Oh yeah, there’s my indoor Easter holiday entertainment sorted out! Time to level up the home network

Alrighty, let’s do this! For the sake of completeness I’m going to keep adding pics to this thread then I’ll roll them into a blog post later on. Here’s where I got up to in my weekly update a couple of days ago: https://www.troyhunt.com/weekly-update-186/

Now, as embarrassing as it may be, I have to share a pic of what the new stuff is replacing: behold my cupboard of shame!

Onto happier things, this @4Cabling rack is *really* nicely built and well-equipped. It’s a half height 18RU on castors and includes mountable feet and a whole bag of rack nuts.

Does seem to be a little dusty inside though which I wasn’t expecting

Feet on next to the lockable castors, I’ll screw them down once everything is in place

The fans are... soulful

Now to load up the “unloaded” patch board with the RJ45 keystone couplers

That’s that mostly done - they only had 19 couplers in stock so the other 5 will come later. Still not sure the order I’m going to rack everything so that can just sit there on the shelf for now.

Onto the good stuff! 24 port gen 2 @ubnt PoE switch... complete with American power plug! They sent this and the UDM over to me so definitely not complaining and it’s a standard C13 socket anyway so must be a gazillion spare ones around the house...

The box of cable shame (there’s a theme here...) must surely have one (hopefully two)

Apparently I’m short on spare power cables, but not short on ones I could steal from other devices

Now - black screws or the silver ones from @Ubnt? Still not sure on rack order either, onto the next bit...

Behold, the @ubnt UniFi Dream Machine Pro! This’ll be the heart of the network and it looks *very* swish. Might have gone a bit overboard on the screw packaging though guys

Everything in situ, albeit not bolted in. I’m thinking this order given most cabling will be patch board to switch. Switch will then SFP to UDM and I’m thinking of wiring the shelf-mounted devices from the ports on the UDM down through the brush panel. Other ideas before I mount?

Some good comments here, thanks folks. Re power, I’ve got a secondary PSU I’m going to mount up higher as 6 plugs was never going to cut it anyway once devices start going on shelves.

Then in terms of heat, I don’t know if the UDM or the switch will run hotter, but I do know that the UDM is significantly longer and both have exhausts at the top rear edge so it makes sense to put the UDM on the bottom.

Think I’m going to leave the top slot empty to make access to the back of the patch panel easier and give the hot air a little more space

I think the build has now reached this point...

Everything now bolted into place. This is nice. I like this

The second PSU is now also in place, that’ll be plenty of power now. Can also see how the units stagger with the larger UDM Pro on the bottom.

Bit of a sense of how I expect it’ll look once cabled. There’s presently only 8 ports patched on the existing board so I won’t need to load the whole thing up. 8 of the switch ports aren’t PoE either so things may need to cross in slightly add directions.

I love my @ubnt gear, but the print size on the docs that come with it is kinda insane. QR code straight to the online content! For anyone interested, here’s the UDM Pro quick start guide: https://dl.ui.com/qsg/UDM-Pro/UDM-Pro_EN.html

Snap a 6TB WD Red (bought separately) into the UDM’s caddy then just a single screw holds it in place. That’s now sitting in the unit and I’m calling it a night. Tomorrow I’ll start powering everything up and configuring it.

Alrighty, time to tackle this again and hopefully get my living room back too! Hardware is in place, let’s move onto the soft stuff.

Main thing now is I want to make sue my config from the old system comes across. For example, the names and icons I've assigned to all the clients.

I'm going to try the "How to Migrate from Cloud Key to Cloud Key or UDM" guide, but I've heard mixed results so I'm not convinced it'll play nice, but let's give it a run anyway. Here goes... https://help.ubnt.com/hc/en-us/articles/360008976393-UniFi-How-to-Migrate-from-Cloud-Key-to-Cloud-Key-or-UDM

Still spinning, still spinning, still spinning, still spinning, still spinning, still spinning, still spinning, still spinning, still spinning, still spinning, still spinning...

(and yes, I'm only taking settings, I don't care recent data relating to usage)

More than a quarter of an hour later and... still spinning. Let's try it with 7 days of data as well, I'm sure that'll work just fine...

Oh wow, it actually did! While I'm here, does anyone know if it's possible to manually migrate client names and icons? I'd actually be quite happy setting everything else up from scratch again and having a "clean" install. Surely all this info just sits in a config file, right?

While I’m thinking about this, time to power on the UDM!

I’ve patched the WAN port into the existing switch from the old network so I should have connectivity to take updates. The display is super nice, looks like it’s booted and ready for setup.

