What to pack for business travel?

For my new job, I need to travel a lot again. So instead of giving tips on how to fold your underwear so you can travel 3 weeks with only carry-on, I will share some of the stuff I take with me during travel.


Since I will be delivering presentations, demo’s and give training I travel with at least 2 laptops. In case 1 stops working, but also to have 1 ready to download stuff you might need to recover the other device in case you get a corrupt OS or something like that.

For this trip to Sydney and Berlin, I will pack 2 Windows machines. I might bring a Mac as the 2nd machine instead the next time, but for this trip that won’t be needed. So I’ll bring my Surface Laptop (all-time favorite) and as a backup the Surface book (1). 2 power adapters so I can charge them both at the same time.


I have 2 external drives with presentations, demos, and other stuff I need to use to help prep myself.


it’s the Samsung T5 250Gb SSD since they are super fast USB-C SSD drives. I had these for some time, The bigger ones are very affordable too. Very useful if you need to copy virtual machines, ISO files etc.

They also have a copy of Win10 and an offline install of Visual Studio 2017 and VSCode. The offline version of VS2017 is important since a regular install will download tons of stuff (like the Android emulators) from the internet and that’s no fun if you are stuck with crappy hotel Wi-Fi.

I’ve set up all my accounts with 2-factor auth. If it happens you don’t have cellular reception or Wi-Fi access for your phone that might be an issue. So I also set the accounts up to accept the codes the MS Authenticator app gives you. An added benefit, you can log in in your sites (like the Azure portal) from your laptop on the plane, where you don’t have phone reception. I also bring my Yubikey to be able to access my accounts. I bought a very cheap FIDO2 compliant one, also to be able to demonstrate some of our AAD integration in the future.


To be able to hook up my laptop on stage to a cable which provides internet (always try to get a wired connection, never trust Wi-Fi at conferences with tons of people in the rooms using that precious bandwidth you so desperately need while presenting) I use a USB3 hub with 1Gbit ethernet port. This comes in handy if you also want to plug in your USB receiver for your mouse, Yubikey and clicker for example. I use this one and it works great (not for your Mac though!)

image (I have a Satechi, but this seems to be the exact same one)

Whenever you travel and have to present, at a conference or customer. You never know if your laptop will successfully connect to whatever AV equipment is set up. Always be on time and try out what works and what not. It happened dozens of times I could not connect successfully at once or only at a very weird resolution. What has helped me was to use this little adapter.


Even if there was a mini display port available, it happened to me I still had to use the HDMI to get the correct connection and audio to work for example. This thing works great on both my surface devices I am bringing. For the Mac, I will carry a USB-C version with VGA, Ethernet, HDMI, and USB. Yes, VGA is still used by a lot of our enterprise customers.

The Logitech presenter has been in my bag for years. Useful to have a remote clicker and on top of that, it has a laser!


When traveling it’s always useful to have a battery pack for your mobile. Even cooler and useful is a battery pack which is also a wireless router or bridge. This is the TripMate Titan. I have the 10400mAh version.


Besides being able to charge your phone. It can also work as a wireless router. Plug in a network cable and you can wireless connect your devices. Both useful in your hotel! but also on stage when you don’t have good coverage. It works without being powered, but you might want to hook up a USB cable just in case. The device is also capable of creating a wireless connection (to your hotel network) and still use it as a wireless hotspot for your own devices, so they can share the same wireless connection.

In the past, I always threw a US power strip in my suitcase and connected that to the power outlet with a travel adapter. The Mogics Power Bagel is something I haven’t used and bring with me for the first time.


It’s very small, has it’s own travel adapter and you can connect 4 plugs and 2 USB devices at the same time. Since it’s round you won’t have a problem to plug in the larger adapters. It extends a little extension cord when you use it as well.

It’s always useful to have a spare ethernet cable handy. For hooking up your laptop in the hotel room or connecting my wireless router to the wall. I bought a set of cable matters retractable ethernet cable since they roll-up so nicely.


I also always bring a mouse. It’s just easier for me than a trackpad. The Microsoft Arc mouse is a favorite. Also since it’s flat when you pack it.


If you are planning to rent a car. I always bring a car USB charger to be able to charge my phone, especially when you are using Waze for navigation.

Of course, USB cables to charge my phone.

