Crosstalk Solutions

2022-08-16 · open the original ↗

• Teleport is remote access into your own network, not a privacy VPN. The host describes Ubiquiti's one-click VPN as reaching home or office resources from somewhere like a hotel, unlike site-to-site VPN or services like NordVPN. It is built on WireGuard, which Ubiquiti says stores no data, and needs a Dream Machine, Dream Machine Pro, Pro SE or Dream Router, UniFi Network 7.1 or later, and the WiFiman app.
• Issue one invitation link per user so each can be revoked. Under Settings, Teleport & VPN, you generate a link, which Ubiquiti says is single-user, and send it to the person, whose WiFiman app opens it and builds the tunnel. The invitation history shows each link's status and lets you revoke one user without affecting others.
• The Teleport client subnet cannot be changed. In the host's test on UniFi OS 1.12.24 and Network 7.2.91, the phone got 192.168.3.1 and appeared as a Teleport client. He says the subnet is fixed for now and has heard this may change.
• Test from a different network, or the result proves nothing. The host's first ping to his TrueNAS ran while his phone was still on the same Wi-Fi. After switching SSIDs, the tunnel reconnected and he could ping the server and load its web interface.

2022-08-12 · open the original ↗

• AI Theta splits the lens from the camera's electronics. Per Ubiquiti's announcement, a lens with a 22 mm footprint sits flush in a wall or ceiling and connects by USB-C, up to 30 meters away, to a PoE body holding the compute. Lenses range from 360-degree to telephoto, and the early-access kit, which hit the store the day of recording, ships with a 360 lens and an 8 MP standard lens.
• Two-way audio needs a separate optional module. The speaker and microphone array is an add-on, resembling the Smart Chime in form, that plugs into the body; there is also an articulating mount. The host likes that this lets a camera watch from above a door while the speaker sits at mouth level.
• The host suspects "AI" cameras will get analytics the G4 line won't. The announcement shows people-counting over time. He guesses AI-branded models will get such features while G4 cameras stay limited to smart detections, which he says would explain the AI Bullet's $399 price against $199 for a G4 Bullet with similar lens specs. He labels this speculation.
• Expect the software to lag the hardware at launch. From past Ubiquiti releases, the host expects basic features at general availability that improve over time. Ubiquiti claims high-frame-rate 4K, lens dewarping and high dynamic range.

2022-08-02 · open the original ↗

• Crosstalk is moving its DECT recommendation from Yealink to Snom. The host cites security concerns at Yealink like those around Huawei and Hikvision. These handsets are now what Crosstalk recommends and sells for both its FreePBX-based PBX systems and its Crosstalk Cloud PBX.
• The M-KLE line is VTech's own design, not rebranded RTX hardware. The older Snom M series was rebranded RTX equipment, while the M-KLE series came after VTech acquired Snom. The M100 KLE base ($99 MSRP, DECT 6.0, PoE or adapter) supports 10 handsets and six concurrent calls; an M18 KLE desktop DECT phone serves desks without Ethernet.
• The rugged handset costs over twice the standard one. The M10 KLE is $89 and the M10R KLE $189, the latter shockproof and water-resistant with a locking battery. Both offer G.722, 7 days' standby, 9 hours' talk and a 3-year warranty. The host gives range as about 500 feet in open space, less through walls, and the host has no dead spots on his property.
• Shared line appearance recreates key-system behaviour on cordless phones. Line buttons for up to four shared lines show a held or in-use call on every handset. In the host's demo a call was put on hold on extension 201 and picked up on 202, and paging lets staff announce the line; he says other DECT handsets may lack this, suiting restaurants and dealerships.

2022-07-26 · open the original ↗

• The Netgate 4100 is the cheapest Netgate appliance that does high availability. At $599 MSRP (support tiers extra) it pairs two units over a heartbeat port, a setup the host says Crosstalk, which installs pfSense for business clients, builds repeatedly. It has an Intel Atom C3338R dual-core at 1.8 GHz, 4 GB DDR4, two WAN ports that take RJ45 or 1 Gb SFP, and four ports bridged as the LAN switch.
• Set the time zone by city, not by GMT offset. Dave Barger, the Crosstalk pfSense engineer, sets DNS to 8.8.8.8 with 1.1.1.1 as backup, and unticks the WAN's RFC 1918 block only behind a double-NATed ISP. The host's first-generation Starlink dish hands over a public IP, so he left it on. Choosing "GMT-8" put the clock eight hours ahead and the update check failed until he switched to America/Los_Angeles. Updating 22.01 to 22.05 takes about five minutes, but Barger books an hour with clients.
• Barger installs the same VPN, IDS and backup tools on every pfSense box. He adds the OpenVPN client export wizard, Snort (needs a free community key) and WireGuard. He often runs both VPNs: WireGuard for lightweight devices, OpenVPN for Windows machines. He turns on Netgate's auto config backup, which uploads on every change and keeps up to 50, protected by a long encryption password; the device key on the Restore tab goes into a password manager.
• A guest VLAN needs its own allow rule, under two higher rules. The wizard only creates allow-all for the main LAN. On guest VLAN 10 (192.168.10.1/24, DHCP .2–.254) the rules run top-down: allow traffic to the guest interface address, block an RFC 1918 alias (10/8, 172.16/12, 192.168/16), then allow all. The alias also covers subnets added later. Client isolation has to be enabled on the access point, because same-subnet traffic never reaches the router.
• Stop pfSense rewriting the ports of a locally hosted PBX. Outbound connections always get their ports rewritten, which Barger says is fine for everything except RTP streams. His fix is an outbound NAT rule with the PBX as a /32 source and static port ticked, with outbound NAT switched from automatic to hybrid. Anything beyond that depends on the PBX provider.

