Topics covered:

• Admin account hardening

• Management access lockdown (GUI/SSH LAN-only)

• Filtered DNS (DNS4EU, Quad9, Cloudflare) with provider comparison

• Firewall (WAN_IN / WAN_LOCAL) including IPv6

• Port forwarding

• VPN: L2TP/IPsec vs WireGuard

• NextDNS or Pi-hole + Unbound

• CVE-2026-98432 mitigation and status

Feedback and corrections welcome.

EdgeRouter (EdgeOS 3.0.1) – Secure Baseline Setup

This guide was last updated: 2026-11-14 · Rev 1.0.3

Secure, clean base configuration for an EdgeRouter running EdgeOS 3.0.1:

• Nothing reachable from the internet except, optionally, a VPN and/or port forwards for specific services.

• Management (web UI, SSH) only from the LAN, with a personal admin account.

• Filtered DNS blocking malware and phishing for every device.

• Optional: port forwarding, VPN, NextDNS/Pi-hole ad blocking.

Each step shows both methods — use whichever you prefer.

Tested on: EdgeRouter 12 (ER-12).

Should apply to all Cavium-based EdgeRouter models running EdgeOS 3.0.1.

This post will be updated as new information or improvements become available.

Disclaimer: This guide is provided as-is for informational purposes only, based on the current state of knowledge at the time of writing. Use it at your own risk. The author takes no responsibility for any damage, data loss, misconfiguration, or security incidents resulting from following this guide. Always test changes in a non-production environment first and keep a backup of your configuration.

1. Before you start

Replace these placeholders with your own values:

• WAN — WAN interface (e.g. eth0, eth1; PPPoE: pppoe0)

• LAN — LAN interface (e.g. eth1, switch0)

• LAN-IP — Router IP in LAN (e.g. 192.168.1.1)

• LAN-NET — Local network (e.g. 192.168.1.0/24)

• WAN-IP — Public IP from provider, DHCP or static (e.g. 203.0.113.10)

• MYADMIN — Your admin username, not admin, root or ubnt (e.g. er-mgmt)

• LONG-RANDOM-PASSWORD — Strong password for the admin account (choose your own)

Before copying any command: replace all placeholders (uppercase words like WAN, LAN, LAN-IP etc.) with your actual values. Commands with unedited placeholders will fail or misconfigure the router.

Backup first (always, before any change):

• GUI: System → Back Up Config → Download to your PC

• SSH: save is not a backup. Download the backup via GUI too.

SSH workflow:

configure
# ... enter commands ...
commit ; save

For changes that could lock you out (firewall rules, management listen-address, interfaces), use commit-confirm 5 instead:

configure
# ... enter commands ...
commit-confirm 5
# test that you can still reach the router, then:
confirm
save

commit-confirm 5 automatically reboots the router after 5 minutes if you do not type confirm — rolling back the change. Use it only where noted in this guide.

2. Initial setup with the wizard

Only for new or factory-reset routers. Wizards overwrite the existing config — skip on a configured router.

• GUI: Wizards → Basic Setup (one WAN, bridged LAN) or WAN+2LAN2 (separate LAN ports). The wizard sets up WAN, firewall (WAN_IN, WAN_LOCAL), NAT and DHCP. Choose WAN type (DHCP, static IP or PPPoE).

  • Create a new admin user in the wizard — not named admin, root or ubnt.

• SSH: The wizard is GUI-only. Set up interfaces, firewall, NAT and DHCP manually (see chapters 4–6).

3. Admin account

Create a personal admin account and remove the default ubnt user.

GUI: System → Users → Add User → Level: Admin. Then delete the ubnt user.

SSH:

1. Create the new account:

# !! Replace MYADMIN and LONG-RANDOM-PASSWORD with your own values !!

configure
set system login user MYADMIN authentication plaintext-password 'LONG-RANDOM-PASSWORD'
set system login user MYADMIN level admin
commit-confirm 5

2. Log out, log in as the new user. If it works: type confirm then save. If not: wait — the router reboots automatically and restores the old config.

3. After confirming the new account works, remove ubnt:

configure
delete system login user ubnt
commit ; save

Never use admin, root or ubnt — these are the first names attackers try.

4. Management access and services

Limit web UI and SSH to the LAN; disable unused services.

GUI:

• System → Management Interface → check "Listen only on specified interface" → select LAN interface

• SSH: System → Management Interface → SSH: set Listen Address to LAN-IP

• Ubiquiti Discovery: System → Miscellaneous → Ubiquiti Device Discovery → Disable

• UPnP: Firewall/NAT → UPnP2 → delete if present

SSH:

# !! Replace LAN-IP and LAN with your own values (see placeholder table above) !!

configure
set service gui listen-address LAN-IP
set service ssh listen-address LAN-IP
set service dns forwarding listen-on LAN
set service ubnt-discover disable
delete service upnp2
commit-confirm 5

• If delete returns "Nothing to delete", the service was never enabled.

• Keep ubnt-discover enabled only if you manage via UISP.

• UPnP2: Skip delete service upnp2 if you have devices that require UPnP (e.g. IP cameras, NAS, game consoles). Better alternative: set up manual port forwards in chapter 7 — then you know exactly what is open.

5. DNS

Pick one provider and use both of its addresses. Each provider listed below gives two IPs — use both for redundancy (if one is unreachable, the other takes over).