Lastly, I have a set of noise cancellation earphones. I use the Bose QC35 II (No Surface headphone yet). It’s also great to use for Teams calls when you are on the road since it has a microphone as well. Priceless when you sit in a place for 20 hours. I also have a pair of in-ear ones which I can use when I want to sleep.


The last thing I pack is my Kindle Paperwhite. Without it it’s really hard to get through all those hours on the plane and nights in the hotel.


So what are your most important travel gadgets? Let me know in the comments.

How to detect if your devices are trying to circumvent your pihole

As I described in my previous blog post, you can set up a pi.hole DNS server to optimize your network traffic and your browsing experience. But not every device will be respecting your DHCP DNS settings it seems. Some devices have hardcoded DNS entries and just ignore your settings. Scott Helme wrote on his blog how to redirect those naughty devices and redirect their traffic to your pihole instead.

But before we start doing that I was curious to find how many of those devices I actually had on my network. To figure this out I had to setup my USG firewall to catch the TCP/UDP request on port 53 which are not originating from my pi-hole (on IP address The USG firewall can be configured to log certain events on your firewall (without blocking the actions). This will show up in the log file on your USG. The log file can be found in /var/log/messages. You can view this file with the command:

tail -f /var/log/messages

Depending on your firewall configuration you will see almost nothing or a ton of information coming by. The goal is to capture these kind of events:

Oct 21 17:53:42 USG kernel: [WAN_OUT-2000-A]IN=eth1 OUT=eth0 MAC=80:2a:a8:f0:0a:49:94:9a:a9:23:23:40:08:00 SRC= DST= LEN=58 TOS=0x00 PREC=0x00 TTL=127 ID=59302 PROTO=UDP SPT=58633 DPT=53 LEN=38

What you see here is a request from IP address doing a DNS request (DPT=53 meaning destination port 53 which is the port a DNS server listens to) to the DNS server at IP address

A legitimate event would look like this:

Oct 21 17:55:05 USG kernel: [WAN_OUT-2000-A]IN=eth1 OUT=eth0 MAC=80:2a:a8:f0:0a:49:b4:fb:e4:8c:32:67:08:00 SRC= DST= LEN=57 TOS=0x00 PREC=0x00 TTL=63 ID=20414 DF PROTO=UDP SPT=23724 DPT=53 LEN=37

This is a DNS request coming from my pihole server on and it’s configured to forward DNS requests to

Let’s set up the firewall to start generating these logs in your log file. I have done this with Unifi version 5.9.29 Go to your cloud key settings page. Click Routing & Firewall. Click on firewall on the top of your screen. Click WAN OUT and click on Create New Rule. This is how my screen looks like:

At the buttom you have to create a new Port group for the Destination. Click on create port group button and create one for DNS like I did below:

Make sure you click on the Add button after you filled in the port number (DNS listens to Port 53) before you hit save. Click Save again, This will cause your USG to be provisioned. SSH into your USG.

To only see all DNS request in your USG log file you can use the following command:

tail -f messages |grep -F “DPT=53 “

This will show any DNS requests going out to the internet, including the ones from your pihole. To only see the naughty devices you can use the following command (another grep, perhaps there is a more efficient way but this worked for me :)) where the IP address is the IP address of your pi-hole:

tail -f messages |grep -F “DPT=53 “| grep -v “SRC=”

This one takes a while before it starts showing the log, but it worked for me. Now you will only see the DNS requests coming through your USG from your naughty devices. So how do you test this? The following command performs a DNS request and you can add a DNS server where the request is sent. This is a great way to test your setup:

nslookup techmeme.com

So far I have only seen a Samsung Galaxy S7 going to a Google DNS server directly. So the devices on my network seem to be well behaved.




Installing pihole on your Cloudkey gen2+

The other day I bought myself a Gen2 cloudkey plus from Ubiquiti and replace my old cloudkey. It comes installed with the Unifi SDN and the new Unifi Protect. The device looks really nice and has a little display which shows you information about the applications running on the device.


Since I have been playing with pi-hole lately on one of my Raspberry Pi’s, I was wondering if I could install pi-hole on the cloudkey so I would have everything from my network on a central place. With help of Google I managed to get it working by following the steps below:

First you have to install a DNS server on the cloudkey, since that’s used by the pi-hole software. ssh into your cloudkey and enter the following commands:

sudo –i

apt-get update

apt-get install dnsmasq

Than we can install the pi-hole software. I choose to download the install script and execute it on my device.

cd /tmp

wget -O basic-install.sh https://install.pi-hole.net
bash basic-install.sh

Keep all the defaults. the only thing I had to do was say no to keep the ip address from DHCP since it didn’t copy the IP adres, I entered it myself. During the install the lighttpd webservice will be installed too. This is used by the admin page.

