Geen routing met Ubiquiti USG en Ziggo

[Jacco Rens]

Ik heb recent een Ubiquiti USG (3P) aangesloten op mijn Ziggo Ubee (bridge modus). De USB eth0 staat ingesteld op DHCP en krijg ook netjes het verwachte IP adres (zelfde MAC als vorige router op eth0). Alles lijkt in mijn ogen goed te staan, maar ik kom niet verder dan het gateway adres van Ziggo. Nu zijn vrouw en kind bij 5 minuten downtime al gefucked, dus echt debuggen lukt niet gemakkelijk.

Relevante info:

eth0 84.106.170.***/23 u/u
eth1 192.168.20.1/24 u/D

interface lo
ip route 0.0.0.0/0 84.106.170.1

Ik heb even geen idee waar ik het zoeken moet. Wie heeft een idee voor debuggen? Ik ben nu verbonden via de serial console

[ Voor 3% gewijzigd door Jacco Rens op 07-06-2018 20:50 ]

[MisteRMeesteR]

Verberg je WAN IP ff. Ik denk een NAT issue? Post je hele config eens?

[3DDude]

staat je nat op je loopback interface?

[Jacco Rens]

De complete config;

code:

----------------
Running configuration
----------------
firewall {
    all-ping enable
    broadcast-ping disable
    group {
        address-group authorized_guests {
            description "authorized guests MAC addresses"
        }
        address-group guest_allow_addresses {
            description "allow addresses for guests"
        }
        address-group guest_allow_dns_servers {
            description "allow dns servers for guests"
        }
        address-group guest_portal_address {
            description "guest portal address"
        }
        address-group guest_restricted_addresses {
            address 192.168.0.0/16
            address 172.16.0.0/12
            address 10.0.0.0/8
:
            description "restricted addresses for guests"
        }
        address-group unifi_controller_addresses {
        }
        ipv6-network-group corporate_networkv6 {
            description "IPv6 corporate subnets"
        }
        ipv6-network-group guest_networkv6 {
            description "IPv6 guest subnets"
        }
        network-group captive_portal_subnets {
            description "captive portal subnets"
        }
        network-group corporate_network {
            description "corporate subnets"
            network 192.168.20.0/24
        }
        network-group guest_allow_subnets {
            description "allow subnets for guests"
        }
        network-group guest_network {
            description "guest subnets"
        }
:
        network-group guest_restricted_subnets {
            description "restricted subnets for guests"
        }
        network-group remote_client_vpn_network {
            description "remote client VPN subnets"
        }
        network-group remote_site_vpn_network {
            description "remote site VPN subnets"
        }
        network-group remote_user_vpn_network {
            description "Remote User VPN subnets"
        }
        port-group guest_portal_ports {
            description "guest portal ports"
        }
        port-group guest_portal_redirector_ports {
            description "guest portal redirector ports"
            port 39080
            port 39443
        }
        port-group unifi_controller_ports-tcp {
            description "unifi tcp ports"
            port 8080
:
        }
        port-group unifi_controller_ports-udp {
            description "unifi udp ports"
            port 3478
        }
    }
    ipv6-name AUTHORIZED_GUESTSv6 {
        default-action drop
        description "authorization check packets from guest network"
    }
    ipv6-name GUESTv6_IN {
        default-action accept
        description "packets from guest network"
        rule 3001 {
            action drop
            description "drop packets to intranet"
            destination {
                group {
                    ipv6-network-group corporate_networkv6
                }
            }
        }
    }
:
    ipv6-name GUESTv6_LOCAL {
        default-action drop
        description "packets from guest network to gateway"
        rule 3001 {
            action accept
            description "allow DNS"
            destination {
                port 53
            }
            protocol udp
        }
        rule 3002 {
            action accept
            description "allow ICMP"
            protocol icmp
        }
    }
    ipv6-name GUESTv6_OUT {
        default-action accept
        description "packets forward to guest network"
    }
    ipv6-name LANv6_IN {
        default-action accept
:
        description "packets from intranet"
    }
    ipv6-name LANv6_LOCAL {
        default-action accept
        description "packets from intranet to gateway"
    }
    ipv6-name LANv6_OUT {
        default-action accept
        description "packets forward to intranet"
    }
    ipv6-name WANv6_IN {
        default-action drop
        description "packets from internet to intranet"
        rule 3001 {
            action accept
            description "allow established/related sessions"
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
:
        rule 3002 {
            action drop
            description "drop invalid state"
            state {
                established disable
                invalid enable
                new disable
                related disable
            }
        }
    }
    ipv6-name WANv6_LOCAL {
        default-action drop
        description "packets from internet to gateway"
        rule 3001 {
            action accept
            description "Allow neighbor advertisements"
            icmpv6 {
                type neighbor-advertisement
            }
            protocol ipv6-icmp
        }
        rule 3002 {
:
            action accept
            description "Allow neighbor solicitation"
            icmpv6 {
                type neighbor-solicitation
            }
            protocol ipv6-icmp
        }
        rule 3003 {
            action accept
            description "allow established/related sessions"
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 3004 {
            action drop
            description "drop invalid state"
            state {
                established disable
                invalid enable
:
                new disable
                related disable
            }
        }
    }
    ipv6-name WANv6_OUT {
        default-action accept
        description "packets to internet"
    }
    name AUTHORIZED_GUESTS {
        default-action drop
        description "authorization check packets from guest network"
    }
    name GUEST_IN {
        default-action accept
        description "packets from guest network"
        rule 3001 {
            action accept
            description "allow DNS packets to external name servers"
            destination {
                port 53
            }
            protocol tcp_udp
:
        }
        rule 3002 {
            action accept
            description "allow packets to captive portal"
            destination {
                group {
                    network-group captive_portal_subnets
                }
                port 443
            }
            protocol tcp
        }
        rule 3003 {
            action accept
            description "allow packets to allow subnets"
            destination {
                group {
                    address-group guest_allow_addresses
                }
            }
        }
        rule 3004 {
            action drop
:
            description "drop packets to restricted subnets"
            destination {
                group {
                    address-group guest_restricted_addresses
                }
            }
        }
        rule 3005 {
            action drop
            description "drop packets to intranet"
            destination {
                group {
                    network-group corporate_network
                }
            }
        }
        rule 3006 {
            action drop
            description "drop packets to remote user"
            destination {
                group {
                    network-group remote_user_vpn_network
                }
:
            }
        }