Do not mix providers (e.g. 9.9.9.9 + 1.1.1.1) — queries are distributed across both servers, so some bypass the filter of the filtered one. Mixing two unfiltered providers (e.g. 1.1.1.1 + 8.8.8.8) is fine for redundancy when no filtering is wanted.

EU — DNS4EU (EU-funded, resolved inside EU, free)

• DNS4EU Protective — 86.54.11.1 / 86.54.11.201 — Blocks: malware, phishing

• DNS4EU Protective + Child — 86.54.11.12 / 86.54.11.212 — Blocks: malware, phishing, adult content

• DNS4EU Protective + Ad blocking — 86.54.11.13 / 86.54.11.213 — Blocks: malware, phishing, ads

• DNS4EU Full protection — 86.54.11.11 / 86.54.11.211 — Blocks: malware, phishing, adult content, ads

• DNS4EU Unfiltered — 86.54.11.100 / 86.54.11.200 — No filtering

Worldwide — Quad9 (Swiss foundation, no IP logging)

• Quad9 Secure — 9.9.9.9 / 149.112.112.112 — Blocks: malware, phishing; DNSSEC

• Quad9 Unfiltered — 9.9.9.10 / 149.112.112.10 — No filtering; troubleshooting only

Worldwide — Cloudflare (US company)

• Cloudflare Malware — 1.1.1.2 / 1.0.0.2 — Blocks: malware, phishing

• Cloudflare Family — 1.1.1.3 / 1.0.0.3 — Blocks: malware, phishing, adult content

• Cloudflare Standard — 1.1.1.1 / 1.0.0.1 — No filtering; fastest

Worldwide — Google

• Google — 8.8.8.8 / 8.8.4.4 — No filtering

Sources: DNS4EU, Quad9, Cloudflare

GUI: Services → DNS → DNS Forwarding → Name Servers: add both IPs. Under DHCP, remove the provider's DNS push.

SSH — WAN via DHCP (ignore provider's DNS):

# !! Replace WAN with your own interface name (e.g. eth0) !!

configure
set service dns forwarding name-server 9.9.9.9
set service dns forwarding name-server 149.112.112.112
delete service dns forwarding dhcp WAN
set interfaces ethernet WAN dhcp-options name-server no-update
set system name-server 127.0.0.1
commit ; save

SSH — static provider IP (no DHCP on WAN, skip the two DHCP lines):

# !! Replace the DNS IPs with your chosen provider's addresses !!

configure
set service dns forwarding name-server 9.9.9.9
set service dns forwarding name-server 149.112.112.112
set system name-server 127.0.0.1
commit ; save

6. Firewall

Only replies to connections initiated from inside are allowed in. Everything else is dropped.

WAN_IN protects the LAN. WAN_LOCAL protects the router itself. The wizard creates these rules; on an existing setup add them manually.

GUI: Firewall/NAT → Firewall Policies → Add Ruleset:

• Name WAN_IN, default action Drop. Add rules: 10 Accept established/related, 20 Drop invalid.

• Name WAN_LOCAL, same rules.

• Assign: Interfaces → WAN → Firewall In = WAN_IN, Firewall Local = WAN_LOCAL.

SSH:

# !! Replace WAN with your own interface name (e.g. eth0) !!

configure
set firewall name WAN_IN default-action drop
set firewall name WAN_IN rule 10 action accept
set firewall name WAN_IN rule 10 state established enable
set firewall name WAN_IN rule 10 state related enable
set firewall name WAN_IN rule 20 action drop
set firewall name WAN_IN rule 20 state invalid enable

set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL rule 10 action accept
set firewall name WAN_LOCAL rule 10 state established enable
set firewall name WAN_LOCAL rule 10 state related enable
set firewall name WAN_LOCAL rule 20 action drop
set firewall name WAN_LOCAL rule 20 state invalid enable

set interfaces ethernet WAN firewall in name WAN_IN
set interfaces ethernet WAN firewall local name WAN_LOCAL
commit-confirm 5

PPPoE: replace the last two lines with:

set interfaces ethernet eth0 pppoe 0 firewall in name WAN_IN
set interfaces ethernet eth0 pppoe 0 firewall local name WAN_LOCAL

IPv6 (if your provider supplies it):

# !! Replace WAN with your own interface name (e.g. eth0) !!

configure
set firewall ipv6-name WANv6_IN default-action drop
set firewall ipv6-name WANv6_IN rule 10 action accept
set firewall ipv6-name WANv6_IN rule 10 state established enable
set firewall ipv6-name WANv6_IN rule 10 state related enable
set firewall ipv6-name WANv6_IN rule 20 action accept
set firewall ipv6-name WANv6_IN rule 20 protocol icmpv6

set firewall ipv6-name WANv6_LOCAL default-action drop
set firewall ipv6-name WANv6_LOCAL rule 10 action accept
set firewall ipv6-name WANv6_LOCAL rule 10 state established enable
set firewall ipv6-name WANv6_LOCAL rule 10 state related enable
set firewall ipv6-name WANv6_LOCAL rule 20 action accept
set firewall ipv6-name WANv6_LOCAL rule 20 protocol icmpv6
set firewall ipv6-name WANv6_LOCAL rule 30 action accept
set firewall ipv6-name WANv6_LOCAL rule 30 protocol udp
set firewall ipv6-name WANv6_LOCAL rule 30 source port 547
set firewall ipv6-name WANv6_LOCAL rule 30 destination port 546

set interfaces ethernet WAN firewall in ipv6-name WANv6_IN
set interfaces ethernet WAN firewall local ipv6-name WANv6_LOCAL
commit-confirm 5

7. Port forwarding

Forward only what must be reachable from outside. The target server must be kept up to date itself.