Last thing is to change the default port of the website since that’s already taken by the cloudkey management interface. During pihole install lighttpd was installed

make a backup of the config:

cp /etc/lighttpd/lighttpd.conf /etc/lighttpd/lighttpd.conf.backup

sed -ie ‘s/= 80/= 81/g’ /etc/lighttpd/lighttpd.conf

or use vi/nano to edit the config file and change the server port

restart the webserver

/etc/init.d/lighttpd restart


http://<IP>:81/admin should bring up the pi-hole interface


Every time you run the pihole install you have to set the port of the webserver back to a non 80 port again


Let me know if this works for you or if I forgot to document a step.

New job in the Azure Identity team

Just posted the email to my colleagues and send an email to our wonderful Windows Development MVPs. Today is my last day in Windows (DEP, developer platform team). I am starting a new job in the Azure Identity organisation in the CxP team. I will be working with developers to evangelize and drive adoption of our Azure Active Directory platform. The full job description is below:


Senior Program Manager

Azure Active Directory Premium, B2C

The Digital Transformation era is upon us! Applications and data are moving to the cloud; employees want to be productive on devices they love from locations of their choice; organizations want to give seamless access to employees and partners; self-service is in and helpdesks are past. In the middle of all these exciting changes, security breaches are getting more sophisticated by the day. The single common factor in this journey that our customers are undertaking is … Identity.

The @Scale CXP team in the Identity engineering division within Cloud+AI works with partners, developers and customers from all over the world to drive service adoption and we work directly with engineering to shape the product. The best of both worlds!

As Microsoft cloud services adoption continues their rapid growth, Developers play a critical role in helping to drive usage of our services. Developers are at the center of enabling key customer scenarios building solutions ranging from enterprise scale applications and services to niche departmental business process apps. Assuring Developers have the technical skills and Identity developer platform necessary to build and sustain a vibrant Identity business is extremely important to our shared success. Assuring our developers needs are evangelized throughout our engineering organization as part of the engineering lifecycle is critical to our long-term business growth and sustainability.


In this role you will help drive usage and adoption of the Identity dev platform by supporting awareness and growth of product expertise within the developer ecosystem, and define, build, and execute on engagements with developers to get feedback, evangelize their product needs, and drive enhancements through the engineering lifecycle. This work is instrumental for our business to learn from developers across the globe as we understand how our technology is adopted. Our world evolves at the speed of cloud and we are looking for active learners who can collaborate across a diverse team and global business.

Key Responsibilities:

Evangelize the Identity developer platform and drive its adoption

Drive usage: More active third-party apps built on the Microsoft Identity developer platform getting used more broadly across a larger customer base.

Drive engagement model with B2C developers to grow the inventory of apps in our marketplace, remove technical roadblocks and discuss product roadmaps. Connect with developers at major Microsoft or Industry events and road shows.

Own Technical Enablement and Readiness: Drive Identity dev platform awareness through calls, webinars, office hours, Yammer, training sessions, etc.

Define performance measure to provide our Identity leadership with crisper actionable insights.

Channel Developer feedback to the feature teams to help with prioritization.

Track and improve Developer satisfaction with our platform.

Partner with other Microsoft teams to align with their developer ecosystem strategy.

Regularly report out on impact and opportunities.


Basic Qualifications:

Minimum seven years of work experience in the computer software industry including two years of technical experience in security, cloud, and/or identity solutions.

Bachelor’s Degree in computer science or related discipline, or equivalent experience.

Preferred Qualifications:

Ability to Ramp to L400+ on Identity Platform Technology

Direct experience working with developers is highly desired

Collaboration/ in cross-teaming skills.

Comfortable working autonomously in a fast-paced environment where new challenges exist around every corner.

Ability to prioritize, time management and organizational skills.

Ability to take on complex systems and processes and drive simplification and improvements.

Self-starter, who can deal with ambiguity, maintains focus, drives to clarity and provides innovative solutions.


I had a amazing time in Windows. The last year working for one of the best managers I had in my career (thank you Lora!). I am going to miss working with the fantastic Windows Developer community and I hope our paths cross again. I will take some time off before I start the new role. Lots of new things to learn and I can finally talk and blog about my work again, so I expect to take you along, on my blog, during the Azure Identity journey I am about to make.

