Tag: unifi

7 Homelab Ideas | Why You Should Have A Homelab

Why You Should Have a Homelab

In 1998 my friend gave me a RedHat Linux CD.  I spent hours each day experimenting with Linux–I loved it.  2 years later I’m in a room with 30 other students at a University applying for the same computer lab assistant job–I’m thinking my chances are grim.  Part way through the mass interview a man walks to the front of the room and asks if anyone has ever used Linux.  I raise my hand–I’m the only one.  He takes me out of the interview for the lab assistant job, introduces me to the department director.  They took me out to lunch.  By the end of the day I had my first job as a Systems Administrator.

Learn things on your own and it will broaden your opportunities.

One of the best ways to learn about systems, applications, and technology is starting a homelab.  A Homelab can give you an enjoyable, low stress, practical way to learn technology.  A homelab will also help you find out the technical areas in which you are interested.  It’s also practical in that you can use it to service your own home.

Here’s 7 Ideas for Your Homelab

1. Router /  Firewall

Ubiquiti EdgeRouter X

The most essential piece of equipment will be your router.  I started out with consumer routers that I’d flash to DD-WRT / Tomato but now I use a virtual pfSense router.  Routers are great to learn about DHCP, DNS, VPN, Firewalls, etc.  I discourage using the router provided by your ISP, they’re usually not very capable and often not secure.  In most cases you can buy a DSL or Cable modem instead of the ISP provided modem combined with the router.  One inexpensive physical router I’d recommend is the Ubiquiti EdgeRouter X.   Ubiquiti provides free software updates (their model is you buy the hardware and the software is free), and you’ll get a handful of advanced features–it’s a very capable router and much better than a typical consumer router–to step up from Ubiquiti you’d be going to pfSense, Juniper or Cisco.

2. Storage

Supermicro StorageThe main reason I started my homelab was storage.  I was taking a lot of family pictures and videos and wanted to save them.  I know there are cloud services, but at the time they were expensive, and then you’re sort of trusting that provider to not delete all your photos or get bought out by a larger company and shutdown.

Then I started using VMware.  I needed faster storage with more IOPS.  One of the best Homelab storage solutions is ZFS.  ZFS takes the best of filesystems, and the best of RAID, and combines them into a software defined storage solution that I’ve not seen any hardware technology able to match.  Two popular free ZFS appliances I like are Napp-It (based on OmniOS) and FreeNAS.  OmniOS is a fork of OpenSolaris and is very robust and has tight integration with ZFS.

FreeNAS LogoI’m currently using FreeNAS which is the free open source version of iX System’s TrueNAS which is used by organizations of all sizes–from small businesses with a few TB of storage to large government agencies with PBs of storage.  FreeNAS has done a great job at technology convergence.  It is both a NAS and a SAN allowing you to try both approaches to storage (I prefer NAS because it takes better advantage of ZFS, but many prefer using SAN and there are benefits and drawbacks to both), it also has many built-in storage protocols:  FTP,  iSCSI, NFS, Rsync server, S3 emulator, SMB (Windows file server), TFTP, WebDav, it can join AD, it can even be an AD DC  (if you like living on the edge) it has a built-in hypervisor (bhyve) to run VMs for whatever you want.  This is now marketed as hyper-converged storage.  All of it is completely free.  You can build your own FreeNAS server like I did, or get started with a FreeNAS Mini from iX Systems.

A few years after I learned ZFS for home, my employer was looking for a new storage solution so having this knowledge and experience was helpful.  I was able to determine one vendor with a traditional RAID solution didn’t handle the RAID-5 write-hole problem properly.

3. Virtualization

VMwareVirtualization allows you to run multiple virtual servers on the same piece of hardware.  VMware is king in the small to mid-size business hypervisor market, and VMware offers their hypervisor for free.  The free version is just like the paid versions except you won’t be able to use some features (most involving high availability and fail-over with multiple servers).  But you can learn most of the concepts and features of VMware.  I’ve tried to use a number of hypervisors but I always come back to VMware.  I consider VMware my basic infrastructure.  From there you can learn about other things like networking, storage, and play with any OS or Linux distribution you want to.

