Replacing My UDM Pro With pfsense

[@chrisslaunwhite9097]

Awesome video, been looking to switch my firewall over from the USG to pfsence. Thanks!

[@howeldh]

Great video, I needed the information on switching from a UDMP to a different controller. I did something similar a few months ago. I set up a PFSense firewall and tried to keep the UDMP to use it as a controller and to keep using Protect with my cameras. It all worked, though I couldn’t get new G3 Instant cameras to adopt and the UDMP was a bit flaky behind the firewall. To do IDS and IPS with Suricata is more complicated than just turning it on in UDMP. Also, the statistic screens in UDMP are easy and straightforward. You have some PFsense and can use add-ins but it is not as easy. I do like being able to use SNMP to query firewall information. I switched back to UDMP for now. However, I will be switching internet services in December and will have by-directional gigabit internet. When I switch, I guess I will have to go back to PFSense and will have a UDMP for sale.

[@neilgreene]

Why will have have to switch out the UDM after moving to moving to new internet provider?

[@johnheller2311]

Great video. Clear and concise.

[@michaelsims7728]

Thank you for this video! I have been looking at picking up the Netgate 6100

[@gmaclean1]

Provided you get your hands on a US-XG-16, and a Whole Home 3000, you can put the SFP into the US-XG-16, which will go SFP to the UDM Pro. I'm getting 1.7gbps on my 1.5 Gbps Bell connection. Admittedly the US-XG-16 is expensive, but it works awesome.

[@gmaclean1]

This isn't so much an issue with PPoE that Bell uses, as Bell Aliant uses DCHP in Nova Scotia. Rather the UDM Pro doesn't have a 2.5 Gbps link. The US-XG-16 takes care of that for you.

[@justinchlan7893]

Cody. Great videos 👍. I'm on Bell using PPPoE as well. USG PRO 4 however. 1G down and 1G up no problems

[@michaeldautry]

I am designing a network for a 1 Gig fiber in home network, I want to use the USG Pro 4 with a cloud key. Does the cloud key affect network speed? I am new to this and appreciate your response.

[@justinchlan7893]

@@michaeldautry Not at all. That's what I use.

[@michaeldautry]

@@justinchlan7893 thank you very much!

[@Hoerli]

0:35 Thank you for these informative words. With this Ubiquiti is out in my selection

[@jean-lucward6587]

On PFSENSE and Unifi controller, how do you get a printer on LAN to be seen by all VLAN's? Thank you for your time and all your videos, they've been a great help.

[@雨田水木]

When will the tutorial videos of firewall and IPS\IDS come out? I'm ready.

[@neilgreene]

I ran pfSense for about 5 years+. Def has more network configuration capabilities.

[@dannythomas7902]

Are you any good with wireguard

[@neilgreene]

@@dannythomas7902 all day long

[@tiger7617]

Hello, Cody! Do you have any news about speed limitation? On UDM Pro, is speed still limited to 600 Mbps on PPPoE connection? Does it also apply to UDM SE? Or has it been fixed in the meantime with a firmware update? Thanks!

[@danemorgan7231]

I’d like to know this as well

[@evelbsstudio]

I would like to know this aswell

[@zubair5244]

how to connect more than 400 users with a single udm pro , according to our vender it is supported for 1200 users at a time but after 400 it got stuck and another dream machine pro is not a feasible solution. is it possible to use pfsense software based firewall and all cpu and memory is used by this instead of UDM pro. please share a little details about it as I am new to it

[@mychaelhouck2404]

I'm ignorant so someone help me out please. What is "advanced routing"? I've got a few VLANs here at home, but no issues with my UDMP really. I don't really need VPN.

[@MactelecomNetworks]

Policy based routing, if you wanted a vlan going through a VPN provide like nord VPN you can’t. Things like that. I love the UDM pro and will be changing back when the UDM pro se comes out

[@mychaelhouck2404]

@@MactelecomNetworks ahhh, I didn't realize you couldn't route one VLAN through nord. Is this being resolved in the SE? Thanks a lot Cody, you're stuff is pretty awesome.

