I would like to set-up a two router configuration for my home network and this is how I plan to set-up.

Modem --> Google Wi-Fi Point --> Gigabit switch --> Ubiquit Edge Router --> Few end points

To give a bit of explanation, I have an ADSL2+ connection and the modem is a TP-Link (modem+router) combo and I have bridged this with Wi-Fi disabled. The modem is subsequently connected to Google Wi-Fi main point and few endpoints connect to this wirelessly. Since Google Wi-Fi has only one ethernet port at disposal, I have a gigabit switch (8 ports) connected to this.

Now, I want to connect a Ubiquiti Edge wired router to the switch and eventually a few laptops using the wired connection. The idea is to have a separate subnet for the laptops connected to the Ubiquiti router. The below diagram gives more clarity to my intended set-up. Two ports on the gigabit switch have been used for a NAS and a smart light hub respectively.

Network diagram

So far, I have configured up to the gigabit switch and I would like to get advice about getting the Ubiquiti router configured.

  • The usual configuration, for various good reasons is to have: [Modem]-[router]-[switch]-[Wireless access point and any other networked devices] Is there any reason you want this setup? Think of everything on the WAN side of the router as being attached directly to the internet and not to your network. – Baldrickk Dec 22 '17 at 11:57
  • Am I correct in assuming in this setup the "Google Wi-Fi" device is actually acting as a router? – Bob Dec 22 '17 at 12:13
  • Also, which EdgeRouter model is this? They behave differently. – Bob Dec 22 '17 at 12:28
  • @Bob yes, correct Google Wi-Fi is acting as a router and I have a Ubiquiti Edge Router X (ubnt.com/edgemax/edgerouter-x) – hypersonics Dec 23 '17 at 22:51
  • 1
    Can you set up static routes at whatever device you decide to be “in front” of your innermost router? In the graph that’d be the Google WiFi thingy. – Daniel B Dec 23 '17 at 23:19

My initial goal was to have a separate subnet for the three laptops, which is what I have got now. However, my intention is to communicate (mainly via SSH) from a Linux client that is connected to Google Wi-Fi with the Linux laptop 1 that is connected to ER-X. So, basically across IPs existing in different subnets.

-- From the chat discussion

There's three general approaches you can use to enable such a setup:

  1. Set up static routes from the "main" router such that the second subnet is routed towards the Ubiquiti ER-X gateway. You'll also need to turn off the firewall between WAN and LAN on the ER-X. Unfortunately, Google Wi-Fi does not appear to support this.

  2. Set up port-forwarding on the Ubiquiti router for every port you want to access. e.g. you might map <ubiquiti-wan-ip>:22222 to <laptop-ip>:22. You would need to add a new mapping for every individual internal IP and service you use, which becomes tedious to maintain.

  3. Use the Ubiquiti router as your primary router. I will be exploring this approach in further detail, as it does appear to be the cleanest option in this scenario.

Just a comment on the Google Wi-Fi equipment. It's good hardware and software, but it's very opinionated. Basically, to use its more advanced features, you must do things their way. Unfortunately, their way is designed around simple network setups, and falls apart when you try to use even slightly more esoteric configurations like yours.

Configuring the Ubiquiti router as your primary router

I will try to explain what these steps do, so it might be beneficial to read through the whole thing first so you can figure out if you want to adjust anything before actually configuring anything.

  1. I would recommend updating the Ubiquiti firmware first. The WAN+2LAN2 wizard you used has actually been superseded by the new Basic Setup wizard. Granted, they're actually the same underlying wizard with a new alias, but I'm using it as an indicator that you have mildly outdated firmware ;)

  2. Run through the Basic Setup (or WAN+2LAN2) wizard. Since this will now be your primary router connected directly to the bridged ADSL modem, you'll want to enter your PPPoE connection details here.

    Luckily, the basic wizard lets you easily set up two subnets - simply untick the One LAN checkbox and it will allow you to designate one port as belonging to a different subnet. Enter your desired IP addresses for the different subnets here.

    Screenshot of wizard

    This will create the following configuration (more or less):

    • eth0 should be connected to the bridged modem. It will be your WAN (internet-facing) interface. Additionally, default firewall rules will be added preventing connections initiated from the internet from connecting to your router's control panel (the WAN_LOCAL ruleset) and your internal network (the WAN_IN ruleset). It will also add a Masquerade NAT rule, like your typical consumer routers.

    • eth1 will belong to one subnet. This is best used for connecting to your Google Wi-Fi device. By default, a DHCP server will be added that will assign addresses to anything connected to this port (including through an external switch). By default, devices on this port/subnet will be allowed to talk to devices on other local subnets (routed through the ER-X), unless you add additional firewall rules blocking this.

    • eth2, eth3 and eth4 will be assigned to the built-in hardware switch called switch0. This means within the Ubiquiti router software they are treated as a single interface called switch0, and the ports will act as if they all belonged to the same external switch - i.e. switched packets (that travel within the same subnet) will not even be seen by the router's CPU. You can connect your laptops to these switched ports. Otherwise, switch0 is configured the same way as eth1 as far as DHCP, firewall, etc., by default.

