Unifi Controller thru Cloudflare Tunnel reddit / selfhosted ---------------------------------------------------------------------- phillee81 · 2023-10-08 09:17 Has anyone successfully got a Unifi Controller working through a Cloudflare Tunnel. I spent way too much time trying to make it work this evening before reverting back just a basic A record pointing to my Unifi server IP. I was able to completely lock down my firewall with the exception of the ports necessary for the Unifi controller. Would love to somehow make this work. I was able to hit the unifi interface and access the controller, but all sites devices showed disconnected assuming because the CF proxy is redirecting the inform port 8080 to 5443. Any suggestions? ---------------------------------------------------------------------- thekrautboy · 2023-10-08 09:44 /r/Cloudflare? ---------------------------------------------------------------------- Firestarter321 · 2023-10-08 09:47 You’ll have to use different subdomains for the web interface and the communications traffic since the communication traffic can’t use HTTPS. ---------------------------------------------------------------------- phillee81 · 2023-10-08 09:51 Problem is there's more ports needed than just 8080 for unifi device communications. I tried that route as well and updated the inform url on a couple sites but devices never showed connected until I re- enabled the firewall rule opening up all the unifi ports. I was hoping to find a way to accomplish this without poking holes in the firewall. ---------------------------------------------------------------------- ElevenNotes · 2023-10-08 09:59 I would not expose the entire controller to the web, only the web UI part and even there only behind a reverse proxy with special rules for authentication failures. ---------------------------------------------------------------------- yakadoodle123 · 2023-10-08 10:10 I use two subdomains for UniFi. unifi-inform.mydomain.com = non proxied CF record for adoption / communication traffic etc unifi.mydomain.com = proxied CF record for web interface The only downside (that I have come across) is that in the notification / update emails, if you click on a link it takes you to the non proxied unifi-inform address which doesn't work for the web interface. I'm only hosting it for myself and my parents devices so not a big issue for me. ---------------------------------------------------------------------- phillee81 · 2023-10-08 10:28 I did just the web UI, which worked fine. The issue is other ports have to be open for remote sites to communicate with the controller. If you don't open those ports, all your site devices will just show disconnected. ---------------------------------------------------------------------- phillee81 · 2023-10-08 10:35 I will try this out tomorrow. I have about 10 sites in my controller. I just moved everything over from Hostifi and am now running in a docker on my Synology NAS. So you had to open port 8080 for the inform url to work via the non proxied CF record. Did you have to open other ports? I followed Ubiquity instructions for self hosting and opened tcp 8080, 6789, 8880, 8843, 8443, & udp 3478, 5514, 10001. I guess I could try removing those one at a time and see if it causes any issues. ---------------------------------------------------------------------- ElevenNotes · 2023-10-08 10:35 I would not do it that way. Connect your remote sites via wireguard VPN and tunnel all traffic to tje controller. **Disclaimer:** *I do exactly that with a unifi controller that manages more than 50 sites* ---------------------------------------------------------------------- phillee81 · 2023-10-08 10:37 I don't want to use a VPN. I'm trying to use Zero-Trust CF tunnels. It's working flawlessly now for about 8 other web services I'm running, just not Unifi. ---------------------------------------------------------------------- ElevenNotes · 2023-10-08 10:41 Ah okay. Sorry can't help you there because I never used CF. Good luck. ---------------------------------------------------------------------- yakadoodle123 · 2023-10-08 10:43 The ports are documented here. [https://help.ui.com/hc/en- us/articles/218506997-UniFi-Network-Required-Ports- Reference](https://help.ui.com/hc/en-us/articles/218506997-UniFi- Network-Required-Ports-Reference) I only open 8443 TCP (web interface), 3478 UDP (STUN) and 8080 TCP (adoption / communication). I don't use captive portal / mobile speed test etc so it depends what UniFi bits you use. ---------------------------------------------------------------------- phillee81 · 2023-10-08 10:50 Thank you! This was very helpful. ---------------------------------------------------------------------- Firestarter321 · 2023-10-08 11:49 It works though as that’s what I’m doing. You’ll have to do the same if you want it to work. Yes, you have to allocate w multiple ports for communications but that’s what it takes. ---------------------------------------------------------------------- KevinSoutar · 2023-10-08 11:55 Just interested, did you have any issues with HostiFi while you were using it, or was it just price that drove you to bring it in house? ---------------------------------------------------------------------- HerbSmokington420 · 2023-10-08 16:13 That’s just a bad idea, why not use the security of a VPN rather than exposing to the internet? That makes no sense ---------------------------------------------------------------------- phillee81 · 2023-10-08 17:23 The CF tunnel doesn't expose it to the internet. For all the services it's working on now, all the ports are closed. I run a CF connector in a docker that allows access to internal services, then can lock those down with access policies. ---------------------------------------------------------------------- phillee81 · 2023-10-08 17:29 No issues whatsoever. Hostifi is a great product. Just saving some $$, learning and just starting out playing with Dockers, and wanted to put my NAS to better use than just Plex. Now I'm running arr's, portainer, unifi, CF tunnel, and WordPress. Finding new stuff to play with every day.