This is my networking rack.
A couple of months ago, I posted a video about how I built my first
networking rack and it got a crazy amount of views. Like... where did y’all come from?
So today I’ll show you how I set up my home and office network to be secure as well as
convenient for my needs and still allow me to use smarthome equipment that might
not necessarily have the best security standards. I love being able to control
my home with smart tech, but I also realize the implications of doing so, so I’ve taken
that into consideration when building out my LAN and wireless access for my network.
In this video, I’ll walk you through how I set up my Ubiquiti UDM Pro for a home office
with high security standards, as well as for a house with a bunch of smart home IoT devices.
I’m Shannon Morse, welcome to Morse Code. If you like videos about security,
privacy, and networking, subscribe below.
One important step I had to do was switch from my ISPs modem to the Ubiquiti Dream Machine Pro.
You know anytime you get a new modem, you gotta set it up with your ISP and they
have to allow the connection. Same applies with my fiber connection and my UDM Pro.
I wanted to completely disconnect my ISPs box from my network entirely and replace it with
the UDM Pro - not bridge it. My ISP offers a modem for free and I used it for a while since my plan
was to eventually upgrade to a networking rack setup, so I didn’t wanna buy one off the shelf
as a holdover. Now, the ISPs box is sitting in my closet as a backup in the event I ever need it.
To switch from the ISP’s setup to my own:
The first step was to find the ISP modem and log into the admin panel to figure out what
the PPPoE login information was, which was different than my admin login information.
The Ubiquiti equipment can be setup on the WAN as PPPoE/DHCP with a username and password,
but I had to get that information from my ISP because it wasn’t provided when I
originally setup my account with them. This allowed me to bypass their provided box.
In the UDM Pro: Go to settings, internet, WAN, edit, switch IPv4 Connection to PPPoE,
enable VLAN ID, change ID to 201,
under IPv4, the Username should equal your ISP username and password. Then choose apply changes.
I also had to put their box in bridge mode so it would stop doing the PPPoE connection
itself. This mode passes through the connection to the UDM Pro so the UDM
Pro could get a public IP address and actually connect to the internet. This
also helps with avoiding any issues with having a double NAT or a double firewall.
PPPoE isn’t necessary for all ISPs but for mine, it was. Some ISPs may just need you to
put their box in bridge mode and use DHCP on the Ubiquiti WAN, but my ISP
did need that PPPoE login information added to the UDM Pro in order for it to work right. I
did have to chat with customer service via their online portal to find the required information but
that was pretty much the biggest hurdle in this setup, so I wanted to make sure to mention it.
Once that was done, we had internet!
Next up is the UDM Pro setup but I do appreciate y’all for supporting my content. Shoutout to
my newest BuyMeACoffee smores including Grant, Roger, Debt Wingman, and Anonymous.
Links are below for ways you can snag access to bonus content by becoming a Smore supporter.
Back to the UDM. You’ll see both older firmware
and new firmware in this video so just keep that in mind if you skip around.
Once I got the UDM connected to the interwebs, I was able to find my UDM from my desktop via
192.168.1.1 - the usual modem home address. And also, if you’re trying to connect to
your UDM pro from the same wired network, you can also access it via unifi.ui.com.
Upon first boot it’ll tell you “Your Unifi Dream Machine is connected to the internet”.
So hit next, and follow the on screen steps. The first step is to name your
UDM Pro to whatever you want... I named mine a weeb anime nickname because it’s a thing I do.
After that hit next and it’ll tell you to either log in with your [UI.com](http://UI.com) account
or create a new UI.com account. This is my first UDM Pro, so I’m setting up an account
for the first time. Since this is used to manage my network as an admin portal,
I’ll skip this page. This is the account you’ll want to keep safe and secure.
Ok, account created, next is the update schedule. I have mine set to update weekly,
on Sunday nights, at 3AM. It’s so important to update routinely especially in the day
and age of attacks like log4j and log4shell, which, no surprise, the Ubiquiti equipment was
vulnerable to before patches. So always update your things, people.
“oh but, Shannon, what about bugs?” Then factory wipe or rollback. Next step.
Configuration lets you choose whether you want your network to auto-optimize (as in, just let
it set up the most commonly used and important settings for you) and you can enable sending of
diagnostic and performance info to Ubiquiti. I keep this disabled, but turned on auto-optimize
for convenience sake. This is a home network afterall, so I want to keep it easy as cake.
The UDM Pro will do some speedtests. Here you can see I was getting about half my
regular download speed, but full upload on my fiber connection. Not bad at all.
I did adjust the set speeds in the GUI since I have fiber to the door. The next page allows
you to review your settings and Finish set up and wait for the device to get ready.
Once it’s set up this will take you to your main portal screen, where if you have
multiple devices or networks, you’ll be able to choose whichever device you wanna log into.
