Slashdot Mirror

One catch with pfSense and OPNsense is that they are not designed to be wireless access points, so you will need one or more separate APs for that. Really high end wireless NICs aren't available as PC plug-in cards in any case. The usual home routers can be used as access points by disabling the routing functions or not using them. If you take a typical home router and plug an Ethernet cable from your router into one of the LAN ports, configure a static IP address in the correct range (optional but recommended as it makes it easier to get to the router's control page if needed), and disable its DHCP server, it will function as an access point. Or you can buy dedicated APs from companies like Ubiquiti Networks ( https://www.ubnt.com/ )

Leaving the controller running (Mine's running on an Ubuntu VM on my NAS) also lets you track bandwidth usage, in case you have limits or capacity issues you're trying to monitor for.

Also also, you can (OPTIONALLY) configure the controller for remote login - sign into https://unifi.ubnt.com/ and gain the ability to remotely manage your network.

MSPs use this extensively, I use it to help family that wanted a more secure option & replace an aging OpenWRT Buffalo device that only did 2.4GHz and wasn't getting updates anymore. (I update theirs shortly after I update mine) Could also link multiple sites off one controller, and just host it for them. (Bit involved to get it set up initially this way as you need DNS entries for the controller then; I haven't gone down this path yet so haven't confirmed how hard)

They also sell a CloudKey (Intel Compute Stick, basically) that can run the controller; but since it only has 8/16GB of flash they don't recommend doing logging on the device.

There is no simple solution to this problem, it's a full network design issue.

My current network setup:
1. ISP Connection.
2. PFSense Firewall with Suricata.
3. Unifi Gateway: https://store.ubnt.com/collect...
4. Router: https://store.ubnt.com/collect...
5. Switch (Managed): https://store.ubnt.com/collect...
6. Wireless AP's: https://store.ubnt.com/collect...
7. ELK Server, so I can monitor the network and computers

Finally firewalls on all the computers, which are all running Linux, so I use UFW and Firejail to make everything nicely locked down. I don't use those exact parts, but close enough. Make sure to disable any built in AP's that come bundled with ISP Modem / Routers. Your ISP connection should ONLY be a modem.

There is no simple solution to this problem, it's a full network design issue.

My current network setup:
1. ISP Connection.
2. PFSense Firewall with Suricata.
3. Unifi Gateway: https://store.ubnt.com/collect...
4. Router: https://store.ubnt.com/collect...
5. Switch (Managed): https://store.ubnt.com/collect...
6. Wireless AP's: https://store.ubnt.com/collect...
7. ELK Server, so I can monitor the network and computers

Finally firewalls on all the computers, which are all running Linux, so I use UFW and Firejail to make everything nicely locked down. I don't use those exact parts, but close enough. Make sure to disable any built in AP's that come bundled with ISP Modem / Routers. Your ISP connection should ONLY be a modem.

There is no simple solution to this problem, it's a full network design issue.

My current network setup:
1. ISP Connection.
2. PFSense Firewall with Suricata.
3. Unifi Gateway: https://store.ubnt.com/collect...
4. Router: https://store.ubnt.com/collect...
5. Switch (Managed): https://store.ubnt.com/collect...
6. Wireless AP's: https://store.ubnt.com/collect...
7. ELK Server, so I can monitor the network and computers

Finally firewalls on all the computers, which are all running Linux, so I use UFW and Firejail to make everything nicely locked down. I don't use those exact parts, but close enough. Make sure to disable any built in AP's that come bundled with ISP Modem / Routers. Your ISP connection should ONLY be a modem.

There is no simple solution to this problem, it's a full network design issue.

My current network setup:
1. ISP Connection.
2. PFSense Firewall with Suricata.
3. Unifi Gateway: https://store.ubnt.com/collect...
4. Router: https://store.ubnt.com/collect...
5. Switch (Managed): https://store.ubnt.com/collect...
6. Wireless AP's: https://store.ubnt.com/collect...
7. ELK Server, so I can monitor the network and computers

Finally firewalls on all the computers, which are all running Linux, so I use UFW and Firejail to make everything nicely locked down. I don't use those exact parts, but close enough. Make sure to disable any built in AP's that come bundled with ISP Modem / Routers. Your ISP connection should ONLY be a modem.

