Mesh Wifi

[Afasoas]

Thanks to all who suggested Ubiquiti Unifi.

Two PoE APs installed in the attic just shoved under the insulation and resting on the plaster board of the ceiling.
-45 Db signal strength all over the house now on both the 2.4 and 5Ghz channels. Rock solid WiFi.

Was a bit spendy but I really should have done it ages ago.

Next job is to sort out a proper firewall/router instead of the Broadband one. Cant decide to go Unifi for that as well or PfSense. Then I can start dividing things up by VLAN and banish the IoT stuff to network of their own.

Unifi access points are the canines danglies but firewalls, not so much. Go pfSense or OPNsense or if you are a hardnut, Mikrotik. They'll cater for pretty much any requirement you can concoct.

[pcolbeck]

Already bought a HP T730 thin client and an Intel 4 port Gig Ethernet NIC of eBay for pFsene
Just waiting to see if the specialist security guys in the office suggest anything better than pFsense. It's 10 years since I was up to date on what firewalls are good. I'm wondering what someone who spends all their time installing next gen enterprise firewalls with links to Cisco Umbrella etc uses at home.

[Kim]

I'm wondering what someone who spends all their time installing next gen enterprise firewalls with links to Cisco Umbrella etc uses at home.

BT Home Hub or the crash-o-matic Virgin equivalent, on the 'by the time they get home they're probably sick of networking' principle.

[rafletcher]

Ok, I want to extend wifi coverage in our house, as the TV and PVR are squirrelled away in a corner downstairs, and the modem/router is sat upstairs at the opposite end of the property.  I could use powerline adaptors (I've got one in the shed at the bottom of the garden), but I'd prefer a mesh solution.

Simple question:  Looking at the Deco system, it plugs into the main modem/router via ethernet. I assume that the existing wifi signal from the router will continue to function?  ie my extended-to-the-shed wifi won't be affected? (It's probably too far away for the mesh at 100ft+, although the Sonos mesh reaches that far).

[ian]

Not sure what you mean, you have a powerline connection to the shed and an a/p there?

Yes, you can leave your original router broadcasting wifi. There are two modes with the Deco, the default is that it's a router, so it'll create a new subnet (or whatever they're called) for connected devices. Or there's a/p mode where you leave the original router in place and let that manage things and the Deco form a mesh of access points. Everything is on the same network then. I did this and turned off the wifi on my BT hub for ease, but you don't have to.

[rafletcher]

Thanks - and no, the shed just has a powerline adaptor with my current wifi network name cloned to it. I appreciate I can do the same with whatever name I give to to the Deco mesh, but I always seem to struggle with that - much guddling in corners and under tables - so leaving the current wifi on helps with that, at least in the short term.

[ian]

The signal from my Deco mesh reaches the end of the garden (though the back of my house is mostly patio doors).

I think your powerline adaptor is a wifi extender, which is where I got confused. You could just put it in a/p mode and create a little network for things at the bottom of the garden.

[rafletcher]

The signal from my Deco mesh reaches the end of the garden (though the back of my house is mostly patio doors).

I think your powerline adaptor is a wifi extender, which is where I got confused. You could just put it in a/p mode and create a little network for things at the bottom of the garden.

I'll probably buy a 3-part set, even though the house itself will only need 2, so I'll see if (like the Sonos Bridge) putting one on the back bedroom widow will reach to the (line of sight) shed.

I think my powerline adaptor is a wifi extender too.

Re things like "setting it as an access point", I'd probably need to know what I was doing!!

[ian]

There's usually a toggle, but I'd have thought if the Sonos reaches it, the Deco will. Mine pumps out enough rays that with three units I get pretty much full-on wifi everywhere.

I did dump my Sonos Boost and put the speakers on the Deco. It's not perfect, it still struggles with all the speakers (though seems better than the Boost), though in principle I never need all the speakers on at the same time, so that's an intellectual gripe.

*Actually, the problem is with the stereo pairs which I think are actually connected to each other directly, but anyway, I've yet to feel the urge to spend an evening troubleshooting.

[rafletcher]

If the Deco reaches reliably I'll do the same, no point on having two devices sat on the windowsill doing essentially the same job and it'll free up some socketry in the shed.

If so, I'll probably turn off the router wifi as well.  A question if I do leave it on - if I name the Deco wifi the same as the existing, will devices hop seamlessly between them?

[ian]

Probably not, some devices will attempt to roam to whatever has the strongest signal, but in my experience of having the Hub and an A/P with the same SSID, it was hit and (mostly) miss. If you leave it active, I'd probably give it a different SSID.

I turned mine off, the signal never really escaped the space under the stairs anyway (I've no idea why we didn't have the phone master socket moved when we had the house done, I guess we thought it looked tidy squirrelled away in a cupboard down there). Now the BT hub is just the modem and main router, it passes the signal through the powerline adaptor to the main Deco in the living room. The Deco system itself can operate as a router (this was the default configuration) but I figured as I had the BT set up, I'd leave that to jibble IP addresses etc.

