I've got a Ubiquiti EdgeRouter PoE (5 port) which I'm setting up just now. I'm trying to achieve a solution where the single UniFi AP can hand out IP addresses in the space, while devices in the office which require a cable connection can get IPs in So far I have set up:

  • Port 0 with address, patched directly to a port in the office so that I can still log into manage the router regardless of the other port settings.
  • Port 1 connected to the internet line using DHCP
  • Port 2, "LAN", configured with an address of
  • Port 3, "WLAN", configured with an address of

I've set up two DHCP pools - one for, which correctly hands out IPs when you connected to the LAN port, and one for, which also correctly hands out IPs when you connect to the WLAN port.

The LAN port is connected to a switch, managed by the company above us who own the racks.

So now, I've connected the AP to the WLAN port, and I can see in the EdgeRouter UI that it has obtained a DHCP lease for (yes, I would prefer to manually assign this outside of the DHCP range, but I don't think it affects this). However, when I run the UniFi controller on my laptop, connected via the switch to the LAN port, it can't see the AP.

How can I get the controller to see the AP, keep the LAN and WLAN DHCP pools separate, and still maintain routing between the two? I'm reading a lot about UniFi having issues when not connected to the same switch, which it isn't, but I don't see anything concrete about how to solve the problem! I'm wondering if I need to connect everything through the switch and use VLANs, but I've not used VLANs before and I don't know if that would just amount to the same setup!


I've actually made some progess, in that I went with Jim G's "Option 3", and I've at least got some WiFi working. I have set up two SSIDs, one which applies the VLAN tag and one which leaves the traffic untagged. Untagged traffic through the AP successfully gets an IP in the network and can access the internet. However traffic on the tagged SSID, which is the setup I really want, sees the same problem - an IP is handed out but there is no network access.

Some investigation with ping led me to see that initially after the DHCP lease is assigned, I can ping the router and use the internet on the VLAN. However the response times from ping are around 5-7 seconds, and then they start timing out and only come back occasionally (but they do come back for the odd response). Given that they do come back, the timing of just having connected may be insignificant though.

Edit - here's the ping times and pattern:

PING ( 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
Request timeout for icmp_seq 4
64 bytes from icmp_seq=0 ttl=64 time=5696.117 ms
64 bytes from icmp_seq=1 ttl=64 time=4987.305 ms
Request timeout for icmp_seq 7
Request timeout for icmp_seq 8
64 bytes from icmp_seq=2 ttl=64 time=7390.786 ms
64 bytes from icmp_seq=3 ttl=64 time=6985.669 ms
64 bytes from icmp_seq=4 ttl=64 time=6236.806 ms
64 bytes from icmp_seq=5 ttl=64 time=5840.661 ms
64 bytes from icmp_seq=6 ttl=64 time=5108.968 ms
64 bytes from icmp_seq=7 ttl=64 time=4186.371 ms
64 bytes from icmp_seq=8 ttl=64 time=3535.087 ms
64 bytes from icmp_seq=9 ttl=64 time=2627.659 ms
64 bytes from icmp_seq=10 ttl=64 time=1683.275 ms
64 bytes from icmp_seq=11 ttl=64 time=776.689 ms
64 bytes from icmp_seq=18 ttl=64 time=1878.685 ms
Request timeout for icmp_seq 20
Request timeout for icmp_seq 21
Request timeout for icmp_seq 22
Request timeout for icmp_seq 23
Request timeout for icmp_seq 24
Request timeout for icmp_seq 25
Request timeout for icmp_seq 26
Request timeout for icmp_seq 27
Request timeout for icmp_seq 28
Request timeout for icmp_seq 29
Request timeout for icmp_seq 30
Request timeout for icmp_seq 31
Request timeout for icmp_seq 32
--- ping statistics ---
34 packets transmitted, 13 packets received, 61.8% packet loss
round-trip min/avg/max/stddev = 776.689/4379.544/7390.786/2045.686 ms
  • Why is the gateway Also, both networks overlap - and are in the same range. Did you mean /24?
    – Jim G.
    Jun 5, 2015 at 16:42
  • Aha - that would be because I posted the question before I changed the configuration slightly! I've modifed the question, but I haven't added the new VLAN because that's already further down. What it should be is two /23 networks: and The router has an IP on each of those (since the VLAN is the latter), and so the router is either or - the first addresses of each range.
    – alitheg
    Jun 6, 2015 at 16:42
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 11, 2017 at 17:14

1 Answer 1


By design, the two networks are segregated and can't communicate with each other. You have a few options:

  • put the unifi controller on the WLAN network (not that great of an option)
  • change the firewall/routing rules to allow the AP to communicate with the LAN (a bit of a security risk)
  • put the AP on the LAN and use a VLAN for the WLAN traffic

Option 3 is the cleanest, IMO. All of the management traffic is on the LAN, but any wireless clients are put on the wireless VLAN.

  • That does seem like the cleanest option, (and I thought of Option 1 last night!). I have a couple of questions though: Can the EdgeRouter make sure that Wireless traffic goes on a VLAN? The only VLAN configuration I can see is configured by physical interface. I'd still be able to route traffic from the WLAN to the LAN devices using the router right?
    – alitheg
    Jun 4, 2015 at 8:09
  • I haven't set up an EdgeRouter before - can you set multiple VLANs on a port? You'd set the LAN VLAN as the PVID and untagged, the wireless VLAN would be tagged. Then on the AP you'd configure the wireless traffic to be tagged to the wireless VLAN.
    – Jim G.
    Jun 4, 2015 at 15:55
  • You can indeed! My first attempt was using 2 VLANS configured on the switch, but I can't for the life of me figure out how to set the PVID! I've looked at the manual and an example config which says it has one, and it's not set anywhere in the config!
    – alitheg
    Jun 4, 2015 at 16:13
  • I've added some more info above - I can use WiFi if the traffic is untagged, but when it's tagged it fails. I also realised that it's not just a complete failure to communicate, it's a combination of timeouts and really long latencies
    – alitheg
    Jun 4, 2015 at 16:18
  • According to this: community.ubnt.com/t5/EdgeMAX/…, the PVID is always 1 on the port unless you are explicitly using a VLAN. So it looks like in theory my setup is as you describe! Unfortunately my tagged traffic still can't get through though!
    – alitheg
    Jun 4, 2015 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.