USG and Unifi network

tracert www.netflix.co.za

Tracing route to detour2.prod.netflix.net [34.252.74.1]
over a maximum of 30 hops:

1 8 ms 9 ms 10 ms 192.168.1.1
2 * * 52 ms 129.205.60.1
3 11 ms 8 ms 7 ms np-isd-edge2.as37497.za.net [197.148.64.12]
4 19 ms 8 ms 7 ms 196-60-9-105.ixp.joburg [196.60.9.105]
5 11 ms 13 ms 10 ms 52.93.56.120
6 16 ms 21 ms 75 ms 52.93.56.129
7 185 ms 180 ms 226 ms 54.239.46.72
8 224 ms 233 ms 201 ms 54.239.46.81
9 * * * Request timed out.
10 * 451 ms 181 ms 54.239.44.148
11 * * * Request timed out.
12 178 ms * 178 ms 52.93.6.164
13 * 286 ms 359 ms 52.93.101.23
14 197 ms 196 ms 279 ms 52.93.101.54
15 * 432 ms 508 ms 52.93.7.77
16 * * * Request timed out.
17 * * * Request timed out.
18 * * * Request timed out.
19 * * * Request timed out.
20 * * * Request timed out.
21 * * * Request timed out.
22 * * * Request timed out.
23 * * * Request timed out.
24 * * * Request timed out.
25 * * * Request timed out.
26 * * * Request timed out.
27 * * * Request timed out.
28 * * * Request timed out.
29 * * * Request timed out.
30 * * DESKTOP-KI99DPL.localdomain [192.168.1.25] reports: Destination host unreachable.

Trace complete.
 
Its so odd as the Litbox youtube works, but netflix or cyberflix does not
 
irBosOtter said:
Like what would break?

10+ years and never had anything break after an update. (AP's and switches, never used a USG gateway though)
Click to expand...
The 1st/2nd gen of UAPs were notorious for random orange ring deaths after upgrades - not enough to recall or become a support nightmare but its notable. Either the network card gives up working or the actual rom corrupts

Ubiquiti's answer is usually a warranty swopout

Personally have a stack of about 6 lying here that I need to take a soldering iron to to try salvage or strip

If you have a TTL cable and know how to use pumpkin you are an old hand at UAPs
 
Bryn said:
I just take the updates slow and one at a time.
Click to expand...
Same I do my slave switches, then the AP's as they are powered off the switches, then the main switch. Must say I have never tried an automatic update and maybe that is the issue. In countless firmwares, only once have I reset the power on the switch port to manually reboot a single AP which didnt come up after upgrade.
 
My Ubiquiti system - USG plus AP-AC-Lites plus poe switch has been totally rock solid; the only time it has been down has been for firmware updates. If only I could say the same thing about my ISP.
 
@OP, perhaps your cloud services have hardcoded DNS servers and the USG is seeing this as a security risk, perhaps it then redirects the DNS requests to the localhost address? Grasping at straws here but without seeing your network it's a bit hard to guess that it could be
 
PhireSide said:
@OP, perhaps your cloud services have hardcoded DNS servers and the USG is seeing this as a security risk, perhaps it then redirects the DNS requests to the localhost address? Grasping at straws here but without seeing your network it's a bit hard to guess that it could be
Click to expand...
Could be

But the cameras were working fine on the USG until I changed ISP at the beginning of November
 
So finally sorted the issue out.

Created a new firewall rule under wan in

Before the predetermined rules that allows all ports
 
seen some people have problems because their mss clamping is not set to auto or its at a value too high.

especially when their ISP uses pppoe

edit: its under, devices-> select USG -> config -> advanced
 
Last edited:
alqassam said:
So finally sorted the issue out.

Created a new firewall rule under wan in

Before the predetermined rules that allows all ports
Click to expand...
Any more specifics in regard to the firewall rule? I seem to be having a similar issue. Some of the devices on the wireless port of the network are struggling to do DNS queries. This includes pointing them to the USG for queries or directly to DNS servers.

Settings:
WAN Network DNS: 1.1.1.1 and 8.8.8.8
LAN Network DNS Configuration Try 1: USG IP
LAN Network DNS Configuration Try 2: 1.1.1.1 and 8.8.8.8
 
Last edited:
Blu82 said:
Any more specifics in regard to the firewall rule? I seem to be having a similar issue. Some of the devices on the wireless port of the network are struggling to do DNS queries. This includes pointing them to the USG for queries or directly to DNS servers.

Settings:
WAN Network DNS: 1.1.1.1 and 8.8.8.8
LAN Network DNS Configuration Try 1: USG IP
LAN Network DNS Configuration Try 2: 1.1.1.1 and 8.8.8.8
Click to expand...

just wondering, who is your isp and is your wan connection dhcp or pppoe?
 
Blu82 said:
Any more specifics in regard to the firewall rule? I seem to be having a similar issue. Some of the devices on the wireless port of the network are struggling to do DNS queries. This includes pointing them to the USG for queries or directly to DNS servers.

Settings:
WAN Network DNS: 1.1.1.1 and 8.8.8.8
LAN Network DNS Configuration Try 1: USG IP
LAN Network DNS Configuration Try 2: 1.1.1.1 and 8.8.8.8
Click to expand...
Call your ISP and find out MTU they are using
If it is less than 1500 then you need to set the MSS manually


You can do it in the controller, under USG wan port MSS setting.


MSS must be 40 bytes lower than MTU so EG

MTU is 1482, MSS should be set at 1442
 
Last edited:
A standard ethernet frame MTU is 1500 bytes. An IP header is 20 bytes, plus a TCP header is another 20 bytes. That makes the standard TCP MSS 1460 bytes.

When using PPPoE the ethernet frame MTU is reduced by 8 bytes to 1492. Again, subtracting 40 bytes (20 bytes each for IP & TCP headers) leaves a TCP MSS of 1452.

Oh - and the TCP MSS is derived from the MTU, not the other way around (IE: You calculate the MSS from the underlying MTU and changing MSS will not change the MTU)
 
access said:
just wondering, who is your isp and is your wan connection dhcp or pppoe?
Click to expand...
Well I can confirm that the problem persists with both a PPPOE (ADSL) or DHCP connection (LTE). A quick browse through the forums indicate that this is not an isolated issue with resolution not clear cut.
 
set the mss clamping to 1408 in the gui and test it
 
Blu82 said:
Any more specifics in regard to the firewall rule? I seem to be having a similar issue. Some of the devices on the wireless port of the network are struggling to do DNS queries. This includes pointing them to the USG for queries or directly to DNS servers.

Settings:
WAN Network DNS: 1.1.1.1 and 8.8.8.8
LAN Network DNS Configuration Try 1: USG IP
LAN Network DNS Configuration Try 2: 1.1.1.1 and 8.8.8.8
Click to expand...
Under wan in

I said allow all

And placed it before the predefined rules.

But I'm sure you are having the clamping issue.
 
alqassam said:
Under wan in

I said allow all

And placed it before the predefined rules.

But I'm sure you are having the clamping issue.
Click to expand...
Thanks. It seems to have solved the issue.
 
alqassam said:
Under wan in

I said allow all

And placed it before the predefined rules.

But I'm sure you are having the clamping issue.
Click to expand...
Blu82 said:
Thanks. It seems to have solved the issue.
Click to expand...

it seems like you guys are allowing all ports in through your wan interface, aka disabled the firewall. like... :unsure:

or am i misunderstanding
 
access said:
it seems like you guys are allowing all ports in through your wan interface, aka disabled the firewall. like... :unsure:

or am i misunderstanding
Click to expand...
Pretty much

Which defeats the purpose of the USG
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X