Knowing VMware was hugely beneficial, I’ve implemented it for several businesses, and one of my previous employers.  And knowing how it works means I can discuss the VMware stack intelligently with the ops team.

See my FreeNAS on VMware Guide if you’re interested in running a virtual FreeNAS server inside VMware.

4. Networking

A Homelab without decent networking won’t get you far.  Fortunately if you use VMware you can leverage it to use virtual network switches.  For physical switches I really like the Unifi products.  They are simple enough for non-network engineers like me.  Everything can be configured using the GUI.  Unifi exposes you to managed switches, central management (with the Unifi controller), VLANs, and PoE (Power over Ethernet), port trunking, port mirroring, redundant paths with spanning tree, etc.

Unifi 8 Port SwitchI started with this little UniFi 8-port switch (4 are PoE ports).  I also added a UniFi 24-port switch so I could learn how to do setup a LAG and configuring VLANs across multiple switches (which was really simple using the Unifi interface).  I also like Unifi’s philosophy–they sell you the hardware but the software is free–which means you don’t pay for maintenance or support but continue to get free updates.  In a homelab you may not need to go crazy on VLANs, but separating your main network from your IoT devices may be prudent.

Learning how to setup VLAN tagging, and link aggregation and understanding how networking works helps me communicate better with the network engineers when discussing design and deployment options–they may be working on Juniper or Cisco equipment but I know the concepts of what they’re doing.

5. Wireless APs

Having a robust wireless setup is also a necessity for a homelab.  If you have a large house you get to setup multiple APs and make sure they can handoff connections.  If I was buying today I’d get a UniFi nanoHD AP.  I use an older model, the Unifi UAP AC Pro (I just have one because that’s all I need to cover my house, but if you can find an excuse to have 2 or more I’d recommend it since you can practice rolling updates without downtime, wireless handoff, etc.).  These are managed by the same Unifi controller as the switches.  I first gave them a try because I read Linus Trovalds uses Unifi APs, and they seem to be highly rated by tech professionals–and now I don’t think I’d go back to anything else.

I have written more about Unifi Equipment here.

6. Network Monitoring

Icinga

It is hard to maintain a reliable network and application stack without monitoring for failures.  There are hundreds of network monitoring solutions and it really depends on your needs.  The most widely deployed solution is Nagios.  I have had that on my Homelab, but lately I’ve been using Icinga because it’s simple and it integrates into Ansible.

7. Infrastructure Automation

Automating your infrastructure may not make as much sense in a small Homelab, but it does make sense to automate any task you do repetitively or a manual task that could be automated.  For me, this was  installing updates, deploying servers and renewing SSL certificates with Let’s Encrypt.  To manage this I use Ansible which is one of the most well thought out infrastructure automation tools I’ve seen.  Ansible can manage Linux and Windows servers.  Learning infrastructure automation, especially if you do it using version control and CI/CD tools like Azure DevOps (you can get a free account for up to 5 users with unlimited private repositories) is a great thing to learn for your career if you’re interested in the DevOps world.   The book, Ansible for DevOps by Jeff Geerling helped me get started.  I suggest getting the eBook since he has been known to provide updates to the book (not sure if he will continue to provide updates, but just in case).

At work we completely automated the deployment of Linux servers using Ansible–infrastructure as code.  It took a month of investment but it paid off big time with developers now being able to deploy VMware VMs at will with Ansible by making a Git Pull Request, our entire fleet of servers is updated automatically, and our server and configurations are all consistent.  This replaced an old process of waiting several weeks for a VM to be provisioned and configured by hand.

Bonus homelab application server ideas…

  1. Minecraft Server — popular Java game–it’s like playing with Legos and a great way to get your friends together for some casual games.
  2. Mumble Server – one of the best voice protocols for in-game communication.
  3. Emby Media Server — Anyone that has kids realizes those flimsy blu-ray drives aren’t going to last long.  It’s great to store and host movies, home videos, pictures, and audio.
  4. Asterix PBX Server – VoIP Phone server (use Twilio or Flowroute for SIP trunking).  Polycom makes great VoIP phones.  With Twilio SIP Trunking you can have a real landline phone number with E911 capability for a few dollars a month–and if you get multiple phones you can use it as an intercom system.
  5. Web Server (maybe start a blog) — I hosted this blog from a server in my house for years–until my ISP couldn’t handle the bandwidth.  Now days you can also use a service like CloudFlare to act as a CDN which really reduces your bandwidth usage.  Hosting your own blog is a great learning experience and gives you a place to log your homelab experiments, and share solutions to problems.
  6. Automatic Ripping Machine — Get all your Blu-Rays, DVDs, and CDs loaded onto your Emby server
  7. Backup server — I use a CrashPlan Business subscription to backup my FreeNAS server to the cloud (one of the main reasons I use a NAS as this would be less efficient with a SAN).  BackBlaze B2 is another great option to backup FreeNAS.