GUI: Firewall/NAT → Port Forwarding → Add Rule: Original Port, Forward-to IP, Forward-to Port, Protocol.

SSH (example: web server on port 443):

# !! Replace WAN, LAN and the forward-to address with your own values !!

configure
set port-forward auto-firewall enable
set port-forward wan-interface WAN
set port-forward lan-interface LAN
set port-forward rule 1 description Webserver
set port-forward rule 1 original-port 443
set port-forward rule 1 forward-to address 192.168.1.10
set port-forward rule 1 forward-to port 443
set port-forward rule 1 protocol tcp
commit-confirm 5

8. VPN

Back up before changing VPN settings. Choose one option.

L2TP/IPsec

• Client: built into Windows, macOS, Android, iOS — no extra app needed

• WAN ports: UDP 500, UDP 4500, UDP 1701 + ESP

• Note: split-tunnel not supported on Android and iOS for L2TP — use WireGuard if split-tunnel is needed on mobile devices

WireGuard

• Client: extra WireGuard app required on every device

• WAN ports: UDP 51820 only

Option A: L2TP/IPsec

GUI: VPN → L2TP Server → enable, set PSK, add VPN user, set IP pool and DNS.

SSH:

# !! Replace WAN, PSK, vpnuser and PASSWORD with your own values !!

configure
set vpn ipsec ipsec-interfaces interface WAN
set vpn l2tp remote-access ipsec-settings authentication mode pre-shared-secret
set vpn l2tp remote-access ipsec-settings authentication pre-shared-secret 'PSK'
set vpn l2tp remote-access authentication mode local
set vpn l2tp remote-access authentication local-users username vpnuser password 'PASSWORD'
set vpn l2tp remote-access client-ip-pool start 10.10.0.100
set vpn l2tp remote-access client-ip-pool stop 10.10.0.110
set vpn l2tp remote-access dhcp-interface WAN
set vpn l2tp remote-access dns-servers server-1 9.9.9.9

set firewall name WAN_LOCAL rule 30 action accept
set firewall name WAN_LOCAL rule 30 protocol udp
set firewall name WAN_LOCAL rule 30 destination port 500
set firewall name WAN_LOCAL rule 40 action accept
set firewall name WAN_LOCAL rule 40 protocol esp
set firewall name WAN_LOCAL rule 50 action accept
set firewall name WAN_LOCAL rule 50 protocol udp
set firewall name WAN_LOCAL rule 50 destination port 4500
set firewall name WAN_LOCAL rule 60 action accept
set firewall name WAN_LOCAL rule 60 protocol udp
set firewall name WAN_LOCAL rule 60 destination port 1701
set firewall name WAN_LOCAL rule 60 ipsec match-ipsec
commit-confirm 5

Static provider IP (no DHCP on WAN — replace dhcp-interface line):

set vpn l2tp remote-access outside-address WAN-IP

Option B: WireGuard

Install the WireGuard app on every client before starting.

GUI:

1. VPN → WireGuard → Add Interface: port 51820, IP 10.10.1.1/24.

2. Add Peer: Allowed IPs 10.10.1.2/32 (next device: .3), Generate Configuration, scan QR code with app.

3. Client settings: Endpoint WAN-IP:51820 (replace WAN-IP with your public IP or DynDNS hostname), Allowed IPs LAN-NET, 10.10.1.0/24 (replace LAN-NET), Keepalive 25.

SSH (firewall rule only — interface setup via GUI):

configure
set firewall name WAN_LOCAL rule 70 action accept
set firewall name WAN_LOCAL rule 70 protocol udp
set firewall name WAN_LOCAL rule 70 destination port 51820
commit-confirm 5

Always test VPN over mobile data, not your own Wi-Fi.

Additional users (L2TP) or peers (WireGuard) can be added at any time by repeating the respective user/peer configuration steps.

Client setup: L2TP/IPsec

Windows: Settings → Network & Internet → VPN → Add a VPN connection. VPN provider: Windows built-in. Connection name: your choice. Server name: WAN-IP. VPN type: L2TP/IPsec with pre-shared key. Enter PSK, username and password.

macOS: System Settings → VPN → Add VPN Configuration → L2TP over IPSec. Server: WAN-IP. Account: username. Authentication: password + shared secret (PSK).

Android: Settings → Network → VPN → Add. Type: L2TP/IPSec PSK. Server: WAN-IP. IPSec pre-shared key: PSK. Username and password.

iOS: Settings → General → VPN & Device Management → VPN → Add VPN Configuration. Type: L2TP. Server: WAN-IP. Account, password, shared secret (PSK).

Note — split-tunnel for L2TP: By default, L2TP routes all traffic through the tunnel (full-tunnel). To use split-tunnel (only home network traffic through VPN, internet goes direct), configure it per OS after connecting:

• Windows: Network & Internet → VPN → Change adapter options → right-click L2TP adapter → Properties → Networking → IPv4 → Properties → Advanced → uncheck "Use default gateway on remote network".

• macOS: System Settings → VPN → your L2TP connection → Details → uncheck "Send all traffic over VPN connection".

• Android: Split-tunnel is not natively supported for L2TP on Android. Use WireGuard instead for split-tunnel on Android.

• iOS: Split-tunnel is not natively supported for L2TP on iOS. Use WireGuard instead for split-tunnel on iOS.