Off to a slow start. Doesn’t want to find internet when connected to either the existing network or direct to the telco modem via the WAN port. It’s obviously coffee time

Amazing what just walking away and having a coffee can achieve

Spoke too soon I’ve decided I don’t trust this cable, just grabbed the longest one I had, time to roll over to backup...

And we’re back! Literally just running the WAN cable directly to the modem now and using one that isn’t all messed up.

Name the UDM, login to @ubnt, 2FA, all looks good, go!

And a little reminder of my Australian shame, thanks guys...

Now this looks like it might take a bit. I was having intermittent connectivity issues so ended up killing power to the old switches to power down the existing APs. A move of desperation, TBH, but just could work out why it couldn’t hold internet. Seems fine now.

While I’m waiting, let’s have a little play with the display on the UDM:

Everything is now ticking along very nicely with the UDM alone. I'm *really* tempted not to even bother restoring from the old network simply because this is so clean. Think I'll keep setting bits up then make a call on it a bit later.

Switch time! SFP to UDM and wait...

Hmm... controller isn’t seeing the switch over SFP, night drop back to RJ45 and see how we go

And like magic, there it is! It's like this issue was foreseen...

(thanks @Nick_Craver!) https://twitter.com/Nick_Craver/status/1249488695884996611

Playing with the display on the switch, this is *really* nice!

Just unplugged the ethernet cable from the switch and immediately got this push notification to my phone. Nice!

Incidentally, I unplugged the RJ45 to try this suggestion from @izevaka which, of course, worked right away! I just hadn’t noticed the WAN icon above the SFP port earlier. https://twitter.com/izevaka/status/1249494155551600640?s=21 https://twitter.com/izevaka/status/1249494155551600640

Now when I look at the switch I can see it talking over SFP to the UDM. Look at the UDM and I can see the SFP connection downlinked to the switch as well as the WAN connection and port 8 connected to my laptop. It all just works together so nicely

Next up is to start stealing APs from the old network and putting them on the new one. Took one from the cupboard of shame and plugged it into the new switch. It's "managed by other" but I can still adopt it, steps for thread completeness: https://help.ubnt.com/hc/en-us/articles/205146020-UniFi-Advanced-Adoption-of-a-Managed-By-Other-Device

And now stuff is getting really funky: first the old network warns me I’ve disconnected an AP (fair enough) then that it’s found a rogue AP as UniFi has picked up another network broadcasting the same SSID. Cool

I've now created 2 new networks with the same names and same passwords as the old networks. Devices in nearby range are starting to associate with the new one. This is all going too easy...

Time for the cupboard of shame to become the cupboard of joy!

Decided to reverse the lower PSU (pictured before) so I can easily plug in peripherals like the modem. Will need a longer cable on that one too so I can run it cleanly.

Took a while to do, but I went through and adopted every AP and switch in the house to the new network and named them appropriately. The network itself now has all the hardware components physically connected and logically adopted.

Almost all clients came over smoothly - almost. The Synology NAS has a static IP on the old subnet (new one defaulted to 192.168.0) and it took me a while to work out what they were, but the Sonos units also decided to stick to the old subnet until rebooted.

I've also got one device that for the life of me, I just can't identify. It's connected to my IoT network on the garage AP and the manufacturer is "Wisol" (looks like they do a lot of IoT chips). It's not pulling much data, wonder what it is?

Worked it out, it was the bloody washing machine which was mid spin cycle

Behold!

Everything is great

People were asking about noise levels of the 2 @ubnt units. Especially once in the rack with the door closed they’re barely audible. The rack fan, however...

And while I’m here, first play with @ubnt’s AR feature

It’s a bit tempting just to sit here with a quiet drink admiring this

I had 2 devices on the old network that had static IPs on the previous subnet so weren't addressable on the new network with different subnet. I set a static IP on my laptop with the old subnet then ethernet cable directly from there to the device, changed the IP, job done!

One of those devices was @The_Pi_Hole which needed me to SSH back into it and run the setup via “pihole -r” during which I could manually specify the new IP. Bit of mucking around but that brought it straight back online.

With @The_Pi_Hole now working again, I can jump back into the @ubnt config and set DNS to use the Pi's IP for name resolution

Now the fun bit: it was *really* obvious how much crap was on the page when @The_Pi_Hole wasn't on. Here's a page I still had open this morning followed by what it looks like with a refresh just now. Check the dev tools - chalk and cheese!

(also, WTF @Forbes, 630 requests?!)

Weird issues with @The_Pi_Hole since this change. It's not resolving really common names (such as Google and my blog) and whilst it shows a heap of activity on the graphs, isn't showing any activity on the client log for the last couple of hours (it's past 19:30 here now). Ideas?

