After many (many!) years I finally got around to my childhood dreams of building a home network rack, centered around the Unifi stack. I've got the new 10 gig switch, the dream machine SE, a bunch of cameras, and I've been very impressed with their stuff. The experience "just works" and feels like they take inspiration from Apple. The whole camera setup can be "closed" by shutting off outside access, this self-hosting option takes it all a step further for those who care deeply about privacy!
back
9 comments
There's one big gotcha with Unifi cameras, where you have to cloud-connect your Unifi system if you want "AI" detections[1] (anything other than simple motion detection). I'm hoping they fix it some day[2], but for now I just have motion detection on my Unifi hardware. If this is a problem for you, make sure you understand the tradeoffs here before you commit to a Unifi system.
[1] https://old.reddit.com/r/Ubiquiti/comments/1cifnut/unifi_pro...
[2] https://old.reddit.com/r/Ubiquiti/comments/1dbyvan/home_assi...
Still dont understand why this is such a big issue, and I have been reading threads about it for a year now.
Just turn on cloud access, accept the t&cs and then turn it off again. If you are really scared then you can isolate that device in a vlan or DMZ temporarily.
I run many commercial and residential networks, and this is definitely a non issue for me.
I stopped buying Ubiquiti when I reset my UDM Pro and took it to another house without internet access, and it refused to "activate" without an Internet Connection or a phone app connection. Seems they are more interested in selling a lifestyle rather than actual production network equipment.
I stopped buying them when I saw users posting on reddit that they were logging in to their systems and seeing other peoples camera feeds and networks.
https://www.bleepingcomputer.com/news/security/ubiquiti-user...
Im not excusing Ubiquiti here, I agree thats pretty annoying.
However a UDM pro is a router (as well as other things). The expectation is that it is connected to WAN.
Unifi switches and access points etc do not have the same online requirement.
What are you using instead?
Having seen a few slippery slope situations like this over the years with IoT and other services, I'm simply not willing to make any concessions in that direction. I use a UDM Pro and turning on cloud access requires associating that hardware with a Unify cloud account. That's already undesirable if you want to safeguard privacy.
Fair enough, the Unifi brand is a consumer/prosumer brand after all.
I guess if you have strict privacy requirements then you would be looking more at enterprise gear anyway.
Will it still get automatic updates in case of security issues?
https://store.ui.com/us/en/products/ai-key
Even this only reviews "Smart Detections" and I have smart detections turned off on my Unifi cameras, because it enables cloud AI. Having the ability to have an AI key to process detections locally would be great.
Also, having to buy extra hardware kinda stinks. Would love to be able to have a self hosted Unifi OS server that can do AI key abilities if the hardware supports it.
If only the system would cope with power outages I would agree. My viewports refuse to reconnect to the cameras and need multiple forgets/adoptions to come back to life. The (wired) cameras themselves take hours before they show up again, except for the (WiFi) doorbell. During this period I can see the all online via the managed ubiquiti switches.
I've been using unfi protect/capture (I self hosted capture for a long time) for years and have never had a forgotten adoption any they almost never go down. I do have everything on UPS now but I never saw the issue before that either.
That said I've only used the wired bullet cams so maybe other models are not so nice.
Really the only downside I've seen is about 5ish years ago, all the bullet cams I bought would die after about .75 -> 3 years. All died with the same issue and I had 100% failure rate with any bought during that time frame. Ubiquiti replaced the ones that died during the warranty period but most died just after that expired.
The ones bought before or after that have been great so the issue was solved but I have a nice stack of dead ones that would work great as fake cameras, especially as their IR leds still light up.
Surely the expected solution for that is a UPS on the POE switch?
A UPS is not a solution for all power outages, just ones short enough to last the UPS uptime. The brains of the system is supposed to be the Cloud Key anyway which has its own built in “UPS” and seems to shut down gracefully if you kill power.
The cameras and viewports should not be writing data at all after an initial configuration if designed properly and killing power should present no problems to any system with a read-only filesystem. As someone who designs systems like these it absolutely baffles me.
Ummm..... So the solution to cameras taking several hours to take back to life is to.... just to make sure the will never go offline?
The UPS remark is such an non sequitur. Sure, it's prudent to have one but this doesn't make the bug go away.
Version 1 Cloud Keys would brick upon power loss.