[@MactelecomNetworks]

@@mychaelhouck2404 I don’t think so maybe in a future firmware update . I just wanted to test out new equipment so swapping out my UDM pro for a few months until SE came out felt like a good idea :)

[@Richard_GIS]

3:40 why vlan only and not corporate with a vlan number, i got confused, what is now the difference, as I followed a previous video of you where you used the corporate for iot and guest and the firewall settings to block the routing between them

[@HunterLaska]

Before, Cody was using the dream machine pro. So using the "corperate" setting would tell the switches to create the VLAN as well as telling the router to create the subinterface to allow the VLAN to get to other places in the network. Using the "VLAN" setting only tells the switches to create the VLAN. In this video, he used the "VLAN Only" setting becuase he will no longer have a Unifi Router. So even if he used the "cooperate" setting, there would be no way to setup the subinterface thorugh unifi becuase that device will no longer exsist. If he did later adopt a router to that unifi network and plugged it in there while using the "Corperate" setting, it could highjack the traffic becuase could become the default gateway. So in this situation, he is only telling the switches to create the vlan and then he will manually set the subinterface(s) on the PFSense firewall/router. If that makes sense.

[@GrishTech]

Tip: If you want to give your devices access to the internet via an any any rule, but not allow them access to anything else, you can then expand the advanced options in the rule and allow allow it out a certain gateway. If you want your devices to be able to reach a controller with this config, feel free to add another rule on top that will allow that net to reach a certain ip/network (your unifi controller as an example).

[@MactelecomNetworks]

Good tip thanks

[@scotsparaman]

I had a UDM-Pro, took it back after 2 days and got a refund. Was really disappointed as i really liked it. Have 1gb down. My Synology RT2600AC gets between 750 and 950 depending on time of day. The UDM-Pro was hitting between 350 and 450 so went back to my Synology.

[@filipetorchiamiranda]

Nice! Maybe if everyone start doing this, Unifi will improve UDM Pro to something better than that UDM Pro SE crap update...

[@giancarlosrm]

Great video, I'm in the debate if I keep my Unifi or go to Pfsense!!!! The video help me a lot!!!!!

[@RobinMoran]

Does the same concept work with Mikrotik router? Also, do I have to setup VLAN in Mikrotik, or can I leave the VLAN on in UDMPro for my IoT devices?

[@mikeberg8546]

I've got that same green alien skull, must be 25 years old and was full of suckers when I got it. Never seen another one :)

[@MactelecomNetworks]

Alien pops!!! They are so good

[@Obtuse94]

So glad I found this new channel! Quick question though Cody, what is the name of the LED light panel you have behind you? I know it is a bit of topic for this video.

[@MactelecomNetworks]

Hey, They are nanoleaf panels

[@smgBy2001]

Is there any reason to have a dream machine pro if you are using a PfSense firewall? I will be installing Unifi AP's and plan on possibly using their door access at some point

[@Somites]

Excellent video! Quick question. Since I plan to use Ubiquiti cameras anyway I should be able to use a Cloud Key Gen2 Plus for NVR but also run Unifi Network software? Thanks!

[@MactelecomNetworks]

Hey yup thats correct

[@Somites]

@@MactelecomNetworks thanks!

[@aldi3556]

Hi Cody, Great video and great content on your channel, keep up the good work! I have a question, on the move to the new UniFi crontoller, wouldn’t a back up from the udmp restored on the new controller have worked? Thanks

[@MactelecomNetworks]

Hey, Yup you could have done that. But I just showed a different process

[@aldi3556]

@@MactelecomNetworks thank you for confirming

[@rambutangonzales6533]

could you show how you import guest users, and how you apply captive portal in pfsense? Or is the Hostfy controller still providing the credentials for your guest users?

[@MactelecomNetworks]

Hmm ill have to take a look into doing other videos on captive portals. I do have some for Unifi and pfsense but they are getting a little older now

[@enderst81]

With the latest goofiness at pfSense, why not OPNsense?

[@fredbuzzell117]

If you have the aggregation pro, why not setup the inter-vlan routing on that as to take the load of the firewall.

[@yourpcmd]

So, take out the UDM because of PPOE issues when the UDM doesn't have PPOE (the SE model does) but leaving the switches that do have PPOE. How does that make sense?

[@MactelecomNetworks]

You have your self confused. PPPOE isn’t for power over Ethernet . It’s the point to point over Ethernet protocol for your wan connections

[@yourpcmd]

@@MactelecomNetworks aaaah.. I thought you said PPOE, not PPPOE. Hard to hear at 38,000 feet traveling back to the states. On a side note, American Airlines has great wifi.

[@MactelecomNetworks]

@@yourpcmd lol no worries. I still love the udm pro and will be using the new se

[@Pabula]

Impressive video, really interesting pfsense + ubuiqui content. One question, you created a VLAN for your Hikvision cameras, can the camara server access multiple vlans? what trying to say is can the cameras server be on the main lan and still access the vlan of the camera's so it can grab the video feeds? I dont want to need to go thorugh the internet to access the camara server, main reason why i dont want move the server to the camera vlan.