Changed DNS back to default last night and picking the whole thing up again this morning. With no @The_Pi_Hole I can ping my website. Change DNS to use it again, ipconfig /renew on the PC then can't ping it again. So, let's start trying to fix this...

First up, try a software update so SSH into the device and... it can't talk to the internet. So, yeah, that wouldn't have been helping. Next question: why can't it talk to the internet?

And there's the problem - it's still looking for the gateway on the subnet of the old network, it should be 192.168.0.1

So it's back to "pihole -r" and the setup shows the old gateway, change that sucker, new gateway confirmed, updating...

And... fail. Still can't connect to download the lists. Same thing happened yesterday when I rolled subnets but it was directly connected to my laptop so no internet. I was *confident* I set the subnet right too. Gateway still shown as the old one.

Drilled down into /etc/dhcpcd.conf and found the old subnet still present so manually changed it and rebooted. Thanks for those who chimed in, including @The_Pi_Hole https://twitter.com/The_Pi_Hole/status/1250547305435901952?s=20

All looks good top to bottom now: @The_Pi_Hole has the right gateway and can talk to the internet, manually setting my PC DNS to it (just to make sure I don't take the whole network down - again!) works fine so I can now set the @ubnt network back to using it again.

And while I'm there:

sudo apt-get update
pihole -up

@The_Pi_Hole had an update so we're now up and running with the latest and greatest. I'll give it a while then come back and see what the logs look like in terms of DNS queries...

An important feature of any good network is being able to identify high TCP latency on your washing machine. My Samsung 8.5kg front load only had a 67% wifi experience this morning when connecting to the media room access point.

(yes, I've been inside for too long...)

Half a day on and @The_Pi_Hole is working precisely as expected now. About a quarter of all DNS queries are being black-holed:

Next up is threat Management on the UDM. Having previously just used a basic UniFi Security Gateway, I've never had this before so let's see what's inside...

Well that was easy! Protections look very high-level though, wonder what I'll actually see in the logs? Let's fire up Tor.

No problem loading over Tor but per the UniFi config, intrusion detection has identified the connection. That's kinda cool, think I'll enabled things like P2P as well (just in case of those pesky kids, of course...)

So far the only thing threat management has picked up is the times I've connected to Tor via my laptop or desktop. But the UDM Pro is also sitting behind the @Aussie_BB provided modem so isn't directly internet facing (and I've not opened any inbound ports).

Next thing to play with is the Network Scanners (alpha). I'm going to give the Endpoint Scanner a go and see how much stuff it finds on the network. There are presently 36 clients on the network so it should pick up *something*, surely...

A few hours on and it's crawled a bunch of the network. Some interesting stats on which devices have which ports open. For example, I just learned that my printer is running a web server...

I’m going to start patching in some more ports on the existing wall outlets. There’s no need to align all numbered points on the house side with those on the patch panel and switch side (nor are there enough ports in the switch), but I need to keep track so it’s label maker time.

Before I started this build, there was a bunch of discussion around temps and fans. I've left the (large, noisy) cabinet fans off, but wanted to see what difference they'd make. Here's a before state: ambient, UDM Pro and Pi Hole temps

Turn the fan on then 1 hour later... ambient temp is identical, Pi Hole temp is identical and the UDM Pro has only dropped 2 degrees. At least from a cooling perspective, fans are overkill here. But is there value in drawing in more fresh air?

Camera time! This is a G4 Pro, a 4K PoE with infrared night vision, a built in mic and weatherproofing. It’s a *very* solid unit, physically larger than I was expecting.

There’s a multi-directional base on it and a gland (not in shots) to pass the cable through and keep the weather out of. Material is a really solid metal (no plastics) and tolerances are pretty tight (almost couldn’t get the RJ45 shielding through).

To make this work, the UDM Pro needs to be running "Protect" which isn't installed by default so let's turn that sucker on then load it up.

Now it'll need a camera. Into an ethernet jack connected to a PoE port on the switch and it shows up as a client right away alongside everything else on the network.

Back to the "Protect" app and it shows up as a new device that can be added. It's sitting next to me on the couch with my laptop and shows a snapshot of what it's seeing (I guess that's useful if you're adopting a heap of cams in different places and you want to name them).

Well that was easy Whole bunch of camera properties sitting there. The 4-position layout then gives you the ability to have live view with however many cams you want. Heap of options there, more than I'll ever actually use.

It's late so a night mode only test for now. Just wandered out with my son and put the Sonos on in the background to see how the mic went too.

Here’s the lighting as taken by iPhone (night mode off). Looking at the vid before this again, contrast seems a little off at first and it feels overexposed (I’ve got a white tshirt on too), then it focuses a little better. Watch how the light on the tiles changes.

