Wifi inside and outside metal pole barn?

[AntonLargiader]

Thanks! I may need that but I did make progress this morning. At this point I'm fighting some software age issues.

I have two older iMacs. There are two versions of the UNA. I installed the older UNA (because I figured it was more likely to run) on the older iMac last night and it didn't launch. This morning I installed the newer one and it did, but hung on a blank screen after logging in so I switched to Firefox (had been on very old Safari 13) and it got much farther but hung on adopting the Lite switch. Internet revealed this can be because the UI Discover app isn't working, and sure enough it has an X on it and the system say's it's damaged.

So I repeated this on the newer iMac (which is really just my photo machine) with Safari 15 to get a clean start. It won't even open the package because it says it cannot verify it and that the developer should update it. Arrgh. Those are the only machines I have with ethernet ports. I'll resume my efforts when I get home this evening.

 

[kj_mustang]

I use the software controller but on a windows pc. Never had issues with it.

 

[AntonLargiader]

Maybe I should bring my Win10 PC from work and use that to get everything going.

 

[Denwood]

That will work. You don’t need the software running after configuration.

In the “for what it’s worth” category I also work with a lot of Ubiquity gear and figured I would give Tplink a go on their Amada line of access points and controller which is very similar to the Ubiquity. I’m using this to share a Starlink based internet access setup across a campground. So far the c200 controller, EAP610 and EAP225 outdoor APs are working very well in the test setup. WIFI It will be set as a hot spot with voucher access. EAP225s meshed with EAP610.

I’ve been using a few RE650 repeaters (in AP mode) in my home setup which are simple to configure directly, have access restriction options, have a gigabit Ethernet port, and AC1900 performance. Very good buzz for your buck on these.

 

[AntonLargiader]

FWIW I'm starting from the right (port 1) for my APs because those are the PoE ports, and starting from the left for modem and hardwires.

 

[wyliesdiesels]

FWIW I'm starting from the right (port 1) for my APs because those are the PoE ports, and starting from the left for modem and hardwires.

Hold on. What is the make/model on your ISPs modem?

You said you have fiber, so there wouldnt be a modem. If their equipment isnt a gateway with a router and firewall built in then you will need a router/firewall as well. You cnat just plug the internet into a switch.

 

[AntonLargiader]

As I described they installed a fiber modem and nothing else. I have a similar one here at work but it's not the same model. This one is connected directly to an Airport Extreme. At home I used the Netgear switch with it and my iMac connected just fine. I was hoping for similar with the Unifi switch but if I need to buy something else I can do that.

 

[wyliesdiesels]

There is no such thing as a fiber modem. It would either be a gateway or a switch.

Do you have the make and model?

Oh and the airport extreme is your router/firewall so...

 

[AntonLargiader]

Ting uses modem and ONT interchangeably. It appears to be an Adtran 411. Safe to say it is not a gateway or a firewall, I think. So I need to buy a gateway/firewall, huh? Any suggestions?

EDIT: Or maybe it is a gateway, but not a router/switch/firewall. That's why I'm asking!

 

[Denwood]

I suspect that unit is just providing a LAN IP and that an attached router does PPPoE authentication...same as what is done here by the telco. Your Unifi switch won't be setup for this. You need a router. If you want to keep things all UB, then take a look at their Dream Router as this should address your controller concerns as well for the WIFI APs.

 

[kj_mustang]

I use the older UniFi Security Gateway firewall/router but not sure they sell that device anymore. Was cheap, about $130 and has been working fine.

 

[wyliesdiesels]

Ting uses modem and ONT interchangeably. It appears to be an Adtran 411. Safe to say it is not a gateway or a firewall, I think. So I need to buy a gateway/firewall, huh? Any suggestions?

EDIT: Or maybe it is a gateway, but not a router/switch/firewall. That's why I'm asking!

That is definitely not a gateway router firewall or even a modem. It is strictly an ONT interface.

So you’ll either need your existing Apple router/firewall or if you want everything under the same umbrella get a router/firewall from ubiquiti as suggested above

 

[wyliesdiesels]

I suspect that unit is just providing a LAN IP and that an attached router does PPPoE authentication...same as what is done here by the telco. Your Unifi switch won't be setup for this. You need a router. If you want to keep things all UB, then take a look at their Dream Router as this should address your controller concerns as well for the WIFI APs.

Nope it is strictly an ONT. i read the spec sheet. No NAT, no firewall, no DHCP, none of that. There is no built-in router. It gives you a WAN address not a LAN address.

