UDM Pro Behind pfsense configuration

[@killerbees1199]

Oh my gosh. Thank you so much!!! Ever since I bought my pfsense I've been trying to figure out how to get the DHCP moved to it from my Ubiquiti. This video is exactly what I needed.

[@matthewcampbell1092]

Been running my UDM pro behind pfsense the whole time, I used the multiple IP addresses assigned to my from my isp to be able to get past my double NAT, great video

[@oozgaar]

Hi Matthew, can you share a diagram or something of how you have done this. I have exactly the same situation.

[@kristinaolson3963]

Thanks, I tried this with an Edge Router 4 last year for a few weeks and finally just gave up. I didn't like the double cabling, the double NAT, and felt a bit like riding in a helicopter - it was spending all of it's time trying to screw me and crash. ;) I agree with your assessment. Sell the UDMP if you want load balancing and advanced routing and get the CKG2+ and just be done with it. Thanks for your great videos as always.

[@MactelecomNetworks]

Yup double the work and not needed definitely does not need to be this complicated. Thanks for watching

[@xxxxxxsauron]

i did that setup with my ER12 and UDM SE and its been working fine for months. I have gone ahead and bought an 18TB HDD and 2 cameras for unifi protect.

[@maxherman11]

Ayyyy I do this too! Glad to know I'm not the only one! I think each device has it's pros and cons, and each one fixes the other, having both of them makes everything better!

[@TheCrazyCanuck420]

I'm glad I found this video. My UDM Pro SE locks up if download large amounts of data at 1Gbps so I have to limit the bandwidth of my clients to avoid this. I was hoping to put a pfsense box between my ISP and UDMP SE but this is sounding like a lot of work so I might just sell the UDM Pro SE.

[@ponchosalazar]

Happened the same to me. The problem is I changed my entire surveilance system (blueiris + reolink cameras) to Unifi Protect before knowing about this issue. Now I went back to my Untangle (now Arista), put it in front of my UDM SE, however, I followed a similar tutorial by Lawrence Systems.

[@xxxxxxsauron]

kzbin.info/www/bejne/hZ7QY6OHiq-CZtE

[@ASUSfreak]

That was a very fast video lol... As a Dutch speaking guy, I'll have to watch it more than once and pause in between to let it sink into my brainzzz :) But I was one of the many who had this same question of putting pfsense in front of unifi stuff hehehe

[@MactelecomNetworks]

You can slow down the video :) I try not to speak fast but it get away from me

[@ASUSfreak]

@@MactelecomNetworks hehehe true

[@timcarabott]

Love this video. Thanks for making it so simple. My UDM pro would be perfect but unfortunately, my remote Avaya phones don't support L2TP over IPSec, they just want pure IPSec so I've been trying to find a solution. Really wish Ubiquiti would improve the VPN features in the UDM Pro! This is my only fault with the Ubiquiti products. They're brilliant.

[@MactelecomNetworks]

I agree with you on the vpns ! Thanks for watching

[@jakubgodlewski639]

not the only fault, the hardware is great, but the firmware lags behind many other solutions

[@PBMS123]

Apply for UID and get oneclick VPN should work on most devices as its just an Ovpn

[@AceBoy2099]

At around 5:40 ish you are putting 1.1.1.1 for dns in each vlan dhcp, what if I'm using an adguard/pinhole ad blocker? Do I have to specify each one, or is there a way to set them all to look at 1 address and then point that address to said ad blocker? For the record, I'm trying to adapt this pfsense tutorial to opnsense I'm trying to setup, all VMs or dockers on my Unraid. I don't have my unifi stiff setup yet, but am trying to do a "pre-setup" of Opnsense for it.

[@JimtheITguy]

The same applies to any UTM device as covered in this video, does add complexity but allows for features of a UTM while keeping a UDMP/UDMSE to manage the rest of the network and protect

[@Marcusss63]

One question regarding this setup. I am using a Frotigate instead of a Pfsense. The thing is that if a try this aproach of VLAN-only network I am no longer able to see the devices or 'clients' connected to the UDM Pro. As if by having another device do routing disbles this feature. I think that in order for the UDM to know what device is connected on which port and have all the metrics, the UDM needs to act as the FW.