Client setup: WireGuard

Install the WireGuard app first: wireguard.com/install

All platforms (QR code — easiest): In the router GUI, generate a peer configuration and scan the QR code with the WireGuard app. Done.

Manual (if no QR code): Add a new tunnel in the app. Set:

• Endpoint: WAN-IP:51820

• Allowed IPs: LAN-NET, 10.10.1.0/24 (replace LAN-NET with your local network, e.g. 192.168.1.0/24)

• Persistent keepalive: 25

Note — split-tunnel: Setting Allowed IPs to only LAN-NET, 10.10.1.0/24 (instead of 0.0.0.0/0) means only traffic destined for your home network goes through the VPN tunnel — internet traffic goes directly. This keeps latency low while still routing DNS through Pi-hole or your chosen DNS provider at home. If you want all traffic (including internet) through the tunnel, use 0.0.0.0/0, ::/0 instead.

9. NextDNS (optional)

NextDNS is a cloud-based DNS filter — no extra hardware, VM or container required. It offers per-device (MAC) filtering, extensive and frequently updated blocklists, and native DoH/DoT support.

Free tier: up to 300,000 queries/month. After that, DNS still resolves but filtering is paused until the next month or you upgrade.

Setup:

1. Create an account at nextdns.io and configure your blocklists and per-device rules.

2. Note your personal NextDNS IP addresses from the Setup tab (unique per account).

3. Tell the router to hand out NextDNS as DNS via DHCP:

GUI: Services → DHCP Server → LAN → DNS 1 and DNS 2: your NextDNS IPs — remove any other entries.

SSH:

# !! Replace LAN, LAN-NET and NEXTDNS-IP-1 / NEXTDNS-IP-2 with your own values !!

configure
set service dhcp-server shared-network-name LAN subnet LAN-NET dns-server NEXTDNS-IP-1
set service dhcp-server shared-network-name LAN subnet LAN-NET dns-server NEXTDNS-IP-2
commit ; save

4. For VPN clients: set VPN DNS to your NextDNS IPs.

10. Pi-hole (optional)

Pi-hole is a separate DNS filter running on its own device (VM, container or Raspberry Pi). It blocks ads and tracking in addition to the upstream DNS filter.

Recommended: run Pi-hole with Unbound. Unbound is a local recursive DNS resolver — instead of forwarding queries to an external provider (Quad9, DNS4EU etc.), it resolves them directly against the root DNS servers. No DNS query data is sent to any third party.

• Chain without Unbound: devices → Pi-hole → DNS provider (chapter 5)

• Chain with Unbound: devices → Pi-hole → Unbound → root servers (full control, no external DNS provider needed)

1. Pi-hole → Settings → DNS: set only your chosen provider from chapter 5 as upstream DNS (or Unbound at 127.0.0.1#5335).

2. Tell the router to hand out Pi-hole as DNS via DHCP:

GUI: Services → DHCP Server → LAN → DNS 1: PIHOLE-IP — remove any second DNS entry.

SSH:

# !! Replace LAN, LAN-NET and PIHOLE-IP with your own values !!

configure
set service dhcp-server shared-network-name LAN subnet LAN-NET dns-server PIHOLE-IP
commit ; save

3. Do not add a public DNS as fallback — devices will use it and bypass Pi-hole.

4. For VPN clients: set VPN DNS to PIHOLE-IP and in Pi-hole set Settings → DNS → Interface settings → "Permit all origins".

5. For devices that travel (laptops, phones, tablets): connect back via VPN to benefit from Pi-hole filtering on the road — no external DNS subscription needed.

NextDNS vs Pi-hole:

NextDNS:

• Hardware/VM needed: No

• Fully local: No (cloud)

• Per-device filtering: Per MAC, easy

• Free: Up to 300k queries/month

• Setup effort: Low

Pi-hole + Unbound:

• Hardware/VM needed: Yes

• Fully local: Yes

• Per-device filtering: Via groups

• Free: Yes

• Setup effort: Higher

11. CVE-2026-98432 (Linux kernel TCP, CVSS 9.8)

A use-after-free vulnerability in the Linux kernel IPv4 TCP stack. EdgeOS 3.0.1 runs kernel 4.9.79 which is affected. No EdgeOS patch exists yet.

Risk: Only exploitable if the attacker can reach an open TCP port on the router itself — not through forwarded ports to LAN servers, and not through UDP-based VPNs (WireGuard, L2TP/IPsec).

Mitigation with this guide: If chapters 4 and 6 are applied correctly, no TCP port is open on the WAN interface. The router is not directly reachable from the internet and the CVE cannot be triggered remotely.

Verify:

netstat -tlnp

Expected: no TCP port listening on the WAN IP. Only LAN-IP should appear on ports 22, 80, 443.

Remaining risk: The vulnerability is still present in the kernel. Monitor the Ubiquiti release notes for a patched firmware and update as soon as one is available.

12. Verify

Open ports

• SSH: netstat -tlnp

• Expected: ports 22/80/443 only on LAN-IP

WAN_LOCAL

• SSH: show firewall name WAN_LOCAL

• GUI: Firewall/NAT → Firewall Policies

• Expected: no TCP, only VPN ports if enabled, drop at end

WAN_IN

• SSH: show firewall name WAN_IN

• GUI: Firewall/NAT → Firewall Policies

• Expected: only established/related, drop at end

Offload

• SSH: show ubnt offload

• Expected: HW offload on (Cavium models)

DNS

• SSH: show dns forwarding statistics

• Expected: queries going to your chosen provider

Then save and download a fresh backup via System → Back Up Config.

