Ubiquti STUN rule help

Modesty · Aug 16, 2018, 6:19 PM

Hi

I have a warning in my unify controller. I need to make a STUN rule:

Communication with controller is partially degraded.
This device is not able to connect to the internal STUN server on your Controller. Please check if the device is able to reach the STUN server on port 3478 and read UniFi - Troubleshooting STUN Communication Errors

Help text here: https://help.ubnt.com/hc/en-us/articles/115015457668-UniFi-Troubleshooting-STUN-Communication-Errors

Rule here:
https://lh3.googleusercontent.com/vQfxlDZUze4KYlTnWYmkjMAZ96iiybBnJO_tAR00vxMk6z4cGewIL02ol3QHVz8AeBjd18i

Can i get a tip how to make this rule in my pfsens box?
My AP in on IP 192.168.200.20

Thanks

johnpoz · Aug 16, 2018, 6:29 PM

So your controller is on different layer 2 network than your AP? Why do you not have your controller on the same layer 2?

So you have multiple routers - ie the unifi? And pfsense.. your showing setup on unifi controler for a port forward? Do you have say a unifi USG? How is that tied in with pfsense?

Where is your controller in this network, where are you AP?

Modesty · Aug 16, 2018, 7:20 PM

Hi, thanks for answer.

I dont have a lot of IP stack know how.
So i dont aqtuallly understand our feedback, sorry.

Under is my setup:
image url)

johnpoz · Aug 16, 2018, 7:48 PM

ok where is controller? connected to that same switch.. That seems to be 1 layer 2 network.. So pfsense has zero to do with AP talking to controller.

I have controller 192.168.2.11/24 and 3 AP all on 192.168.2.0/24 as well at 192.1168.2.2,.3 and .4 pfsense has nothing to do with them talking to each other. There is lots of info about stun errors on their forums.. You seem to be looking at it when the controller is on a different network than the AP..

But from your drawing if controller is on this same dumb switch on the same network 192.168.200.0/? Then pfsense has nothing to do with it.

Did you try a simple reboot of your AP(s) or controller?... What firmware are you running on them, what controller version?

Modesty · Aug 16, 2018, 7:56 PM

Hi johnpoz

Thanks for info.

My switch is a Toug Switch from ubiquity (manageable)
I dint have a HW controller, but i use SW Ubiquiti UniFi Controller v 5.7.20

I did a total reboot of all my system and now all is in order. I have no idea why... and no idea why this happended.

Thanks for helping me with pro info!

johnpoz · Aug 16, 2018, 7:59 PM

Where is the controller software running? On a computer connected to that switch I assume?

If your switch is smart/managed switch - did you setup different vlans on it? You didn't include any of that info in your drawing so it seems like its all just 1 flat network this 192.168.200/?

5.7 is bit old ;) might be their stable release.. Im on beta 5.9.22 with firmware 3.9.47 on the AP

Modesty · Aug 16, 2018, 9:54 PM

Hi

well, versions are old due to system is very stable, everything is working really good. Last update i did in April.
I have speeds close to 95% of 1gbit on wired connections, cat6.

I'm running the controller on my win7 64b computer.

Yes it is one flat lan, everybody sees everything. 192.168.200.1-255

I have no vlans. I would really like to make a vlan, because AP 3 is in a rental apartment i have, so status now is that we share net, and residents in apatment sometimes play their Netflix on my chromecast... I would like to split out the apartment AP in a vlan, but i dont manage to do it. I have tried to get some help, also from ubiquiti, but i dont manage to make it work.

I did have a plan to get remote help (teamview) but with no success. Maybe you are the guy :-)

johnpoz · Aug 17, 2018, 9:52 AM

So if eventhing is 1 flat network then no pfsense has zero to do with any stun problem with AP talking to your controller.

As to vlan.. Simple enough to do yes.. Create another SSID, lets say its ssid-guest, put a vlan ID on it - lets call it 100.

Then on the switch port connected to your AP set vlan 100 as tagged. On switch port connected to pfsense also tagg vlan id 100.

On pfsense create a vlan, lets make the network 192.168.100.0/24 pfsense IP 192.168.100.1 and put this vlan on the physical port your lan is on. There you go other than creating the rules you want on this new vlan your done.