…

There are many more areas than I listed, but I think the above is a good baseline to get started.  Pick one area at a time–my homelab was built over many years–often the case is I will improve an area after a piece of equipment fails or I need to replace it for some other reason–that’s a great time to do research.  If you aren’t sure where to start, pick the area that you enjoy the most.  For areas you have no interest the best thing to do is something else–you’re probably not going to be great at something you don’t enjoy.   Certainly a homelab isn’t going to be a substitute for real-work experience.  But it does provide an environment to learn, experiment and enhance your abilities–and the great thing is since it’s your own lab you can learn things that interest you.

I think that’s the largest benefit of a homelab.  To me it’s a playground.  It’s a place put the love of learning into practice.  It’s a place of freedom.  Nobody else is dictating what you do here.  It’s a place to have fun while enhancing your skill.

Do you see a man skillful in his work?
He will stand before kings;
he will not stand before obscure men.     – Proverbs 22:29 ESV

Wireless APs and Switches | UniFi

When all of your network devices lose access to the internet all at the same time regularly throughout the day, there is not much to blame other than a bad network cable to your Wireless Access Point (AP), or the Access Point itself.  It wasn’t the cable.  My old Cisco-Linksys E3000’s days were numbered.  Skype calls were dropping, Emby videos streams were getting interrupted, websites weren’t loading.  As with most technical things, the burden to set things right fell on my shoulders.

Ubiquiti UniFi

It was past time to upgrade to 802.11ac anyway.  I use pfSense for my router so all I want is a Wireless AP, I don’t need a combo, so I started my search.  I don’t really like researching APs because consumer devices are pretty awful at security, and enterprise devices involve support contracts and enterprise software and sometimes the security is just as bad.  But WiFi router recommendations are one of the most frequently asked questions from friends and family, and I’ve never had a good answer …until now.   I came across UniFi made by Ubiquiti.  These are the wireless AP’s that Linus Torvalds uses. The products appear to be marketed towards Businesses and Enterprises, but the software to run it is free, and pretty much all I need for my home/soho environment can be configured through the web-interface.

UniFi Access Points (AP)

AP on Wall
AP Mounted on Wall, LEDs turned off

I purchased the UAP-AC-PRO which is their high end model as well as the budget model, the UAP-AC-LITE.

The UniFi AP (Wireless Access Point) looks more like a smoke detector than a wireless access point.  A typical install is mounting them on the ceiling.  Here’s mine mounted on a wall (the circular ring LED is normally blue which is too bright at night, but fortunately it can be turned off).

Power over Ethernet (PoE)

The AP is powered by PoE.  This means you don’t need an AC-DC adapter, instead it gets it’s power from the Ethernet cable.  This works on standard Cat 5e, Cat6, or Cat6a cable.  Normally PoE devices require an expensive PoE capable switch, and I was a bit hesitant of getting into the PoE world, but as long as you buy a single unit and not their bulk pack the UniFi APs usually comes bundled with a PoE injector to get you started.

I had no idea what a PoE injector was, but it turns out to be really simple.  It’s a little box with a power cable, and two Ethernet ports, LAN and PoE.  Just plug the LAN port into your switch and your AP into the PoE port.  Couldn’t be any simpler.  Now, if you’re running a fleet of WiFi access points it probably makes sense to get a PoE switch.  But for one or two in a house the PoE injector is fine.

PoE Injector

Switch -> Ethernet -> PoE Injector -> Powered Ethernet -> AP

Two PoE Options:  Passive or IEEE 802.3af/at

Now, there are a couple of different kinds of PoE.