I've exported the configuration, just wondering if I can use a 3.0.1 exported configuration on 2.0.9hf7 or if the UI changes will break it.

Has anyone done this? If so, how much of a pain was it?

Also, is there an option in UISP to tell it to not offer the 3.0.x updates? (Will 2.0.x get any more updates?)

It looks like you can read it while the system is running using the command.

sudo dd if=/dev/mtd0 of=/tmp/mtd0.img && sudo chmod 777 /tmp/mtd0.img

This is very serious since we are talking about a CVE score of 9.8.

Debian already released a fixed kernel for it.

Will Ubiquity also release a new version?

Is the EdgeRouter secure?

Is there a chance for an upgrade?

@UI-Team

Obviously, rooting a container is less valuable than getting the whole host system, but I would assume that the "ucrm" container can at least move laterally to the other containers and steal or damage data (since this container seems to be the main webUI host and thus interfaces with the other containers fairly heavily).

This is from the "current" UISP release, version 3.1.65:

/usr/src/ucrm# php-fpm -v
PHP 8.3.32 (fpm-fcgi) (built: Jul  2 2026 20:47:04)
Copyright (c) The PHP Group
Zend Engine v4.3.32, Copyright (c) Zend Technologies
    with Zend OPcache v8.3.32, Copyright (c), by Zend Technologies

The patch landed in PHP 8.3.36.

I haven't poked around the Unifi app/controller in a while, but I'm guessing you've got PHP in there too...

[edit] Apparently I put this in the wrong place.

Someone already made a post over in the correct section, sorry.

So we have been trying to mitigate an issue with Tough Cable Pro / UISP Cable Pro. We have always ran our ethernet cables into the equipment shelter and plug directly into the switch mounted in the rack.. The last few batches of UISP cable we have used is allowing water to flow back into the back of the RJ 45 connector and it leaks though the gold pins and burns out the data port of our switches. This happens in a driving hard rain with wind. We just got a storm system from the FL hurricanes that blew up into Kentucky. This hard wind and rain combo pushed the water into the cable somehow.

I have checked the cable visually all the way up the tower and can not find the source of this intrusion. This cable has been up less than 12 months. Currently 2 of the 16 cables are leaking water like this.

We have many radios on this tower.

(6) PTP Dishes - (4) AF5XHD (1) AF11 (1) AF60

(4) Wave 60 APs

(6) AirMax AC - Rocket Gen2

16 total cables

We are thinking about going to switch and Fiber on the tower to help eliminate this issue. If not what sort of cable do you recommend to eliminate this water ingress? Something USA made? Flooded with gel?

What switches are you guys using on the towers for midspan? I have considered using the UISP PLUS and enclosures for the WAVE APs but I would have to have two of them.

Thanks for you time if you choose to answer.

If you had previously been using the EdgeOS feature to have the Edgerouter handle DNS forwarding and you found all DNS stopped working this morning (if you did anything to trigger a dnsmasq restart), the reason is because on October 11, 2026, the internet's root DNS servers stopped signing records with the old KSK-2017 key (key tag 20326) and switched exclusively to the new KSK-2024 key (key tag 38696). To correct this problem you have to add in the new KSK-2024 key anchor. You may also find these older Edgerouter DNS forwarding configuration posts from years ago also included an obsolete KSK-2010 key (key tag 19036).

While you're in there, this one should be deleted, if found. The following CLI commands after entering configuration mode will address both issues:

First, add in the new 2026 Root KSK (Key Tag 38696)

set service dns forwarding options trust-anchor=.,38696,8,2,683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16

Second, remove the highly obsolete 2010 key (Key Tag 19036)

delete service dns forwarding options trust-anchor=.,19036,8,2,49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5

commit

save

exit

That should do it, however in some situations you may have to enter an additional CLI command to kick start things:

restart dns-forwarding

Again you should leave the 20326 key trust-anchor entry as found, unlike the 19036 key this one is still needed for backward compliance.

Hope this helps someone out,

shop.poetexas.com/collections/splitters/products/poe-12v10w

Worked but inelegant. You can clearly run 1 Gbps speeds because, for years, my UAP-AC-LR and UAP-AC-M both ran at 1 Gbps, powered by the EdgeRouter. I also had an add-on board for a Raspberry Pi3 doing the same thing. So here is my DIY solution to the problem. You will need to be comfortable using a soldering iron and have some basic electronics skills. If your not go and hand in your geek card 😁

First, you need to purchase a standard IEEE802.3af/at splitter that works at gigabit speeds. The one I used is branded Revodata on Amazon and comes with a wide range of output tips: 5.5/2.1mm, 5.5/2.5mm, microUSB, and USB-C. Choose the tip you need. For me, that was a 5.5/2.1mm tip.

www.amazon.co.uk/dp/B0D35J5BPP

The basics are that we'll open it up, remove most of the electronics, and then solder in a suitable DC-DC converter. I used a Recom R-78K12-2.0; it takes an input voltage range of 14-36V DC and outputs 12V/2A DC in a TO-220 package. It is not isolated, but I can live with that. They are not particularly expensive either; they will set you back under 5 GBP here in the UK. The Recom R-78K DC-DC converter comes in versions that output 5V, 9V, 12V and 15V, so you should be able to power most devices.

uk.rs-online.com/web/p/dc-dc-converters-ics/2743518

They also recommend a 27µF capacitor on the input as well if you might hot-plug it. I got a pack of 20 Panasonic 105°C-rated ones for 2.5GBP.

uk.rs-online.com/web/p/aluminium-capacitors/1458491

I skipped the protection diode on the output because reverse voltage on this is highly unlikely.

