Ubiquiti EdgeRouter Lite (UBNT ERLite-3) Update - still works great for my family, and for my VMware vSphere, Windows, and Linux home lab

Posted by Paul Braren on Jul 11 2017 (updated on Jul 19 2017) in
  • Networking
  • VMware
  • ESXi
  • HowTo
  • HomeLab
  • This article was originally intended for my audience at The Greater Boston Network Users Group at their July 11th meetup. Until I'm able to do a complete configuration walk through, this spot in a recent "Network Enthusiast" EdgeRouter video I created gives you a good look at how DNS is supposed to work in Windows + Linux and/or VMware vSphere environments, only using this little metal box router, no Microsoft AD/DNS/DHCP required!

    Shop

    This Ubiquiti EdgeRouter Lite (aka, UBNT ERLite-3) is available at Amazon and Newegg.

    Product Page

    • Ubiquiti EdgeRouter Lite
      Model-Comparison
      Steve Gibson brags about his beloved $65 "EdgeRouter X" on many Security Now podcast episodes, an even smaller router that uses the same firmware family. But the EdgeRouter X doesn't specify that it can also do a million packets per second. I wanted something fast enough for my home's 300Mbps/30Mbps connection, with a bit of future-proofing for even faster internet speeds someday. Even with a year of daily heavy use already behind me, I don't suspect I'll want or need to swap my ERLite-3 for some years to come.

    EdgeOS User Guide

    EdgeRouter Datasheet

    Firmware Download

    Status Update

    The ERLite-3 has been around since 2013, still pictured in it's original plastic body on Amazon. They're made of metal now, and has gained a lot functionality ever since through regular firmware updates, see full history here. This "networking enthusiast" router has enjoyed a lot of popularity in the market, with mostly-favorable reviews on Amazon and on Ubiquiti's forum. I've personally owned two of these little ~$90 routers for about a year, one dedicated to my traveling home datacenter right, and the other used heavily full time by my entire family, with better reliability than every consumer router I've used before it.

    TinkerTry-UBNT-EdgeRouter-Lite-with-eero-cropped
    ETH0 at left is connected to my cable modem, ETH1 connected to my gigabit switch, one of my 3 eero Wi-Fi devices is pictured at right, using SlimRun gigabit wired backhauls to the same gigabit home network.
    883710450961133569

    I rely on my ERLite-3 for all my home network routing, DNS, and DHCP functions, leaving the Wi-Fi duties to my wired-backhaul eero 3 pack Wi-Fi that I configured for bridge mode. This combination, wired up to my DCOSIS 3.0 SB6183 cable modem, gives me a consistent 300 MBps down and 30 Mbps up speed from anywhere in my home, whether I'm wired or wireless. Hard to not be happy with that.

    The deployment overview will hopefully help newbies make this little metal box behave much more consumer-router-like. Don't bother configuring the router with the default firmware, update it first! All the steps are detailed below.

    Firmware update history

    1.9.1.1 - Current Version

    Download here. This is the latest release, it arrived in April 2017, and was just a security update, with no new features since December 2016's 1.9.1 release. Read all about 1.9.1.1 in the forums and release notes. You can also see future release announcements at the EdgeMAX Updates Blog that even features a handy RSS feed.

    1.9.7

    1.9.7 is in beta now, sign-up for access to the beta forums. When 1.9.7 is released, it might not have the DNS shortname fix incorporated, and it won't have OpenVPN vulnerability fixes, but 1.9.7-hotfix.1 will.

    2.0.x

    Future release with many new features and fixes. Date TBD.

    VPN server

    L2TP IPsec VPN Server

    It works, both split and tunnel all settings from iOS tested over LTE just fine, but:

    1. can't be used in conjunction with UPnP, causes only first tunnel connection to work, subsequent connections from same or any other device require router reboot, note that UPnP shouldn't be turned on anyway, which I explained back in my consumer router days here and here.