2022-07-22 · open the original ↗

• The UniFi Dream Router is a low-cost all-in-one entry into UniFi. It lists at $199, after roughly $79 in the early-access store as the host recalls. It combines a router/firewall, a Wi-Fi 6 4x4 MU-MIMO access point, a four-port switch with two 802.3af PoE ports, a UniFi controller and 128 GB of storage, on a dual-core Cortex-A53 at 1.35 GHz with 2 GB RAM. It is rated −10 to 45 °C, so indoors only, and more access points or switches can be added later.
• The UDR runs only two UniFi applications at once. In practice that means Network plus one of Protect, Access or Talk. Bluetooth setup through the UniFi app took about two minutes of boot time, and the firmware then updated itself. The box was on UniFi OS 2.4.10 at recording. The host would turn off automatic updates in production and run them by hand.
• A microSD card replaces the internal storage rather than adding to it. So a 128 GB card, which the host believes is the minimum, gains nothing; he assumes but has not confirmed a 1 TB maximum. Two cameras recording continuously gave an estimate of about 1 day 5 hours of history. He recommends detections-only with five seconds of buffer either side, warns that microSD is not made for surveillance, and points to a UNVR for a real system.
• His IPS speed tests over Starlink were inconclusive. With IPS off, a phone next to the router reached 248/19.5 Mbps. With IPS on high, two tests gave 108/14 and 66/10. With it off again, they gave 140/10 and 153/16.7. He calls this anecdotal because Starlink speeds swing widely, and says a single-device test cannot show the CPU load of many clients at once.
• The host sizes the UDR for ordinary home or small-business use. It does not suit 100–300 clients or heavy IoT, and he calls three extra U6 Lite access points too many for most homes. Teleport VPN works on it, and it had not crashed in about a day and a half of testing. He plans to put it in his mother-in-law's house to watch it in normal use.

2022-07-14 · open the original ↗

• This short has no text to summarize. The archived transcript for this 16-second short is empty (0 words), so nothing in the archive records what it says or shows beyond its title.

2022-07-13 · open the original ↗

• Starlink Maritime costs $10,000 up front and $5,000 a month. The hardware fee covers two high-performance (business-class) dishes and two pipe mounts but no Ethernet adapter, which the host objects to. Starlink advertises up to 350 Mbps download at sea with unlimited data. Service pauses and resumes in one-month increments, and resuming on any day bills the full month.
• Coverage at launch is mostly a coastal fringe, by Starlink's map. It covers waters near existing land service around the US, Europe, Australia/New Zealand and parts of South America. The map adds a further band in Q4 2022 and the rest of the oceans in Q1 2023. The host doubts these dates, given how often Elon Musk's companies miss timelines.
• Two dishes allow for deck obstructions. The high-performance dish measures 57 × 51 cm (22 × 20 in) and is rated IP56, against 50 × 30 cm and IP54 for the standard dish. The difference is withstanding powerful water jets rather than splashing. Starlink's FAQ promises a free upgrade to a flat-panel antenna and mount when it ships in Q4 2022. The host speculates that the mount, not the dish, will do the actuating.
• The fine print limits where Maritime can be used. It is best-effort service, with priority because it uses the business dish. It is not a safety-of-life-at-sea service, is limited to territorial waters where SpaceX or the user holds a licence, and is approved in the US. In-motion use is authorized only on a non-interference basis in the 12.2–12.7 GHz band. The host links this to Starlink's fight with Dish Network: Starlink claims Dish's plans would cause interference 77% of the time and outages 74% of the time. He reads its customer letter campaign to the FCC as a panic move.
• Against VSAT and Inmarsat, the host calls the price a bargain. In Starlink's own case study, SpaceX paid over $165,000 a month for 25 Mbps metered VSAT across 10 vessels with 1–2 seconds of latency, and about $50,000 a month on Starlink. A Twitter respondent put Inmarsat's Fleet Xpress at 10 Mbps, $35,760 for the dish and data from $1,800 a month, with 500 MB costing $1,245 a month on a three-year contract, using a 37 kg dish.