[@RealLordy]

Hi, Nice summary, but as you stated: I wouldn't do this kind of setup either as it makes things overcomplicated unnecessarily. My five cents (and I think I already mentioned it in other responses on other videos) is to let the UDM Pro do whatever it needs to do. However, it is always a good thing to put another firewall in front of it, but put that firewall in bridge mode (inline). The firewall does not handle any routing or blocking on the level of inter-VLAN communication or blocking specific inter-VLAN traffic, as this is not necessary because on that level the UDM Pro does what it needs to do very, very well). I did the inline firewall setup with Sophos XG, however, also works with PfSense I assume. The reason for this kind of setup: additional layer of IPS/IDS as I trust Sophos XG (or PfSense) more than UDM Pro for that (and in any case: it IS an additional security layer on which you can block anything you absolutely want to keep blocked when it comes to homenetwork to internet traffic and more important internet to homenetwork traffiic, even if you make a mistake on the UDM configuration and accidentally open up everything. However: I was wondering: is there a possibility to do https decryption in front of the UDM Pro (as in: where the in-line firewall is between internet and the UDM Pro?). The reason why I would do this is to avoid having to publish certificates to each and any device (I think). When the https decryption happens in front of the UDM Pro, only the UDM Pro would have to trust the certificate for the decryption (I might be dreaming here as I doubt this is even possible)

[@JP-ou3ht]

Hi there, I'm trying to do a similar setup with Sophos xg as you describe. Modem>Sophos in bridge with static IP>UDM. My UDM and LAN work fine but Sophos can't update firmware, patterns etc, almost like appliance itself doesn't have internet access. Did you do anything to enable this?

[@RealLordy]

@@JP-ou3ht It has been some while since I played with that, but if I remember well, I had the FW setup in kind of a hybrid mode: 2 physical NIC interfaces were bridged for doing the IPS/IDS on the WAN connection. I used a third one to connect to my management network. Firmware was always uploaded manually (so I downloaded it from the sophos site using a regular PC, did put it on a stick and then uploaded it to the machine). In my own home lab, any port / interface used for management of a device is very restricted on where it can access to and from where it can be accessed and sits on a controlled mgmt network that has zero internet access. The FW on the UDM is configured such way that for internet out the default rule is block all. Only specific VLANs or specific devices are allowed to go out to the internet, so it is very granular. Native LAN is always blocked from going out. Any traffic originating/initiated from the internet is also blocked by default, apart from a couple of things I am running for public. But in that last case, the destination is very restricted by VLAN/IP/Port and the destination machines are VMs in a DMZ that can only be accessed via hypervisor console, so full separation. In fact, the only networking device or appliance that is capable of pulling in updates from the internet directly is the UDM as that one has the WAN connected to it. As a consequence, all the UBNT equipment is fairly easy to update as the updates come in via the UDM Pro and are not requiring to pull those files in over the management network

[@JP-ou3ht]

Thank you so much for responding to this. I actually just got it to work. It's a bit bizzare setup but works beautifully and I'm using Sophos xg135 aplliance as Sophos FW host. I did the Wan-Lan bridge, plus LAN management port plus another WAN going to UDM Lan port. Then routed sd-Wan to that additional Sophos Wan port. Everything works on both UDM and Sophos side.

[@jeffm2787]

Bridged or routed, so long as it's not double natted. Just use PFSense as a router disabling NAT. You can then use Suricata, PFBlocker, ntopng, etc. Good video, but you made it more difficult then it needs to be. You can also then use DNS over TLS DoT on PFSense. The UDMP can handle DHCP, NAT, etc.

[@jeffm2787]

Replying to my own comment the UDMP is just too primitive to do this right. Bridge mode or 1:1 NAT on PFSense would be a good option. Routed you would need multiple public IP's and then it just all get's messy to route through PFSense. If Ubiquiti would make the UDMP a proper router life would be easier. The fact that you can't turn off NAT just kind of blows. If you could turn off NAT then you could just use it as a router and let PFSense do the translation alone.

[@austinstallion8187]

@@jeffm2787 Hey Jeff I read that you can turn off NAT on the USG routers - by editing the json file and that way you can use PFS as your router and firewall and have the USG pass the traffic through so that way you still get the fancy gui stats - im going to try it and see...

[@gametechfocus4295]

Does the way you are connecting between Netgate 6100 and UDM Pro allow multigigabit/10gigabit VLAN downstream?

[@jonathan.sullivan]

Seeing UDM-PRO and Ubiquiti don't have a native HA proxy or plugin support but pfsense does, I had to do something similar to this video. It's a common request and sad is still missing from the prosumer UDM-PRO.

[@ppmguire]

After watching this video, I think it's time I let go of my UDM Pro. I've only been looking into this because the 3.5Gb throughput cap for IPS will limit me in the near future, but from the first thought I didn't want to deal with over complication and double NAT.