I agree, not sure why you are being downvoted.
Yea Ubiquiti is brutal after a power outage. I got a battery back up for my rack just to avoid post power outage down time.
huh, strange, never had this issue with any of my camera's. takes... a minute to come back online.
My general impression is that it “Just Works” if you don’t do anything remotely interesting with it.
Want to create a VLAN with no Internet connectivity? Better test that it actually has no Internet connectivity because the setting doesn’t actually work.
Want to use the firewall? Better test all the rules — it’s amazingly buggy.
Want to change a WiFi setting without WiFi going down for a minute or two? Good luck — UniFi doesn’t seem to care about making it work.
Want to find information (MAC, switch port, DHCP reservation, etc) about a device that uses the same MAC address on multiple VLANs? Good luck — it looks like UniFi utterly flubbed either their database schema or whatever interface their front end uses to talk to their backend about it, and it’s very, very broken.
Want to find basically any setting based on online docs? Too bad — they keep moving the settings and not updating the docs.
Just to reiterate for those that missed it:
If you change the schedule of a WiFi network your entire network (wired and everything) goes down for two minutes.
Just a simple admin policy change… full network outage.
Clown. College.
Constantly tweaking settings is not a use-case they have optimized for. Most of their customers are small IT shops that support small/medium sized businesses. They set up a network for a few doctors offices, law firms, etc. by clicking a few buttons in the controller's GUI once, and then remotely keep an eye on the networks with the controller software's remote management features.
Eh, in my experience, if you disable the uplink monitor features aggressively enough (which is in a different place in different firmwares and currently seems to also require disabling all wireless uplink/“mesh” capability), then sometime more of the network will stay up. Maybe even the gateway will keep working too if you don’t touch any gateway settings. Of course, if the gateway does decide to reboot, you’re down for many minutes.
It’s real classy.
The thing that made me move off of it was issues connecting to devices on mesh'd APs if the ARP entry for that device timed out on the main AP.
Literally couldn't connect to my mobile phone, and after a lot of troubleshooting (which Unifi does pretty much nothing to help you with) I found that when the phone had roamed to the mesh'd AP, ARPs for it wouldn't get answered. If I forced it back to a wired AP or manually added it to the table... all worked fine. Went unfixed for years, heck, I still don't know if it is...
And all the "alerts" about malicious traffic that a bunch of prosumers seem to love? It's not very actionable for figuring out if it's really a problem nor digging deeper...
Oh, and when they had a firmware update that changed the SSID maximum length from 32 (the spec) to 31. My SSID is 32 characters and after that I could no longer edit the network without a UI error. That sucked.
I'm now on OPNsense and Ruckus APs and while it's not as integrated, I couldn't be happier.
If you can spring for Ruckus (I just buy used off ebay), it's worth it. The controller is integrated into the AP - for me that was worth it over unifi alone.
This. They make excellent access points and their lite beam/air fibre products are great.
But UniFi has serious limitations when it comes to anything beyond the basics. An off the self Asus all in one home router actually has more features and capabilities.
> An off the self Asus all in one home router actually has more features and capabilities.
This is just not true at all. I agree unifi can be buggy at times, and their super clean interface means they need to hide stuff all over the place, but I havent found any network configuration I couldnt do on Unifi yet.
Care to elaborate on exactly which functions standard asus routers have over Ubiquiti gear?
Idk about you but I’m rocking a site to site link to my parents house, I have vlans for each segment in my home network (iot, priv etc) with full ipv6 routing and custom filtered dns over https with full network name resolution for all dhcp clients by their hostname on my local subnet domain…
I have complete control over my kids network access, can block specific types of traffic by app type or time based rules. I have high visibility into my WiFi setup and everything is on prem and self hosted and integrated with home assistant…
This was absolutely my experience. I ended up tearing it all out and selling it on eBay.
I run OPNsense now with a Ruckus standalone AP, and it has been bulletproof.
Funny, I did the same... Never looked back at Unifi. That was a constant fight with problems.
OPNsense, a cheap fanless Brocade switch, and two Ruckus enterprise-grade APs from eBay and boom. Stuff Just Works, and when I want to do anything fancy (I did a /lot/ of weird network setup to troubleshoot users' WFH scenarios during COVID times) I just could.