2022-07-07 · open the original ↗

• The friend's Idaho lake house started with badly placed, ISP-owned gear. A MikroTik 2.4 GHz antenna from the local wireless ISP pointed through trees and a metal tram track, giving about 12 Mbps symmetrical. A point-to-point bridge owned by the ISP fed the back house, where a second Netgear router double-NATed the network. Wi-Fi had to cover three structures at different elevations plus RV parking.
• Internet comes in at the boathouse; the router stays in the house. Moving the ISP antenna down gave line of sight across the lake and a full 16/16 Mbps. The ISP's planned 5 GHz upgrade, which could double that, would not pass through the trees. Starlink, the planned primary with the ISP as backup, goes on a custom 4-inch steel post halfway along the dock, since the end comes out for winter. The UDM SE router sits in the main house because snow can cut off the boathouse. The host chose it for built-in PoE, dual WAN and the option of Protect.
• VLAN-only networks carry both WANs over one cable. The host created a primary WAN on VLAN 3 and a backup WAN on VLAN 4 as VLAN-only networks. He set ports 7 and 8 to those profiles on both the boathouse US-8-Lite PoE switch and the UDM SE, then patched them into the WAN ports. The backup WAN was waiting on an RJ45 SFP module he forgot to bring.
• Terminating the outdoor shielded Cat6 was the hardest part. The cable ran up the tram rail in conduit laid on the existing electrical conduit, with a spare pull string left in. The host bought shielded outdoor Cat6 because temperatures there have reached −30, but its thick conductor coating defeated hours of termination attempts. A technician from the wireless ISP, Aaron, terminated it. The boathouse gear runs on a UPS because the boathouse is not on the generator.
• A point-to-multipoint link serves two spots at the back house. NanoBeam AC radios cover a roughly 100 ft shot, with about 345 Mbps of link capacity to each station. One station feeds an outdoor U6 Mesh for the RV area through chained PoE injectors; the other feeds a US-8-Lite and access point inside. The radios were painted with non-metallic Plasti Dip, and 24 V passive PoE converters were needed. The house is effectively an Airbnb, so there is only a secure and a guest network, with no separate IoT network. The product links are affiliate links.

2022-07-05 · open the original ↗

• The Wi-Fi 6 Extender is a renamed, Wi-Fi 6 Beacon HD. The form factor looks unchanged, but the LED ring now does only blue and white; the host attributes this to chip shortages. The extender is $149 against $129 for the Beacon HD. Without high client density he expects no noticeable performance difference, so the Beacon HD saves $20 and suits buyers who want LED colours.
• The advertised throughput overstates what one mesh radio delivers. Ubiquiti claims up to 4.8 Gbps on 5 GHz and about 573 Mbps on 2.4 GHz. The host notes that Wi-Fi is not full duplex and that the single 5 GHz radio carries both the wireless uplink and the clients, which roughly halves capacity. It needs UniFi Network 6.5.55 or later, and the uplinking access point needs firmware 6.0.11 or later.
• The host treats it as supplementary coverage, not a primary access point. It has no Ethernet port, and he uses it mainly to connect a G4 Doorbell where there is no wiring. Clients with serious bandwidth needs should get a wired access point, and he would not run a 20-person office from one extender linked to one access point.
• It runs about 30 °F hotter than the Beacon HD. He measured about 138 °F against 108 °F, which he flags as a concern for a wall outlet within children's reach. In UniFi it still shows the old colour-picker settings, uses a generic access-point icon, and drew clients that were nearer his main access point. The purchase links are affiliate links.

2022-06-14 · open the original ↗

• Starlink for RVs lets waitlisted buyers skip the residential queue. In a waitlist area in Idaho, the host had the same rectangular dish ordered, delivered and running in under a week; the trade-off, he says, is that RV traffic gets the lowest priority on the network, so nearby residential customers come first and speeds depend on local saturation and time of day.
• The RV plan costs the same as residential plus portability. The dish is $599 plus tax and $50 shipping, with the first month of $135 paid up front; the host equates that to the $110-a-month residential service plus its $25 portability charge.
• Its one advantage over residential is that it can be paused. The host suggests it for a seasonal vacation home, where service can be turned off for the months you are away instead of paying the $110 residential base rate year-round.
• Under trees and at lowest priority, it still delivered usable speeds. After a plug-in setup, the dish found signal and self-oriented in about five to ten minutes; three tests from 15 feet from the included router gave 64/10, 197/14 and 122/14 Mbps, and a day of remote work showed no slowdowns. His verdict: with no other internet, a minimum of about 60 Mbps is well worth the cost.

2022-06-07 · open the original ↗

• The U6 In-Wall matches full-size UniFi APs on radio power. Earlier in-wall units were weaker hotel/dorm devices, but the host puts this Wi-Fi 6 model on par with the U6 Pro: 4x4 MU-MIMO with OFDMA on 5 GHz, 2x2 MU-MIMO on 2.4 GHz, 22 dBm (2.4 GHz) and 26 dBm (5 GHz) max power, and 300+ concurrent clients per the spec he cites.
• PoE passthrough needs PoE+ in, not standard PoE. It has a rear PoE-in port plus four bottom ports, three gigabit and one 802.3af PoE out for a camera or VoIP phone; 802.3af in powers the AP but gives no PoE out, which requires 802.3at PoE+ in. It is indoor-only, rated −30 to 60 °C.
• Park replaced gear in UniFi's default site instead of unadopting it. When swapping out his UAP In-Wall HD (on UniFi 7.1.66), the host moved the old unit to the default site as a placeholder, avoiding a factory reset and re-adoption later; this works only on multi-site controllers like his hosted UniFi, not Dream Machines.
• The old UAP In-Wall HD backplate cannot be reused. The U6 In-Wall is slightly wider and uses a metal backplate instead of plastic, so the plate must be replaced; the host likes the simpler two-piece design versus the HD's three pieces plus optional cover.
• It drops the security screw and the decorative skins. The HD had a Torx security screw; the U6 relies on a click lock the host says a paper clip can defeat, a loss for hotels and dorms. No skins exist even in the early access store, and the old HD skins do not fit.

