Simple setup Netgate 1100 - UDM

sven72

Good morning,
I failed to find on the forum (and elsewhere on internet) a simple guide on how to connect together the two products:
ISP <-> Netgate 1100 <-> Unifi Dream machine.
The idea is to have pfsense to manage the routing, firewalling on one end, and the UDM to take care of the WiFi clients and passing all the traffic back to Netgate 1100.
Would anyone have a simple guide on what to plug where, and what basic rules should be set ?
Thank you very much !
Sven.

SteveITS

@sven72 said in Simple setup Netgate 1100 - UDM:

Unifi Dream machine

I'm not at all familiar with that, but if it's a router with an access point there are generally two options:

Connect the WAN port of the router/AP to a LAN port of the pfSense. Can be via a switch. The wireless clients are on a different subnet from the LAN but can access LAN devices by IP address. LAN devices can't access the wireless subnet because of NAT on the router/AP .
Bridge the router/AP so the wireless clients are on the same network as the LAN. Some routers you can just plug a cable into a LAN port on the router/AP and leave its WAN disconnected. Others have a "bridge" setting somewhere.

johnpoz

@sven72 if your goal was just wifi - the UDM is a bad choice.. You be better prob return it or sell it and just get AP(s) from unifi.

While you could just use it as AP via how you can do any other soho router connect its lan port to your network and disable its dhcp server. It can not be adopted by any other controller.

And for it to update firmware and stuff on its ap you need to have its wan be able to talk to the internet. So you really need to connect its wan to a vlan that can have internet, etc. Or you would have to do any firmware and software updates of the UDM manually, etc.

You can set it up but its convoluted at best. Possible you could set it up so it doesn't do nat and use it as downstream router for your wifi networks, but then pfsense wouldn't be routing between any wifi networks.

If you want pfsense to be your networks router and firewall between networks - it again better/easier to just use AP vs the udm line of their routers with wifi.

stephenw10

You can't disable NAT on the UDM? I've never spent any time with one.

johnpoz

@stephenw10 I don't think you can disable its routing between wifi networks you create, and using it in like bridge mode is asked about a lot on their forums.

Its a bad choice in such a scenario.. It is meant to be the whole shebang for your network..

While you could get it to work - I believe there was a thread around here where setup a vlan for its wan so it had internet, etc. So you could have it do updates.

I really would suggest the user if what they want is pfsense as their router/firewall to possible look to just getting AP..

sven72

@johnpoz Thank you for your answers. The thing is, on top of AP, it comes with 4 ports that I can as well use. So the trade-off is to get a small switch + an AP, for that UDM. Quite pricy from my window.
Bridge mode would be the way to go indeed.

johnpoz

@sven72 said in Simple setup Netgate 1100 - UDM:

So the trade-off is to get a small switch + an AP, for that UDM

And that price is way lower than what UDM costs..

U6-lite 99$
Any smart 8 port gig switch $40

UDM - $400

sven72

@johnpoz Great indeed, the AP is very cheap from that angle, and ... missing a software to be managed I suppose ? The we add the cloud keys that do the job, and a bit of an evolutive model is $150. Still $300, so cheaper.
Thank you johnpoz!

johnpoz

@sven72 The controller can just run on a VM.. Or a docker even - I run mine as a vm on my nas.

You get a better AP, you get a better switch to be honest and more ports. While the UDM and the PRO and what the SE do have market I suppose. They have a new budget one coming out its in EA I think right now that is only 79$ that could be a good seller for them.

I am just really not a fan of all in one boxes.. For big one where that box would go is rarely the correct place for an AP.. 4 ports pretty useless and would need a switch anyway ;)

Once you put all that stuff into one box you limit yourself on features and functions, etc. While you can get a $40 smart switch.. You could also spend way more than that if you want more features at the switch level, etc. AP you can spend way more as well - but the U6 lite is better than the wifi that comes with that udm I do believe.

If you really want to make it work - it can be done, it would end of being a bit of a mess in how has to be configured to be honest.

Just a normal AP or even APs, a switch and your router makes for a clean setup with lots of options for expansion and configuration to really do whatever you would want to do..

There is a market for the UDMs even if your past your return window and want to get your money back. But if you don't want to use it as they intended a all in one box setup, its a pain trying to force it into your network and just use the functions you want.