A USG is actually an EdgeRouter with extra code to interface with the UniFi controller. It can still be configured the way the EdgeRouter is. The beauty of the UniFi controller is having the most commonly accessed areas at a glance. And you don't have to leave it running unless you are utilizing guest services ( and who doesn't want to be able to set their WiFi up to accept payment from the family/friends when they come over? ). You can even run it from a Raspberry Pi.

A USG is actually an EdgeRouter with extra code to interface with the UniFi controller. It can still be configured the way the EdgeRouter is. The beauty of the UniFi controller is having the most commonly accessed areas at a glance. And you don't have to leave it running unless you are utilizing guest services ( and who doesn't want to be able to set their WiFi up to accept payment from the family/friends when they come over? ). You can even run it from a Raspberry Pi.

https://www.ubnt.com/edgemax/e...

Just a happy customer. Firewall, VLANs, scheduling, logging, etc. Can't beat the price either.

I don't think the idea was to standardize on a single hardware vendor.

That's not how any of this works.

First, the tower is grounded and at the same potential as earth. The primary concern is not electric shock.

Please, tell me how AM broadcasting works (first and last visible paragraphs of section 5.5.5.2). Because for the majority of AM transmission towers you are dead wrong - literallty.

"Most AM radio towers are series fed (end fed at the bottom) and have a ceramic insulator at the base. A few smaller ones are shunt fed about 20 feet up the tower and are grounded at the base, and a variation are metal poles grounded and have wires insulated from the pole as vertical radiators."

Up to 50,000 watts says that the primary concern is electric shock. A secondary concern is RF exposure.

Try Googling AM radio, maintenance, and "hot tower" before you lecture about areas that you plainly lack experience in.

I would buy a proper AP, I really love the stuff from https://www.ubnt.com/unifi/uni...

Perhaps it fails the trustworthy part because of this

CONSENT TO USE OF DATA

You agree that Ubiquiti may from time to time collect and use device information (such as hardware model, firmware version, device identifiers, device performance information and device operation parameters), collected in a form that does not personally identify you, to facilitate the provision of Ubiquiti Firmware updates, authenticate Ubiquiti products, verify compliance with the terms of this Agreement, and improve Ubiquiti's products and services

I have heard that the Ubiquiti Edgerouter is a low cost, fully featured piece of hardware.

https://www.ubnt.com/edgemax/e...

Never owned one myself, but a lot of people who listen to Security Now seem to like it.

You use Ubiquiti but haven't found a wired only solution? Looked at EdgeRouter? If your AP is UniFi then look at their USG. It's basically the same hardware as the EdgeRouter Lite but running the UniFi software.

You use Ubiquiti but haven't found a wired only solution? Looked at EdgeRouter? If your AP is UniFi then look at their USG. It's basically the same hardware as the EdgeRouter Lite but running the UniFi software.

Here you go... https://www.ubnt.com/unifi/uni... It runs a Debian derivative, powered from 802.3af POE or a Micro USB port, and includes a MicroSD slot for expandability. It's an awesome headless server for low power applications.

Just go "enterprise", I got one of these https://www.ubnt.com/unifi/uni... with one of these https://www.ubnt.com/edgemax/e... for $150 or so total, it really lights up my whole house, doesn't have lots of network names for different wireless frequencies, easily isolated guest network, super long range, and if I really wanted, I could add an outdoor one and light up my backyard too.

It wasn't perfect (you need a computer with some weird java app to seup and update the setup), but overall, I'm very happy with my results, and it didn't cost me much extra over a mid-range router ($150 vs $75).

Just go "enterprise", I got one of these https://www.ubnt.com/unifi/uni... with one of these https://www.ubnt.com/edgemax/e... for $150 or so total, it really lights up my whole house, doesn't have lots of network names for different wireless frequencies, easily isolated guest network, super long range, and if I really wanted, I could add an outdoor one and light up my backyard too.

It wasn't perfect (you need a computer with some weird java app to seup and update the setup), but overall, I'm very happy with my results, and it didn't cost me much extra over a mid-range router ($150 vs $75).

I want to second the above post. I have the exact same experience at my home. I went with two (so far) "UniFi AC Lite AP" https://www.ubnt.com/unifi/uni... for my rather elongated apartment. They just work. Highly recommended.

They sit behind a SG-2220 pfSense appliance https://store.pfsense.org/SG-2... which also just works.

This combo costs a bit more than typical consumer grade would, but as a reward it is absolutely rock solid, with great coverage and equally great performance.