2022-05-31 · open the original ↗

• The host calls the Pro a worthwhile upgrade, mainly for package detection. He thinks package alerts justify the extra cost, especially where porch pirates are common, and also points to USB-C power and future integrations. A doorbell press reached his phone in about one second, and a package alert in under 30 seconds.
• Package alerts come only from the downward package camera. That camera is 8 MP and records 1600x1200 at 2 frames per second. In the host's test, a package the main camera could see but the package camera could not raised no alert, and one only the package camera could see did. He calls this an oversight.
• Package detection in UniFi Protect 2.0 looks half-implemented. The non-Pro G4 Doorbell offers package smart detection but has no package notification option. Protect 2.0 also will not let one device sit in more than one device group. The animated display shown in the launch video was missing as of Protect 2.0.
• Image quality matches the original G4 Doorbell, below Ubiquiti's standalone cameras. The host believes both doorbells use the same 5 MP main camera. The view is very wide and displayed at 1600x1200, and shots are backlit on default settings, but a year with the original never left him unable to tell who was at the door.
• The speaker is still too quiet for two-way talk. Microphone gain seems better than on the G4 Doorbell, but the host says he will never use the talk feature, since couriers have usually gone by the time the app opens. The fingerprint and NFC reader did nothing yet, and the rated operating ceiling of 40 °C (104 °F) worries him for doors in direct sun.

2022-05-19 · open the original ↗

• A basic Omada home network needs three separated LANs and SSIDs. The host builds it from factory defaults on a TL-R605 router, a TL-SG2210MP PoE switch, an in-wall Omada access point and an OC200 controller, which a software controller can replace. The secure LAN is 192.168.42.1/24, guest is VLAN 10 (192.168.10.x) and IoT is VLAN 107 (192.168.107.x).
• Moving off the default subnet strands devices on old DHCP leases. The host avoids 192.168.0.x out of habit, not for security, starts DHCP at .10 to keep .2–.9 free for static addresses, and sets DNS to 1.1.1.1 and 9.9.9.9, or a Pi-hole's address. Rather than wait for leases to expire, he power-cycled the PoE switch. The controller then needed a reboot before it took its fixed IP of .2.
• Guest Wi-Fi uses Omada's guest network policy plus a rate limit. The policy blocks guest clients from every private IP subnet but still lets them reach the internet, and the SSID is tagged VLAN 10. A rate-limit profile caps guests at 20 Mbps down and 5 Mbps up so they cannot use up the household's bandwidth.
• The IoT network relies on a one-way switch ACL, not guest isolation. Guest isolation would block casting between IoT devices, so the host instead denies all protocols from the IoT network to the secure network, leaving the rule one-way. Ping tests confirmed IoT was blocked from secure but kept internet access. He puts his own phone on the IoT network to cast rather than writing cross-network ACLs.

2022-05-17 · open the original ↗

• Newer UniFi PoE cannot power the NanoBeam 5AC directly. The $99 NanoBeam runs on 24 V passive PoE, while the host's UniFi Lite 8 PoE switch and UDM SE supply only 802.3af. He bridges the gap with an INS-3AF-I-G adapter; the bundled injector or the older US-8-150W, which is selectable per port, also work. The side where the network originates is the access point, and the far ends are stations.
• Each unit starts at 192.168.1.20 and must be re-addressed. The host gives his laptop a static 192.168.1.99 and moves the units to 192.168.42.10, .11 and .12 so they can reach the internet and update from airOS 8.7.1 to 8.7.9. He disables the Bluetooth management radio and saves a configuration backup of every unit, which the setup wizard can restore onto a replacement.
• Narrow the radio to what the site needs. The host uses 80 MHz channels instead of the default 40 MHz only because his rural site is quiet; wider channels give more bandwidth but pick up more interference. He removes DFS channels, which give way to priority users such as airports and the military, and sets 0 dBm output on the bench out of a −4 to 21 range.
• Update firmware on stations first, then the access point. If the access point is updated first and the versions turn out incompatible, remote stations become unreachable without a site visit. In this test an 8.7.1 station linked to an 8.7.9 access point, which the host says used not to work. Lying flat on his desk, the link reported 250–300 Mbps of capacity and a 77/41 Mbps speed test, and he expects about 300 Mbps once aimed.
• Point-to-multipoint requires turning off airOS 8's point-to-point mode. With that mode on at the access point, a second station could see the SSID but not select it. After the host turned it off, station one did not reconnect within five minutes until he also unchecked the mode on the station and reselected the SSID. Point-to-point mode accepts only airMAX AC stations, while mixed mode also takes older M5 units.

