An initial stab at it
One of the things I’d like to do with the Unifi Dream Machine I have sitting in my livingroom is to enable some kind of guest wifi that has zero access to any of the internal systems I’ve been setting up. The long-term goal might actually be to segment as much as possible across separate VLANs, but let’s dip our toes into the water first.
I’m aware of VLANs. I’ve monitored them, detected them, indexed them, but I’ve never actually set one up.
I browse over to
unifi.home.lan, create a new wifi network, apply a VLAN ID to it, enable Guest Policies
and wonder if that’s really as simple as it is. After all, Unifi’s interface seems to suggest it is:
Apply guest policies to this network, including hotspot authentication, hostname restrictions, and subnet restrictions
Double-checking the guest policies configuration page, post-authorization restrictions seem pretty clear:
Restrict guests from accessing specific hostnames or subnets after they have authorized
And yet, nothing.
I’m not overly concerned about breaking things, as one of the steps I took last week was to synchronize backups into FreeNAS, so I can always restore from a functioning state. At worst, I’m going to make my wifi non-functional for 10 minutes while I restore from backups. Best to do this work while everyone else is asleep.
Documentation, community support
If the process for enabling this isn’t as straightforward as I had hoped, the next step is to go diving into the documentation. Reading over Unifi’s documentation on creating a guest network suggests that what I’ve done is sufficient. Looking around in the forums, I find posts about similar issues, but nothing recently.
Perhaps a bug was recently introduced? If that’s the case, I worry about the stability of the product and whether or not a UDM was a hasty decision. I’ve certainly run across other bugs in the UI (e.g. old clients not disappearing from the clients page until the UDM is rebooted), but I don’t want to jump to conclusions.
I make a post of my own and continue hunting. Community support is really hit or miss.
- Sometimes there’s a quick and clear answer
- Sometimes you’ll feel like you’re intruding on others' time
- Sometimes people entirely misread your question and the answer isn’t relevant
Try to be verbose enough to include all the relevant details, but also concise enough that you get to the point before folks start skimming. If I had more time, I’d have written a shorter post.
Eventually I found the solution on Server Side Up’s YouTube channel
while trying to watch others implement the same feature. In short, one also needs to create a separate LAN,
Network Purpose: Guest, and apply the Wifi Network to this guest LAN. I’m honestly unclear why
Unifi’s documentation fails to mention this, but I’ve updated my forum post with hopes that it helps others
in the future.
The result at the end of the day is that I now have guest wifi and can keep untrusted hardware from accessing the rest of my network. I might even make a QR code and print it on to a coaster or into a picture frame.