Unable to run UniFi Controller on FWG
Hello,
I've found a topic created over 2yrs ago but acutally issues described over there weren't simillar to mine.
https://help.firewalla.com/hc/en-us/community/posts/360051987813-Trying-to-install-Unifi-Controller
I'm trying to run my first docker on FWG and i'm not a pro IT person.
Please confirmt did i understand that correctly:
- A network as your docker network, we will use 172.16.1.0/24 in this tutorial.
- A static IP for your unifi controller instance, we will use 172.16.1.2 in this tutorial.
Point 1 is network where i will put my Unifi APs - it is named as LAN and under Network Menager (in APP) it exists as 192.168.88.1/24 - as i understand nevertheless it has 1 on the end i should use 192.168.88.0/24 as docker network
Point 2 is static ip of ... ? FireWalla Gold box ? same as this where i am going thru ssh ? so it will be 192.168.88.1
So now... I successfully done Step 1 point 1 and 2 of guild (where i changed proper ip addresses) like this:
version: "3"
services:
unifi:
container_name: unifi
image: jacobalberty/unifi:latest
volumes:
- '/data/unifi/:/unifi'
restart: unless-stopped
networks:
default:
# static IP address for unifi controller
ipv4_address: 192.168.88.1
networks:
default:
driver: bridge
ipam:
config:
# your chosen docker network here
- subnet: 192.168.88.0/24
then point 3 with no errors.
Step 2 gave me errors, whenever i try to execute commands:
sudo ip route add 192.168.88.0/24 dev br-$(sudo docker network ls | awk '$2 == "unifi_default" {print $1}') table lan_routable
or
sudo ip route add 192.168.88.0/24 dev br-$(sudo docker network ls | awk '$2 == "unifi_default" {print $1}') table wan_routable
Im getting same info:
RTNETLINK answers: File exists
Then step 4 with corrected FWG ip address with no errors... Besides unify controller is not reachable under unify 8080, 8443 or 192.168.88.1 with those ports...
When im trying to check status i get:
docker-compose@unifi.service - unifi service with docker compose
Active: activating (auto-restart) (Result: exit-code) since Fri 2022-10-28 13:12:10 CEST; 3s ago
Process: 1139 ExecStopPost=/bin/rm -rf $TMPDIR (code=exited, status=0/SUCCESS)
Process: 25335 ExecStop=/usr/local/bin/docker-compose down -v (code=exited, status=0/SUCCESS)
Process: 984 ExecStart=/bin/bash -c /usr/local/bin/docker-compose pull; /usr/local/bin/docker-compose up (code=exited, status=1/FAILURE)
Process: 312 ExecStartPre=/usr/local/bin/docker-compose rm -fv (code=exited, status=0/SUCCESS)
Process: 311 ExecStartPre=/bin/mkdir -p $TMPDIR (code=exited, status=0/SUCCESS)
Main PID: 984 (code=exited, status=1/FAILURE)
May someone lead me with it, becouse of i moved to Ubiquiti APs now i want to have control over it... As far as i understand buying Cloud Key or UDM is not nesessary while i got FWG.
-
Please confirm did i understand that correctly:
- A network as your docker network, we will use 172.16.1.0/24 in this tutorial.
- A static IP for your unifi controller instance, we will use 172.16.1.2 in this tutorial.
Point 1 is network where i will put my Unifi APs - it is named as LAN and under Network Menager (in APP) it exists as 192.168.88.1/24 - as i understand nevertheless it has 1 on the end i should use 192.168.88.0/24 as docker network
Point 2 is static ip of ... ? FireWalla Gold box ? same as this where i am going thru ssh ? so it will be 192.168.88.1
The "Docker Network" is not a network will you see in the Firewalla app. It is the network containing all your docker container's static IP addresses. Those docker containers will also not be visible as clients in the Firewalla app.
You should use the addresses mentioned in the tutorial, not the 192.168.88.0/24 addresses you mentioned.
Your Unifi APs can go into any other network. You can use your main LAN, or if you are segmenting your networks, any other network.To adopt your APs, you'll need to do a manual L3 adoption with the IP address 172.16.1.2. Alternatively, you can add a custom DNS entry for "unifi" (no domain) that maps to 172.16.1.2, so your APs will auto-discover your controller. If you're using the latest EA version of the Firewalla software, you can now customize DNS in the app. Otherwise, see https://help.firewalla.com/hc/en-us/articles/360056024294-Guide-How-to-customize-Firewalla-DNS-service.
-
Alternatively, you can add a custom DNS entry for "unifi" (no domain) that maps to 172.16.1.2, so your APs will auto-discover your controller.
May i ask to elaborate? In case i would use specified in guild IPs. What should I add as dns entry 172.16.1.2 ? Can you provide me customized command ? -
Yes, create an entry for "unifi" with address 172.16.1.2.
The easiest way to do this is to switch to the Early Access program for your box and your phone app. You can find out how to join EA here: https://help.firewalla.com/hc/en-us/community/posts/360046872134-Early-Access-Onboarding. You can find out more about adding the new DNS entry with the 1.52 EA app version here: https://help.firewalla.com/hc/en-us/articles/10221985597331-Firewalla-Box-Release-1-975-App-Release-1-52
Otherwise, you'll have to SSH in to your box and follow the directions here: https://help.firewalla.com/hc/en-us/articles/360056024294-Guide-How-to-customize-Firewalla-DNS-service. You'd want to create a file with one line:
address=/unifi/172.16.1.2
-
Ok i want to pump this up again.
I have another problem now, but it's related to that one...
I want to turn on Guest Hotspot (Unifi option with landing page with authorisation) instead of FireWalla quarantine zone. But when i turn that on i got info:
Nie można załadować strony http://172.16.1.2:8880/guest/s/default/?ap=60:22:32:3a:a0:7c&id=0c:c4:13:29:be:11&t=1675451506&url=http://connectivitycheck.gstatic.com%2Fgenerate_204&ssid=MiniMix%20Guest, ponieważ:net::ERR_CONNECTION_REFUSED
I've already tired options in Unifi - HTTPS Redirection, Secure Portal, Encrypted redirect URL. No success still blank page with error on landing.
I guess I should do something in FireWalla setting, may someone help? -
Looks like the wrong URL to me if you are running the controller on Firewalla follow this guide https://help.firewalla.com/hc/en-us/articles/360053441074-Guide-How-to-run-UniFi-Controller-on-the-Firewalla-Gold. In which case you need https://172.16.1.2:8443/
Please sign in to leave a comment.
Comments
32 comments