Welcome to Ethernet Blueprint - Creating a Blueprint for a better home network.
About This Channel: Are you building your dream home and want to ensure a seamless and high-speed network experience? Look no further! Ethernet Blueprint is here to empower you with the knowledge and expertise needed to plan and set up a top-notch Ethernet wiring system. Say goodbye to Wi-Fi dead zones and laggy connections - we've got you covered!
💡 Key Topics We Cover: 🔹 Ethernet Cable Types & Standards: Cat5e, Cat6, Cat6a, or Cat7? We'll demystify these options and help you pick the best one for your needs. 🔹 Network Planning & Design: Learn how to strategically place network outlets and access points for optimal coverage throughout your home. 🔹 Future-Proofing Your Network: Stay ahead of the curve with insights into emerging technologies and trends in home networking.
Hi, really nice video. I have a granny unit I rent and supply internet for. It was nice to know how to isolate that traffic from mine, as well and the IoT, camera, and Guest traffic. I used the Guest button for the guest network and started to use the isolate button for IOT and Granny and realize it is not quite the same as the rules you suggest. I used yours. Things seem to be working well but I can't ping devices from default to one of the isolated networks. Is that expected?
Hi there... If you set up the rules like I have in the video and have the "allow default to Any" (right below "allow established and related" and "drop invalid") but still on top of your blocking rules, you should be able to ping from the default to that VLAN. I have found there are other factors the block ping like windows firewalls or maybe you still have the isolate button checked on that VLAN that you can't ping... maybe?!? If you set it up like my rules, you should be able to ping it.
My ISP in the new house will be in the office where I plan to hard wire my computers. There's a network box that runs from the office to my closet where my whole home network cables are housed. I'll have no APs in my office but will need POE+ in the closet to power my APs. Do I just need a GbE switch for the office and a POE+ switch for the closet?
Which ever area is powering the APs will need POE, yes. Based on your comment, it sounds like that may be in the whole home cabling closet. If your office equipment does not require POE, then you can get a non-poe switch for that area and it will work just fine. Sounds like you are on the right track!
Well thank you so much Tim. I have been watching your videos in preparation and the day finally happened where I moved to my new home, purchased the gear and going through the setup. This would be so overwhelming as a newcomer but these videos and your interactions have really helped. I am going to have my doorbell as wifi, but based on what you showed, i think I understand what to do for WIFI network
Great! It is such a good feeling to be able to help my viewers. My doorbell is WiFi too and it works just fine. I think you will be happy with your new network... not to say that it doesn't come with its own headaches... but keep at it! Nice job!
Hi Tim , Q: Location for any special FW rules. Example: IOT Device Camera needs to communicate with NAS on Default VLAN; do we need to put a rule in here for a unifi camera using the UDM pro NVR to save its recordings on a Camera Vlan?
Yes you will. That will be a LAN-IN Rule and it will need to go above the Deny all Private to All Private rule. You will want to make an IP group that has your NAS IP address in it and use that in the rule. For the cameras, the LOCAL rules can block access to the UDM Pro NVR. I have an example of how the cameras need to be setup in the video and on my downloadable guide that is in the description.
At first this series is awesome, so many useful information in such a simple and understandable way. Now the question if a may :) - i'm running on T-mobile home internet with ODU and IDU devices. I think i can switch the IDU for Ubiquiti Cloud Gateway Ultra (i know there is no W-Fi on this) but ODU in which i install sim card is also a router with DHCP. So now it's like two networks one from ODU which is connected to IDU and IDU is making another network. Have you encountered such situation ? What can i do to have one network (the thing is i like to play online so now i have double NAT) to resolve being behind double NAT ? Thank you in advance.
Very new to Unifi. I'm just wondering if I can apply these tips with just the Ubiquiti Networks UniFi6 Enterprise AP. I found the software ridiculously overwhelming and I'm at the point of giving up and returning the AP.
If you only have a single AP, then these rules wouldn't really apply very well because they are mostly done in the Unifi Controller. Now, if you have a Unifi Controller that is managing that AP, then I would say that some of them would apply for sure. If you just have a Unifi AP and are setting it up as a stand alone device, it is possible, but isn't really how the system is designed. Is the AP the only device you have?
@@ethernetblueprint Yes, I haven't changed my home network in over six years, so I thought it would be a good idea to mix things up a bit. After a few hours of research and some investment, the UniFi 6 Enterprise finally landed on my doorstep. I was completely unaware of the complexity involved, which caught me off guard. This access point is fantastic, but I feel it has minimal value without the rest of its ecosystem. I was exploring the idea of keeping it and learning as I go, but I'm really not sure this is a good idea anymore, considering the overall costs of the added parts required to make it usable for me.