The first step is to open it up. Mine was ultrasonically welded together, so I had to score along the weld seams and pry it open. The knife slipped and caused minor cosmetic damage to the casing, but it didn't matter to me. Next, remove almost all the components from the circuit board. Leave only the pulse transformer and the bridge rectifiers. I forgot to take before pictures, but here are my after pictures. First, the top side, where you can see the pulse transformer right next to the RJ45 socket

Then we have the underside. You can see the two bridge rectifier packages. They are below the pulse transformer. The pulse transformer and the bridge rectifiers separate the PoE voltage and pass it through with a known polarity, regardless of the voltage orientation in the cable. If you look closely (it doesn't show in the pictures), you'll see four pairs of traces going from the pulse transformer to the output socket. Those are the Ethernet signals after being separated from the PoE voltage. The bridge rectifiers are connected directly to the input pins before the pulse transformer.

Next, plug it into an EdgeRouter port with PoE enabled and probe around with a multimeter until you find 24V and ground. You should find them near the bridge rectifier. Now solder on some jumper wires and dead-leg the DC-DC converter and capacitor. Then connect them to the output. This is the finished result. Glue the top back on with some ABS solvent-weld adhesive, and you're done. I have done a couple of these now, since I wanted one for the internet connection at my mother's. This is from the second one. The first has been going for a couple of years, and I thought I would document it this time.

If you really wanted, you could get an isolated DC-DC converter instead, but those are much more expensive, around 30 GBP each, so I didn't bother.

I'm trying to get dhcpv6-pd going on my Edgerouter but unable to get any IPv6 assigned on the WAN. Kindly see attached interfaces config and advise where I messed up. Thank you.

Edit : Removed code formatting

Edit : 10/10 Updated modified config, still nothing from WAN interface

Edit : 17/10 Updated ethernet interfaces to reflect working config

interfaces {
  ethernet eth0 {
    address 192.168.1.254/24
    description LAN
    duplex auto
    firewall {
      in {
        name LAN_IN
      }
      local {
        name LAN_LOCAL
      }
    }
    speed auto
    vif 2 {
      address 192.168.2.254/24
      description IoT
      firewall {
        in {
          name IoT_IN
        }
        local {
          name IoT_LOCAL
        }
      }
    }
    vif 3 {
      address 192.168.3.254/24
      description Guest
      firewall {
        in {
          name Guest_IN
        }
        local {
          name Guest_LOCAL
        }
      }
    }
  }
  ethernet eth1 {
    address 192.168.4.254/24
    description "LAN"
    duplex auto
    firewall {
      in {
      }
      local {
      }
    }
    speed auto
  }
  ethernet eth2 {
    address dhcp
    description "WAN"
    dhcpv6-pd {
      no-dns
      pd 0 {
        interface eth0 {
          host-address ::1
          prefix-id :0
          service slaac
        }
        interface eth0.2 {
          host-address ::1
          prefix-id :1
          service slaac
        }
        interface eth0.3 {
          host-address ::1
          prefix-id :2
          service slaac
        }
        interface eth1 {
          host-address ::1
          prefix-id :3
          service slaac
        }
        prefix-length /56
      }
      rapid-commit enable
    }
    duplex auto
    firewall {
      in {
        ipv6-name VQ-WAN-IPv6-In
        name VQ-WAN-IPv4-In
      }
      local {
        ipv6-name VQ-WAN-IPv6-Local
        name VQ-WAN-IPv4-Local
      }
      out {
        name VQ-WAN-IPv4-Out
      }
    }
    ipv6 {
      address {
        autoconf
      }
      dup-addr-detect-transmits 1
    }
    speed auto
  }
  loopback lo {
  }
}
protocols {
  static {
    route6 ::/0 {
      next-hop 2001:d98:xxxx:xxxx::1 {
        interface eth2
      }
    }
  }
}

I have a EdgeSwitch 16 XG, and I'm configuring 802.1X port access control with a FreeRadius server.

I have 2 VLAN for this setup : VLAN 3 and VLAN 5. I want clients to go either on one or the other based on the authentication.

On a port I enabled Mac-Based 802.1X Port Access Control. I set up a guest vlan ID (5).

On the same port I set up the VLAN with untagged VLAN 3 and untagged VLAN 5 with PVID 5.

On this port if a client connect without any 802.1X security it goes in VLAN 5. If it connects using 802.1X (user configured on FreeRadius with vlan id 3) it goes in VLAN 3. I'm using DHCP on each VLAN with different subnet and getting IP corresponding.

So in this way the config is working.

Here is the configuration on the switch :

show running-config interface 0/13

!Current Configuration:
!
interface  0/13
dot1x port-control mac-based
dot1x timeout quiet-period 5
dot1x guest-vlan 5
dot1x timeout guest-vlan-period 5
vlan pvid 5
vlan participation include 3,5

But with this configuration I see a problem : either i'm on guest VLAN 5 or connected and assigned to VLAN 3, i'm receiving the multicast/broadcast traffic of both VLAN (I can see it on Wireshark).

I think this is because both VLAN 3 and 5 are untagged.

So I tried the same but assigning VLAN 3 as tagged.

But with this configuration if I want my clients do go on VLAN 3 I also need to configure tagged VLAN 3 (with 802.1).

