Best IPS configuration for a USG-PRO-4 (or alternatives) for a residential gigabit network?
Hi all,
I have a small residential setup (2 Switch-8s, 2 AP-HD-IWs, 1 nanoHD), and I've just upgraded my USG-3 to a USG-PRO-4. I've updated its firmware to the latest version.
I have a gigabit AT&T fiber connection, and have been playing with IPS. I know Ubiquiti says my config is limited to 250Mbps, but anecdotal reports have hinted that it can hit ~650Mbps. In my tests (from a wired client to speedtest.net), I get about 930Mbps with IPS off, and 330Mbps with IPS on (in its default configuration).
I expected IPS to slow things down, but I don't quite understand why there's such a range using similar equipment. Are certain IPS categories more resource-intensive than others? Do certain internal network configurations (e.g. running my AT&T modem in bridge mode) throw a wrench in the works? Any tips/tricks are appreciated.
Assuming there's some magic solution I'm overlooking that will get me to ~650Mbps, I can live with that so long as I whitelist Backblaze and my high-bandwidth servers at the office, as they're really the only connections that saturate a gigabit anyway. Ideally, I'd also like to whitelist iTunes servers and similar, but those tend to user CDNs with ever-changing IPs, and there doesn't seem to be a way to whitelist a domain (e.g. "apple.com")…or is there?
Alternatively, I've considered:
- Exchanging the USG-PRO-4 for a Dream Machine, which can theoretically hit 700-1,000Mbps with IPS. This is actually cheaper, but it's running a beta OS and doesn't notch nearly as neatly into my rack.
- Turning off IPS and adding a dedicated Sophos firewall device downstream (although this eliminates the elegance of UniFi's "all in one" management)
- Waiting for the mythical UDM-PRO, but it's still vapor at this point and its price is unknown (although I could theoretically sell my CloudKey gen2, one of my Switch-8s, and the USG to offset the cost)
- Dispensing with IPS entirely (although I do have one port-forwarded, network-facing Mac)
Thoughts? Thanks.
Posted Jul 15, 2019, 12:42 AM UTC
Enabling ips turns off hardware offloading so everything is calculated in software which is why your speeds go in the dumpster. This is true of almost all products like the usg that cost less than like 1000$
Your USG info is correct, however, you can get gigabit performance with much more "stuff" turned on with something like the Supermicro 5018D-FN8T and an OS like Untangle, pfSense, OPNsense, etc.
We got rid of our USG Pro because we got gigabit at work and 360Mbps was the highest we could get.
Now with that Supermicro server that I listed above we can max out our connection with Untangle and everything turned on. I have the same setup at home and can get 1.3Gbps/500Mbps even though my connection is only 1Gbps/250Mbps.
It’s just a matter of what you’re willing to spend and if you want to use the ubiquiti dashboard or not. I don’t personally care about ips, and I doubt I’ll go over my 150mb connection any time soon due to cost so I went with the usg. If I thought I needed 250mb and maybe wanted to use the ips I’d have gone with the pro4. I dropped 350$ on a switch because I wanted the full stack. It just depends what your priorities are and what your budget is like.
If I'm going to go with 3rd party hardware, I'd love to let the USG do the routing (keeping the UniFi ecosystem intact) and insert something between the USG and the LAN. In a perfect world, this would be a dedicated IPS (and maybe content filtering for the kids' devices) firewall running in a 1U device (which is why I was considering Sophos XG Home Edition).
This particular Supermicro is an excellent suggestion, but probably overkill for what I need. I'd like to keep things under $500, and can tolerate 700Mbps provided I can whitelist judiciously. Any 1U recommendations in that class?
Look for a used Dell R210II or R220 with a quad core Xeon E3.
I've got a lead on Craigslist and might just play with that, thanks.
It also occurs to me that if I set up VPN on the USG, I could just VPN into my network when I need to get to my Mac and security cameras, which would allow me to turn off the last of the port-fowarding. If the LAN is entirely isolated, the USG's firewall might be adequate without the need for IPS. I'd have to set up something else for content filtering and malware, but it's a thought.
My main worry with a supermicro server in comparison is the cost of power consumption. What’s the wattage on that?
Edit: oh huh, googled and it seems 200w max. That’s not bad if I can do 1gb!
I've never actually seen it go over 50w even at 1Gbps.
They just put a 200w power supply in it.
I wonder if the atom processor version could do the IPS I need at 1gb.
How much does it cost to run untangle at home? Was looking in to it and the prices seemed steep.
$50/yr or $200/5yr.
It's worth every penny to me.
You want the HomePro license for home use.
That's not too bad, I've must of been looking at different pricing.