UniFi Cloudkey - remote access

[TheHyperTechie]

Hi all,

 

I have had a head scratcher today. I am trying to enable remote access on a sites cloud key, so I can manage everything through my phone/web browser instead of having to log onto it locally.

 

I logged onto the cloudkey and tried to enable remote access, it asked me to log in with my UniFi SSO - no problems there! However, I received an error message stating to contact my ISP. I had a read online and asked my ISP to allow the correct ports for remote access (as listed on the Ubiquiti website)

 

After I had confirmation they were unblocked, I tried again, still no luck! I restarted the cloud key to make sure but yet again no luck... Has anyone else come across an issue like this?

 

TIA.

[dhicks]

I logged onto the cloudkey and tried to enable remote access, it asked me to log in with my UniFi SSO - no problems there! However, I received an error message stating to contact my ISP. I had a read online and asked my ISP to allow the correct ports for remote access (as listed on the Ubiquiti website)

 

Do you mean the ISP for the site, or your own home ISP? Is the site you're talking about a school, do you know how the internet connection is provided? I don't have a problem connecting to the Cloudkey at our school, which is sitting behind a local firewall with an otherwise unfiltered fibre-to-the-premisis internet connection. That's from both my remote office, again on a fibre-to-the-premisis connection, and from home, which is on a Three 5G broadband connection, complete with home filtering at the ISP end, which doesn't seem to cause any issues. At one point long-running SSH connections from the home connection tended to get dropped, but that doesn't seem to happen now.

[TheHyperTechie]

Hi @dhicks,

 

Yes sorry, I should have elaborated! The cloudkey is located at a school. I asked the ISP for the school to unblock the ports. I did even try excluding the IP address of the CK and putting it into its own unfiltered policy so there were no restrictions outbound... But it still didn't like it.

[XiJ]

Can you probe the ports to see if they are open into school ? Really all you should need are 80 and 443 for unifi key access (8443 for web ui controlller).

[ZeroHour]

What firmware are you on?

I dont know if your Cloud Key gen has this but there is an option in Network called "Direct Remote Connection" and that opens port 443 instead of it being proxied and I am aware some ISP's block 80/443 to prevent people hosting their own server.

[dhicks]

I asked the ISP for the school to unblock the ports. I did even try excluding the IP address of the CK and putting it into its own unfiltered policy so there were no restrictions outbound...

 

I'd be surpised if there were any outgoing port restrictions on traffic imposed by your school ISP, which (if I understand correctly) is all the Ubiquiti Cloudkey needs - it opens an outgoing connection to their servers, you connect to it from there to interact with their console. Might be worth checking if there's any outgoing URL / IP address blocking going on from the school's / ISP end - the URL the Cloudkey is trying to connect to might be blocked somewhere along the way.

[Davit2005]

Can you probe the ports to see if they are open into school ? Really all you should need are 80 and 443 for unifi key access (8443 for web ui controlller).

 

You should not need to open ports as far as I'm aware into the school through the firewall. Outbound is all that should be needed.

Edited June 15, 2023 by Davit2005

[TheHyperTechie]

Thanks for your help everyone.

 

I just followed the advice from Ubiquiti website... https://help.ui.com/hc/en-us/articles/115012240067-UniFi-Network-Remote-Access-Requirements

 

I will speak to our ISP again and see if they can help. The CK is running the latest firmware.

 

Thanks!

[TheHyperTechie]

The only thing I can think of is DNS. The cloudkey is set to use the internal DNS rather than 8.8.8.8 or 1.1.1.1. I suppose changing it could be the fix.

[XiJ]

You should not need to open ports as far as I'm aware into the school through the firewall. Outbound is all that should be needed.

 

Ah yes, I was thinking if the Self hosted controller as I’ve just spun one up in a VM. I had to open some outbound firewall rules as not all outbound are open for this trust.