2022-05-11 · open the original ↗

• The host likes the RT6600ax overall, objecting only to its antennas. It lists at $299.99, went on sale in the US on 11 May 2022 and was due in Europe the following month. Its web interface was snappy on what the datasheet gives as a quad-core 1.8 GHz CPU with 1 GB of DDR3. Beyond one Wi-Fi 6 phone test he did little: 630 Mbps down and about 20 Mbps up, which maxed out his 600/20 internet line.
• The ports suit dual-WAN homes and faster-than-gigabit internet. It has a 1 Gb WAN port, three 1 Gb LAN ports and a 2.5 Gb WAN/LAN combo port, enabling failover or load balancing, which the host did not test. The USB 3.2 port takes storage for SMB, FTP or Time Machine, or tethers a phone as the internet connection. He dislikes the physical power switch because it is easy to hit.
• Inter-network firewalling is simple but aimed at home users, not IT pros. New networks are isolated by default; to open access you uncheck isolation and write ordered source/destination allow or deny rules. The host's example blocks IoT and the main LAN both ways, then allows an NVR at 192.168.10.10 with a rule placed above the blocks. Networks bind to physical ports, with no VLAN tagging exposed.
• Safe Access gives granular parental and guest controls. Profiles apply per network or per user, with devices assigned to each family member. They combine web-filter presets (child, employee, guest, custom), schedules, a daily time quota such as 3 hours 30 minutes, and SafeSearch for Google, Bing, DuckDuckGo and YouTube. The host thinks, unsure, that Google needs an API key. Logs show which device tried which blocked site.
• Add-on packages make it a VPN server, IPS and more. Like Synology's NAS, it installs packages such as DNS server, Download Station, media server, RADIUS and Threat Prevention (IPS/IDS). VPN Plus offers clientless web VPN, SSL VPN, remote desktop and site-to-site. A second unit can extend coverage in mesh mode. The host, a Synology NAS user, would like the router and NAS to integrate.

2022-05-05 · open the original ↗

• Starlink portability is a paid add-on, limited to one continent. According to Starlink's announcement email and FAQ, it costs $25 per month, is turned on from the account page, takes effect immediately and works anywhere on the same continent with active coverage. Each Starlink in an account needs its own portability purchase.
• Billing is in whole months, so short trips cost $25. Starlink charges the full month on the next invoice with no proration; enable it on 12 March and you pay $25 on 1 April. Once disabled, it stays active until the cycle ends. The host reads this as $25 for a week's camping with internet, which he would gladly pay.
• Portable users get best-effort, lower-priority service. Starlink says users at their registered address take priority, especially in waitlisted areas and at peak times. The host notes there is no data yet and suspects the slowdown will be modest, perhaps 70 Mbps where 150 Mbps was usual. He reads the policy mainly as a deterrent against people using portability to skip the waitlist.
• No use in motion, and long stays require changing address. Starlink says in-motion use voids the limited warranty. More than two months in a foreign country requires moving the service address or buying another Starlink, and an unspecified "extended period" elsewhere also requires a change; the host guesses two to three months. He speculates that a separate dish, perhaps under a radome, will serve moving vehicles.
• The host expects people to use portability to bypass the waitlist. In his scenario, someone in an available area orders the dish, the buyer turns on portability, takes it home, then changes the service address, at a likely cost of one month's $25. He sees nothing in the FAQ that prevents this, and says the new address would then get full priority.

2022-04-27 · open the original ↗

• Manually set channels; never leave channel selection on auto. The host calls this the most important and most overlooked step: survey neighbouring networks first (UniFi's Wi-Fi Insights, or the NetSpot app), then give each access point the clearest channel, as far from its neighbours as possible. With three wired APs he put 2.4 GHz on channels 1, 6 and 11, with 1 and 6 on the APs farthest apart.
• On 5 GHz, avoid DFS channels and spread APs across the band. The host treats the DFS channels as reserved and not to be used, working only in 36–48 and 149–165. Neighbours crowded 36–44, so he chose 36 and 48 for the two farthest-apart APs and 165, which no neighbour used, for the one between them.
• Use 20 MHz width on 2.4 GHz and 40 MHz on 5 GHz. Wider channels allow more bandwidth but are more prone to interference, and the host calls a 40 MHz 2.4 GHz channel rude in apartments, offices or neighbourhoods. He would use 40 MHz there only somewhere with no competing signals, such as a ranch; 40 MHz is his standard for 5 GHz, which has more spectrum.
• Place APs centrally so their strong 5 GHz coverage barely overlaps. In the UniFi Design Center he modelled a generic 2,000 sq ft house with a U6 Lite, U6 LR and U6 Pro, drew in walls by material, and adjusted placement until the yellow (strong) 5 GHz zones just touched. He plans for 5 GHz because 2.4 GHz penetrates obstacles better; brick, concrete and metal such as fireplaces or stoves weaken signal.
• Leave transmit power on auto unless APs share a channel. The host almost always does: lowering power matters only where two APs reuse a channel, for example a fourth AP sharing channel 1, so each covers only its own area. The advice assumes hardwired APs; he says mesh changes the channel picture and has a separate video on it. He applies it across vendors, demonstrated on a UDM SE.

2022-04-26 · open the original ↗

• The UniFi Dream Router is now generally available and in stock. The host says it went GA that day and is in stock for the first time he has seen in a long while, and points buyers to a link on his Twitter.

2022-04-12 · open the original ↗

• A DHCP reservation pins a dynamically assigned address to one device. Without one, a device that is offline for a while, such as a phone off for a week, can come back to a different address after its old one goes to another client. The host reserves addresses for devices that apps must always find at the same IP, such as an OctoPrint Raspberry Pi and a Lutron hub.
• Split a /24 into gateway, static range and DHCP pool. The host's example: 192.168.1.1 as gateway, .2–.50 set aside for manually assigned static addresses (switches, servers), and .51–.254 as the pool DHCP hands out automatically.
• In UniFi, enable "Use fixed IP address" on the client. On a UDM Pro running 1.12.15, which the host says was current in April 2022, you open the client, go to settings, pick the network and keep or set the address. UniFi then stops handing that address to any other client.
• In EdgeOS, map a lease to a static IP. On an EdgeRouter 4 running 2.0.9 hotfix 2, the host goes to Services, DHCP Server, opens View Leases on the network and uses Map Static IP, which ties the device's MAC address to the address. Existing mappings are listed, and can be deleted, under the Static MAC/IP Mapping tab.