The aspect and the aesthetics of a AP have nothing to do with its functionality (at least for the ones mentioned in the video). The ceiling AP doesn't emit downwards from the ceiling. This is not how radio wave emitters work. It's like saying that the Pole AP emits upwards because the antennas are pointed up! The ceiling AP is called/named "ceiling" because it looks best (most natural) mounted on a ceiling - mimics a lamp or something. Functionality-wise, you could put it in any position (reversed, left to right on the wall, right to left, etc.), and it would still function the same.
I am subscribed. As a newbie, I feel so much better with these settings I added to my simple vlan. I will keep learning and reading however thank you Sir for a HUGE leap forward for someone who knew nothing about vlans/firewalls. I was just told by a friend to get Unifi equip and APs for my new home but had no idea of the rest, LOL
Great Series. Just finalising a home renovation & this is perfect. Question. I’m looking at the UCG-max for the router and was considering multiple smaller switches for different purposes to separate traffic & match Poe demand etc. Eg switch for cameras, switch for APs, switch for TV/media traffic, switch for NAS etc. Pros & cons of this approach vs one big UDM Pro switch?
This is only my opinion here so please keep that in mind... I am also making the assumption that each of these switches would be connected directly into the UDM Pro Max Router and not be daisy-chained together. (daisy-chain = Bad) I would say that if you only needed a 1Gb connection to each switch and didn't need 2.5Gb or 10Gb (now or later), then this approach could work fine. That being said, I personally think the single switch setup with VLANs gives you more flexibility. It would allow you to utilize the 10Gb backbone from router to switch, and the separation that you are talking about can be achieved with VLANs on a single switch, so I don't know that you gain much by physical separation. It is putting all your eggs in one basket and does cost more, so if that is a risk you are wanting to avoid, I certainly understand that. Typically the multiple switch approach is used when the switch devices can't all be in the same room and need to be placed in different areas of the home or building. I guess if it were, me, I would do the single, larger pro switch to make the network more "upgradeable". I hope that helps. And again, if you ask 10 people this same question, you could get 10 different answers.
I haven't done anything that big with Unifi so I don't want to steer you wrong. I would ask @MactelecomNetworks. I follow him and he does larger setups with multiple NVRs.
We found that all the phone lines in our town house (built 2012) are wired with CAT5e (twisted pairs were separated out for multiple lines) so I just swapped all the RJ11 jacks with RJ45. Unfortunately our "new" house was built in 1989 so I will have to do the cable runs myself.
Cool tool. I hope Ubiquiti develops it further to address coverage from adjacent floors. I would also think that AP orientation would make a difference (horizontal/ceiling mounting vs vertical/wall mounting). Looks like a great start though.
The answer is as always "it depends". Could be as simple as a Unifi express. That might be all most people need. But if your propeller hat is spinning hard and you must have all the shiny things in a great big rack with wire or fibre to every room in the house plus the shed, then the sky is the limit. Clearly.
I have a question, in your previous video you created VLANs and assigned IPs to them on UDM. Now, why there is a need to assign the IPs again to the switch port? Why we did not configure only access port or trunk port? If I have AP connected to port 1 of the switch and in AP, we have 3 different SSID and each are in different VLANs. I have created these 3 VLANs on UDM and assign DHCP per VLAN, so that each SSID will get relevant IP address. Are you creating native VLAN network for the management purpose? As native VLAN is untagged. Right? So, I have VLAN 20 for management purpose, that network traffic will be untagged?
It is all about the terminology. For this, you don't assign IPs to the switch ports... similar to WiFi SSID's, you assign VLANs to switchports which are tied IP Networks. The native VLAN is what IP you wan't the device to get assigned.. So, if you plug an AP into a trunk port with a native VLAN, the AP will get a management IP of that native VLAN, but still allow those other VLANS to talk on your SSID's Hopefully that makes sense.
They can be plugged into the UDM Pro SE ports because that has POE. The UDM Pro does not support POE in it's switch... but yes, you can do that with the proper UDM.
You don't lose your recordings, but they don't have it where you can import the videos into the new system. It's still got some room to grow, but they're making really strong improvements with each release, so I'm optimistic that they'll get this ironed out in a future release.