So here’s my main page, brand new (on an older firmware), showing that I have nothing connected
yet, except for a switch, that’s my UniFi Switch 24 POE. Anytime I add a new device it’ll show up
on this network map. So clicking into Devices shows me my UniFi switch on it’s new IP and
the option to Adopt or Upgrade. Click Adopt to add it to your network. I got a few questions
on the last episode that asked me why I had a wifi AP inside my networking rack. The reason
why is because I was in the process of “adopting it” to my network. It was really easy to do since
I just plugged it into the same port that my old access point (my old wifi router) would’ve
eventually been plugged into. That way once I was ready to mount this new AP to the ceiling,
I just needed to remove the old one, plug the new one into the POE cable, and I was done.
It was way better than mounting it then setting it up in the event there was an issue. There
was a ladder involved because it was going on the ceiling. So yeah, I did it the easy way. The next
time you see a wifi AP sitting in a metal rack, dont make the assumption it’ll be there forever.
Jeez, it’s like I didn’t have anything to do with WiFi pineapples and antennas for
the past decade of my life. I know a little bit about how wifi works.
Going back to the dashboard and you can see there are two devices connected - the UDM
Pro and my switch. At this point I can plug in ALL of my client devices and decide which
ports they plug into on the switch. I have a LOT of IoT smarthome devices,
plus each room in the house is wired, and I have a ton of wireless products too.
So this list includes all the things and it’ll show you which port they are connected through.
If you see multiple clients all connected to the same port, it’s likely because they are
all connected to the same Wifi Access Point, and that AP is connected through that port number.
If you click the ports, that’ll bring up a layout of your switch.
You can edit the port names or restart the devices if they’re powered over POE.
So from looking at this menu, you can tell that I have two Wifi APs,
port 5 and 6. If you click on Clients, you can see all of them listed under the switch as well.
I did pause here to go through the update process, and it’s as simple
as checking the settings and updating as needed. But this got me into the new GUI.
I also went to Devices, and did a device upgrade on my 24 port switch.
So that way everything is fully up to date and ready.
Under internet, we see our IP address for the WAN, and now there’s a WAN2. Edit WAN1, check
settings. In wifi, add new wifi network - this is where you can create your SSID so you can use
wifi. I named mine the same thing as my old one so most, if not all, of my devices will
automatically connect to my new access point. Same thing with the password. Then I kept all
the other settings the same. I did enable fast roaming for devices that have that compatibility.
This is where I started doing segmentation of my network - not allowing everything to
talk... I have a private secure LAN that is not wireless connected, that is only used
for work - My PC and NAS boxes. This network is only allowed to connect to other products on the
approved ports - no smart home hubs, no IoT home equipment, and no other laptops or PCs or phones
on the regular home network. I recorded this before I put the NAS boxes on the same LAN but
the same rules apply. I also created a guest network for guests to connect to the internet
like when friends and family come visit. Then, I created a regular home network for everything
else - that includes phones, wearables, IoT and smarthome equipment, TVs, Chromecasts, etc.
So, to do this: I created an IoT specific wifi account,
kept all the default options. Then I created a guest wifi network for anyone visiting. This
one allows you to share access via a variety of options, but I just included a password - very OG
but the older generations in my family will appreciate this comfort level.
I had to go into Classic settings in order to do this the way I wanted. So I went to
classic settings, disabled new user interface, and clicked settings, wireless networks, create new,
then added my guest SSID, changed to QPA(?) personal for security, added security key,
and applied guest policies. I switched the network to LAN and isolated this on layer 2
Ethernet level under L2 isolation. Then under User interface, I went back to the new user interface.
Once finished my guest network now appears under Guest Hotspot
in the new UI under WiFi settings. I did set this up months ago so hopefully this is easier
to do with the newer GUI now than it was when I did it. If not, I hope Ubiquiti updates it!
So under Unifi Devices, you’ll notice my new Wifi AP is now adopted, so I updated it since
an update was available. Under the switch settings, I clicked on Switch in Devices,
then went to Ports, chose Port 5 for the AP, Port Profile Override, and Exit.
Under Networks, Add a new network, and this is where I created my totally private work LAN. This
page didn’t need any changes so I just hit save. This sets my network up with two different LANs.
In Unifi Devices, I click POE Switch, Ports, click on Port 1, which is the first port that
I want to delegate for this specific private LAN, then choose Port Profile. Under this menu
I chose my new private LAN, then clicked Manage Port Profiles and Apply Changes.
Under Internet Threat Management, edit LAN rules - Here I chose rull index 2000, Click
Enabled, Block LAN New Connections to the private LAN name, click drop, all LAN in.
This was a long process but was much more advanced than what I could usually find
off the shelf in a consumer grade router, and this gave me the segmentation that
I really wanted for all of my devices. There’s probably other ways to do it too,
this isn’t the only setup option you could use, but it works well for my needs.
And I’ve been using this setup for several months now, with no hiccups.
If you’re interested in seeing my first ever networking rack build,
check out the video here. Thanks for watching!