      If you later need more subnets, you can remove/reassign these ports from the internal switch and use an external switch instead.

    I believe this setup will also enable the built-in caching DNS server for both interfaces (eth1 and switch0), but you can confirm that within the Services tab, DNS sub-tab, if desired.

  3. You may wish to enable hardware offloading of NAT, which will improve performance. But this is mostly relevant for >300Mbps NAT to the WAN side, which ... is rather more than ADSL2+ can manage. Or even most NBN options can manage.

  4. From here, you can connect your Google Wi-Fi to eth1, and your laptops to the switched eth2, eth3 and eth4. The router will automatically route packets between the different subnets (assuming it is assigned as the default gateway for each device, which its DHCP server will do by default).

Google Wi-Fi, double NAT, and bridging

The above configuration will allow you to access devices on your new switch0 subnet (the laptops) from your Google Wi-Fi clients. Unfortunately, it only inverts your current config: now you cannot access your Google Wi-Fi clients from your switch0 subnet! Well, not without port forwarding, anyway.

Basically, you end up running a double-NAT config: you're performing NAT on the Ubiquiti router, and on the Google router at the same time. Note that this is what you'd be doing with your original proposed layout anyway. Double-NAT means slightly increased latency on the innermost network (negligible) but more importantly it's rather difficult to get bidirectional communication going across NAT layers - you can generally initiate connections going from within the innermost NAT to the other layers but not the other way around.

There is a way around this: enable bridged mode on the Google Wi-Fi device. This is not a recommended configuration by Google (see: opinionated) and they do list the features that will no longer function when the Google AP is not functioning in router mode, but most of them are not important.

Do note that this will only work if you are using individual Google Wi-Fi access points, as this will disable their mesh network functionality. The other significant (?) loss would be the inability to set up an isolated guest Wi-Fi network. Otherwise, DHCP, DNS, etc., can be happily handled by the Ubiquiti router.

If you do need a mesh network, you would either have to live with double-NAT or consider switching to an alternative, e.g. Ubiquiti's own AmpliFi or TP-Link's Deco should support mesh networks in bridge mode (also known as AP mode). Alternatively, you can run multiple Access Points connected to the main switch/router via wired connections, in which case something like the UniFi range is recommended (for easier management; otherwise you can just connect multiple independent APs and manually configure them to the same SSID).

  • chat bookmark and additional context in case of extra messages. – Bob Dec 25 '17 at 10:13
  • Thanks for your clear instructions on setting this up. I will try to configure the way you have suggested, that is, having ER-X as the main router. I will let you know how I go along with updates. Appreciate a lot for your efforts. – hypersonics Dec 25 '17 at 22:24
  • I followed your set-up procedure and made the Ubiquiti ER-X as the main router. The eth0 is now my gateway (from modem basically) and I have plugged Google Wi-Fi on eth1. I am running a switch on the LAN port of Google Wi-Fi for other wired devices intended to be connected. On the ER-X eth2, I have my other laptop. Now, I am able to ssh successfully between Google Wi-Fi and ER-X clients. Thanks again for assistance. – hypersonics Jan 2 '18 at 0:08

I was able to successfully configure as per my network diagram above.

Firstly, I plugged my laptop to the eth0 on the Ubiquiti EdgeRouter and configured the manual IP address (192.168.1.x) as given in the Ubiquiti guide.

Next, I was able to access the EdgeRouter on (again given in the guide). Once logged in, I did set-up the WAN + 2 LAN2 wizard. This basically configured the eth0 as a default gateway and the other ports as LAN ports. After a subsequent reboot of the EdgeRouter, I unplugged the ethernet cable from eth0 and plugged into eth1. On my laptop, I removed the manual IP and set it to DHCP. Within a few seconds, I was able to again access the EdgeRouter on

Lastly, I plugged the eth0 to one of the ports on the switch. On the EdgeRouter side for eth0, I left DHCP on. Within a few seconds, I was able to get internet on the laptop connected to EdgeRouter. Additionally, I was able to update the firmware on the EdgeRouter successfully. Did a speed test and everything seems ok at this stage.

Eth0 is on a different subnet to the rest of the LAN ports on EdgeRouer.

  • This is a suboptimal configuration, IMO - at the moment I believe you're allowing one-way communication from the devices within the ER-X subnet to devices within the Google subnet. There is probably no easy way to configure two-way communication, if that's wanted. And you'd still need to add a firewall rule on the ER-X if you want proper isolation (i.e. block the one-way). If you're happy with those restrictions, sure, but otherwise I would have suggested making the ER-X the "primary" router and perhaps using the Google device in AP-only mode. – Bob Dec 24 '17 at 10:04
  • I suppose the question is whether you want this additional subnet simply for management reasons (in which case your setup would work, but feels a bit patched together) or if you want it for security reasons (in which case you'd at a minimum need to configure the ER-X firewall properly). Don't really want to flood the comments too much but I'd be happy to discuss further in chat if you want. – Bob Dec 24 '17 at 10:05
  • @Bob Thanks for your inputs. Certainly, I would like to take your suggestions on making ER-X as the primary router and Google Wi-Fi as the AP. I am happy to discuss further on the chat. – hypersonics Dec 24 '17 at 21:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.