[@MactelecomNetworks]

Hey the main lan will be able to see everything the Hikvision vlan won’t be able to access anything. I have a few ports on my Synology nas which is hosting the hikvison footage. The one port is tagged with the Hikvision vlan

[@Pabula]

@@MactelecomNetworks Thanks for the reply. So the PCs (like a server) on the main/default LAN always has access to any component (cameras) on the VLANs?

[@5280Woodworking]

Great video, well done. About the only place I got lost was the "set inform" stuff you glossed over from stale DHCP leases. Couldn't you just power cycle the devices or am I missing something unique about Unifi equipment in this regard? Thanks!

[@MactelecomNetworks]

Yup but the set inform command is to push the devices to another controller

[@jeffsmith3419]

Sorry if it was already answered. Can you post a speed test after migrating ? I have the same issue 1g connection with PPPoE and a UDMP.

[@jeffsmith3419]

@@alexdonofrio6140 Thanks for the suggestion, however Smart Queue's are already disabled

[@lindamora7]

Cody what's your hourly rate

[@johnestan]

How can I tell if my internet connection is using pppoe? I have gigabit at&t fiber. I've been seeing slower than expected download speeds but full upload speed. I've been pulling my hair out looking for the problem.

[@MactelecomNetworks]

PPPOE you would need a username and password for the ISP connection to work. If you did not put that in under WAN then you are not using PPOE. You can check click edit on WAN. You most likely are using dhcp

[@ikkuranus]

Even worse it uses 802.11x and depending what equipment at&t & you have determines weather you can bypass their shitty router or not If you have a separate ONT + gateway you might be able to bypass but it's not a guarantee. Also, most residential fiber connections (at&t included) are shared and suffer when more people in your area use them at the same time. This can explain your worse download speeds as not everyone is torrent freaks or doing other activities which would constantly saturate the upstream.

[@xsillycarnifex]

USG is one of the most disappointing devices. You can’t add static DNS entries.

[@idjpashka]

I'm using UDM Pro on 1Gbps fiber connection and have no issues with PPPoE protocal. I'm getting my full 1000/1000 Mbps speeds and with "Threat Management" turned on. What ISP are you using?

[@MactelecomNetworks]

Oh really are you going through your providers modem or directly connected? I’m will bell Canada

[@idjpashka]

@@MactelecomNetworks I'm using providers modem. My ISP is CenturyLink.

[@MactelecomNetworks]

@@idjpashka oh ya if I use my providers modem I get full speed as well

[@idjpashka]

@@MactelecomNetworks Ohhh!!! I see. I didn't know you can hookup directly to UDM Pro. Still learning here. Thanks for fast reply's.

[@derrysan]

pfSense, can't be wrong.👍👍👍

[@worldvistor]

Where is video storage? How did we setup the storage place?

[@MactelecomNetworks]

Do you mean for my cameras? I have a UNVR Pro

[@georgelza]

... interesting what you mentioned about PPPoE on UDM Pro... I will be having 300Mbps soon... but I can see that growing easily to the 1Gb within lifespan of the planned UDM... curious, any knowledge if the UDM Pro SE will have the same limitation, Whats the cause of this, processing power... Was thinking of putting a pfSense device in front of the UDM, as my Edge modem/router/FW, Lan going into WAN of the UDM Pro SE from where my network then hangs. With this it will def lighten the load on the UDM... Big reason for the pfSense though is the want of a outgoing VPN into NordVPN... (I'm not aware if you can do outgoing not he UDM, know you can do incoming) ???

[@ikkuranus]

stacking routers is a terrible idea (at least where NAT is involved)

[@georgelza]

@@ikkuranus ... changed the design a bit. will be putting a pfSense as Modem/FW/Router/Edge device, feeding into a Unifi 24 port PoE Get 2, The AP's will be patched in there. Busy re-laying network out, different networks for uses,

[@georgelza]

@@ikkuranus ... any chance we can take my thinking offline, love to have someone with more experience give some input/insight.

[@COR0NAD0]

Holy crap that was a great video. Very insightful and very detailed. The only question I have is, what is Hostifi and does it cost extra? Since you did remove your UDM-Pro.

[@MactelecomNetworks]

Hostifi is about $50 a month. If you’re just a home user would be better to host it locally or on a cloud key

[@justintemp]

@@MactelecomNetworks so it's not worth hosting on the cloud given the Camera files are kept on the ckg2+ and could be lost or taken?