Also PPPoE authentication is not used on fiber circuits. That’s a strictly DSL circuit thing and its from the early 2000s. New DSL circuits dont even have PPPoE authentication these days. I was just working on a bonded VDSL2 circuit crom frontier today. No PPPoE

 

[wyliesdiesels]

I use the older UniFi Security Gateway firewall/router but not sure they sell that device anymore. Was cheap, about $130 and has been working fine.

They do but theyre almost always sold out

 

[AntonLargiader]

Thanks. The Airport Extreme is in use here at work so I'll see if I can scrounge something out of the Bag 'o Old Stuff. For now, could any old typical WiFi router from the past be pressed into service for this, ingoring its WiFi functionality if needed? All have a yellow LAN/WAN port

Netgear WNR1000 V2
Netgear WNR2000 V2 <- looks best
CenturyLink C2000T
At least one other Netgear one at home

EDIT: and will I need a crossover cable for anything?

 

[wyliesdiesels]

You need a router that is rated for the internet speed you have or higher. You dont want a router that cant deliver the speed youre paying for

No need for a crossover cable

 

[AntonLargiader]

I'll try the WNR2000. It's not fast fiber; it's cheap ($19 for 5 MBPS which is pretty useful; can step up to gigabit for $89 if we want). I didn't bring my Win10 machine home so I might not make any real progress this evening.

Thank you VERY much, folks. This has been super helpful.

 

[Denwood]

Nope it is strictly an ONT. i read the spec sheet. No NAT, no firewall, no DHCP, none of that. There is no built-in router. It gives you a WAN address not a LAN address.

Also PPPoE authentication is not used on fiber circuits. That’s a strictly DSL circuit thing and its from the early 2000s. New DSL circuits dont even have PPPoE authentication these days. I was just working on a bonded VDSL2 circuit crom frontier today. No PPPoE

The teleco (which is municipally owned) here still uses pppoe authentication for all residential/commercial accounts unless you pay extra for a static non auth. I have quite a few business clients..and it’s a PITA. I specifically spec a static non auth IP whenever possible for business accounts.

@Anton, you may want to future proof a bit and make sure the router can at least route a gigabit. The WNr2000 only has 100 Mbps network ports and is 300 Mbps max WLAN speeds. I would not use it.

 

[AntonLargiader]

It's here now and it's free, so as long as there's nothing wrong with using it I'll just do that. If I need a faster one in the future I'd rather buy it in that same future when it's cheaper and better.

5 MBPS (I'm on it right now) is fine for my surfing. My wife sits on a VPN all day doing all sorts of stuff with shared drives and so forth, and if she thinks it's sluggish we'll bump up to gigabit and revisit the router issue. She is still on the Comcast service but maybe today she'll switch over. Just a plug swap... but she has zero tolerance for tech issues when work is crazy.

 

[Denwood]

She won’t be happy at 5Mbps on a shared link if she’s pulling files over a work VPN. 100/30 would be a minimum. She’s likely using VOIP telephony as well so stack everything up and 5 will be awful.

 

[wyliesdiesels]

The teleco (which is municipally owned) here still uses pppoe authentication for all residential/commercial accounts unless you pay extra for a static non auth. I have quite a few business clients... and it’s a PITA. I specifically spec a static non auth IP whenever possible for business accounts.

@Anton, you may want to future proof a bit and make sure the router can at least route a gigabit. The WNr2000 only has 100 Mbps network ports and is 300 Mbps max WLAN speeds. I would not use it.

your telco is living in the dark ages.... PPPoE authentication is pointless. why? because DSL signals are sent to specific addresses. not like someone is gonna go to a building plug in a modem and get internet from someone else's account.

Also, most DSL ISPs dont even allow you to bring your own DSL modem anymore (unlike cable modem ISPs) making the PPPoE authentication even more pointless... i dont even know where you can buy a DSL modem for ADSL2 bonded service that will work with our ISPs...

I service lots of DSL circuits.... havent seen PPPoE authentication in years and years.... also, Ive never seen PPPoE authentication for a fiber handoff. that would just be silly... again because someone isnt gonna setup an ONT on someone else's service in someone else's building...

here we can get a DSL circuit w/ either a dynamic or static but neither come with PPPoE authentication....

 

[wyliesdiesels]

I'll try the WNR2000. It's not fast fiber; it's cheap ($19 for 5 MBPS which is pretty useful; can step up to gigabit for $89 if we want). I didn't bring my Win10 machine home so I might not make any real progress this evening.

Thank you VERY much, folks. This has been super helpful.

5Mbps is useful? yikes maybe if youre living in the early 2000s.... what do you do? just surf webpages? good luck doing any streaming with that or multiple users.... way too slow....