Adding FlightRadar24 feed to my FlightAware raspberry pi PiAware install

Since a week or so I am running PiAware from FlightAware on 1 of my Raspberries. It’s running fine. Thanks to Chris Johnson I also managed to feed Flightradar24 from the same feed. This are the steps I did on my raspberry through the shell. I don’t run a fancy container solution like Chris does on his setup so I had to steal some configuration and instructions from his github page.

This were the instructions I pasted in my sudo shell window:

To configure the feed type:

Enter your email address, leave the next blank, enter your latitude, enter your longitude, enter your altitude in feet, enter ‘yes’ to confirm and the ini file will be filled in for you.


and you are set. You can check the /var/log/fr24feed.log file to see if everything is working correctly.

Creating my config.gateway.json provisioning file for my USG

As described in a few previous blog posts I needed to set some configuration through the command line for my USG. But every time you provision the USG the changes will be lost. This can be solved to store the changes in the config.gateway.json file on my cloud key. Since the cloud key is running Ubuntu I can find that file in /usr/lib/unifi/data/sites/default (your site can be named differently, but mine is the default).

This is my current configuration, it both contains the IPV6 configuration for Comcast and my VPN routing information. Line 74-89, Line 135-173 are the lines specific to my source address based routing setup.

What I did to create this file was login to my USG, via configure set 1 configuration file. Entered the command mca-ctrl -t dump-cfg to see what the config looked like and copied the correct node into the file. After saving I did a forced provisioning of the USG from the UI and checked if it worked (show configuration).

Configuring source address based routing on my Unifi USG

Updated 10/24/2018 since routing didn’t work anymore. You have to disable source-validation, thanks to Roelf for the comment with the correct command.

For some time now I wanted to be able to test some network stuff. I want to be able to connect certain devices over a VPN to the Netherlands but without the need to configure every client with VPN connections.

With this scenario it is possible to test different geo stuff accessing my network from different places in the world, it also helps me test the different latencies when going across the ocean and back. It also could be used to access certain video services in another country or access a different Netflix catalog, but I would never use it for something like that obviously Smile

After reading up on the different forums and asking some questions I was able to configure my USG in a way which gives me the most flexibility possible for my scenario. This is the step by step guide how to configure your USG and network so all your network on that special network will be routed over the VPN connection to the Netherlands.

The first step is to configure my ‘hoekstraonline NL’ network as described in this blogpost. Connecting through my ‘hoekstraonline NL’ wireless network and specific ports on my router (tagged with the same VLAN 100) will be the basis of my configuration. I want all that network going over the VPN connection to NL. All me regular traffic will go over my Comcast connection as usual but machines connected to that wireless network and specific ports on my routers will be routed over the VPN connection.

So lets create the VPN Client network first. Nowadays this can be done through the UI (I am running Unify version 5.6.20 stable candidate when I am writing this)


After you create this network you can check on your USG how the routing table looks like. It should have added the VPN NL network. Enter the following command on your USG (via SSH):

ubnt@USG:~$ netstat -r

My routing table looks like this:


the pptpc0 interface is the VPN connection I just defined, you can see from the flags the connection is up (U). The eth1.100 is the virtual network which was added in the previous blogpost.

The next step is to change the routing depending on the source address. Unfortunately this can’t be done through the GUI from Unifi. They add more and more functionality every month, but this has to be done through the command line. so fire up your bash shell or putty and connect to your firewall (USG in my case).

In the shell type; configure

ubnt@USG:~$ configure

We have to define a new routing table we call table 1 which will route traffic to my VPN connection on the network.

ubnt@USG# set protocols static table 1 route next-hop

Now we have to define the modify policy. A modify policy allows us to modify various items when the rule matches. So if the source address came from, then we want to use routing table 1:

ubnt@RTR# set firewall modify SOURCE_ROUTE rule 10 description ‘traffic from eth1.100 to VPN NL’
ubnt@RTR# set firewall modify SOURCE_ROUTE rule 10 source address
ubnt@RTR# set firewall modify SOURCE_ROUTE rule 10 modify table 1

Now we need to apply this policy to the interface. When it comes to applying a policy to an interface, it needs to be done on the input interface before the routing lookup takes place.

ubnt@USG# set interfaces ethernet eth1 vif 100 firewall in modify SOURCE_ROUTE

A last step which you need to add (this changed so this step was added 10/24/2018) is to disable source validation (thanks to Roelf for the comment and help)

ubnt@USG# set firewall source-validation disable

After this you can give the commit and save command and you can test your network routing. From a client in the 192.168.1.x range nothing should be different. But when you test it from a 192.168.2.x client you see the traceroute change to the hop and than off to the Netherlands.

