Found this and might be helpful to this traffic issue. In a Windows Computer you could use Glasswire on a wim to find out what traffic is going out of it:
https://github.com/zerotier/ZeroTierOne/issues/1174
https://github.com/zerotier/ZeroTierOne/issues/1018
https://github.com/zerotier/ZeroTierOne/issues/867

i'm not going to turn on logging to find out.

@jaredbusch said in ERL and Smart Queue throughput:

If the CPU was not limiting things, the unit should be pull 100Mbps
The Smart Queue is set to 100.

Of course, that is what I was referring.

@mattbagan said in Looking for stock of the EdgeRouter 4:

@JaredBusch ubnt has them in their store now https://store.ubnt.com/collections/routing-switching/products/edgerouter-4

I ended up purchasing from DoubleRadius.

@tdantzler said in Yet another UBNT EdgeMax vs Unifi:

@JaredBusch I'm looking at the AirMAX lineup and have used a few of the products like the NanoStation 5AC loco with fabulous results.. but the rest of the stuff looks a little more than consumer grade. Do you think this is an accurate breakdown -

Unifi - Small to Medium business with low customization needs. Primarily for Access Layer and down. Nice interface but not standard for routing setup

UniFi routers and switches, yes. UniFi Access Points, are solid for any purpose.

Also, I would personally never use UniFi routing/switching in SMB. But I know some people just live that pretty pane of glass that they never look at after 3 weeks.

@gjacobse said in Ubiquiti released EdgeOS 1.9.7:

@scottalanmiller said in Ubiquiti released EdgeOS 1.9.7:

Just got my EdgeRouter for home hooked up after years of it disconnected.

Welcome back to the world of Internet.....

And to good Internet equipment, as well!

Seems pretty clear that UBNT has gone public with this at this point.

Seems like the ERL is probably right for you most of the time.

Yeah, WTF?

Are you connecting a permanent IPSEC tunnel with some other network you do not control?

No problem!

@Dashrender said in EdgeMAX EdgeRouter software release v1.9.0:

I used to do VLANs for broadcast storm reasons.. but as I've sense learned, if you have broadcast storms, you have another problems you need to solve anyway... and the VLANs probably won't save you, the switches will still be swarmed and might be brought to their knees anyhow... so, yeah.. today, if I need more than 250 devices in a network, move from /24 to /23 or even /22.

Migrating an existing network though - kinda a huge pain in the ass.

Definitely true. But to bring this full circle, the person in question wants to setup VLAN for learning how to implement them and how they work, and that is awesome.

Did you end up putting in a support ticket? Pretty unfortunate you haven't received a reply yet as to whether you should or not. Hopefully it's fixed soon.

@tonyshowoff said in Hello Mr Chinese IP based hacker:

That's why we set any WAN-fancing SSH port to something obscenely high like 41022, not for "security" but because of the logs. In fact, all of our sshd services run following that pattern, as does our internal HTTP(S) servers but the load balancers take in 80/443.

This prevents as many services as possible from running as root, which anything running port < 1024 does. I don't think most people even know this. At the very least if there's a NAT in play, one can always set ssh and web services ports much higher and just translate the ports to avoid the same issue.

(I know there are some work arounds like setcap on Linux, but in general this is the default behaviour on most machines)

For some reason this made me think of The Venture Bros, Hunter Gather says:

And we want your sad ass undercover agents to stop trying to infiltrate our group. Frankly we're tired of killing them and we can't afford the body bags!

Useful piece of information. Thanks!

@JaredBusch

Good to know. I'm planning on starting this later this week. If I can get this working, I'm going to replace a PFSense firewall with an ERX or lite. Right now, this is the only thing that I dont have setup for ERX yet.

@fuznutz04 said in EdgeMAX Alpha release v1.8.5alpha1:

@JaredBusch said in EdgeMAX Alpha release v1.8.5alpha1:

@fuznutz04 said:

@JaredBusch said:

@fuznutz04 said:

@JaredBusch said:

@fuznutz04 what type of OpenVPN? Site to site? I have wrote up that process before back when I was learning EdgeOS originally. I can update it and make it clean.

No, I was looking to set it up as a server so I can remote in via the OpenVPN client. Basically, secure access to my home network when I need it. Right now, my experience with Open VPN is limited to the package available for PFSense. I'd like to do the same on my ERX.

I have that setup also. both as a certificate based and as a password based. at different sites. I really need to make new documentation anyway.

You would be hailed as "the man" if you produce that content and share it. 🙂

It is already on the ubnt forum. buried somewhere in posts I made 2 years ago there.

Just needs updated and reposted.

Hey Jared,

Any update on this new guide? I'm getting ready to replace a PFSense router with an ERX and the only thing holding me back is a working OpenVPN solution for the ERX.

I've been working on IPSEC VPN issues that are client affecting and have not had time to revisit the OpenVPN process.

annoyingmuse no more? i'll have to fire up some of these again and play with the VPLS/MPLS configs. whoop

For comparison here is a session going over OpenVPN to another site with an 80/5 cable modem service.

Maxing under 8mbit on average.

