News for hackers. Stuff that matters.
Re:How we solved our office Wi-Fi problems by walrus01 on Wednesday September 26, 2018 @03:41PM (#18079515)
You can also 'cloud' host a unifi controller on a VM somewhere and set up the APs for "layer 3" management, where when you originally provision them you tell each AP to register to a specific hostname. It's all done over TLS. Each AP just needs to be able to get a DHCP lease, default route out to the internet, and to resolve hostnames. A small Unifi controller can run on a $10/month VM if you don't want the 'cloud key' device on premises.

Or if you happen to have your own hardware on premises a unifi controller on debian can be a really small Xen VM that runs at an average load of 0.02, your xen or KVM hypervisor can be as small as an Intel NUC stuck to a plywood board on the wall of a telecom room in the building.

Re:How we solved our office Wi-Fi problems by xoa on Wednesday September 26, 2018 @04:12PM (#18079804)
I agree with this, I don't even use a VM somewhere I just run it on a system I already had at home and point a lot of other sites at it L3, no issues in a few years. Obviously it depends on the kind of uptime and home setup you've got, but the take home should be that running a Unifi controller doesn't inherently have to cost anything, not even for L3 adoption. There is zero cloud tie-in needed, or even colo/VPS or whatever, not via Ubiquiti and not for any other 3rd party either. You certainly can use any of those if you consider the advantages they offer (which can certainly be very real!) worth it, or just plain like to do it that way.

Unifi absolutely has flaws and missing parts that are easy to run into if you push into more powerful aspects of networking, but overall it's a delightful foundation, and critically to me was the feature of zero online dependencies. I feel like that's the Net at its best, a smooth progression from your own random kit all the way up to multi region failover hosting or whatever but purely based on bandwidth/uptime/maintenance/cost considerations, never any permanent ties. Can centralize/decentralize/move around/selfhost/colo/contract out at will. Unifi can match where you're comfortable with, is has pleasant pretty safe defaults, and they're great about long term updates and support. At the end of the day I can forgive a lot over that, particularly given the contrast it is with so many other offerings.

Re:How we solved our office Wi-Fi problems by walrus01 on Wednesday September 26, 2018 @04:16PM (#18079846)
My home unifi controller doesn't even 'run' 99.9% of the time, it's not necessary to have the controller online once the APs are provisioned. It's just a debian stretch virtualbox VM that lives on my laptop, with its virtual ethernet interface bridged to the laptop's physical interface. I bring it up on the same L2 fabric as the APs if I need to make any changes, and then suspend it again.
Re:How we solved our office Wi-Fi problems by xoa on Wednesday September 26, 2018 @04:51PM (#18080164)
>My home unifi controller doesn't even 'run' 99.9% of the time, it's not necessary to have the controller online once the APs are provisioned.

That's also a good point, the reliability is solid and things won't fall apart even without a controller. That said the controller is necessary for certain nice extras like stats, guest portal, etc. Granted the average HN crowd may have other appliances or systems to manage that, and plenty of people do use a controller locally installed on a notebook purely to adopt and setup APs and then never worry about it again, but given how cheap the minimal VM needed would be or Ubiquiti's local "cloudkey" (worst name ever, has nothing to do with the cloud, it's just a stick computer dedicated for this), I think it's worth considering having a controller running if someone was going that way anyway. Might as well have the management console up all the time. My only point was that running it is highly, highly flexible.

Re:How we solved our office Wi-Fi problems by basch on Wednesday September 26, 2018 @03:55PM (#18079651)
for comparison

UniFi Cloud Controller

$299.00/year for up to 10 devices

$498.00/year for up to 20 devices

$697.00/year for up to 30 devices

+ $199.00/year per 10 additional devices

When I include my time, one less things to break or be misconfigured, one less vendor involved, etc... $299+ a year is worth it vs $120 a year + AWS/Azure, but if youre trying to do it on the cheap, I agree with you.

Does the Unifi mobile app work with the setup you described?

Re:How we solved our office Wi-Fi problems by walrus01 on Wednesday September 26, 2018 @03:58PM (#18079668)
For me, that's really overpriced, since the ongoing maintenance and updates on a debian stretch based unifi controller (which is just a JRE and a blob of ubnt provided software) is super simple and takes maybe 20 minutes of my time a year. I have a ton of things doing different network infrastructure purposes that are also based on debian stretch amd64 so it's barely any additional effort.

You can easily control 50 to 100 ubnt APs on the cpu, ram and disk resources of a $10/month VM. Big difference between like $700-900/year and $120/year.

Re:How we solved our office Wi-Fi problems by basch on Wednesday September 26, 2018 @04:02PM (#18079707)
Does the Unifi mobile app work with the setup you described? If you are outside the network? Do you use a vpn client to connect your phone back inside the network?
Re:How we solved our office Wi-Fi problems by walrus01 on Wednesday September 26, 2018 @04:05PM (#18079742)
Yes, it should. Assuming you're running your unifi controller on a public ipv4 /32 somewhere on the internet (at some commodity VM host), it's entirely up to you how you want to lock down access to it. Some people do leave the TLS1.2 web browser admin control panel login exposed, but on a non standard port, other people set up iptables ACLs to only allow traffic from a certain IP range, other people set it up so that you can only reach the admin control panel login page over openvpn. Entirely up to you and depends on your level of experience with linux sysadmin/firewalling tasks.

However I am more in favor of having the unifi controller on the same premises as the APs, or at least in the same metro area network as the APs, in your own private network. Just throwing the L3 management option out there for people who truly want 'cloud' hosted everything.

Re:How we solved our office Wi-Fi problems by basch on Wednesday September 26, 2018 @04:26PM (#18079932)
>more in favor of having the unifi controller on the same premises as the APs

But when your premise is MANY sites across the country, and you are using a single controller, only ONE site gets the controller on prem, OR you have many controllers running.

>Big difference between like $700-900/year and $120/year.

At the end of the day, it comes down to what my time is worth doing other things (not how much im paid, but the opportunity cost of me managing management interface infrastructure, stability, and resources. Unifi cloud, for lack of a better phrase, just works.)

Re:How we solved our office Wi-Fi problems by walrus01 on Wednesday September 26, 2018 @04:27PM (#18079943)
> But when your premise is MANY sites across the country, and you are using a single controller, only ONE site gets the controller on prem, OR you have many controllers running.

yes, totally agree, in that sort of scenario with many premises you would set up your own internal L3 management of the APs, in your own management VRF, in RFC1918 IP space.