In our home we have UniFi networking equipment as our backbone for providing WiFi services. We have also been running a home media and ebooks server. The home media server is running a Plex server, and the ebooks server is running Calibre.<\/p>\n\n\n\n
In the past, to access these servers we have to use the following format with the browser:<\/p>\n\n\n\n
http:\/\/hostname:port<\/pre>\n\n\n\nThis is not very user friendly especially when you forget the port number. It would really be nice if we can access the servers with something like:<\/p>\n\n\n\n
http:\/\/media.home
http:\/\/books.home<\/pre>\n\n\n\nAt the same time, the kids have been abusing their screen time privileges. Although their iOS devices can be easily managed with the new Screen Time feature, I still need to govern usage time windows on their gaming PC’s and laptops. I would like to configure our firewall so that Internet traffic from their devices are blocked from 12am to 7am.<\/p>\n\n\n\n
The above configurations are both possible on the UniFi Secure Gateway (USG) running EdgeOS. However, these configurations are deemed as advance configurations and are not supported on the web user interface. To perform these configurations, I had to create and edit config.gateway.json<\/span> file. This file will contain all the key \/ value overrides of the USG device in a JSON structure. Below are my additions to accomplish the above:<\/p>\n\n\n\n
{
\"firewall\":
{
\"name\":
{
\"LAN_IN\":
{
\"default-action\": \"accept\",
\"description\": \"packets from intranet\",
\"rule\":
{
\"3001\":
{
\"action\": \"drop\",
\"description\": \"Jason Laptop AM\",
\"protocol\": \"all\",
\"source\":
{
\"mac-address\": \"84:38:35:50:64:12\"
},
\"time\":
{
\"starttime\": \"00:00:00\",
\"stoptime\": \"07:00:00\"
}
},
\"3003\":
{
\"action\": \"drop\",
\"description\": \"Kalen Laptop AM\",
\"protocol\": \"all\",
\"source\":
{
\"mac-address\": \"e0:ac:cb:8c:32:00\"
},
\"time\":
{
\"starttime\": \"00:00:00\",
\"stoptime\": \"07:00:00\"
}
},
\"3005\":
{
\"action\": \"drop\",
\"description\": \"Jason Gaming AM\",
\"protocol\": \"all\",
\"source\":
{
\"mac-address\": \"1c:1b:0d:70:80:84\"
},
\"time\":
{
\"starttime\": \"00:00:00\",
\"stoptime\": \"07:00:00\"
}
},
\"3007\":
{
\"action\": \"drop\",
\"description\": \"Kalen Gaming AM\",
\"protocol\": \"all\",
\"source\":
{
\"mac-address\": \"1c:1b:0d:72:ed:bf\"
},
\"time\":
{
\"starttime\": \"00:00:00\",
\"stoptime\": \"07:00:00\"
}
}
}
}
}
},
\"system\": {
\"static-host-mapping\": {
\"host-name\": {
\"media.home\": {
\"alias\": [
\"media\"
],
\"inet\": [
\"192.168.168.9\"
]
},
\"books.home\": {
\"alias\": [
\"books\"
],
\"inet\": [
\"192.168.168.9\"
]
}
}
}
}
}
<\/pre>\n\n\n\nThe above config.gateway.json<\/span> file had be stored in the directory \/var\/lib\/unifi\/sites\/default<\/span> on my Ubuntu box that is running the UniFi Controller software.<\/p>\n\n\n\n
The next step is to perform a force provision of the configurations to the actual USG. This can be done with web based controller software.<\/p>\n\n\n\n
To double check, I can run the following on the actual USG box itself.<\/p>\n\n\n\n
mca-ctrl -t dump-cfg > config.txt
less config.txt<\/pre>\n\n\n\nAny JSON path key and its corresponding value can be overridden using this technique.<\/p>\n\n\n\n
The USG is truly a hidden source networking gems.<\/p>\n","protected":false},"excerpt":{"rendered":"
In our home we have UniFi networking equipment as our backbone for providing WiFi services. We have also been running a home media and ebooks server. The home media server is running a Plex server, and the ebooks server is running Calibre. In the past, to access these servers we have to use the following … Continue reading “UniFi USG Advance Configuration”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-658","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p7V6i8-aC","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/blog.lufamily.ca\/kang\/wp-json\/wp\/v2\/posts\/658","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.lufamily.ca\/kang\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.lufamily.ca\/kang\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.lufamily.ca\/kang\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.lufamily.ca\/kang\/wp-json\/wp\/v2\/comments?post=658"}],"version-history":[{"count":4,"href":"https:\/\/blog.lufamily.ca\/kang\/wp-json\/wp\/v2\/posts\/658\/revisions"}],"predecessor-version":[{"id":662,"href":"https:\/\/blog.lufamily.ca\/kang\/wp-json\/wp\/v2\/posts\/658\/revisions\/662"}],"wp:attachment":[{"href":"https:\/\/blog.lufamily.ca\/kang\/wp-json\/wp\/v2\/media?parent=658"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.lufamily.ca\/kang\/wp-json\/wp\/v2\/categories?post=658"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.lufamily.ca\/kang\/wp-json\/wp\/v2\/tags?post=658"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}