I have several of the Ubiquiti EdgeRouters and they have been absolutely fantastic. I’ve recently been on a kick to use certs for ssh auth as well as adding Let’s Encrypt SSL certificates to any web services I have, and the EdgeRouter is no exception.
SSH Certificate Authentication
Most of the EdgeRouter file system can be wiped during upgrades and other parts do not keep state even across power cycles. In order to use SSH certificate authentication you must use the supported command.
Now when you SSH to the router you will use your key for authentication.
HTTPS SSL Certificate
As I mentioned I’ve been using Let’s Encrypt for all of my HTTPS services. However it is important to keep in mind that Let’s Encrypt certificates are only good for 90 days. I found a very helpful script to create and manage the certificate lifecycle. Check it out on GitHub. https://github.com/hungnguyenm/edgemax-acme
Previously I wrote about the challenges of internet access and how I display the active internet service. In this followup I’ll tell you how I added the ability to enable and disable the ports associated with the service. In this way I can force which service is used or prevent the expensive satellite internet from being used while we are moored.
In order for this to work you will need a few things. SignalK, Node-RED (installed along with SignalK), the signalk-n2k-virtual-switch plugin, and of course a Ubiquiti Edge Router.
I’m assuming that you already installed the Node-RED nodes node-red-node-snmp and node-red-contrib-bigssh.
I’m also assuming you have either already configured SNMP on your router or you understand how to do so. If you need assistance, please checkout the excellent article from Ubiquiti on Configuring SNMP using the Command Line.
Download interface.sh script file from GitHub and save a copy to your router in /config/scripts/interface.sh.
Login to SignalK and make sure you have the signalk-n2k-virtual-switch plugin installed and configured.
Launch the Node-RED admin page from SignalK.
You are now going to import the flow which checks the interface admin state as well as enable or disable the interface. Select the Import option. .
You will see the following dialog box open.
Copy the flow from GitHub and paste the code into the dialog box.
Select new flow and click Import.
You should now have a flow that looks like:
Now we need to set the ip address, username, and password for your router. Double-click on the “change interface state” node. Then click on the edit button that appears.
Enter the IP Address, username, and password. Then click Add and then Done.
Edit the “Interface Admin Status” node to set the Host and Community. Then click Done.
Click on in the upper right hand screen.
You should now be able to click on the button of the Inject node to execute the flow.
The interface state will update the following paths as outlined in the table below. This is just what I happen to use, but feel free to modify the switch bank and switch number as you see fit for your usage.
Interface
SignalK Path
eth0
electrical.switches.bank.101.16.state
eth1
electrical.switches.bank.101.17.state
eth2
electrical.switches.bank.101.18.state
Router Interface to SignalK Path Mapping
At this point the interface status will updated every minute. You can then choose to display the status on your favorite UI compatible with either SignalK or NMEA Switch Bank Status PGN 127501. The interface can also now be controlled via SignalK or NMEA Switch Bank Control PGN 127502 or Command PGN 126208 (like Maretron and some others do).
Here is an example of a page I created in Maretron N2KView.
One of the bigger challenges I have found living on a boat is internet access. We are lucky to have cable internet access at the dock, but when we head out we need to switch cellular, and depending on how far out you go, you might need to switch to satellite internet.
The best device that I have found to handle and automatically switch internet service is the Ubiquiti Edge Router. The device is small, low cost, and power efficient. It runs on 12 volt which is a great benefit! At some point I’ll do my own post about configuring the router for multiple connections, but for now check out the excellent WAN load balancing article provided by Ubiquiti.
In order for this to work you will need a few things. SignalK, Node-RED (installed along with SignalK), the signalk-n2k-virtual-switch plugin, and of course a Ubiquiti Edge Router.
Login to SignalK and make sure you have the signalk-n2k-virtual-switch plugin installed and configured.
Launch the Node-RED admin page from SignalK.
The first thing we need to do is install the SNMP nodes. To do this browse to Manage Palette.
Click on Install and then type in “node-red-node-snmp”. Click on the install button.
Click on Install.
You should now see that the state of the node is “Installed”.
Repeat steps 3-5 to install “node-red-contrib-bigssh”.
You are now going to import the first flow which checks the load balance status and will show us which internet service is active. Select the Import option.
You will see the following dialog box open.
Copy the flow from GitHub and paste the code into the dialog box.
Select new flow and click Import.
You should now have a flow that looks like:
Now we need to set the ip address, username, and password for your router. Double-click on the “show load-balance status” node. Then click on the edit button that appears.
Enter the IP Address, username, and password. Then click Add and then Done.
Click on in the upper right hand screen.
You should now be able to click on the button of the Inject node to execute the flow. If everything is successful you should see “done with rc 0” underneath the show load-balance status node. You should also see a Value: X underneath each of the 3 switch ports.
The internet service state will update the following paths as outlined in the table below. This is just what I happen to use, but feel free to modify the switch bank and switch number as you see fit for your usage.
interface
SignalK Path
eth0
electrical.switches.bank.101.1.state
eth1
electrical.switches.bank.101.2.state
eth2
electrical.switches.bank.101.3.state
Router Interface to SignalK Path Mapping
At this point the internet service status will updated every minute. You can then choose to display the status on your favorite UI compatible with either SignalK or NMEA Switch Bank Status PGN 127501.
Here is an example of a page I created in Maretron N2KView.