Google Access may implement their own 3.5 GHz wireless internet service -or- they might partner with an existing wireless internet service provider (WISP). This approach leverages Google's end user presence and strengthens the WISP serving rural areas, small towns & cities, or the outskirts of a large metro area. It all fits. Google finances the deployment of the fiber backbone (this is the backhaul to an internet), a tower is erected (or leased or shared with a partner WISP), point to point links connect towers, and 3.5 GHz or 5 GHz radios link a tower to the end user business or residence. The end user bandwidth will be better than many end users receive now at a reasonable price. My AT&T dsl line is 5 MB down / 1.5 up for $58 a month for ONLY internet. A speed of 10MB to 50MB meets all my needs; VOIP, video streaming, and gaming. Yes, more speed is great, but for home use, I don't need more. Time Warner offers 300 MB to my location, but not at a price I'm willing to accept. For those that have 1 GB for under $100 a month, consider yourself blessed. Clearwire had the right idea but deployed the wrong technology. Many customers in their homes or business often complained of poor signal quality. Wireless radio designs are far better than 10 years ago. Ubiquiti Networks is on the right path. https://www.ubnt.com/ They may, or may not, have the right mojo, ... but they are working on a piece of the problem. Read more here: http://www.wispa.org/ ...or here: http://www.wirelesscowboys.com...

http://www.ubnt.com/ + RadioMobile + Renogy solar panels and charge controller + 155Ah VMaxTanks SLA/AGM battery (or two)

I was in your situation and did a 5 mile PTP backhaul with PowerBridge M5 400mm dishes and 900MHz for PTMP. I was actually worse off with only satellite internet availability that had terrible latency (700-1500ms+) and strict bandwidth caps (38GB/month, throttled at 85%) and no bandwidth accounting reporting. I actually had to gang together two WildBlue connections to get that and was paying just over $200/month.

Fixed terrestrial wireless is amazing and it will work for you if you put in the effort. Expect to spend $1500-2000 to get the radios, solar panels, batteries, STP cables, battery boxes, masts, etc.. I enjoy 50Mbps now.

Ubiquiti makes a line of cameras with an NVR, that is probably more trustworthy than the loads of cheap Chinese DVRs heading to our shores.

https://www.ubnt.com/products/...

It's all IP based stuff no Analog/CVI/TVI - so you can't use your existing siamese cable.

For those of us who want quality, but don't want the hassle of complicated configs, the Unifi USG is pretty nice as well - and it's cheap.

https://www.ubnt.com/unifi-swi...

So far, I'm a big fan of what Ubiquiti is doing these days.

Ubiqiti EdgeRouter is exactly this: dual core MIPS64 @ 1Ghz, 512Mb memory and a removable USB flash stick for storage.
https://www.ubnt.com/edgemax/e...
This is ample for my needs. I bought the 3 port version about a year ago for £80.

https://blog.netbsd.org/tnf/en...

As of today, NetBSD-current has an uptime of about 6 months - which is when I made the last kernel modifications to support the NPF firewall.
This is more uptime than any other SOHO gear I have and the performance of the unit is exceptional.

The Ubiquiti UAP Access Points I would consider home-network through to enterprise class. A three pack is cheaper than all but the Trendnet router. Coupled with a Security Gateway and you have a bloody easy setup that is fairly price competitive and easy to maintain.
https://www.ubnt.com/unifi/uni...

I guess my feeling of what home-network class may be out of the norm but I found the ubiquity gear easier to setup and configure than the Fritzbox given to me by my ISP.

Ubiquiti Networks offers IP cameras that are priced quite reasonably. The controller that runs the cameras and records the video footage is available for Windows, Debian and Ubuntu. No source code available unfortunately. If you don't have any spare hardware, you can buy their NVR appliance which runs the same controller software.

More information on the cameras here: https://www.ubnt.com/unifi-vid...

Ubiquiti's UniFi cameras will do a direct RTSP feed, and are fairly inexpensive for the quality. You can also install their UniFi software on a server to capture multiple feeds, store video, and rebroadcast RTSP if desired. https://www.ubnt.com/products/...

Indeed. Their controller software can do RTSP translation: http://community.ubnt.com/t5/U...

Do you really think a bunch of guys in dark suits didn't show up and basically threaten them with jail time?

Yes.