2022-04-05 · open the original ↗

• Wyze's new handgun safe is sturdy and opens four ways. The host, who doesn't own a handgun, describes solid metal construction weighing about 20 pounds. It opens by code, fingerprint, key or the Wyze app, and has a USB-C auxiliary power connector so it can still be opened if the battery dies.

2022-03-31 · open the original ↗

• The U6 Mesh is the host's new favourite UniFi access point. He puts it at the top of his recommended UniFi APs for its soda-can form factor, which looks unobtrusive indoors yet is IPX5-rated (low-pressure water from any direction) for outdoor use, with the caveat that he had not yet tested the U6 Pro.
• It is Ubiquiti's first Wi-Fi 6 mesh access point. Specs given: 4x4 MU-MIMO on 5 GHz, 2x2 MIMO on 2.4 GHz, one 1 Gbps Ethernet port, 802.3af PoE; a PoE injector, ceiling-base mount and pole mount come in the box.
• It costs slightly more than the U6 Pro. MSRP is $179, about $30 more; the trade-off against the U6 Pro is the form factor and weatherproofing in exchange for about 1 dBi less antenna gain.
• It performed very well in his single-client speed tests. On a 600 Mbps home-office connection, a Wi-Fi 6 laptop got 376.7 down / 41.7 up and an iPhone 390 down / 45.6 up; he notes one client does not show Wi-Fi 6's real benefit, which is dense environments such as a stadium.
• The unit runs warm, and configuration in UniFi is standard. He measured 109°F on the front and 108°F on the back; the LED ring colour is configurable (a change takes about 8–9 seconds to reach the AP), and a specific mesh uplink AP can be set when it is deployed outdoors.

2022-03-28 · open the original ↗

• TP-Link switches fall into three management tiers. Smart managed switches have a local GUI and can be centrally managed by the software, hardware or cloud Omada SDN controller; Easy Smart switches have a web GUI but cannot join Omada; unmanaged switches are plug-and-play with no GUI. The video makes no sponsorship disclosure.
• TP-Link model numbers decode systematically. TL-S = TP-Link switch, then speed (F fast Ethernet, G gigabit or 2.5G, X 10G), then layer (1 unmanaged, 2 L2, 3 L2+ with static routing, ACLs, sFlow/OAM, console port), then uplink count and total ports, then suffixes; in the TL-SG3210XHP-M2, X means 10G uplinks, HP high-power PoE, M2 2.5G ports.
• His Omada-capable picks span backbone fibre to the desk. The TL-SX3016F (16x 10G SFP+, redundant PSUs, 320 Gbps, $499.99) and 8-port sibling (160 Gbps, $229.99) for backbone, NAS and servers; the TL-SG3210XHP-M2 (8x 2.5G PoE+, 2x SFP+, 240 W, $399.99) for 2.5G APs such as the EAP660 HD; the TL-SG3428MP (24x PoE+, 4x SFP, 384 W, $465.99) as the standard business switch.
• Smaller Omada and Easy Smart picks cover a few PoE devices. The TL-SG2210MP (8x gigabit PoE+, 2x SFP, $239.99) suits a handful of phones, cameras or APs; the TL-SG2008P ($89.99, 4 of 8 ports PoE+) is his desk switch; the Easy Smart TL-SG1016PE gives 16 ports, 8 PoE+, 110 W, for $229.
• Unmanaged picks are for cheap, quick connectivity. A 5-port 2.5G desktop switch ($169) ties together 2.5G PCs; 8- and 5-port 10G models (TL-SX1008 about $433; 5-port $337) link 10G NAS and workstations; the TL-SF1008P (under $50, 4 of 8 fast-Ethernet ports PoE) suits a garage; and the sub-$20 TL-SG108 lives in his gear bag as a spare.

2022-03-24 · open the original ↗

• Inbound routes match on dialed DID, caller ID, or both. FreePBX imposes no limit on the number of routes beyond the server's CPU and RAM, and a route can send a call to an IVR, extension, queue, ring group, announcement or call flow control.
• Always keep a blank catch-all default route. With DID and caller ID left empty it takes every call; in the series it sends the main number to the "weather" call flow control, then holiday and business-hours time conditions, then the main IVR, which the test call followed.
• A dedicated DID route bypasses the whole call flow. The host adds a "sales queue" route on the sales DID that drops callers straight into the sales queue, skipping call flow control, time conditions and IVR; the test call showed the "sales" prefix and went directly to hold music.
• The DID pattern length depends on the trunk. It may be 10 or 11 digits in the US (11 for the SIP trunk used here), other lengths abroad, or 3–4 DNIS digits on a PRI; Asterisk logs an informational message giving the exact DID when a call falls through to the catch-all.
• Per-route options mark where a call came from. Alert info sets a distinct external ringtone (native only on Sangoma/Digium phones, workarounds for others such as Yealink), alongside ringer volume override and a caller ID name prefix ("main:"); privacy manager forces callers without caller ID to enter one; call recording can be forced, but the host warns recording laws vary by state and country.