Excellent. I would suggest adding some rules to cover the following services, which you'll find in many IOT networks. mDNS (your rules will start blocking some of the automatic mDNS rules), DHCP and NTP. I haven't watched all of your videos, so you may cover this later, but having the logging enabled for the rules (at least for a while) will allow the user to look at "flows" under "insights" and see what traffic they may be inadvertently blocking in their setup. Very good tutorial -- thanks for posting.
I appreciate your comment and suggestion. I will say that with this series especially, I am trying to keep this very beginner level since many of my followers are new to this. I think logging rules and checking flows would be a bit advanced. Either way, you are very correct. If DNS, DHCP, and NTP are things you want to control, then you would probably need rules for that. Unifi does have an mDNS checkbox that allows you to add the VLANs you want to talk and that does allow that to happen outside the firewall...
The way you released these videos show you want to help and teach rather than get views and rir that reason you got my sub. Please dont become a bigger channel then just pump out veiled ads. Like many others do. Thanks for the great content.
Thank you. I do love to help and plan to keep that as my focus with my channel. And, from what I can see, that seems to make it stand out in the white noise of RU-vid. However, I will also admit that I want to make money with this as well. I promise to do my best to keep my soul with my videos and always make them to help others. Thanks for watching and for the Sub! It means a lot.
Even with a lack of WiFi 7 devices, the U7 access points are the cheaper way to get WiFi 6E since only the expensive enterprise version of the U6 line provides that.
Yes I did and that was an oversight in that video. I am sorry for the confusion. When I redid the video in my Newbie Series which is in my playlist (VLANs is Video #4), I corrected my mistake and gave my viewers a downloadable PDF that they can take with them when setting up their systems. Sorry for my mistake here...
Question: In setting up your "networks", do they all have to be on the same subnet (192.168, 10.0, 172.16) or can they be mixed and you have to write rules for routing to the internet?
They can be whatever subnet you like. The rules I created in video 4 will work for anything you choose. The networks do have to be private IPs though.. there are some IP addresses reserved for public networks. 192.168.X.X, 172.16.X.X and 10.X.X.X networks will work for this.
I'm so green this was is so needed...thank you Sir for helping a senior here with all these setup. So many questions I had you answered now on your other videos
About to give the low voltage guys final instructions on how many drops to put in each room, do you do any consulting? Will love to have you look at our plan and give me some tips, so I don’t forget make a decision I’d regret in the future!
Great Video. My cameras won't show up when in a VLAN don't know if it's because is a 3rd party camera using ONVIF, it does work when I take it out of the VLAN back to my default network . My setup UCG Max running my network and protect, 16 Port Poe Switch that I have my cameras plugged in ports using VLAN 3. Spoke to Unifi and they told me that it needs to be in the same VLAN. This was happening even before I blocked anything so can this be a problem with the new update from UNIFI PROTECT do use ONVIF. Any info will be great to test.
the ONVIF is very new so I am sure there are bugs they need to work through. Sorry for your issue.
7 дней назад
Fantastic video - explained so, so much. Thank you ever so much. One quick question - the All Private IP’s you used (192.168.0.0/16 & 172.16.0.0/12 & 10.0.0.0/8) - why did you put in the 172xxx & 10xxx ones? I thought the network was 192.168.xxxxxx? I’m missing something obvious I’m sure! (And why the /16,/12,/8 on the end of the private IP’s?) Thanks again.
I’m assuming you’re talking about all of the Wi-Fi 7 access points. There are other benefits outside of throughput that make that AP better than some of his predecessors, however, if it’s plugged into a one gigabit port on a switch, that is the max throughput, it will have. It does not.
The lack of poe ports is a complete miss in my eyes. One of these with two ap's is what i put in my parents house with a couple of cameras but having to use poe injectors makes the setup look messy and needs too many outlets so then your into poe switches but they dont make a small afordable 2.5g poe switch. The udr would have been ideal for them but they are never in stock and really need an update. Unifi express would have likely worked for them if it had a few poe ports.
I’m still hoping they come up with a replacement for the UDR. Because, you’re right, that was a great solution for very small deployments, especially since it had POE.
Yeah the Poe inbuilt is quite important in a small deployment for keeping it a clean install. An updated udr with 4 2.5g Poe ports and wifi 7 would be perfect. Then you can run the udr at one end of the building, put a second AP at the other side of the building then run 2-3 cameras. My parents and brother have zero hard wired devices in their houses so some cameras and wifi7 would be perfect to future proof them.
If you are doing 10, 2K cameras, I would do a switch. There won't be enough ports on the SE and the NVR attaches to the switch as well and does not power the cameras like other brands of NVR.
Appreciate the overview, thank you! in reviewing my setup I see I missed a few things. :-} Tried to download your guide and was unable to. Is the link still working?