The first tracert is from a machine in the 192.168.1.x range. You see the first hop is my USG gateway and than it goes out to the internet.

The second tracert is from the machine when it’s in the 192.168.2.x range. You see the second hop goes through the VPN gateway and you also see the response times go up since it’s traveling the ocean now.

Mission accomplished!.

The last step is to add these settings to the provisioning script stored on my cloudkey, so when I reset the USG the settings won’t be lost.

One of the sources I used to write this article.

Creating 2nd network with seperate IP range on my Unifi network

Some time ago I bought new network gear for my home from Ubiquiti. The Unifi range of hardware is very nice. It’s a bit pricy but you can do so much interesting stuff with it and the hardware is rock solid.

At home I have the following hardware running:

I am configuring my network to be able to use a VPN connection to The Netherlands depending on what wireless network or what physical network port the client is using. To be able to do that I first needed to add a network which operates on a different IP range. My network is by default configured to use the range. But for this network I need to add a range. The following steps is what I used to configure this.

Fortunately all steps can be done through the UI. I am running Unifi version 5.6.20 stable candidate when writing this. Depending on the version you are running the screens might look a bit different since they are adding more and more functionality every month.

First I created a new network with the following settings:


I tagged the network with VLAN value 100. This value we need in the next part of the setup. I also configured the DHCP server for the range. When you fill in these numbers it will automatically calculate the subnet mask etc.

Once that is done I needed to configure the new wireless network. I called my network Hoekstraonline NL so it’s easy to identify. By itself this network would get the same IP addresses as my other wireless networks. But since I needed a seperate network which is also by default blocked through the firewall from my other networks, I tagged this network with the VLAN value 100 as well.


That was all. When I connect my devices to this wireless network they receive an IP address in the 192.168.2.x range. When I tag a network port on my switch with VLAN 100 the devices connected to that port will also get an IP address in that range.

Next step is configuring source address based policies.

BUILD 2017 videos from Windows (UWP)

As every year, Windows was a big part of BUILD. For convenience (and my own) I listed all recorded and pre-recorded sessions from Windows below. Enjoy (Click the title of the session to go to the Channel9 page).

Breakout Session Title Speakers
App Model evolution Andrew Clinick
What’s new in the Microsoft Design Language Bojana Ostojic; Paul Gusmorino
Build Amazing Apps with Fluent Design James Clarke;Paul Gusmorino
What’s new and coming for Windows UI: XAML and composition Ashish Shetty; Tim Heuer
Bring your desktop apps to UWP and the Windows Store using the Desktop Bridge John Sheehan;Peyman Zanjani
Windows Ink and Microsoft Surface Dial David Abzarian;Sha Viswanathan
Cross-device and cross-platform experiences with Project Rome and Microsoft Graph Vikas Bhatia;Carmen Forsmann
App engagement in Windows and Cortana with User Activities and Project Rome Shawn Henry;Juan Oviedo
XAML custom controls for UWP: Start to finish

Nikola Metulev

John Bristowe (Telerik)

Explore the next generation of innovative UI in the Visual Layer

Kelly Renner

Lindsay Kubasik

Tip, tricks, and secrets: Building a great UWP app for PC

Stefan Wick

Ginny Caughey

Modernize Win32 apps with maximum code reuse, cross-platform reach, and efficient DevOps

Mike Battista

Joshua Weber

Introducing Adaptive Cards

Matt Hidinger

Lei Xu

What’s new in Xamarin.Forms

David Ortinau

Jason Smith

Microsoft Edge: What’s new and what’s next for the web and web apps on Windows

Kyle Pflug

Nadia Fortini

Progressive web apps and the Windows ecosystem Aaron Gustafson
Ten things you didn’t know about Visual Studio 2017 for building .NET UWP apps

Daniel Jacobson

Clint Rutkas

Using the Windows Subsystem for Linux and the Windows Console for a next gen dev experience