[@SKULLEYEZ]

Hello, I was wondering if you could tell me if it’s possible to use UniFi protect camera and store the live footage simultaneously on the Nvr/cloud key gen2plus and on a cloud storage like Dropbox,backblaze in real-time.is that possible?

[@stephenreaves3205]

Wouldn't it be better to let the udm pro do everything as normal then just set up pfsense as a transparent firewall/proxy in front of it? That would give you the analytics on the udm dashboard and eliminate the weird middle subnet between the udm and pfsense.

[@jakubgodlewski639]

my question exactly

[@RealLordy]

Should have read the responses on the video before posting myself. Had the same idea: UDM Pro handles all the routing of the local network and also handles the inter-VLAN traffic (it does that very well). IDS/IPS can be handled by an inline firewall in front of UDM Pro with rules enabled both for LAN to WAN IDS/IPS and WAN to LAN IDS/IPS without having to sacrifice speed/processing power of the UDM Pro (although: in my case, IPS on UDM Pro is set to maximum and I still get 1Gbps throughput, so that's very fine). I consider the inline firewall in front of the UDM Pro as an additional layer of security covering for any mistakes made on the UDM Pro (e.g. accidentally leave a debug firewall rule "allow any/any" enabled.....). Any idea what about https decryption on such an inline firewall/web proxy in front of the UDM Pro (with regards to certificates for the https decryption ?)

[@matthewcollier4277]

Hi I’m moving to another country so need to have a way of circumventing geo-locking. I was thinking of adding a PFSense between the UDM and the modem to install a VPN on my system. Would this work?

[@travisaugustine7264]

I've been considering doing this because of UI's horrible IPv6 support.

[@kc0eks]

Says a lot about the unifi routing product if you have to find a way to make use of a routing device that sucks at it's job. Throw em away and just run pfsense and a cloud controller for unifi. Unvr if you need protect.

[@MactelecomNetworks]

I don’t mind the routing for UDM pro I don’t need PBR or whole home vpn but for the people that do they may need another option

[@ronm6585]

Thanks.

[@yourpcmd]

Thanks for the video. I would say either use pfSense OR the UDM Pro/SE on their own. It's fun to mess around in a lab setting, but in production, not so much. Ask me how I know 😉 Edit to say I've increased to your highest tier from the live stream the other day.

[@MactelecomNetworks]

Whatttt you didn’t need to do that thank you so much 😊 I’ve completed my next Grandstream video will be out Friday

[@alienJIZ1990]

There's really no good way to use pfsense as an edge device with the UDM Pro. I think you'd need a Unifi Layer 3 switch instead of a UDM Pro to avoid the double NAT problem. That or put pfsense/opnsense on the "side" rather than on the edge/perimeter, but port mirror the UDM Pro and feed it to pfsense/opnsense and use Snort or Suricata for IDS/IPS

[@xbhollandx]

Why buy a udm, to not use as a router? Just buy a cloud key instead

[@MactelecomNetworks]

My thoughts exactly

[@TVJAY]

How about just running Unifi on a virtual machine or docker? Then you don't have to spend any money.

[@MactelecomNetworks]

@@TVJAY well I mean you have to have something that host a vm or docker lol so in theory you are spending money. But he’s you can most definitely do that, or you can host the Unifi controller on your computer

[@kaisergurdeep]

Perhaps my use case, new to prosumer networking and went UniFi, got the UDM Pro, using it UniFi Protect. But say I want features that the UDM Pro can't provide such as better VPN management or more robust firewall, but I have already heavily invested in the UniFi ecosystem. This would be ideal, keep the UDM Pro for Protect and Controller for my other UniFi devices and still get pfsense features. Ideally I would have figured out what I wanted before bought the UDM Pro.

[@MactelecomNetworks]

@@kaisergurdeep ya that’s fair and I think a lot of people that is what happened

[@tommybronze3451]

Yes, but why ? You essentially put a device (UDM) that dials out for you outside of your network :/ And considering how their manufacturer approached a catastrophic security breach, begs to ask why you would use any of their "toys" (pretty graphs and facebook logging rather than ability to configure properly a nat-loopback to improve wifi-calling or decent wifi roaming constitute a toy, sorry).

[@sparkstack]

You should look again at that “massive breach”.

[@RealLordy]

@@sparkstack Indeed. It was a fired employee who caused the so-called breach. In the end, Ubiquity handled this very, very well. In fact, even much better than a lot of other vendors who try to keep things under the wraps. They were as open as possible on it (and in the hindsight, things that were not published initially was to avoid issues with the pending lawsuit against that employee. It was an ongoing criminal investigation that prevented to publish all info from the beginning)