I took a hybrid approach -- Unifi for everything except the firewall, and a Firewalla for that. I'm overall quite happy with it, although you won't get a single pane of glass for management.
This. I don't use their gateways/ security devices anymore. I run ONSense at every edge which allows me to so some really nice things with respect to remote access for non-home sites.
Most people don't want to do anything 'interesting'. If you stray too far from the beaten path, I'd argue that you no longer need or something that "Just Works". You need something very configurable, which, by definition, will let you shoot yourself in the foot.
My current setup is Mikrotik for wired and Ubiquity APs for wifi. Their wifi devices have great specs and are difficult to beat. Mikrotik has decent wifi devices but not only they have a footgun minefield - not exactly their fault since Wifi is difficult to get right, so the more settings you expose, the worse it gets. Mikrotik also logs behind in features (they are still at wifi 6). It's an odd combination of philosophies but seems to work, all the vlan logic is offloaded to Mikrotik. And so are firewalls, etc. Then the voodoo Wifi stuff gets handled by Ubiquiti.
> Want to change a WiFi setting without WiFi going down for a minute or two? Good luck — UniFi doesn’t seem to care about making it work.
I am with you on that. It's things like that that prevent adoption by larger businesses and contribute to the perception that they aren't a serious contender. I previously had an Aruba InstantOn setup(which is focused on SMB), and got really accustomed to being able to tweak (most) settings without any interruptions at all. I could even do things like change channel widths (in one direction) without losing connectivity. What was really surprising on Unifi is that I lost connection when I changed settings for a _different_ SSID, for like a minute. That isn't really acceptable.
They still do a lot of things right though, and it shouldn't be too difficult to get their act together. The devices are pretty decent and at a surprisingly low price point.
Because Wi-Fi going down for a minute or two doesn’t matter in most deployments. And when it does… you submit a change ticket and not just Yoo-hoo a change in production.
Reading this thread I’ve been using unifi equipment for over a decade why are people tinkering with their networks on a daily basis?
I have more issues with enterprise equipment than with unifi equipment because it just works, and it’s 1/5th of the price, and I can buy a replacement the same day. My spf modules on junipers cost more than most of the products in the entire unifi catalog and can’t support being downlinked to 1GB on one port without the whole module being set 1gb and the entire core rebooted.
The amount of hate is simply unwarranted, people are afraid to patch enterprise switches because historically that meant driving out and a call with TAC, when did we start pretending that enterprise network equipment works flawlessly?
But unifi is trying to position at the prosumer segment.
And we have things like indeed no WiFi (all networks down) if you dare to change WiFi settings, or mdns having a hard limit of five networks because the underlying Perl script is 10 or 15 years old.
I did this in 2023 and my experience has been the same. Had 0 problems other than Sonos being, well, Sonos.
Recently set up CCTV at my parents’ with a Cloud Gateway Max, set up a site to site VPN in 3 clicks and now I can support remotely and their Sony smart TV can see my Jellyfin server.
IIRC some Sonos issues are related to STP. AFAIK it's, like you said, Sonos being Sonos. Lol.
Yeah, that was exactly it. Unifi have a special page in their docs for dealing with Sonos.
https://help.ui.com/hc/en-us/articles/18930473041047-Best-Pr...
I ended up connecting everything with a wired connection and disabling WiFi. Thankfully I have cat6 to every room so it wasn't an inconvenience.
It's worked perfectly since.
How could a Sonos device possibly interact with spanning tree? Are there Sonos devices that act as bridges?
I am more interested in your childhood than your network at this point.
That's because Robert Pera, CEO/founder used to work for Apple for a few years when he was very young.
Has he said that?
I did a lot of jobs when I was very young. I wouldn't want someone to draw conclusions about me today based on my failed stint at Burger King, for example.
Google it.
But yes.
> I finally got around to my childhood dreams of building a home network rack
My childhood dream was to build crazy buildings, before that it was a space explorer. Not sure a home network rack ever made the list!
ok well technically my original network dream was rows and rows of 14.4k baud modems, so we've come a ways since then.
I really love my Dream Machine. Super reliable. What I don't like that much is their UI. It is super weirdly done. It is not natural to use, at least if like me, you use it once every 6 months or more.
I like the way they do VLANs. It's easy enough that it can be managed by people that don't understand all the low level terminology.
> feels like they take inspiration from Apple
the founders are ex-Apple