[@bbsport]

@@MactelecomNetworks Thanks for the video. Noob question, how do you host locally without the UDMP in the mix? Thanks

[@MactelecomNetworks]

@@bbsport I’m hosting in the cloud using hostifi. You can host a Unifi network controller on a computer or on a cloud key . There’s a few ways it can be done

[@MactelecomNetworks]

Well hostifi just host the network controller. If you don’t run a consulting business or msp hostifi probably isn’t a great deal for you I host my customers on it so that’s why I used it for my install

[@AngryDadTech]

Hey Cody, thanks for this video. how would it differ for a self hosted controlled on a nuc? Just set the host inform to the ip address of that nuc? Where would it sit in the network if it were behind the pfSense. Looking at replacing the UDMP also .. sadly i Netgate lost my 6100 in the post it seems :D so i'll have to grab a 3100 for now

[@LampJustin]

The nuc has to be able to talk to all the ubiquity devices, so in the same net, or in another net with appropriate firewall rules that allow access between each other

[@TayschrennSedai]

Isn't the 6100 literally twice as expensive as the UDM Pro?

[@midwestiowashooter]

Where did you define the .10 network in PFSense? It was the main LAN on PFS but UniFi didn’t have a .10 defined and the default was kept .1.

[@withcookies]

Great video! Great to see how you use different vendors together on the same network. Just wondering, why did you go with hostifi over a cloud key? Would a cloud key work in this deployment?

[@MactelecomNetworks]

Well I’m actually back to my UDM pro 😂 but love PFsense and still use it . I use hostifi for some clients so no need to pay for a cloud key when I have one hosted

[@jmurray0220]

@@MactelecomNetworks Hi Cody. I thought you needed the UDM Pro for Unifi Protect & Door Access?

[@MactelecomNetworks]

@@jmurray0220 Wel I’m back to using my UDM pro but you can have Unifi access, protect, and talk on the cloud key gen 2 plus

[@neogenzim1995]

@@MactelecomNetworks I take it you're leaning UDM pro then, in your usecase? thank you for the great content.

[@nekotherion7317]

Good video, glad ya finally took the plunge, let us know how it goes in the future

[@willersrs]

I'm having the same problem with speed contracted in my UDM 1gb contracted and receiving 500,600mbps

[@HaemonAK]

Just curious if you have tried the Beta release of firmware and network on the UDM Pro. They had a PPPoE fix built into it. Not that you should have to use a beta, but just mentioning it. Interested in seeing the PfSense in your network though.

[@MactelecomNetworks]

Hey nope I didn’t try it. But when the update releases to the general public I’ll give it a shot

[@HaemonAK]

@@MactelecomNetworks I'm running it at my office with network, 2 cameras and 2 talk phones. The new update sped up the network app big time, very responsive even on the "new" interface.

[@MactelecomNetworks]

Oh wicked I’ll have to try it out. This video is not saying I won’t be using the UDM pro any more because I will be . But trying out new hardware helps everyone learn

[@Dy13yDx]

PPPoE Fixed??? anyone can confirm this? I also suffer from this known issue too!!

[@justinchlan7893]

@@Dy13yDx Still has issues. Read on the unifi forum's. Sounds like the UDMP SE is working ok though.....

[@jlford30]

What are you using as the new controller?

[@MactelecomNetworks]

I was using Hostifi in this video. But you can have a controller on your local computer, a Docker image, on a raspberry pi or a cloudkey

[@jlford30]

@@MactelecomNetworks Excellent thanks.

[@AndreasLink]

Awesome, but why pfSense and not OPNsense?

[@MactelecomNetworks]

Just used PFsense more. I’m actually going back to my UDM pro 😂 I just really like it. But the Netgate 6100 is great

[@freebs3545]

OPNsense ftw :)

[@MactelecomNetworks]

Also good

[@wcmedic69]

Great when can you switch my network over? I assume my ppoe and static block would work better on this?

[@MactelecomNetworks]

Send me an email

[@wcmedic69]

Sent

[@ZimorKilled]

So, does this mean Ubiquity is going to cut you off with free equipment?

[@MactelecomNetworks]

Why would they? I still use and love their equipment I’ve just upgraded my firewall

[@ZimorKilled]

@@MactelecomNetworks Yup, I like Ubiquiti too, however, this known PPPOE problem is going on more than 1 year and it seems so silly for Ubiquiti to go dark. Doing "workarounds", "reconfigs" is just not acceptable for expensive equipment.