Gilles Khouzam

Jack Hammons

Windows Store: Manage and promote apps your way

Bernardo Zamora

Jonathan Garrigues

Proven tips for a successful Windows Store app

Jaime Rodriguez

Sonia Carlson

Nextgen UWP app distribution: Building extensible, stream-able, componentized apps

John Vintzel

Sandeep Mathew George

Connected intelligent things with Windows IoT Core and Azure IoT 

Rushmi Malaviarachchi

Sam George

The road to commercialization for your Windows IoT solution  Jason Farmer
Unity and Windows holographic tooling and intro to mixed reality Mark Schoennagel (Unity)
State of play: Modern game development

Andrew Parsons

James Yarrow

Windows 10 identity overview

Matthew Palko

Yogesh Mehta

Developing on Windows Server:  Containers, Docker, .NET Core, Service Fabric, and more

Steve Lasker

Taylor Brown




Recorded Session Title Speakers
IoT Studio: Development of apps that can control OCF devices Luiz Felipe Lage Campos Tenaglia; Srikrishna Gurugubelli
Bridges to UWP for Retail Point-of-Sale Application Developers Marcus Breda; Terry Warwick
Advancing commerce: Bring a fast and easy checkout experience to your customers across the web, UWP platform, and bots Jonathan Cutler; Molly Dalton; Stan Chang
My People on the Taskbar is a Window to Your App Allison O’Mahony; Tony Pendolino
Collect and analyze crashes for your Windows apps using the Visual Studio Mobile Center Ela Malani; Francis Zhou
Lighting up HDR and advanced color in Microsoft DirectX Simon Tao
Desktop Bridge: Smooth user transition and migration Arian Ghotbi
Introduction to Windows 10 Accessibility Jeff Petty
Vector Iconography: Using SVG images in your app Rick Manning
OpenType variable fonts: How to use fewer fonts and get a lot more typographic richness Peter Constable; Shrinath Shanbhag
WinAppDriver Yosef Durr
No more blurriness: Making your desktop application render crisply on high DPI displays James Clarke; Peter Felts
Beyond App Containers: Gaining privileged access to hardware inside your Windows app using custom capabilities Ben McGregor; Viraf Gandhi
Innovate faster with Windows as a Service (WaaS) Ethel Garcia Simon Matachana; Steve DiAcetis
WebVR: Adding VR to your websites and web apps David Rousset; Etienne Margraff
Production tracing with Event Tracing for Windows (ETW) Doug Cook
Surface Dial: What’s new for developers in the Creators Update Connor Weins
File Access Improvements in UWP Apps Adam Wilson; Steve Maillet
A quick lap around Microsoft Monetization Platform Kiran Bangalore
Bot Conversations for Apps Khuram Shahid
Go big! Optimizing your applications for large screen experiences  Mark Rideout
Maximizing user engagement and conversions with customized app content Yamil Hernandez
Dev Center analytics for Win32 applications Sonia Carlson
How to add an in-app purchase flow to your desktop app leveraging the Desktop Bridge Vladimir Postel
Microsoft’s Universal User Acquisition Platform Anusha Subramanian
Xbox Live Creators Program Mehmet Erkilic
Enable natural pen interaction by using Ink Analysis to better understand users’ ink Jianfeng Lin
Maximizing revenue through advanced pricing, sales and scheduling configuration in Dev Center Bernardo Zamora
App Diagnostics #1 – The New APIs Andrew Whitechapel
App Diagnostics #2: App Profiling Andrew Whitechapel
Windows 10 on ARM Hari Pulapaka
What’s new for multi-tasking in UWP? Chris Cortes
Tips and Tricks for Creating Performant UI in UWP David Li; Robert Mikhayelyan
Bluetooth 1: Intro to Bluetooth Explorer Frank Gorgenyi; Steffen Froehlich
Bluetooth 2: Unpaired Bluetooth LE device connectivity Frank Gorgenyi
Bluetooth 3: Bluetooth GATT Server in Windows 10  Frank Gorgenyi

How to enable IPV6 from Comcast on your UniFi Security Gateway

Since a while I run my home network on Unify hardware. I have got the UniFi security Gateway 3P, 1 (but soon 2) UniFi AP-AC-Pro and a UniFi Switch 8 POE-150W. Of course a Cloud key to manage it all (so I don’t need to install Java on my PC).

Update (11/22/2017) for Unifi 5.7.7 or higher which added ipv6 support in the UI.

