Demystifying the Ubiquiti Cloud access

dbeato

I have been reading that setting up your own Unifi Cloud Controller or a Ubiquiti Cloud Key local and connecting to the Cloud Access you need to open the ports of your controller externally. I went ahead and setup a Unifi Controller internally without opening ports externally.

Setting up the Controller

### Add the Ubiquiti Sources
sudo echo 'deb http://www.ubnt.com/downloads/unifi/debian stable ubiquiti' |  sudo tee /etc/apt/sources.list.d/100-ubnt-unifi.list
#### Add the key
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv 06E85760C0A52C50
### Update the Repository
 sudo apt-get update
### Install Ubiquiti Unifi
sudo apt-get install unifi

Setup your Controller and enable Cloud access

Check the connection through the Cloud Access Interface
LOGIN: https://unifi.ubnt.com

Then press Launch and it will be using WebRTC to connect

Now check the connection list in the Ubuntu Server

dbeato@inventory:~$ netstat -nputw
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:27117         127.0.0.1:41672         ESTABLISHED -
tcp        0      0 127.0.0.1:27117         127.0.0.1:41650         ESTABLISHED -
tcp        0    384 192.168.150.119:22      192.168.115.102:58415    ESTABLISHED -
tcp        0      0 127.0.0.1:27117         127.0.0.1:41646         ESTABLISHED -
tcp        0      0 127.0.0.1:27117         127.0.0.1:41652         ESTABLISHED -
tcp        0      0 127.0.0.1:27117         127.0.0.1:41670         ESTABLISHED -
tcp        0      0 127.0.0.1:27117         127.0.0.1:41656         ESTABLISHED -
tcp        0      0 127.0.0.1:27117         127.0.0.1:41648         ESTABLISHED -
tcp6       0      0 127.0.0.1:41670         127.0.0.1:27117         ESTABLISHED -
tcp6       0      0 127.0.0.1:41672         127.0.0.1:27117         ESTABLISHED -
tcp6      32      0 192.168.150.119:60750   34.215.39.6:443         CLOSE_WAIT  -
tcp6       0      0 127.0.0.1:41652         127.0.0.1:27117         ESTABLISHED -
tcp6       0      0 192.168.150.119:54926   54.193.80.69:443        ESTABLISHED -
tcp6      32      0 192.168.150.119:42046   54.193.62.86:443        CLOSE_WAIT  -
tcp6       0      0 127.0.0.1:41650         127.0.0.1:27117         ESTABLISHED -
tcp6       0      0 127.0.0.1:41648         127.0.0.1:27117         ESTABLISHED -
tcp6      32      0 192.168.150.119:42042   54.193.62.86:443        CLOSE_WAIT  -
tcp6       0      0 127.0.0.1:41646         127.0.0.1:27117         ESTABLISHED -
tcp6       0      0 127.0.0.1:41656         127.0.0.1:27117         ESTABLISHED -
udp6       0      0 ::1:56080               ::1:56080               ESTABLISHED -

As you noticed there is nothing inbound and still the console is accessible from the Cloud Access Interface.

Sources
https://help.ubnt.com/hc/en-us/articles/115000169007-UniFi-Port-Requirements-for-Cloud-Key