Here’s the difference: Passive PoE is as dumb as an electrical outlet.  It just sends power through the Ethernet cable whether you need it or not… and this can damage devices not designed for Passive PoE if you accidentally plug a powered Ethernet cable into them.  The much better standard is 802.3af and 802.3at PoE.  With this power isn’t provided until the device requests it, which means it’s very safe and you can plug non-PoE devices into PoE ports without blowing them up.

The UAP-AC-PRO uses 802.3af.

The UAP-AC-LITE and UAP-AC-LR products require passive PoE.  However, I have seen possible signs that Ubiquiti is switching all their products to the IEEE 802.3af/at standards, so it may be worthwhile waiting for the newer models if you don’t want to spend the extra for the Pro model and can afford to wait.

The UniFi Controller

UniFi Controller Overview
UniFi Controller Overview Page

So, these Access Points don’t run a web-server with a management interface.  This is a business/enterprise class solution so it’s meant to be centrally controlled from a single controller.  You will need to download the UniFi Controller (which is free).   Once it’s running you can access it via web browser or the UniFi App for Android or iOS.  The controller can be installed on Windows, Linux, or MacOSX.  If you don’t care about collecting stats it doesn’t need to be up and running all the time so it can be run on a workstation, but if you have a server I recommend running it there.  I created an Ununtu 16.04 VM called “unifi.b3n.org”  I gave it 1GB RAM, 30GB HDD, and 1 core which seems to be plenty.

The install process is straight forward…

Create a file, /etc/apt/sources.list.d.100-ubnt-list

Then add the GPG Keys and install the software.

Go to https://unifi.example.com:8443 (See the bottom of this post for info on setting up a real certificate).

The first time you access it you get Wizard to set it up, after creating an account and such it will have you adopt the UniFi APs on your network.  If they’re plugged in it will find them automatically.  It not only manages APs but also manages UniFi branded routers, switches, cameras, VoIP devices, etc.

Wireless Mapping Tool
Wireless Mapping Tool

I can see how it would help manage a fleet of wireless equipment across multiple sites.  You can see all the devices connected, the AP they’re connected to, signal strength, connection speed, data they’ve used, how they’re authorized to be on the network, VLANs, etc.  I’ve hidden a lot of columns in the screenshot below but it gives you an idea of the data you can get on wireless clients.

UniFi Wireless Clients
Wireless Clients

Neighboring APs

Wasted SpectrumThe UniFi also keeps track of every wireless AP that it has seen.  My neighbors seem to have a lot of HP Smart Printers and TVs that need to waste RF spectrum running their own APs for some reason.  Cars Have APs?  It looks like a lot of cars have their own APs now days?  At least I’m guessing these MitsumiE APs are automobiles that have driven by my house.

Probably Car Hotspots?
Probably Car Hotspots?

UniFi Android / iOS App

The Android app is is just as capable (and I presume it is on iPhone as well), I didn’t do a thorough comb through but at a quick glance it appears every screen and configuration setting in the web interface is available in the Android App.

unifi_android_shot_1
android_unifi_shot2

AP Models Comparison

The APs perform well.  Since I installed the UniFi we have not had a single wireless connection drop, even if I put the AP power settings at their lowest it has better range than my previous AP.  I also setup both APs and my devices had no trouble roaming between the two APs as needed while maintaining connections.

The three main models are:

  • UAP-AC-LITE – 2×2 MIMO on both bands (budget)
  • UAP-AC-LR – 3×3 MIMO on 2.4, 2×2 MIMO on 5GHz (middle)
  • UAP-AC-PRO – 3×3 MIMO on both bands (fastest)

Does 3×3 MIMO make a difference for 2×2 clients?  You might get better reception, but probably not a noticeable difference.  However, if you do have 3×3 capable clients you should see a benefit going to a 3×3 AP.

UAC-AP-PRO vs UAC-AP-LITE Performance and Coverage with 2×2 Clients

Most wireless clients are only 2×2 MIMO these days, and even though I tend to run the latest hardware I only have 2×2 devices which can connect at a maximum speed of 866.7Mbps.  A 3×3 MIMO AP can improve performance of 2×2 MIMO clients because the extra antenna might provide a better signal.  That’s the theory anyway.