    OpenVPN vulnerabilities

    I personally haven't gone through the admittedly better, but more-complex OpenVPN configuration process. But for those who have, they may have spotted that there were some OpenVPN vulnerabilities recently discovered by Guido Vranken's fuzzing techniques, see:

    Insecure-about-using-public-WiFi-Connect-to-your-home’s-OpenVPN-appliance-for-free-Network-Diagram-Page-1-2014-Jul-22

    with OpenVPN pathes already released for OpenVPN's installable versions of VPN servers intended for actual servers (not this router). The Hyper-V and ESXi Virtual Appliances have unfortunately been neglected since 3rd quarter of 2016, which is a shame, since I used to enjoy the occasional use of that OpenVPN VMware appliance, see also:

    Implementation of dnsmasq coming soon, we hope

    • dnsmasq seems more desirable for DNS/DHCP, since it may eliminate duplicate DNS admin overhead (see screenshots below), but it won't be available until the 2.x firmware release.

    How to properly configure DHCP and DNS for properly for mixed OS home labs

    Meanwhile, while we wait for the Ubiquiti to get to 2.x, there a very workable way to have robust DHCP and DNS (not DDNS) for your current Windows, Linux, and VMware hypervisors & VMs. I've been using this method extensively for a year now, hasn't let me down for the ERLite-3. While these weren't the most intuitive steps for me to figure out initially (dogged determination/trial-and-error), now that they're documented, implementing them is easy

    For proper VMware forward (both FQDN and shortname) and reverse (IP) DNS lookups, which happens to help Windows and Linux systems also get to know one another on a first name or full name or IP basis, here's the steps.

    Prepare your router

    1. Download latest firmware

      If your ERLite-3 is new, be sure to update the firmware first before bothering to configure anything at all! 1.9.1 is available here, with video that guides you through the simple firmware update process here, using a laptop/PC/mac directly attached to eth1.

      EdgeMAX - Upgrade Firmware via Web GUI
    2. Reboot

      When the firmware update is complete, you will be prompted to reboot.

    3. Use the Setup Wizard to turn it into a consumer-like router

      a. click on Wizards tab, along the left-edge under Setup Wizards choose WAN+2LAN2
      b. under Internet port (eth0)
      c. under Firewall, ensure checkbox is on for Enable the default firewall
      d. under LAN port (eth1) is where you create your network router/gateway IP address and subnet mask, most will like the defaults of 192.168.1.1 / 255.255.255.0
      e. under (Optional) Secondary LAN port (eth2), this is where you create a second network router/gateway IP address and subnet mask, most home and SOHO users won't need this, and will choose to uncheck the Enable the DHCP server checkbox like I did, although some may choose to isolate their WiFi access points onto this separate network if they can run a backhaul cable right to this port (or via a switch), giving them better visibility into just the traffic generated by their Wi-Fi devices using EdgeMAX Traffic Analysis tab, with a live overview of traffic flow that's leveraging the optional Deep Packet Inspection (DPI), which doesn't seem to slow traffic down at all

    4. Create a DHCP Reservation

      a. Power up your network-connected device, which by default will request a DHCP lease.
      b. in your ERLite-3 Web UI, nagivate to
      DHCP Server / Actions / View Leases / Map Static IP [change the IP and/or Name to those desired] / Save / Close

    5. Create a DNS shortname/FQDN/IP entry

      a. in your ERLite-3 Web UI, nagivate to
      Wizards / DNS host names / Static host names / Host name [enter FQDN name] / Alias [enter short name], / IP Address [enter your available IP Address], then and click OK

    Admittedly, implementing the DHCP reservations and making the name entry is easy enough, it's maintaining the discipline to make all future changes in both places that is a bit tougher. Maybe dnsmasq will change all that, hopefully eliminating the need to both create a lease entry and create a duplicate DNS entry. But in all releases to date, the DHCP Lease GUI doesn't yet support dnsmasq.

    Screenshots

    Taken with 1.9.1.1 firmware loaded.

    2017-07-12_0-41-34
    The main Dashboard view, it's what you see when you first log into the router with your browser.
    2017-07-12_10-21-31
    Traffic Analysis view is availabe because I've turned on Deep Packet Inspection and left it on, which seemingly hasn't slowed things down at all.
    2017-07-12_10-17-55
    DHCP Server Static MAC/IP Mapping view.
    2017-07-12_10-13-32
    DNS hosts names wizard.

    See also at TinkerTry

    Includes the BOM (Build Of Materials)

    replaced-linksys-with-eero-after-also-testing-luma
    How to install Ubiquiti EdgeMAX EdgeRouter firmware v1.9.1 onto UBNT ERLite-3