C:\iperf3>iperf3 -c 10.202.10.49 -p 9676 -F office2013.iso -t 120 -P 4 - - - - - - - - - - - - - - - - - - - - - - - - - [ 4] 113.01-114.01 sec 128 KBytes 1.05 Mbits/sec [ 7] 113.01-114.01 sec 384 KBytes 3.15 Mbits/sec [ 10] 113.01-114.01 sec 256 KBytes 2.10 Mbits/sec [ 13] 113.01-114.01 sec 128 KBytes 1.05 Mbits/sec [SUM] 113.01-114.01 sec 896 KBytes 7.35 Mbits/sec - - - - - - - - - - - - - - - - - - - - - - - - - [ 4] 114.01-115.00 sec 256 KBytes 2.10 Mbits/sec [ 7] 114.01-115.00 sec 384 KBytes 3.15 Mbits/sec [ 10] 114.01-115.00 sec 256 KBytes 2.10 Mbits/sec [ 13] 114.01-115.00 sec 256 KBytes 2.10 Mbits/sec [SUM] 114.01-115.00 sec 1.12 MBytes 9.45 Mbits/sec - - - - - - - - - - - - - - - - - - - - - - - - - [ 4] 115.00-116.00 sec 256 KBytes 2.10 Mbits/sec [ 7] 115.00-116.00 sec 512 KBytes 4.20 Mbits/sec [ 10] 115.00-116.00 sec 128 KBytes 1.05 Mbits/sec [ 13] 115.00-116.00 sec 0.00 Bytes 0.00 bits/sec [SUM] 115.00-116.00 sec 896 KBytes 7.35 Mbits/sec - - - - - - - - - - - - - - - - - - - - - - - - - [ 4] 116.00-117.00 sec 256 KBytes 2.10 Mbits/sec [ 7] 116.00-117.00 sec 384 KBytes 3.15 Mbits/sec [ 10] 116.00-117.00 sec 0.00 Bytes 0.00 bits/sec [ 13] 116.00-117.00 sec 0.00 Bytes 0.00 bits/sec [SUM] 116.00-117.00 sec 640 KBytes 5.25 Mbits/sec - - - - - - - - - - - - - - - - - - - - - - - - - [ 4] 117.00-118.01 sec 256 KBytes 2.07 Mbits/sec [ 7] 117.00-118.01 sec 384 KBytes 3.10 Mbits/sec [ 10] 117.00-118.01 sec 128 KBytes 1.03 Mbits/sec [ 13] 117.00-118.01 sec 128 KBytes 1.03 Mbits/sec [SUM] 117.00-118.01 sec 896 KBytes 7.24 Mbits/sec - - - - - - - - - - - - - - - - - - - - - - - - - [ 4] 118.01-119.01 sec 384 KBytes 3.15 Mbits/sec [ 7] 118.01-119.01 sec 384 KBytes 3.15 Mbits/sec [ 10] 118.01-119.01 sec 128 KBytes 1.05 Mbits/sec [ 13] 118.01-119.01 sec 128 KBytes 1.05 Mbits/sec [SUM] 118.01-119.01 sec 1.00 MBytes 8.40 Mbits/sec - - - - - - - - - - - - - - - - - - - - - - - - - [ 4] 119.01-120.01 sec 384 KBytes 3.15 Mbits/sec [ 7] 119.01-120.01 sec 128 KBytes 1.05 Mbits/sec [ 10] 119.01-120.01 sec 128 KBytes 1.05 Mbits/sec [ 13] 119.01-120.01 sec 256 KBytes 2.10 Mbits/sec [SUM] 119.01-120.01 sec 896 KBytes 7.35 Mbits/sec - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bandwidth [ 4] 0.00-120.01 sec 27.5 MBytes 1.92 Mbits/sec sender Sent 27.5 MByte / 1.39 GByte (1%) of office2013.iso [ 4] 0.00-120.01 sec 27.3 MBytes 1.91 Mbits/sec receiver [ 7] 0.00-120.01 sec 30.1 MBytes 2.11 Mbits/sec sender Sent 30.1 MByte / 1.39 GByte (2%) of office2013.iso [ 7] 0.00-120.01 sec 30.0 MBytes 2.09 Mbits/sec receiver [ 10] 0.00-120.01 sec 25.6 MBytes 1.79 Mbits/sec sender Sent 25.6 MByte / 1.39 GByte (1%) of office2013.iso [ 10] 0.00-120.01 sec 25.5 MBytes 1.78 Mbits/sec receiver [ 13] 0.00-120.01 sec 25.1 MBytes 1.76 Mbits/sec sender Sent 25.1 MByte / 1.39 GByte (1%) of office2013.iso [ 13] 0.00-120.01 sec 24.9 MBytes 1.74 Mbits/sec receiver [SUM] 0.00-120.01 sec 108 MBytes 7.58 Mbits/sec sender [SUM] 0.00-120.01 sec 108 MBytes 7.53 Mbits/sec receiver iperf Done.

Everything that you are doing sounds logical and makes sense to me. I'm pretty confident you are not going to hurt anything here. Will it help dramatically? No idea there. But I think it is likely to help without much risk. Seems like a good idea.

@Dashrender said:

If they are all on the same controller, why does rebooting affect the others? Isn't the controller suppose to managing that?

The point of auto is to have the AP detect what channels are in use around it and pick the best one. That will obviously be different each time any AP reboots. When the first one reboots, it will immediately affect the ones next to it as the signal drops and the unit around it detect a difference. Then once it powers back on, it has to detect what is around it and then determine what channel to use.

High density deployments are much different beasts than an office building with 3 or 4 AP scattered around for coverage.