2022-03-24 · open the original ↗

• Call flow control is a manual switch between two call paths. Unlike time conditions, a CFC is toggled by a person, like a railway switch sending a train down track A or B; in the series' design it sits first on the inbound route so an inclement-weather closure can override everything downstream.
• The host advises against CFCs for daily day/night mode. Relying on staff to toggle it every morning and night means it will sometimes be missed, so he automates schedules with time conditions and keeps CFCs for ad hoc diversions, such as a client's daily noon team meeting greeting.
• *Each CFC is toggled by 28 plus its index. FreePBX allows up to 99 (indexes 0–99, so *280 through *2899); an optional password stops users who discover the code from toggling it, and the GUI's "day/night" labels simply mean normal and override mode.
• The test confirmed the weather override path. Normal mode passes to holiday then business-hours time conditions and the main IVR; with *280 activated, a simulated inbound call (7777) heard the weather-closure announcement and went to the general voicemail box.
• A BLF line key makes the toggle easy for receptionists. Configured in the phone's model layout with value *280, the key shows green in normal mode and red in override, and pressing it toggles the CFC.

2022-03-22 · open the original ↗

• The 1960 series brings stacking to an SDN-managed lineup. The host believes the Aruba Instant On 1960 switches are the first and only switches stackable within such a central management portal: up to four switches per stack, with unlimited stacks, linked over the 10G Ethernet or fibre ports rather than proprietary stacking cables, in series or a ring for redundancy.
• The 24-port PoE model is quiet and well equipped. The JL807A has 24 gigabit PoE ports, two 10G Ethernet and two 10G SFP+ ports, and a single non-redundant power connector; its fan never ran in his office testing, and he believes the non-PoE models are fanless. The range has five models, including 48-port and non-PoE variants; all are Layer 2+.
• Cloud and local management are mutually exclusive. The free Instant On cloud portal offers only basic stack settings (no spanning tree, no cross-switch link aggregation); STP, ACLs, LLDP and routing require the much richer local GUI, chosen at first boot, and his Aruba contact says cloud features are being added. Its plug-and-play stacking beat the local GUI's port selection and reboots.
• The host values the choice of management mode. As an integrator selling switches, he can stock one model and move a customer from cloud to local later without replacing hardware; and since the cloud has no on-premises option, a factory reset to local mode would keep the switches running if Aruba's cloud disappeared.
• They carry a steep premium over UniFi equivalents. Over 50% more: at B&H the 24-port PoE model was $1,275, against $800 for UniFi's 24-port PoE enterprise switch, and was unavailable until about June; there are no licence fees, unlike Cisco. He recommends the 1960 only for businesses needing Layer 2+ features with IT staff to run the local GUI; vanilla SMBs can use the 1930 ($425, 24 ports, four SFP+ uplinks).

2022-03-17 · open the original ↗

• Time conditions replace staff manually opening and closing the phones. The host prefers them because people forget to switch the system at the start and end of the day; they also handle holiday routing.
• Time groups define the hours; time conditions route on them. The example business-hours group is Monday–Friday 08:00–17:00 plus Saturday 08:00–12:00; the holidays group lists whole days by date, such as January 1, July 4, and Thanksgiving as November 24–25, 2022.
• Floating holidays need yearly maintenance or a calendar. Because dates like Thanksgiving move, the host sets a reminder for his first day back each January to update the time groups; alternatively a time condition can run in calendar mode against a local, CalDAV, Outlook or iCal calendar with recurring events.
• The two conditions are stacked, holiday check first. The holiday condition sends matches to the holiday announcement and non-matches to the business-hours condition, which goes to the main IVR or the "closed" announcement and voicemail; business hours must therefore be created first, as it is the holiday condition's destination.
• Each condition gets a feature code for manual override. Here *271 (business hours) and *272 (holidays), which can be put on a phone button; an optional PIN stops employees guessing the code, and an override reverts at the next scheduled change. Test calls (7777) followed the IVR, closed and holiday paths as toggled.

2022-03-17 · open the original ↗

• The series builds the IVR last, tying together prior pieces. Voicemail boxes, announcements, ring groups and queues were built first, so the IVR entries only map digits: 0 to the receptionist ring group, 1 to the sales queue, 2 to the customer service queue, 3 to the accounting ring group.
• Direct dial can be limited through a directory. Besides enabled or disabled, direct dial can use a directory such as "all employees"; deleting an entry (the CEO) blocks external callers from dialling that extension, and an entry can be redirected to another extension, such as an assistant's, or given alternate spellings.
• The host cuts the default timeout and retries. He lowers the timeout from 10 to 5 seconds and the invalid and timeout retries from the default 3 to 1, with "append announcement" enabled so the main greeting replays; a second failure goes to the receptionist ring group.
• Hidden IVR entries add unannounced options. He adds a "*" entry mapped to the dial-voicemail feature code (equivalent to *98), so staff calling in from outside can enter their mailbox number and password to check messages.
• Every option should be tested by calling in. After pointing the main inbound route at the IVR instead of extension 200, the host's test call reached the sales queue; he advises manually checking each option's destination, and notes after-hours routing is still to come.