 

[wyliesdiesels]

It's here now and it's free, so as long as there's nothing wrong with using it I'll just do that. If I need a faster one in the future I'd rather buy it in that same future when it's cheaper and better.

5 MBPS (I'm on it right now) is fine for my surfing. My wife sits on a VPN all day doing all sorts of stuff with shared drives and so forth, and if she thinks it's sluggish we'll bump up to gigabit and revisit the router issue. She is still on the Comcast service but maybe today she'll switch over. Just a plug swap... but she has zero tolerance for tech issues when work is crazy.

no way will 5Mbps be enough for all that. VPNs have overhead traffic that will make that connection crawl...

how fast is your comcast service?

and why do you have 2 services?

 

[dscheidt]

your telco is living in the dark ages.... PPPoE authentication is pointless. why? because DSL signals are sent to specific addresses. not like someone is gonna go to a building plug in a modem and get internet from someone else's account.

Pretending that the addresses of hardware are fixed is living in the dark age. Session level authentication makes it possible for the customer to change their gear, and makes it much harder for someone to connect when they're not authorized to do so (stop paying, for instance). (Which happens all the time, don't think it doesn't. )

 

[wyliesdiesels]

Pretending that the addresses of hardware are fixed is living in the dark age. Session level authentication makes it possible for the customer to change their gear,

very rarely have i had a customer move locations anywhere here in the state. and when there has been a move, the ISP has to be involved to either move the DSLAM (headend equipment) or setup a new one in the next CO. so its not like the customer can just willnilly move or change equipment at will and instantly get service at a new address without ISP involvement. so yes the hardware is fixed.

Are you even familiar with how DSL circuits work? a DSLAM has to be set up in the CO to feed the specific pair feeding the building. Its not like cable modems that use a shared line on the pole and you can get signal anywhere theres service from the same ISP. completely different technologies. so yeah PPPoE authentication is pointless for DSL circuits because of their wire and headend equipment topology.

out here, the ISPs own and provide the DSL modems so the customer wouldnt be changing any of that. your comment about a customer changing THEIR gear is illogical and makes no sense whatsoever...

Lets take it a step further for fiber DIA circuits. the customer cant just willnilly change the NID equipment because they dont own it nor can they move it to a new location because the fiber has to be setup at the new location.

and makes it much harder for someone to connect when they're not authorized to do so (stop paying, for instance). (Which happens all the time, don't think it doesn't. )

thats funny & ironic. the cable modem ISPs accomplish that with cable modem MAC address registration. and when you dont pay your bill? they just send an automated signal to the CMTS (cable modem headend equipment similar to DSLAMS) to shutoff your internet.

are you aware that cable modems dont use PPPoE authentication or session level authentication and accomplish the same things you mentioned? apparently not...

Also all the recent DSL circuits ive worked on dont use session level authentication either so yes PPPoE is from the dark ages. all the ISPs here have moved away from it...

 

[Denwood]

your telco is living in the dark ages.... PPPoE authentication is pointless. why? because DSL signals are sent to specific addresses. not like someone is gonna go to a building plug in a modem and get internet from someone else's account.

Also, most DSL ISPs dont even allow you to bring your own DSL modem anymore (unlike cable modem ISPs) making the PPPoE authentication even more pointless... i dont even know where you can buy a DSL modem for ADSL2 bonded service that will work with our ISPs...

I service lots of DSL circuits.... havent seen PPPoE authentication in years and years.... also, Ive never seen PPPoE authentication for a fiber handoff. that would just be silly... again because someone isnt gonna setup an ONT on someone else's service in someone else's building...

here we can get a DSL circuit w/ either a dynamic or static but neither come with PPPoE authentication....

Preaching to the choir. Not sure why a site installed ONT with a defined MaC even needs authentication. Static non auth resolves that, but it’s still a special request with extra $$ for the static. DSL is a rarity here aside from rural as fiber has become pervasive here.

 

[AntonLargiader]

I was on that 5 MBS service for years at work. I bumped up to gigabit there when we shared it throughout the building but for regular surfing the difference is barely noticeable to me. My wife can function in a car with a cell phone connection but I doubt she's done meetings that way. Her call. If she wants gigabit, it's one flick of a switch away. If she can function on 5 she probably will because she's... thrifty. Streaming? What's that? Seriously, not a thing. But her meetings might be.

Speed: on Speedtest.com Xfinity (cable) looks like 59/12 and Ting (fiber) shows as 20/3 which makes no sense to me as I think it should be 5/5. That's on WiFi. I can do a hardwired test.