[@realburn6845]

Hi, I got a quick question: did you ever do a setup using the UDM Pro as router, but not using the FW functionality and instead put a firewall inline (without using routing functionality on the firewall). I was just wondering if an inline firewall is capable of blocking inter-VLAN traffic (in my specific case I was planning to use Sophos XG as inline firewall)

[@ramush88]

is the Netgate 6100 powerful enough to handle IPS on a 1000/100 connection?

[@MactelecomNetworks]

Not sure haven’t got that far with it

[@andreas7944]

Yes. Depending on the workload you should be able to handle at least twice as much. It has the same CPU as the 5100, but the rest of the hardware has been improved. This device is really for middle to large setups including a multi-gigabit uplink.

[@ValorHeart]

I suffer from the PPPOE issue aswell with the UDM-Pro and they don't solve it, it sucks!

[@MactelecomNetworks]

I hope they get it fixed. Stil love the UDM pro and will be selling and installing them

[@rick5056]

Are you not using opnsense anymore? You seem to have very capable equipment for that.

[@MactelecomNetworks]

OPNsense I just did videos on this was never in my home office. A lot of people requested a video so i made one. OPNsense is great though but I prefer PFsense

[@rick5056]

@@MactelecomNetworks It was because of your video that I bought a Protectli FW6D with i5-8250 from Amazon and installed Opnsense into it. I am using that for my home network.

[@MactelecomNetworks]

@@rick5056 awesome it’s great I’ve just been working in PFsense longer so know the interface better

[@squadramunter]

You should consider updating to the beta release. It should be fixed already in the beta release.

[@MactelecomNetworks]

I’ve heard that. I may test It out in my lab

[@George-kj6bm]

Great, but you normally state what you want to achieve and then do it. I don't know if I missed a video but a lot going on. Love pfSense can't wait to learn how to work it from your videos

[@MactelecomNetworks]

I did a video showing off the 6100 and said I was switching my UDM pro out for it. Thought I mentioned it in the video but may not have come across clear.

[@George-kj6bm]

@@MactelecomNetworks my bad!

[@MactelecomNetworks]

@@George-kj6bm no worries at all

[@George-kj6bm]

@@MactelecomNetworks big question is, when will we get to see the speed test and hopefully >600mbps!

[@MactelecomNetworks]

@@jacquesdesroches8961 I was getting about 940 Mbps

[@datmayne]

I use both 🤔 works great lol

[@Parkville64152]

I switched from UDMPro for the same reason. Poor performance PPPOE and went to Untangle which was simple.

[@MactelecomNetworks]

I’m planning on loading untangle onto one of my protectli and doing a series on it

[@GrishTech]

That's right. If you're on x86, PPPoE can only use a single thread/queue on freebsd due to intel. You are switching platforms, yet it's the same issue on the other side. Sad they can't fix it. Unfortunately, the freebsd community stated that it's not possible to fix because Intel themselves did not resolve the issue with the NICs themselves (and how the load traffic into queues with PPPoE). My protectli gets about 750 down with PPPoE. You would need a really high clocked cpu to get gigabit PPPoE. However, with ARM and a netgate appliance, you might get full gigabit with PPPoE.

[@gamerneversleep4200]

I was thinking of using pfsense in my home for firewall my router suck at handling 3 people.

[@AFiB1999]

After you going to this route, you will never going to look back! No more Soho for me.

[@gamerneversleep4200]

@@AFiB1999 maybe i will go back cause of frequent power cut in my area and i cannot run my computer on battery.

[@dannythomas7902]

I was die hard sonicwall then Sophos now Pfsense bargain and better than both, 1year down

[@George-kj6bm]

Can't wait to watch this

[@mullvaden83]

American ISPs are soo far behind europe. Still using PPPoE. In sweden we dont even know what it is. ISPs here only use DHCP. And has always done since forever.

[@mrpcakes]

naww, i removed my netgate 3100 and went with unifi. too many issues to keep up with firewall rules, speeds were no where need what i wanted.

[@MactelecomNetworks]

I’m just having the pppoe issue. I’ll be back to the UDM pro when the UDM pro se is released

[@MerchantNation]

so basically...udm pro is still not stable🤦‍♂️

[@MS-fh7mw]

I don’t know about Canada but I never get the speeds my ISP promises At best maybe 80%

[@MactelecomNetworks]

Ya you never get the exact speed you are promised. But with the pppoe issue I’m losing about 40%

[@MS-fh7mw]

@@MactelecomNetworks let us know how much your speed improves. Thanks

[@MactelecomNetworks]

@@MS-fh7mw it’s already at 960mbps so a change of 360

[@balla2172]

Pfsenae is used by fortune 500 companies you can't really honestly compare the 2 as they are targeting different audiences