        rule 3007 {
            action drop
            description "authorized guests white list"
            destination {
                group {
                    address-group authorized_guests
                }
            }
        }
    }
    name GUEST_LOCAL {
        default-action drop
        description "packets from guest network to gateway"
        rule 3001 {
            action accept
            description "allow DNS"
            destination {
                port 53
            }
            protocol udp
        }
:
        rule 3002 {
            action accept
            description "allow ICMP"
            protocol icmp
        }
        rule 3003 {
            action accept
            description "allow to DHCP server"
            destination {
                port 67
            }
            protocol udp
            source {
                port 68
            }
        }
    }
    name GUEST_OUT {
        default-action accept
        description "packets forward to guest network"
    }
    name LAN_IN {
        default-action accept
:
        description "packets from intranet"
        rule 6001 {
            action accept
            description "accounting defined network 192.168.20.0/24"
            source {
                address 192.168.20.0/24
            }
        }
    }
    name LAN_LOCAL {
        default-action accept
        description "packets from intranet to gateway"
    }
    name LAN_OUT {
        default-action accept
        description "packets forward to intranet"
        rule 6001 {
            action accept
            description "accounting defined network 192.168.20.0/24"
            destination {
                address 192.168.20.0/24
            }
        }
:
    }
    name WAN_IN {
        default-action drop
        description "packets from internet to intranet"
        rule 3001 {
            action accept
            description "allow established/related sessions"
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 3002 {
            action drop
            description "drop invalid state"
            state {
                established disable
                invalid enable
                new disable
                related disable
            }
:
        }
    }
    name WAN_LOCAL {
        default-action drop
        description "packets from internet to gateway"
        rule 3001 {
            action accept
            description "allow established/related sessions"
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 3002 {
            action drop
            description "drop invalid state"
            state {
                established disable
                invalid enable
                new disable
                related disable
:
:
            }
        }
    }
    name WAN_OUT {
        default-action accept
        description "packets to internet"
    }
    options {
        mss-clamp {
            interface-type pppoe
            interface-type pptp
            interface-type vti
            mss 1452
        }
        mss-clamp6 {
            interface-type pppoe
            interface-type pptp
            mss 1452
        }
    }
    receive-redirects disable
    send-redirects enable
    syn-cookies enable
:
}
geoip {
    action accept-only
    country-list CA,NL,SE
    lan-list eth1,eth2
    traffic-direction both
    wan-list eth0
}
interfaces {
    ethernet eth0 {
        address dhcp
        dhcp-options {
            client-option "retry 60;"
            default-route-distance 1
            name-server no-update
        }
        firewall {
            in {
                ipv6-name WANv6_IN
                name WAN_IN
            }
            local {
                ipv6-name WANv6_LOCAL
:
                name WAN_LOCAL
            }
            out {
                ipv6-name WANv6_OUT
                name WAN_OUT
            }
        }
    }
    ethernet eth1 {
        address 192.168.20.1/24
        firewall {
            in {
                ipv6-name LANv6_IN
                name LAN_IN
            }
            local {
                ipv6-name LANv6_LOCAL
                name LAN_LOCAL
            }
            out {
                ipv6-name LANv6_OUT
                name LAN_OUT
            }
:
        }
    }
    ethernet eth2 {
        disable
    }
    loopback lo {
    }
}
port-forward {
    auto-firewall disable
    hairpin-nat enable
    lan-interface eth1
    wan-interface eth0
}
service {
    dhcp-server {
        disabled false
        hostfile-update enable
        shared-network-name net_LAN_192.168.20.0-24 {
            authoritative enable
            description vlan1
            subnet 192.168.20.0/24 {
                default-router 192.168.20.1
:
                dns-server 192.168.20.200
                dns-server 192.168.20.201
                domain-name jaccorens.com
                lease 86400
                start 192.168.20.50 {
                    stop 192.168.20.150
                }
                unifi-controller 192.168.20.202
            }
        }
        use-dnsmasq disable
    }
    dns {
        forwarding {
            cache-size 10000
            except-interface eth0
            options ptr-record=1.20.168.192.in-addr.arpa,UNIFI-USG-3P
            options host-record=unifi,127.0.0.1
        }
    }
    gui {
        https-port 443
    }
:
    lldp {
        interface eth0 {
            disable
        }
    }
    nat {
        rule 6001 {
            description "MASQ corporate_network to WAN"
            log disable
            outbound-interface eth0
            protocol all
            source {
                group {
                    network-group corporate_network
                }
            }
            type masquerade
        }
        rule 6002 {
            description "MASQ remote_user_vpn_network to WAN"
            log disable
            outbound-interface eth0
            protocol all
:
            source {
                group {
                    network-group remote_user_vpn_network
                }
            }
            type masquerade
        }
        rule 6003 {
            description "MASQ guest_network to WAN"
            log disable
            outbound-interface eth0
            protocol all
            source {
                group {
                    network-group guest_network
                }
            }
            type masquerade
        }
    }
    ssh {
        port 22
        protocol-version v2
:
    }
}
system {
    conntrack {
        timeout {
            icmp 30
            other 600
            tcp {
                close 10
                close-wait 60
                established 7440
                fin-wait 120
                last-ack 30
                syn-recv 60
                syn-sent 120
                time-wait 120
            }
            udp {
                other 30
                stream 180
            }
        }
    }
:
    domain-name jaccorens.com
    host-name UNIFI-USG-3P
    ip {
        override-hostname-ip 192.168.20.1
    }
    login {
        user beheerder {
            authentication {
                encrypted-password ****************
            }
            level admin
        }
    }
    name-server 1.1.1.1
    name-server 1.0.0.1
    ntp {
        server 0.ubnt.pool.ntp.org {
        }
    }
    offload {
        ipsec enable
        ipv4 {
            forwarding enable
:
            gre enable
            pppoe enable
            vlan enable
        }
        ipv6 {
            forwarding enable
            vlan enable
        }
    }
    static-host-mapping {
        host-name setup.ubnt.com {
            alias setup
            inet 192.168.20.1
        }
    }
    syslog {
        global {
            facility all {
                level notice
            }
            facility protocols {
                level debug
            }
:
        }
    }
    time-zone Europe/Amsterdam
    traffic-analysis {
        dpi enable
        export disable
    }
}
unifi {
    mgmt {
        cfgversion 174c557994fc976a
    }
}