Have both because, well, we're switching. Which is why I'm starting fresh with my setup; all we had was the Xfinity modem/router. We've been on the waitlist for Ting for probably ten years now and they finally just installed a branch by our house. We had DSL for a while and then switched to cable for some reason (probably reliability; we were on the edge of the DSL distance) but never liked having to play the bundling/discount game every year. We just want reliable internet at a standard price.

 

[Denwood]

59/12 would work likely for remote work. It's what I'd call a bare minimum for my org. They do file access/video conference/VOIP along with web based apps so its the 12Mbps upload that is the limiter, particularly on a shared connection at home. I also very much push for a direct LAN cable connection (we make a requirement for new hires) for remote workers as it eliminates all the weird WIFI issues I have to deal with a few clients. It sounds like you're doing a new build, so something to think about for your wife's office area.

For remote workers with fibre at home, the residential service level at 400/200 makes for an experience quite similar to being in the office if they access our multi wan setup over fibre. They can typically transfer files at 20MB/s (about 160Mpbs) which is faster than a 100 Mpbs local LAN cable connection. That said, my brother works for a large manufacturing firm (multi national) and their internal LAN speeds here are much worse than that..ha.

 

[AntonLargiader]

Well, looks like it's working. I installed the Unifi app on my work machine and brought it home. If I never have to deal with Java again that will be great. It found, adopted and updated the switch and APs. I plugged in my iMac and wife's laptop (she also has a hardwire requirement), and they are recognized. I'm typing this on the iMac. I got on its WiFi with my MBP and phone, no issues. A buddy says he has an older Unifi AP that he'll send me so I can put that on the porch.

Right now I have connected:

1. U6-Lite AP
2. U6-Lite AP
3. -
4. -
5. -
6. Wife's laptop
7. iMac
8. WNR2000 router -> ONT

I will put her printer on 5, probably my other iMac on 4, my friend's AP on 3, and then if I want to add more devices I can take my iMacs off and just let them be WiFi. 1-4 are PoE.

My Win10 machine is connected to the router, not the Unifi switch.

Network security question: If I wanted to have a LAN cable that had no visibility at all to the rest of the network, just to the internet, how would I do that? Connect that to the Unifi switch and set Port Isolation?

 

[dcg9381]

wanted to have a LAN cable that had no visibility at all to the rest of the network, just to the internet, how would I do that? Connect that to the Unifi switch and set Port Isolation?

Historically, these are called vlans. They're separate, but can both route to the internet. Might look implementing a new vlan up per port.

It's easier with wifi: With the UDM-Pro (I assume it's the same in the unifi app), I just setup a "guest" wifi and there's a box to set network isolation. Shop has "guest" wifi, no password, not tied to the rest of the network.


On the larger question subject, I have a single unifi AP in my 40x60. We've got a friend who is camping out (RV) outside the shop on one of the wings and the wifi isn't strong enough, she was getting 25% packet loss on her laptop. I simply used a AC-1750 that I had sitting around and setup a wireless network bridge. It works because the antennas on the bridge router are much better than a PC. I was going to toss that router, but turns out it has a use. Metal buildings do cause a lot of signal attenuation. It'd be simpler to add an outdoor access point, but that costs money and I had the time and AC-1750.

 

[Smoker]

Historically, these are called vlans. They're separate, but can both route to the internet. Might look implementing a new vlan up per port.

It's easier with wifi: With the UDM-Pro (I assume it's the same in the unifi app), I just setup a "guest" wifi and there's a box to set network isolation. Shop has "guest" wifi, no password, not tied to the rest of the network.


On the larger question subject, I have a single unifi AP in my 40x60. We've got a friend who is camping out (RV) outside the shop on one of the wings and the wifi isn't strong enough, she was getting 25% packet loss on her laptop. I simply used a AC-1750 that I had sitting around and setup a wireless network bridge. It works because the antennas on the bridge router are much better than a PC. I was going to toss that router, but turns out it has a use. Metal buildings do cause a lot of signal attenuation. It'd be simpler to add an outdoor access point, but that costs money and I had the time and AC-1750.

To support VLANs and trunk ports you'll need a managed switch that supports those functions.

 

[dcg9381]

To support VLANs and trunk ports you'll need a managed switch that supports those functions.

It's not clear to me what the unifi app and 8 port unifi POE "switch" is capable of. I have the UDM-Pro, it'll definitely VLAN a port.

 

[wyliesdiesels]

I was on that 5 Mbps service for years at work. I bumped up to gigabit there when we shared it throughout the building but for regular surfing the difference is barely noticeable to me. My wife can function in a car with a cell phone connection but I doubt she's done meetings that way.

most cell phone connections are way faster than 5Mbps....