Lot of tweaking to be done I reckon. It didn't originally pick us up walking down to the jetty (metal frame in the background), but sensitivity and zone can be adjusted. Same again with what you actually want to record. Anyway, heaps of configurability.

Next cam is a G3 Flex. Much smaller than the G4 Pro, also only 1080P but still with a mic. Wide angle lens too (same as the G4 Pro, which I forgot to mention).

Same setup process as the G4 Pro - add a device... done! Unplugged the first cam to add this one so only the G3 Flex showing now.

Both these have a *heap* of configurability too, something I'll have to jump into once they're in permanent locations.

Turned off all the lights to give this one a run - it's near pitch black and I could barely see a thing. Cool

Quick look at some of the iOS app features, haven’t drilled down beyond these yet. (And yes, I know my iPhone battery is nearly dead, you don’t all need to point it out!)

Time to play with another cam, this time the G3 Dome. 1080p, mic, weather proof, but this time intended for ceiling mounting with a super wide angle lens.

Add the Dome to UniFi Protect per the other cams, open up the live view on the laptop, get Ari to push "PrtSc" and here we go. A lot covered in the field of view, would be good for sitting above an entryway or facing into a commercial area (none of these will face inside my home)

Gotta hand it to @ubnt - I’ve never seen such careful packaging of screws before

That packaging is for an AP XG I had laying around, got a plan for it that will benefit from a high-powered unit, let’s adopt, upgrade then see if this works...

So 5 days and many, *many* hours later, I finally have cameras working in the house. Why so many hours? Because there are no wired ports anywhere near where I want the cameras, so I started out by trying to wirelessly uplink one AP with a secondary Ethernet port to another AP.

Got this working in the garage so you’re looking at a PoE injector to power the AP then another one to power the cam. Ethernet runs from one injector to the main port on the AP, from the secondary port on the AP to the other injector then that injector to the cam. Phew!

I can now see the garage AP uplinked wirelessly to the AP in the media room with plenty of signal strength for streaming video.

I used a G3 Dome cam mounted to the roof (3M Command stickers) and removed the clear lens shield (it’s staying indoors in a clean, dry environment) which improved the quality remarkably. So that’s one cam done and dusted!

So next problem (and I appreciate this is a most first world of problems), is how to get a cam into the boat shed. It’s bottom left of pic behind the slatted door and under 40cm of reinforced concrete. No way, no how could I get a wireless signal between APs down there.

Eventually got a great suggestion via Twitter DM after my last weekly vid - Ethernet over powerline. I had some old NetComm units from years ago laying around so I plugged one in on the inside and patched the port.

Down in the boat shed (which also houses the pool pump), I attached a mounting bracket for a G3 Bullet cam to the pipe work with cable ties then wired in the cam.

Below that is a UniFi AC Mesh Pro powered by a PoE injector with the secondary port connected to another injector then into the cam. You can see the other end of the NetComm unit in the power socket providing network connectivity to the AP.

Finally, when all bundled up (kinda) neatly, it doesn’t look too bad in a room already full of exposed plumbing and conduit.

Most importantly though is the picture quality. I tried all the cams I had further up the thread and the G3 Bullet had the best framing and most mounting flexibility. Pics here are from the middle of the day then pitch black night with the IR doing its thing.

In the prior pics you can see a timeline next to them. It’s easy to zoom in and focus on areas with events (namely movement), and because it’s constantly recording it’s also easy to export a time lapse between given points. Here’s sunrise then me grabbing some stuff.

Next up, it’s time to get serious with those G4 Pro cams and that means professionally running cables

Needed another couple of PoE ports on the switch for the cams but wasn’t sure which ports actually needed to provide power. No problem, fire up the @ubnt app and turn on the AR, looks like port 9 can be patched into a non-PoE port. Cool

The G4 Pro 4K cameras are now hard wired in! As part of the setup I’ve defined “Privacy Zones” I don’t want recorded, namely the pool and the window to the master bedroom. These will always appear black.

I’ve also defined a “motion zone”; only activity within it will trigger an “event”. It’s constantly recording anyway, but it’s much easier to scroll back through specific events. I can define multiple ones with different sensitivities too - got more tweaking to do.

Sample of captured video (and audio) below after a motion event triggered by my daughter and I walking down to the boat. Embedded from YouTube to ensure the original 4K quality comes through:

That video was good, but it cut off even though we were still moving, albeit down at the boat. Let’s add another motion zone and increase the sensitivity of it. Note: giant inflatable swan remains outside the zones as it roams around the pool