[ Voor 100% gewijzigd door Equator op 08-06-2018 06:49 . Reden: Even de config in [code][/code] tages geplaatst ]

[Equator]

Waarom geef je:

dns-server 192.168.20.200
dns-server 192.168.20.201

Mee in de DHCP configuratie? Moet dat niet je IP adres van de USG zelf zijn? Aangezien je USG zelf:
1.1.1.1
1.0.0.1
gebruikt?

(Letop, als jij op die IP adressen een DNS server - bijvoorbeeld Pi-Hole - draait, geen probleem)
Maar voglens mij mis ik de rules op WAN_OUT om DNS verkeer uberhaupt naar buiten te krijgen. Sowieso mis ik daar behoorlijk wat rules naar mijn idee. Maar ik heb even geen toegang tot mijn Edge Router om dat te controleren.

[Jacco Rens]

Het probleem is dus dat wanneer ik serieel verbonden ben met de USG, ik wel het eigen WAN IP, en de Ziggo gateway kan pingen, maar geen next hop, b.v. de google DNS. Ik heb de USG al twee maal compleet gereset, maar zonder effect.

[HKLM_]

is je USG up to date ? heb je de config als eens via de controller doorlopen i.p.v CLI.
check anders een deze van ziggo: https://community.ziggo.n...iten-ubiquiti-unifi-22834

[Aherin]

Kan het niet komen omdat de USG niet het mac adres van je modem heeft?
Ik weet dat ik in het verleden wel eens het mac adres van mijn modem moest klonen om internet toegang te krijgen met een ander apparaat dan mijn modem

Ja dus

[ Voor 3% gewijzigd door Aherin op 08-06-2018 18:22 ]

[Jacco Rens]

Uiteindelijk opgelost door nog eens helemaal van scratch te beginnen. Blijkbaar gaat het achteraf toevoegen van een USG aan een bestaande Unifi Setup niet helemaal soepel. Na alles compleet tot factory default te hebben gereset, en de boel als LAB Setup te configgen draait alles ondertussen als een zonnetje.