The Edge firewall can be configured via ACLs (Access Control Lists) or zone-based. I'm more comfortable with list-based configurations, so I stuck with ACLs. Ubiquiti has a guide on zone-based firewall configurations here.
Edge firewall ACLs are configured with series of rulesets. Firewall rulesets are applied to interfaces to filter inbound, outbound, or "local" traffic "Local" traffic is traffic directed at the router itself.
Each Edge firewall ruleset is a list of rules defining action(s) to take on traffic. Firewall rulesets follow top-down logic and act on the first matching rule. Firewall rules are where you specify the traffic you want to accept, drop, or reject. Dropped packets are simply dropped, whereas rejected packets receive an ICMP message saying destination unreachable.
Firewall rules can be created to filter traffic based on IP address, port, protocol, session, fragment status, TCP flags, and time. There are also pre-built peer-to-peer applications that can be filtered including Applejuice, Bittorrent, Directconnect, Edonkey, Gnutella, and Kazaa.
The WAN+2LAN setup wizard in the GUI creates two firewall rulesets: WAN_IN and WAN_LOCAL. These statefulrulesets permit traffic that is part of an established two-way connection or related to an established connection, while all other traffic blocked. These two rulesets essentially enable a stateful firewall on the WAN interface. The below screenshot shows a snippet of the CLI configs for the WAN_IN and WAN_LOCAL firewall rulesets.
WAN_IN and WAN_LOCAL Firewall Rules
I found using this GUI wizard helpful to get the firewall enabled and to figure out how to create additional firewall rules. You can edit the firewall via the GUI and CLI, and you will have to edit the firewall to get the most out of the Edge. For example, VPN functionality requires editing the firewall rules. Other configurations on the Edge also use rules, such as NAT (Network Address Translations) configurations.
Let's preface this section by stating that Ubiquiti's EdgeRouters and in particular the EdgeRouter Pro have routing performance beyond our capability to accurately measure it.
Routing performance for the EdgeRouter Pro loaded with v1.4.0 firmware and using our standard test method is summarized below. The throughput results listed in Table 2 are obviously not reflective of the router's actual 8 Gbps spec'd performance. In our review of the EdgeRouter Lite, we measured WAN-LAN at 821 Mbps, LAN-WAN at 772 Mbps and Total Simultaneous Throughput at 1,306 Mbps. After trying different configurations on the EdgeRouter Pro, we've concluded the measured routing performance of the EdgeRouter Pro is beyond our ability to accurately test it. (It's that fast!)
Essentially, these results below are more reflective of our testbed limits instead of the router. (Note, the maximum simultaneous connections result is at the limit of our test process, indicating the EdgeRouter Pro can certainly support enough user sessions.)
|Test Description||EdgeRouter Pro|
|WAN - LAN||304.1|
|LAN - WAN||553.6|
|Maximum Simultaneous Connections||30,998|
Table 2: Routing Throughput
For completeness, below is a screenshot of our throughput tests for download and upload speeds.
Simultaneous up/downlink throughput is shown in the below IxChariot plot.
The Ubiquiti EdgeRouters are first and foremost, extremely fast routers. The previously reviewed EdgeRouter Lite is near the top of our router charts with Total Simultaneous Throughput of 1,306 Mbps and is available for less than $100. The EdgeRouter Pro is rated over 2.5x faster than the EdgeRouter Lite, its performance exceeds our test tool's capability and costs only $399!
I only scratched the surface of the EdgeRouter Pro's capabilities in this review. I successfully tested VPNs, firewall rules, VLANs, dual WAN load-balancing and dynamic DNS following various configuration guides on Ubiquiti's wiki. Clearly, the EdgeRouter Pro offers significantly more features than I could possibly test in a single review.
Ubiquiti bills the EdgeMAX routers as "Advanced Routing Technology for the Masses." Certainly, the EdgeMAX routers are priced for "the Masses," and bring high throughput routing speeds to a very affordable level. However, "the Masses" are more accustomed to GUI-based router configuration and this is where Ubiquiti's OS and documentation come up short. While Ubiquiti has made progress in expanding GUI-based configuration options, you'll still need to use the command line for most anything other than basic setup. This is not a router for novice users!
[Editors note from Tim: To reinforce this point, Doug took twice as long for this review vs. other VPN routers. And he is no stranger to CLI-based router configuration.]
I reviewed Ubiquiti's UniFi Wi-Fi controller software awhile back and complimented Ubiquiti for "pushing the wireless industry to a more economical and flexible solution." I think Ubiquiti has done it again with the EdgeMAX routers, challenging the wired network industry with an economical, fast and flexible routing solution!