[pcolbeck]

WiFi roaming between access points with the same SSID relies on one of two things happening:

A) The device noticing the signal strength is better as it get nearer a different access point than the one it originally associated with.
B) The access points themselves realising that the device is now nearer (from a signal strength point of view) the second access point and forcing the device off the first access point and on to the second.

A) is a bit iffy with quite a few devices, they just hang on to the first AP they associated with as long as there is any signal at all even if your stood right next to a different AP.

B) requires the APs to be telling each other things and cooperating. This only happens with systems like mesh WiFi or controller based APs. It doesnt work with APs that are on disimaler systems such as Deco and a powerline AP or Deco and your existing WiFi router.

[Kim]

WiFi roaming between access points with the same SSID relies on one of two things happening:

A) The device noticing the signal strength is better as it get nearer a different access point than the one it originally associated with.
B) The access points themselves realising that the device is now nearer (from a signal strength point of view) the second access point and forcing the device off the first access point and on to the second.

A) is a bit iffy with quite a few devices, they just hang on to the first AP they associated with as long as there is any signal at all even if your stood right next to a different AP.

B) requires the APs to be telling each other things and cooperating. This only happens with systems like mesh WiFi or controller based APs. It doesnt work with APs that are on disimaler systems such as Deco and a powerline AP or Deco and your existing WiFi router.

Quite.  Most of the problem stems from roaming between APs never being part of the original WiFi spec, so the implementation is entirely down to the client.  Since there's no standard way to do roaming, we end up with the situation where on most devices disassociating and re-associating causes an appreciable latency spike or, on particularly stupid OSes, all TCP sockets being closed.  Which is extremely annoying if you're doing anything interactive, hence the drivers tend to go for the (A) approach of clinging-to-the-association-they've-got-until-it-loses-contact.  So your sockets stay open and you end up with packet loss and latency problems instead, while sitting next to a perfectly good AP.

Meanwhile, in the absence of a baked-in standard, making (B) appear seamless requires various degrees of bodgery which don't always work well on all platforms.  Hence you end up with unisex spaceadmins tearing their hair out over "My iThing won't roam" or "Certain flavours of Android won't stay connected" type problems.

There's a reason it's known as The Devil's Radio.

[ian]

It works pretty well (as far as I can tell) on the mesh though.

Previously, having two devices and one SSID resulted in my iPhone developing amnesia and shouting PASSWORD at me each time it tried to reassociate.

[pcolbeck]

It works pretty well (as far as I can tell) on the mesh though.

Previously, having two devices and one SSID resulted in my iPhone developing amnesia and shouting PASSWORD at me each time it tried to reassociate.

Indeed because a proper mesh or WLC based solution has the access points force a re-association to the nearest AP but caches the authentication across the APs so the device (eg your iPhone) doesn't have to re-authenticate.

[ian]

Yeah, I know. But it was the same bloody password. And you know it, idiot phone.

[rafletcher]

Set up the first Deco this evening, signal looks good and strong, I’ll check down the garden tomorrow. One thing, my iPhone has tagged the network “weak security”.

[ian]

Make sure you update the Deco firmware – there was a security update recently that took away the TKIP encryption option – it's probably that.

[rafletcher]

Make sure you update the Deco firmware – there was a security update recently that took away the TKIP encryption option – it's probably that.

I’ll do that, but it seems that I hadn’t turned on the inbuilt AV. Now I have, that annotation has disappeared.

[pcolbeck]

Make sure you update the Deco firmware – there was a security update recently that took away the TKIP encryption option – it's probably that.

I’ll do that, but it seems that I hadn’t turned on the inbuilt AV. Now I have, that annotation has disappeared.

That's weird.There should be no way the phone knows that the Deco is running AV.

[ian]

Mine doesn't appear to have an AV. But they did turn off TKIP in favour of AES a firmware release back (hence Windows refusing to talk to it, but not saying it wouldn't talk to it). I believe TKIP is viewed as vulnerable these days.

[rafletcher]

Since I updated the firmware (which I did immediately after turning on the AV options) the AV options have disappeared from the app.

[pcolbeck]

I believe TKIP is viewed as vulnerable these days.

Indeed it is.

[rafletcher]

Update. Re the “weak security” warning”, that’s appeared against my existing Vodafone network WiFi so it looks like an iPhone thing. No matter.

Finally got around to trying out the mesh properly.

Good news, it readily reaches the shed 30m away, so I can do away with the powerline adaptors I was using.

Not so good news, my Garmin 1000 and 1030 won’t connect to it, although my Forerunner 245 does. The bike computers, for some reason I can’t fathom, see it as an unsecured network, so don’t ask for a password, but unsurprisingly fail to connect. Looks like I’ll have to leave the Vodafone WiFi on just for them as it’s the easiest way to upload my rides. Unless someone has a bright idea of how to get them connected? I may ask in a separate thread.

[pcolbeck]

For devices that wont connect try deleting the WiFi network in their setup then allowing them to rediscover it like its a new connection.
Sometimes devices get stuck and don't like it if something has changed in the security or other connection details settings of a WiFi network that they already know about. Easy test is to create a new SSID and see if they can connect to that.