Her call. If she wants gigabit, it's one flick of a switch away. If she can function on 5 she probably will because she's... thrifty. Streaming? What's that? Seriously, not a thing. But her meetings might be.

5Mbps may work for a video meeting but when you add other users on it wont. BTW video meetings are streaming video to and from the server so...

Speed: on Speedtest.com Xfinity (cable) looks like 59/12 and Ting (fiber) shows as 20/3 which makes no sense to me as I think it should be 5/5. That's on WiFi. I can do a hardwired test.

DSL circuits are never symmetrical plus you may have burst speeds on your circuit which means the speed will be a % more than youre paying for. but if youre only getting 3Mbps upload, thats not gonna work for more than one device streaming video to a server. the problem with low upload speed on a broadband circuit is that once youve maxed it out, the circuit becomes saturated which makes the circuit slow down and causes everything using it to suffer.

youll be much happier on the 60/15 from comcast if youll have more than one host using the service

 

[wyliesdiesels]

It's not clear to me what the unifi app and 8 port unifi POE "switch" is capable of. I have the UDM-Pro, it'll definitely VLAN a port.

it looks like almost every 8 port switch they have is layer 2 so... if the OP gives us the model number of the switch he has, we can obviously look it up

 

[AntonLargiader]

DSL circuits are never symmetrical ...

We had DSL... about a decade ago... but this is fiber which is advertised as 5 MBPS symmetrical. I may have had some boost/burst assistance on that test, but I tested from a LAN cable-only machine and got about 4.7 each way so it sounds right.

it looks like almost every 8 port switch they have is layer 2 so... if the OP gives us the model number of the switch he has, we can obviously look it up

It's the Unifi Lite 8-port POE. At the moment I'm using the Netgear WNR2000 as the router and I have two U6-Lite APs connected per my post a few posts back.

 

[wyliesdiesels]

We had DSL... about a decade ago... but this is fiber which is advertised as 5 MBPS symmetrical. I may have had some boost/burst assistance on that test, but I tested from a LAN cable-only machine and got about 4.7 each way so it sounds right.

It's the Unifi Lite 8-port POE. At the moment I'm using the Netgear WNR2000 as the router and I have two U6-Lite APs connected per my post a few posts back.

aww ok yeah some fiber circuits are symmetrical. depends on the ISP

as for VLANs with that switch, the problem youre gonna run into is that router isnt VLAN capable...

 

[AntonLargiader]

OK, thanks. Getting a different router if it comes down to it is fine. I would probably get one of the Unify Dream routers just to stay in the ecosystem, as long as it DID support VLAN. So I can't create a VLAN with one of the ports on the Lite 8-port?

 

[jdm5]

I don't think that's right - the Lite 8 port is listed as supporting VLANs. Check here, table: https://ui.com/switching#compare "VLAN Support"

As long as it's managed by the Unifi App (or their "key") you should be fine to create "profiles" / VLANs for each port. I manage a large Unifi installation, but don't use any of the Lite switches to validate, but worth testing before buying anything else.

 

[AntonLargiader]

I think there will be a benefit in getting one of the Dream router products, which is that it has the Network Application on it. That's the "console" they talk about; it can be managed by a phone or remotely or whatever. Without a console, you need to manage from a computer running the Unifi app which then apparently becomes the owner of the overall configuration. If you log into the application from a different machine you will see that the components have all been adopted into a different system which you don't have management access to. So in the name of keeping that on the network and being able to access it from any device, I think I will eventually spring for one of the Dream routers.

The basic Dream Router, at $200, only claims to support 600 mbps. Which is plenty, but in this day and age I would think that any premium product would support gigabit. It is also an AP and has 2 PoE ports and 2 non-PoE. I suppose this is the equivalent of the basic "Wifi router" that you get with nearly any residential internet service, or the Airport Extreme. Honestly, this (rather than the switch) would have been enough to get me off the ground on this project but I may as well keep the switch at this point so I can keep more stuff hardwired. It's pretty cheap.

The next step up, the Dream Machine, is full Gigabit but none of the ports seem to be PoE which is kind of amazing. The higher level Dream Machine Pro and SE do have PoE ports but they are not APs.

 

[dcg9381]

OK, I wanna say I've been fighting this issue all weekend. We've got a guest 5th wheel just outside the barn.
I've re-oriented the access point twice, tried putting a wireless bridge in the RV. At this point, I just ordered another access point and I'm installing it outside the building.