As paranoid as is sounds, these days I think it is entirely plausible that a national security letter or somesuch was used to say "if you tell anybody about this, we will put you in a deep dark hole ...

It is using a commercially available product for the purpose it was designed. If it was that illegal to do, the FCC would have confiscated all of Ubiquity's product and levied a fine for violation of the FCC regulations.

This technology will never see the light of day,

You can buy them from more than 200 distributors worldwide. The genie is out of the bottle, the horse has left the barn. It's not the full system, but anyone with any technical proficiency in networking can put it together in their sleep almost.

I have a system with a pair of COTS 5GHz bridge wireless boxes that does exactly the same thing this system is supposed to do. I fear no dark suits telling me to stop.

There are two ways of doing this.

One is to look for alternative remote desktop software that does work. I've had success with TeamViewer - YMMV.

Two is to put in a lan-to-lan VPN at each site and configure your routing appropriately - either go with something like DD-WRT or get something that will do it out of the box like a Ubiquity EdgeRouter Lite ($100 and it has 3x gigabit ports and enough horsepower to route at an appreciable fraction of that rate)

https://www.ubnt.com/edgemax/e...

Just use a couple of small business routers with built in VPN. They do all of the different subnets and wireless and all of that stuff. They're a few hundred bucks each. http://www.cisco.com/c/en/us/p...

Ubiquiti has a small router with enterprise level features for less than $100. A site to site VPN and VLAN support are just a few of it's features and all you need to solve this problem.

I'm still running a Juniper SRX-210 at home, but I've been happy with the UniFi APs and EdgeSwitches I have from Ubiquiti so this little router is definitely on the short list when the time comes.

I could see this being an Ask Slashdot 15 years ago when IPSec was a new idea, but c'mon - there are devices you can buy for $100 that have a fucking web wizard to set up IPSec tunnels between them.

No amount of college coursework will fix someone being too lazy to use Google. Or Amazon.

Cameras from Ubiquiti, Vivotek, Axis, and many others support retrieving the current image jpg through a http request to the camera..

Ubiquiti Networks make some decent cameras with a whole bunch of decent features including fetching a snapshot with an HTTP request. They are designed to send their video output to their DVR software (which is actively supported on Linux) but in practice if all you need is to access still images over HTTP and video over RTSP then you can set up the control software on your laptop, fire it up once to configure the camera and then switch it off and the camera will continue to run without the DVR.

Of course, as other posters have pointed out, the right answer is to brew your own with a Raspberry Pi and a Pi Camera.

Ubiquiti Networks make some decent cameras with a whole bunch of decent features including fetching a snapshot with an HTTP request. They are designed to send their video output to their DVR software (which is actively supported on Linux) but in practice if all you need is to access still images over HTTP and video over RTSP then you can set up the control software on your laptop, fire it up once to configure the camera and then switch it off and the camera will continue to run without the DVR.

Of course, as other posters have pointed out, the right answer is to brew your own with a Raspberry Pi and a Pi Camera.

http://www.ubnt.com/products/#...

For $99 it's hard to beat:

http://www.ubnt.com/edgemax/ed...
http://www.amazon.com/EdgeRout...

http://www.ubnt.com/products/#...

For $99 it's hard to beat:

http://www.ubnt.com/edgemax/ed...
http://www.amazon.com/EdgeRout...

http://www.ubnt.com/edgemax/ed...

I dont' have gb internet, but it's the best router I know of for 100 bucks. Pair it up with a good wireless AP solution (I use ubiquiti for that as well) and your golden.

Or, buy a box that already runs vyatta. The Ubiquiti EdgeRouter

http://www.ubnt.com/edgemax/ed...

At less than $100, with build in switching, embedded linux and apt-get support, you can't go wrong.

http://www.newegg.com/Product/...

Oh, and it's quiet. (No fans)

And wait, there's more! Their $175 version the Edgemax Pro has 5 ports and 24/48v poe. (You'll need to buy a third party power brick for 48v poe, but it's worth it)

I just went through this and here's the short summary of my research. DIY - go with a PC Engines Alix board or a Soekris board if Intel NICs matter to you. You can buy them here (link below). Install PFSense. Done. Easy. Or if you want a more command line approach install VyOS. https://soekris.com/ http://www.mini-box.com/ALIX-b... https://www.pfsense.org/ http://vyos.net/wiki/Main_Page If you want an off the shelf solution the best product I've found for the money is by Ubiquiti Networks called Edge Router lite. http://www.ubnt.com/edgemax/ed... As far as VPN acceleration. With the Alix or the Soekris you can have a dedicated Crypto Accelerator. I haven't gotten to the VPN portion of my build yet. It only really matters if you need fast sustained throughput on a point to point IPSEC. If you are just connecting from remote software decoding will probably be fine. PFsense has OpenVPN included and makes this easy. VyOS or another route will require more hands on.