I can’t really tell a difference between the two routers in my house, in the Android App Wireless Test I get better uploads speeds on the Pro than I do the Lite, which might be due to it’s extra antenna but I don’t see that performance benefit on our laptops when transferring files back and forth between them and my FreeNAS unit.

I do think I get slightly better upload speeds on the Pro model when I’m far away from the AP.  This may be due to the extra antenna or it could just be subjective.

As far as real life performance on 5GHz setting the channel width to 80Mhz I get about 50-60Mb/s down and 30-40Mb/s up pretty consistently throughout the house, and that’s with multiple wireless clients connected and a pretty saturated RF spectrum.  Here’s an RF Scan at my house… there’s really not a single empty channel even on 5Ghz.

RF Scan

UniFi Managed Switches

US-8-60W
US-8-60W

Ubiquiti also sells managed switches, ranging from 8 to 48 ports with a variety of PoE options.  I’ve been wanting try out managed switches so I picked up their small 8-port.  Since I’m running these at home low noise is extremely important.   The two switches that fit the bill are the 8-port US-8-60W (with 4 PoE ports) and the 24-port US-24 (without PoE), both of these models are fanless and silent.

UniFi US-24
US-24

The US-24 doesn’t have PoE on it.  The US-8-60W has four 802.3af PoE ports.  I should note that this switch cannot do passive PoE so it won’t be able to power UniFi’s passive PoE equipment (such as the UAP-AC-LITE).

Ubiquiti US-8-60W UniFi

There are two banks of LEDs, top row is only for the four PoE ports on the right and light up orange if PoE is activated.  The bottom row lights up green on gigabit links and orange for 100Mbps links.  There’s also a blue/white LED on the far left front of the router that’s off.  I do not like blue or white LEDs.  Fortunately as soon as I provisioned it the UniFi Controller automatically turned it off based on my site preferences.

VLAN Configuration

After getting a quick primer from a Network Engineer on how VLAN tagging works I decided to start VLAN tagging my network.

Under the UniFi Controller you can setup your VLANs, I programmed all of mine in above.  Something that is a bit confusing is there are two Network Purpose types that support VLAN tagging, “Corporate” and “VLAN-Only”.  There is no difference between the two, unless you are using the USG (UniFi Security Gateway), which can run a DHCP server for each “Corporate” network type.  Since I’m using pfSense instead of the USG I setup mine as vlan-only.

Then it’s fairly trivial to manage the ports, setting up trunking and access ports for certain VLANs.  In my case port 2 is my trunk port and goes to my pfSense router.  I also ran my Northland Cable connection through the switch so I could get some bandwidth insights.

As always, the UniFi Controller provides some pretty neat insights, it picked up devices not only connected to it but also found devices connected to other switches (notice most of the devices below were found on port 2 which connects up to my VMware vSwitch).

Switch Insights

And UniFi provides great statistics and insights into traffic flow on the switch.

Appendix A: Setting an SSL Certificate on the UniFi Controller.

By default the Unifi controller runs on port 8443 with a self-signed SSL certificate.  It is ridiculously difficult to set a custom cert… I know how to work with Java keystores but I just couldn’t get the ace.jar Java cert importer to accept my intranet cert.  Then I read the CA cert had to be in DER format which also didn’t work…. arrgh.  Suddenly it hit me that setting up certs on nginx is easy, it would be much simpler to set up an SSL certificate on an nginx reverse proxy on port 443.  I want the UniFi Controller listening on 443 anyway, and even better, I don’t have to touch any UniFi configuration files or certs.

If you’re running an internal CA like I am you can just generate an internal Cert, or if you need a public cert Let’s Encrypt should work just as well.  Here’s an example of generating one from FreeNAS.

FreeNAS Unifi Cert Generation

Export the certificate and key and save them to /etc/nginx/cert.crt and /etc/nginx/cert.key.  The configuration is a pretty standard nginx reverse proxy, the only issue I initially ran into was the UniFi controller reported a  “WebSocket connection error” warning, so I enabled nginx’s proxy support for WebSockets (which the configuration below takes care of).  Other than that it’s a straight forward reverse proxy.

Edit /etc/nginx/sites-available/default :

And restart nginx and then I was able to browse to https://unifi.b3n.org with a green SSL cert.