Is this normal ? Is there a way to overcome this issue without tagging interfaces ?

Thanks

I am a new owner of a Edgerouter 4. I have updated the firmware to 4 3.0.1.

I have plugged in the router to my ISP optical fiber adapter, Internet is working fine.

The configuration is with a pppoe loggin (and Vlan 40 as indicated by EBOX, canadian ISP). I am now trying to optimize MTU size to 1492.

What I see now configured:  

Interface IP Address      S/L Description     

--------- ----------      --- -----------     

eth0       -         u/u         

eth0.40      -         u/u Internet (PPPoE)    

eth1       192.168.1.1/24     u/u Local       

eth2       192.168.2.1/24     u/D Local 2      

eth3         -         u/D         lo         127.0.0.1/8      u/u    ::1/128                

pppoe0  104.163.183.81     u/u         

ubnt@EdgeRouter-4:~$ show interfaces ethernet eth0.40

eth0.40@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 

group default qlen 1000  

I googled 2 methods to change the MTU to 1492. Both are not working.

The first thing I try is to use the GUI, but I see no 'action' button for any interface.

I then try using the CLI, this command:

set interfaces pppoe pppoe0 mtu 1492

IT does not work, if you look my currently configure Interface, my guess the name use in my command is wrong ?

Any help to resolve the situation is appreciated.

PS: I am not a total noob in networking, but I am new to CLI and EdgeOS.

Thanks.

I have an EdgeRouter X SFP and 2 aircubes. I want to prepare for deploying some cameras so I bought an Edgeswitch 16 150W. 

As part of the integration, I decided to move everything that I can to the switch, so the router should handle the internet connections only (primary and backup). The switch is connected to the server via SFP. I already moved everything and works fine, except my guest network. On the router I made a logical switch for the ports with name switch0. The guest network operated on switch0.6, used the vlan 6. The firewall rules are fine, I didnt touch them yet. On the switch I made a vlan for the same with 6 vlan id. The switch port, where the AP connects is Untagged on the default vlan and Tagged on the vlan 6.

I assumed it should work, but the clients can’t receive ip. What would you recommend to check?

Thanks in advance for any help!

PS: No vlan-aware used

The ER is currently set to failover to eth1, with the entire set of LAN IPs having access to both eth0 and eth1.

My goal is simple: create an address-group comprised of a sub-set of the group that accesses eth0, i.e. I don't want all LAN devices to be able to access the failover ISP (bandwidth considerations).

Creating an address-group or network group is easy. But I need to know how to tie this into existing configuration and firewall rules, relative to failover to eth1.

Should point out that there is already a firewall > modify > balance > rule 1, so if there needs to be another firewall rule prior to this one, this one will need to be moved.

Thanks for any pointers. Am comfortable with CLI, GUI, config tree... simple configuration command sequence preferred.

I have an automation that will reboot the router, but what I need to do is to have the router run the script to re-allow (Geo-IP table) outside IP ranges to a specific IP table that is used in routing rules to allow those outside IP ranges into services, without that table, all services are unavailable.

ls -al /config/scripts/post-config.d

total 3

drwxrwsr-x 1 root  vyattacf  224 Sep 4 14:18 .

drwxrwsr-x 1 root  vyattacf  232 Mar 5 2020 ..

-rwxr-xr-x 1 root  vyattacf  40 Sep 4 14:18 geo.sh

I have the geo.sh which calls the script I have, but it seems to not work:

sudo sh /config/zonefiles/country-load

I did a sudo reboot in PuTTY on the router and when it comes back up, it fails to run that script, as I know, because I'm sending log information to /var/log/countryload and there is no such file on reboot and all the services are offline from allowed Geo-IP table. I know the script works as I did an sh /config/scripts/post-config.d/geo.sh and it ran, the log file showed up and services came back.

What is missing to get this script setup to work properly?

Repo: https://github.com/bengoerz/erx-mt7530-switch-docs

Because this exposes the port mirroring built into the switch silicon, it should support a full 1Gbps port mirror. I plan to test the performance in my homelab soon.

Credit to gojimmypi's post https://gojimmypi.github.io/Edgerouter-Port-Monitor/ for sparking my curiosity.

I'd love to hear from anyone who has achieved full 1Gbps port mirroring on an ER-X already.

Yes, I found https://help.uisp.com/hc/en-us/articles/22591049434903-EdgeRouter-Port-Forwarding

Hints and tips sincerely appreciated!

# open port for httpd forwarding
set firewall name WAN_IN rule 22 action accept
set firewall name WAN_IN rule 22 description httpd
set firewall name WAN_IN rule 22 destination address 192.168.httpd apache server
set firewall name WAN_IN rule 22 destination port 8080
set firewall name WAN_IN rule 22 log disable
set firewall name WAN_IN rule 22 protocol tcp
# set firewall name WAN_IN rule 22 source port 8080 #- tried with and without this

# port-forward configuartion for httpd
set port-forward rule 3 description httpd
set port-forward rule 3 forward-to address 192.168.httpd apache server
set port-forward rule 3 forward-to port 8080
set port-forward rule 3 original-port 8080
set port-forward rule 3 protocol tcp