FInally ubnt added IPv6 support to the UI of Unifi. This was introduced in the 5.7.7 release. I removed the changes below from the config.gateway.json file. Provisioned the USG and confirmed all IPV6 settings were gone. My clients on the network didn’t get an IPv6 address anymore either. If you check your interfaces on the USG you should see an ipv6 address from Comcast. Your eht1 interface will only have a ipv4 address.

First open your USG device in your Unifi Dashboard and enable ipv6 as follows, for Comcast I filled in 64 as the Prefix Delegation Size

Next you have to configure ipv6 for all your networks. Go to Networks. open LAN (edit) and select the IPv6 interface type. Click save and your are set. You can enable this on other networks you have configured as well of course.

Now check your clients if they get an iIPv6 address and you can test at http://test-ipv6.com/ to see if everything works. Way simpler than with the config file. Cool new feature is you have IPv6 firewall rules in the UI as well under the Routing & Firewall chapter.

Information for Unifi below 5.7.7

So far there is no way to configure IPv6 through the UI, it’s on the roadmap though. But you can very easily set it up through the command line or through provisioning a configuration file. I have been searching in the forum and found several posts explaining how to do it but neither seemed to work 100% or perhaps I did something wrong.

The easiest is go through the command line. Make an SSH connection to you USG. I use Bash on Windows to be able to use SSH.

ssh adminname@ (type yes if this is the first time you connect) enter your password to login to your gateway. You can enter show configuration to see what the current configuration is.

run the configure command and than run the following commands (I assume eth0 is your WAN connection with Comcast and eth1 is your internal LAN):

set interfaces ethernet eth0 dhcpv6-pd pd 0
set interfaces ethernet eth0 dhcpv6-pd pd 0 interface eth1
set interfaces ethernet eth0 dhcpv6-pd pd 0 prefix-length 64
set interfaces ethernet eth1 ipv6 router-advert prefix ::/64
set interfaces ethernet eth1 ipv6 router-advert managed-flag true
set interfaces ethernet eth1 ipv6 router-advert send-advert true

then enter the command commit

You will see some messages about Re-generating radvd config file for eth1… and Re-starting radvd: radvd.

type the command save

The next thing you might want to do is setup some firewall rules so you won’t expose all your machines with an ipv6 address directly to the internet. The following commands need to be entered in configuration mode again:

set firewall ipv6-name wan_in-6 default-action drop
set firewall ipv6-name wan_in-6 description wan_in
set firewall ipv6-name wan_in-6 enable-default-log
set firewall ipv6-name wan_in-6 rule 1 action accept
set firewall ipv6-name wan_in-6 rule 1 state established enable
set firewall ipv6-name wan_in-6 rule 1 state related enable
set firewall ipv6-name wan_in-6 rule 1 description “Allow Enabled/Related state”
set firewall ipv6-name wan_in-6 rule 2 action drop
set firewall ipv6-name wan_in-6 rule 2 log enable
set firewall ipv6-name wan_in-6 rule 2 state invalid enable
set firewall ipv6-name wan_in-6 rule 2 description “Drop Invalid state”
set firewall ipv6-name wan_in-6 rule 5 action accept
set firewall ipv6-name wan_in-6 rule 5 log enable
set firewall ipv6-name wan_in-6 rule 5 protocol icmpv6
set firewall ipv6-name wan_in-6 rule 5 description “Allow ICMPv6”
set firewall ipv6-name wan_local-6 default-action drop
set firewall ipv6-name wan_local-6 description wan_local
set firewall ipv6-name wan_local-6 enable-default-log
set firewall ipv6-name wan_local-6 rule 1 action accept
set firewall ipv6-name wan_local-6 rule 1 state established enable
set firewall ipv6-name wan_local-6 rule 1 state related enable
set firewall ipv6-name wan_local-6 rule 1 description “Allow Enabled/Related state”
set firewall ipv6-name wan_local-6 rule 2 action drop
set firewall ipv6-name wan_local-6 rule 2 log enable
set firewall ipv6-name wan_local-6 rule 2 state invalid enable
set firewall ipv6-name wan_local-6 rule 2 description “Drop Invalid state”
set firewall ipv6-name wan_local-6 rule 5 action accept
set firewall ipv6-name wan_local-6 rule 5 log enable
set firewall ipv6-name wan_local-6 rule 5 protocol icmpv6
set firewall ipv6-name wan_local-6 rule 5 description “Allow ICMPv6”
set firewall ipv6-name wan_local-6 rule 6 description “DHCPv6”
set firewall ipv6-name wan_local-6 rule 6 action accept
set firewall ipv6-name wan_local-6 rule 6 destination port 546
set firewall ipv6-name wan_local-6 rule 6 protocol udp
set firewall ipv6-name wan_local-6 rule 6 source port 547
set interfaces ethernet eth0 firewall in ipv6-name wan_in-6
set interfaces ethernet eth0 firewall local ipv6-name wan_local-6

commit and save again and you should be all set.

