6, so I'm learning as I'm going along at this point. And you can see I have an IPv6 address. We set this IPv6 address up in the WAN settings. Now, the first thing I
Speaker A
want to do is create a quick static route. So, we're going to create static route and then we're just going to do this IPv6 routting. Now, you'll be able to get all of this information from your ISP. And if you want to know who my ISP
Speaker A
is, it is olo.co.uk. You can go and check them out. If you want a really good ISP experience that's designed for home labers and people that want full access to their internet without any traffic shaping, etc., etc., You can find out about more about them
Speaker A
down in the description below. So, we going to use the gateway. We're going to type in the IPv6 address, which is actually going to be my gateway. And then we're going to give ourselves an IPv6 address down here. And this network
Speaker A
down here is the network we're going to be using to give all of our subnets an IPv6 address. So, we can go and click add. And that creates the static route for us. And then we can go across to
Speaker A
networks. And then we're going to go to our networks and then start assigning each of our networks a static IP address. So the first one is the management network. So we'll go down to the bottom. We can tick IPv6 is none at
Speaker A
the moment. We can click static because I don't have a prefix delegation. I have a static IPv6 address. So you can see we have the IPv6 address and we're starting with the first one with one. And I'm going to copy this because we're going
Speaker A
to just replicate them down. So we're going to use the same prefix. Then we're going to do one, then the next network will do two, then the next network will do three, etc., etc. But everything else pretty much stays the same. So we change
Speaker A
this to manual. or you can add some additional IPs like we've seen in the IPv4. Client assignment, do you want SL AAAC or do you want DHCP v6? I'm going to leave it with DHCP v6 at the moment.
Speaker A
The lease time, the DNS server, again, I'm going to keep that as auto because we'll leave that as what's been set on the when. And then we have the routter advertisement if that's what you want.
Speaker A
So, these are messages used to inform the clients that IPv6 is present on the router. So, we'll leave that as high.
Speaker A
And then if you want to allow SLAC, this is for non DHCP v6 devices. There's a little recommendation at the bottom. We recommend enabling this option when using Android client devices. So, we can click apply and you can see that's just
Speaker A
appeared up here. And I'm going to quickly run through and do them with the rest of my network. And there you go.
Speaker A
You can see we have all the IPv6 addresses assigned on there. So, if we open up the command prompt and I just do an IP config, you can see my IPv6 addresses and my temporary addresses are all set there. And then if we go and now
Speaker A
test the IPv6 test. So, we can go here. Let's load up this website. And you can see your server possibly run by ISP have IPv6 internet access. This is my IPv6 address. This is my IPv4 address. So, and then we can run some tests. You can
Speaker A
see everything is all okay there. And other IPv6 sites. So, there's a whole bunch of websites that use IPv6. And this then gets testing it for you. Now, this does open another rabbit hole around the firewall ruling and stuff
Speaker A
like that, but I'm not going to cover that in this video at this point. But if you want to see a bit more of a deep dive as I start diving deeper into IPv6, let me know down in the comments below.
Speaker A
So, I hope you found this video lengthy and very useful. I have gone into quite deep into some areas. So, I will be splitting these up into different sections and posting them individually as well. So, if you do come across a
Speaker A
video that doesn't sound about right or doesn't look about right, then this is what it's from. So, if there is anything specific you want me to create a separate video on, I'm hoping to do one on the captive portal and one on high
Speaker A
availability, which I didn't cover too much in this one as I think they need a little bit more of a deeper dive into them. For now, this is inside wire.
Topics:UniFiUDM Pro Maxhome networkVLANfirewallstatic IPIoT networknetwork setupUniFi OSUbiquiti