It is still working... I just double checked. www.dropbox.com/scl/fi/x7g4vtqe7tahcdbbwm984/VLAN-FW-Summary.pdf?rlkey=b7wkur9ut9vlg1em9y9gf5907&e=1&st=oahosl3p&dl=0
Thank you for making this video! I noticed that they dropped the 4 port switch on the newer in wall AP, but hadn’t considered the speed limitations in our phones and tablets. I recently moved from a 2 story house to a single story and am finding that my AC router no longer reaches everywhere I need it to. I’ve been casually looking at setting up a Ubiquity network and am more comfortable getting a couple in wall 6’s, one for each end of the house, and a U7 pro for the middle. Hopefully they integrate switches in the next generation of access points when I need to upgrade again. Cheers!
Yes. I will have to upgrade this video to include the new devices they have delivered. I'm glad you found it helpful though. Good luck with your project!
Thank you. It's rare finding someone genuinely willing to teach things. I myself teach on my channel and am always pleased when I find a genuine content creator who is teaching as I do. Subbed my good man! 😃
That is a very good tutorial. I had a lot of that already but I have reorganised my FW rules using your nomenclature and it is now pretty much self-documented. I love it. Thank you
OMG, thank you for this. It is the best I have found that helped me set up my new unifi network and vlans. The PDF was so helpful. Thank you for your time and effort :)
What is the best way to email you. I am building a new house and used the unifi design center like you recommended. I would just like a bit more advice.
This video is great. I've been looking into unify for a while now, but my biggest reservations about diving into it has been VLANs. I'm pretty familiar with vlans as I do IT at a large resort and everything we connect to a network has a different VLAN. Everyone says unify can do VLANs, but they don't elaborate further and I want something robust enough for firewall rules like the ones you demonstrated. My biggest concern was that unify either would not allow firewall rules, or they would be very limited. This video demonstrates the capabilities well and has shown this is exactly what I'm looking for. I plan to start ordering my components over the next couple of weeks and setting everything up and I could not be more excited.
I appreciate your kind words... Just so you know, I did a full Unifi series and even have a downloadable document for the firewall rules too... check out my playlist for that 8 part series... one video has been dedicated to FW rules...
Hi, I used your video to implement FW rules on my UDM pro max. But I have a slightly different setup; using the default network only for the router & switches. So I created a ‘User’ VLAN. So I altered the 3 rule to give the user network access to all local IP’s (in stead of default). But when I have my laptop in the user vlan, it can’t reach anything in another vlan (also no ping). When I try it from the default network I can reach anything. What did I do wrong?
Sorry for the delay. I was on vacay.. Why don't you email me at tim@ethernetblueprint.com and just reference this comment and we can figure out what is going on. Basically, you have a mgmt vlan and a user vlan... my network is setup that way too. We can talk through it better via email.
Tim doing a great job helping us new comers to Unify. It is very overwhelming just starting out with my new UCG-Max. One problem is when watching a video it will be a older version OS/firmware and some things have moved are renamed etc. Then the hunt begins to find it before you can set it up. Thanks Tim!!!
In this case the connection maxes at 1Gb. I usually do that for 10Gb. However, that being said, you can absolutely use an SFP for that truck connection.
Okay but what if we live in a typical apartment and have one coaxial outlet? Should we assume Verizon home internet can handle up to 6 devices and not be trash? Especially in such close proximity(practically the living room)? Of course location, interference and such affects performance.
I would say yes. It is a WiFi6 Router so it should be able to handle 6 devices with NO Problem - assuming that you have good signal and low interference of course. I will say that I don't have personal experience with this router since I don't connect devices to it. I'm basing this off generalities.
I think the value that Ubiquiti bring in UniFi is the ongoing software support that is provided for FREE. I have just retired my old USG-Pro after almost ten years. Right up until retirement, I was till getting the software updates to Unifi Network, and software updates for a lot of the old switches and AP's. How many companies support your devices for that long with FREE software updates? Cisco and similar cahrge a high price for hardware, then an additional price for licensing to get updates. Thats the value I find in Ubiquiti UniFi.
I typically put the Sonos on the same VLAN that your phones will use... Most times that is the default. In my experience, Sonos doesn't always play well with VLANs.
Its not something you think would be a big deal. But for many, aesthetics is actually important lol. Unifi hits the mark on this. I really just like their switches and NVR/cameras for the price. Its not much compared to other vendors who software leaves a lot to desire. Other than that I use my own pfsense router and self host the controller.
