Ubiquiti EdgeRouter Lite (UBNT ERLite-3) Update - still works great for my family, and for my VMware vSphere, Windows, and Linux home lab
This article was originally intended for my audience at The Greater Boston Network Users Group at their July 11th meetup. Until I'm able to do a complete configuration walk through, this spot in a recent "Network Enthusiast" EdgeRouter video I created gives you a good look at how DNS is supposed to work in Windows + Linux and/or VMware vSphere environments, only using this little metal box router, no Microsoft AD/DNS/DHCP required!
EdgeOS User Guide
The ERLite-3 has been around since 2013, still pictured in it's original plastic body on Amazon. They're made of metal now, and has gained a lot functionality ever since through regular firmware updates, see full history here. This "networking enthusiast" router has enjoyed a lot of popularity in the market, with mostly-favorable reviews on Amazon and on Ubiquiti's forum. I've personally owned two of these little ~$90 routers for about a year, one dedicated to my traveling home datacenter right, and the other used heavily full time by my entire family, with better reliability than every consumer router I've used before it.
I rely on my ERLite-3 for all my home network routing, DNS, and DHCP functions, leaving the Wi-Fi duties to my wired-backhaul eero 3 pack Wi-Fi that I configured for bridge mode. This combination, wired up to my DCOSIS 3.0 SB6183 cable modem, gives me a consistent 300 MBps down and 30 Mbps up speed from anywhere in my home, whether I'm wired or wireless. Hard to not be happy with that.
The deployment overview will hopefully help newbies make this little metal box behave much more consumer-router-like. Don't bother configuring the router with the default firmware, update it first! All the steps are detailed below.
Firmware update history
22.214.171.124 - Current Version
Download here. This is the latest release, it arrived in April 2017, and was just a security update, with no new features since December 2016's 1.9.1 release. Read all about 126.96.36.199 in the forums and release notes. You can also see future release announcements at the EdgeMAX Updates Blog that even features a handy RSS feed.
1.9.7 is in beta now, sign-up for access to the beta forums. When 1.9.7 is released, it might not have the DNS shortname fix incorporated, and it won't have OpenVPN vulnerability fixes, but 1.9.7-hotfix.1 will.
Future release with many new features and fixes. Date TBD.
L2TP IPsec VPN Server
It works, both split and tunnel all settings from iOS tested over LTE just fine, but:
- can't be used in conjunction with UPnP, causes only first tunnel connection to work, subsequent connections from same or any other device require router reboot, note that UPnP shouldn't be turned on anyway, which I explained back in my consumer router days here and here.
I personally haven't gone through the admittedly better, but more-complex OpenVPN configuration process. But for those who have, they may have spotted that there were some OpenVPN vulnerabilities recently discovered by Guido Vranken's fuzzing techniques, see:
with OpenVPN pathes already released for OpenVPN's installable versions of VPN servers intended for actual servers (not this router). The Hyper-V and ESXi Virtual Appliances have unfortunately been neglected since 3rd quarter of 2016, which is a shame, since I used to enjoy the occasional use of that OpenVPN VMware appliance, see also:
- Presenting at New York City VMUG July 24 2014, “Insecure about using public WiFi? Connect to your home’s OpenVPN appliance, for free.”.
Implementation of dnsmasq coming soon, we hope
- dnsmasq seems more desirable for DNS/DHCP, since it may eliminate duplicate DNS admin overhead (see screenshots below), but it won't be available until the 2.x firmware release.
Meanwhile, while we wait for the Ubiquiti to get to 2.x, there a very workable way to have robust DHCP and DNS (not DDNS) for your current Windows, Linux, and VMware hypervisors & VMs. I've been using this method extensively for a year now, hasn't let me down for the ERLite-3. While these weren't the most intuitive steps for me to figure out initially (dogged determination/trial-and-error), now that they're documented, implementing them is easy
For proper VMware forward (both FQDN and shortname) and reverse (IP) DNS lookups, which happens to help Windows and Linux systems also get to know one another on a first name or full name or IP basis, here's the steps.
Prepare your router
Download latest firmware
If your ERLite-3 is new, be sure to update the firmware first before bothering to configure anything at all! 1.9.1 is available here, with video that guides you through the simple firmware update process here, using a laptop/PC/mac directly attached to eth1.
When the firmware update is complete, you will be prompted to reboot.
Use the Setup Wizard to turn it into a consumer-like router
a. click on Wizards tab, along the left-edge under Setup Wizards choose WAN+2LAN2
b. under Internet port (eth0)
c. under Firewall, ensure checkbox is on for Enable the default firewall
d. under LAN port (eth1) is where you create your network router/gateway IP address and subnet mask, most will like the defaults of 192.168.1.1 / 255.255.255.0
e. under (Optional) Secondary LAN port (eth2), this is where you create a second network router/gateway IP address and subnet mask, most home and SOHO users won't need this, and will choose to uncheck the Enable the DHCP server checkbox like I did, although some may choose to isolate their WiFi access points onto this separate network if they can run a backhaul cable right to this port (or via a switch), giving them better visibility into just the traffic generated by their Wi-Fi devices using EdgeMAX Traffic Analysis tab, with a live overview of traffic flow that's leveraging the optional Deep Packet Inspection (DPI), which doesn't seem to slow traffic down at all
Create a DHCP Reservation
a. Power up your network-connected device, which by default will request a DHCP lease.
b. in your ERLite-3 Web UI, nagivate to
DHCP Server / Actions / View Leases / Map Static IP [change the IP and/or Name to those desired] / Save / Close
Create a DNS shortname/FQDN/IP entry
a. in your ERLite-3 Web UI, nagivate to
Wizards / DNS host names / Static host names / Host name [enter FQDN name] / Alias [enter short name], / IP Address [enter your available IP Address], then and click OK
Admittedly, implementing the DHCP reservations and making the name entry is easy enough, it's maintaining the discipline to make all future changes in both places that is a bit tougher. Maybe dnsmasq will change all that, hopefully eliminating the need to both create a lease entry and create a duplicate DNS entry. But in all releases to date, the DHCP Lease GUI doesn't yet support dnsmasq.
Taken with 188.8.131.52 firmware loaded.
Includes the BOM (Build Of Materials)
- The Xeon D Supermicro SuperServer "Bundle 2" of joy, a complete home datacenter virtualization solution that really flies
Dec 07 2016
- Replaced my Linksys router with an eero 3 pack after also testing Luma mesh surround Wi-Fi, faster wireless in every room has arrived!
Aug 21 2016