You can check if you received an ipv6 address by typing show interfaces

matthijs@ubnt:~$ show interfaces
Codes: S – State, L – Link, u – Up, D – Down, A – Admin Down
Interface    IP Address                        S/L  Description
———    ———-                        —  ———–
eth0                  u/u
eth1                    u/u
eth2         –                                 A/D
imq0         –                                 u/D
lo                        u/u

And if you have an ipv6 address you can test the connection by using ping6 www.netflix.com

matthijs@ubnt:~$ ping6 www.netflix.com
PING www.netflix.com(2620:108:700f::3425:db06) 56 data bytes
64 bytes from 2620:108:700f::3425:db06: icmp_seq=1 ttl=44 time=30.7 ms
64 bytes from 2620:108:700f::3425:db06: icmp_seq=2 ttl=44 time=33.3 ms
— www.netflix.com ping statistics —
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 30.740/32.035/33.331/1.307 ms

Another way to provision your USG is by creating a config.gateway.json file with your settings and place it in the /srv/unifi/data/sites/default directory on your cloudkey. (or equivalent directory when you are using the management software on another system like Windows or your Mac). You need to trigger a provisioning of your USG to make this configuration happen. This can be done by changing the HDCP lease range from to for example and save the configuration change. The provisioning will merge the USG configuration with the configuration in the json file.

This is the configuration file with the changes done through the command line:

“firewall”: {
“ipv6-name”: {
“wan_in-6”: {
“default-action”: “drop”,
“description”: “wan_in”,
“enable-default-log”: “””,
“rule”: {
“1”: {
“action”: “accept”,
“description”: “Allow Enabled/Related state”,
“state”: {
“established”: “enable”,
“related”: “enable”
“2”: {
“action”: “drop”,
“description”: “Drop Invalid state”,
“log”: “enable”,
“state”: {
“invalid”: “enable”
“5”: {
“action”: “accept”,
“description”: “Allow ICMPv6”,
“log”: “enable”,
“protocol”: “icmpv6”
“wan_local-6”: {
“default-action”: “drop”,
“description”: “wan_local”,
“enable-default-log”: “””,
“rule”: {
“1”: {
“action”: “accept”,
“description”: “Allow Enabled/Related state”,
“state”: {
“established”: “enable”,
“related”: “enable”
“2”: {
“action”: “drop”,
“description”: “Drop Invalid state”,
“log”: “enable”,
“state”: {
“invalid”: “enable”
“5”: {
“action”: “accept”,
“description”: “Allow ICMPv6”,
“log”: “enable”,
“protocol”: “icmpv6”
“6”: {
“action”: “accept”,
“description”: “DHCPv6”,
“destination”: {
“port”: “546”
“protocol”: “udp”,
“source”: {
“port”: “547”
“interfaces”: {
“ethernet”: {
“eth0”: {
“dhcpv6-pd”: {
“pd”: {
“0”: {
“interface”: {
“eth1”: “””
“prefix-length”: “64”
“rapid-commit”: “enable”
“firewall”: {
“in”: {
“ipv6-name”: “wan_in-6”
“local”: {
“ipv6-name”: “wan_local-6”
“eth1”: {
“ipv6”: {
“dup-addr-detect-transmits”: “1”,
“router-advert”: {
“cur-hop-limit”: “64”,
“link-mtu”: “0”,
“managed-flag”: “true”,
“max-interval”: “600”,
“other-config-flag”: “false”,
“prefix”: {
“::/64”: {
“autonomous-flag”: “true”,
“on-link-flag”: “true”,
“valid-lifetime”: “2592000”
“reachable-time”: “0”,
“retrans-timer”: “0”,
“send-advert”: “true”

So now you got IPv6 running on your network. You can test if it’s all working (after renewing your ip addresses) here.

This is the post in the forum which helped me fix this in the end.