I just bought a Ubiquiti EdgeRouter Lite and I LOVE it! Yes it takes a bit more network knowledge to get it setup (as opposed to an Apple Airport...) but WOW is it robust! Enterprise class FAST with a highly tweakable CLI!

http://www.ubnt.com/edgemax/ed...

Sure there's only 3 ports (it's a router/firewall!) and no wifi (it's a router/firewall!) but WOW what a router/firewall it is! At a stunning $99.00!

Oh and it runs on top of Debian with Vyatta. So yeah this thing has some solid bones!

Ubiquiti also makes some very good WAP's!

If you like to tweak a router/firewall this might be your new best friend!

No I don't work at Ubiquiti. I'm just a shameless fan of a cool product!

Don't bother screwing around with anything less then AC and enterprise grade AC at that. What you should do is buy a good quality small business Gigabit router with management and POE+ and get something like: http://www.ubnt.com/unifi/unif.... This will provide your house with excellent full speed Wifi, suitable for almost anything you can throw at it and the wired router will allow you to have an almost no downtime wired solution for when you need extra juice. This is the setup I use and honestly for 10 months of the year I don't even think about it because I never have to.

Actually, current equipment is capable of delivering 150mb+ per 40MHz sector and new AC based equipment, that was just announced today, is capable of 450mb+. This has huge potential for bringing service to these underserved areas. http://www.ubnt.com/airmax/roc...

...if you're familiar with the Cisco IOS CLI, Vyatta is another solution...

Vyatta/VyOS are actually a lot closer to JunOS syntax, FYI. Which is good, since recent IOS syntax makes less sense than ever.

If you're not the DIY type, there's also Ubiquiti, who has their own fork of Vyatta called EdgeOS. Ships standard on all their EdgeMAX routers.

Last time I tried DD-WRT, getting IPv6 on there was a CLI bitch, and I don't think it supported PD at that time.

I'm using pfSense now & never looked back to a SOHO router again. If you have an old P4 lying around with 512 ram, throw an extra 10/100 NIC in there & give it a spin. If you like it, you can roll your own fanless case & get the power consumption back down to an appliance level.

For a while I used the linksys I had as an access point, then swapped it out for a UniFi & again, couldn't be happier for the price.

Back to the topic, you'll find that the current state of IPv6 is not only an ISP issue, but also a hardware & software issue. Even pfSense only recently really supported IPv6 properly with 2.1, and many other devices I've tried have varying levels of support.
Ironically, the most IPv6-complete item I've found is Windows 7/Server 2008R2.

While I'm on a kick recommending stuff, check out ipvfoo for Chrome once you get IPv6 working. It is helpful to see how many sites still don't support IPv6 native: https://code.google.com/p/ipvf...

Much further than a mile with a pair of these. http://www.ubnt.com/airfiber

They say they can hit 13 KM with them at 1.4 gb/s, and faster at shorter ranges.

It's not as reliable as it could be yet, but I've set up a couple of these now and they worked for my jobs well enough. (Assuming version 2, original release sucked if you had more than one or two cameras.)

Is it a complete solution? Not yet. I've been working with some of the mFi stuff and it's okay too.

For an on the cheap system, I'm pleased enough. I'd *really* like to see the two product lines integrate with each other better though.

http://www.ubnt.com/mfi
http://www.ubnt.com/airvision

It's not as reliable as it could be yet, but I've set up a couple of these now and they worked for my jobs well enough. (Assuming version 2, original release sucked if you had more than one or two cameras.)

Is it a complete solution? Not yet. I've been working with some of the mFi stuff and it's okay too.

For an on the cheap system, I'm pleased enough. I'd *really* like to see the two product lines integrate with each other better though.

http://www.ubnt.com/mfi
http://www.ubnt.com/airvision

Any commercial grade AP is going to cost you around the $500 mark. At the least.

Wut?

https://store.ubnt.com/unifi.html