$ show configuration | no-more
firewall {
    all-ping enable
    broadcast-ping disable
    group {
        address-group ExtIP {
            address my Pub IP address
            description "Public IP (eth0)"
        }
        address-group PBX {
            address 34.210.91.112/28
            address 34.226.36.32/28
            address 136.57.136.147
            address 24.163.114.98
        }
    }
    ipv6-name WANv6_IN {
        default-action drop
        description "WAN inbound traffic forwarded to LAN"
        enable-default-log
        rule 10 {
            action accept
            description "Allow established/related sessions"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
    }
    ipv6-name WANv6_LOCAL {
        default-action drop
        description "WAN inbound traffic to the router"
        enable-default-log
        rule 10 {
            action accept
            description "Allow established/related sessions"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
        rule 30 {
            action accept
            description "Allow IPv6 icmp"
            protocol ipv6-icmp
        }
        rule 40 {
            action accept
            description "allow dhcpv6"
            destination {
                port 546
            }
            protocol udp
            source {
                port 547
            }
        }
    }
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians enable
    name WAN_IN {
        default-action drop
        description "WAN to internal"
        rule 10 {
            action accept
            description "Allow established/related"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action accept
            description RTP
            destination {
                address 192.168PBX box IP
                port 10000-25000
            }
            log disable
            protocol udp
        }
        rule 21 {
            action accept
            description "Asterisk 5060"
            destination {
                address 192.168PBX box IP
                port 5060
            }
            log disable
            protocol udp
            source {
                group {
                    address-group PBX
                }
                port 5060
            }
        }
        rule 22 {
            action accept
            description httpd
            destination {
                address 192.168.httpd apache server
                port 8080
            }
            log disable
            protocol tcp
        }
        rule 50 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
    }
    name WAN_LOCAL {
        default-action drop
        description "WAN to router"
        rule 10 {
            action accept
            description "Allow established/related"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
}
interfaces {
    ethernet eth0 {
        address dhcp
        description Internet
        duplex auto
        firewall {
            in {
                ipv6-name WANv6_IN
                name WAN_IN
            }
            local {
                ipv6-name WANv6_LOCAL
                name WAN_LOCAL
            }
        }
        speed auto
    }
    ethernet eth1 {
        description Local
        duplex auto
        speed auto
    }
    ethernet eth2 {
        description Local
        duplex auto
        speed auto
    }
    ethernet eth3 {
        description Local
        duplex auto
        speed auto
    }
    ethernet eth4 {
        description Local
        duplex auto
        poe {
            output off
        }
        speed auto
    }
    loopback lo {
    }
    switch switch0 {
        address 192.168.1.1/24
        description Local
        mtu 1500
        switch-port {
            interface eth1 {
            }
            interface eth2 {
            }
            interface eth3 {
            }
            interface eth4 {
            }
            vlan-aware disable
        }
    }
}
port-forward {
    auto-firewall enable
    hairpin-nat enable
    lan-interface eth1
    rule 1 {
        description RTP
        forward-to {
            address 192.168PBX box IP
            port 10000-25000
        }
        original-port 10000-25000
        protocol udp
    }
    rule 2 {
        description "Asterisk 5060"
        forward-to {
            address 192.168PBX box IP
            port 5060
        }
        original-port 5060
        protocol udp
    }
    rule 3 {
        description httpd
        forward-to {
            address 192.168.httpd apache server
            port 8080
        }
        original-port 8080
        protocol tcp
    }
    wan-interface eth0
}
service {
    dhcp-server {
        disabled false
        hostfile-update disable
        shared-network-name LAN {
            authoritative enable
            subnet 192.168.1.0/24 {
                default-router 192.168.1.1
                dns-server 192.168.1.1
                lease 86400
                start 192.168.1.38 {
                    stop 192.168.1.243
                }
                static-mapping Asterisk {
                    ip-address 192.168PBX box IP
                    mac-address xx:xx:xx:xx:xx:xx
                }
                static-mapping FreeNAS {
                    ip-address 192.168.fileserver
                    mac-address xx:xx:xx:xx:xx:xx
                }
            }
        }
        static-arp disable
        use-dnsmasq disable
    }
    dns {
        forwarding {
            cache-size 150
            listen-on switch0
        }
    }
    gui {
        http-port 80
        https-port 443
        older-ciphers enable
    }
    nat {
        rule 5010 {
            description "masquerade for WAN"
            outbound-interface eth0
            type masquerade
        }
    }
    ssh {
        port 22
        protocol-version v2
    }
    unms {
    }
}
system {
    analytics-handler {
        send-analytics-report false
    }
    conntrack {
        timeout {
            udp {
                other 60
                stream 360
            }
        }
    }
    crash-handler {
        send-crash-report false
    }
    host-name EdgeRouter-X-5-Port
    login {
        user guest {
            authentication {
                encrypted-password ****************
                plaintext-password ****************
                public-keys guest@tatooine {
                    key ****************
                    type ssh-rsa
                }
            }
            level admin
        }
    }
    ntp {
        server 0.ubnt.pool.ntp.org {
        }
        server 1.ubnt.pool.ntp.org {
        }
        server 2.ubnt.pool.ntp.org {
        }
        server 3.ubnt.pool.ntp.org {
        }
    }
    offload {
        hwnat enable
    }
    syslog {
        global {
            facility all {
                level notice
            }
            facility protocols {
                level debug
            }
        }
    }
    time-zone UTC
}

HI

Has anyone tried using an EF Core and an EdgeRouter for a WISP?

I'm trying or I want to use a EF Core as a firewall and let the EdgeRouter handle all the routing, since the UDM or UniFi has problems with routing and the EdgeRouter is more advanced.

...or any better suggestions you might have?

I'm all ears.