2022-03-15 · open the original ↗

• PiVPN turns a Raspberry Pi into your own remote-access VPN. Unlike a commercial VPN proxy, it sits on the home or office network, so you can reach internal files and services from outside and browse from your home IP rather than a hotel's; the host rates it a 4 out of 10 for difficulty and 30–60 minutes of work.
• Use the 32-bit Raspberry Pi OS Lite. The host found the 64-bit version did not work perfectly with the PiVPN installer; Lite avoids the desktop GUI's CPU and RAM cost, and his 2 GB Raspberry Pi 4 ran fine on it. He recommends a class 10 microSD card of about 32 GB, SSH enabled in Raspberry Pi Imager, and a wired rather than Wi-Fi connection.
• The server needs a fixed address and a forwarded UDP port. Set a static IP outside the DHCP range (he used .30, below his .100–.254 pool) or a DHCP reservation; choose WireGuard, recommended for speed and mobile battery life; forward UDP 51820 to the Pi; use dynamic DNS if the ISP's public IP changes. He enabled unattended security upgrades because a port is open to the internet.
• Run pivpn -d if clients connect but pass no traffic. His phone tunnel reached only the Pi itself until the debug session flagged the iptables masquerade, input and forward rules as unset; after fixing them and rebooting, he could reach the gateway, his Synology NAS and the internet.
• Create one client profile per device and back up. A separate profile per device lets a lost phone be revoked without affecting others; phones import via pivpn -qr, Windows by copying the config file off with WinSCP. pivpn -c lists connected clients, and pivpn -bk creates a backup to download after any significant change.

2022-03-03 · open the original ↗

• Mesh should be used only when hardwiring is impossible. A mesh AP spends its radio both serving clients and backhauling to another AP, so a wired AP always performs better; adding more APs to a struggling mesh can worsen it by adding 2.4 and 5 GHz interference, as the friend's redundant bedroom UAP-AC-M did.
• The friend's half-acre property was badly configured, not under-equipped. Two wired APs (an HD and a Mesh Pro on a US-8-60W) and three mesh APs gave ample coverage on the design map, but Wi-Fi experience scores were as low as 70%, the guest-house AP double-hopped through the bedroom AP, the man cave got about 2 Mbps, and Sonos struggled.
• The HD access point was overkill for a home. The host says HD models add no range and are built for many simultaneous clients such as an auditorium; for this deployment he would have recommended the LR or, best, the Pro series.
• Separate 2.4 GHz channels; UniFi meshes only over 5 GHz. He found almost every AP fixed on channel 6, and spread them across 1, 6 and 11 at 20 MHz width, leaving transmit power on auto; at 40 MHz on 2.4 GHz channels overlap, and 2.4 GHz now mainly carries IoT and Sonos.
• Every mesh AP should make one hop to the wired AP. On 5 GHz at 40 MHz, the non-meshing house HD went on channel 48 while the wired patio AP and all three mesh APs shared channel 149, with the patio accepting downlinks only and each mesh AP's uplink fixed to it. Scores rose to 88% and above and the man cave went from 2 to about 30 Mbps; he calls this temporary, pending hardwiring.

2022-02-25 · open the original ↗

• The entry 2x2 model suits most homes and small businesses. At $99.99 MSRP the EAP610 is a 2x2 MU-MIMO Wi-Fi 6 access point rated up to about 1.2 Gbps on 5 GHz and 574 Mbps on 2.4 GHz, powered by 802.3at PoE or a 12V adapter; the host notes these are total wireless figures, capped at 1 Gbps to the wired LAN by its single gigabit port.
• Step up to 4x4 MU-MIMO only for dense client loads. The host likens MIMO streams to highway lanes, with phones and laptops using one or two each. The EAP660 HD, at $179.99, doubles the EAP610's wireless capacity to 2.4 Gbps on 5 GHz and just over 1.1 Gbps on 2.4 GHz, and adds a 2.5 Gbps Ethernet port.
• The wall-plate model is built for single-room coverage, not range. At $89.99 MSRP the EAP615-Wall fits over a single-gang box, takes 802.3af or 802.3at PoE, and adds three gigabit ports; the third passes PoE out only when the unit is fed PoE+ (802.3at). It matches the EAP610's throughput at lower antenna gain, which the host says suits hotel rooms or dorms.
• A Wi-Fi 6 outdoor Omada model is coming soon. TP-Link plans it for early Q2 2022. The current EAP225 Outdoor ($69.99) is Wi-Fi 5, IP65, powered by 802.3af or 24V passive PoE, rated 867 Mbps on 5 GHz and 300 Mbps on 2.4 GHz; TP-Link's Wi-Fi 6 successor is to be called the EAP610 Outdoor.
• The host rates TP-Link's Omada APs as cost-effective strong performers. He says they performed great in his own wireless testing; the video makes no sponsorship disclosure either way, and links to the gear are in its description.

2022-02-24 · open the original ↗

• Always label your equipment. The nine-second short is the host's one-line reminder, with no further reasoning or method given in the captions.

2022-02-24 · open the original ↗

• Ubiquiti's four Enterprise switches are out of early access and shipping. The Enterprise 8 PoE has eight 2.5 Gbps PoE+ ports and two 10G SFP+, which the host pitches at advanced home and small-business users; the Enterprise 24 PoE has 12 x 1 Gbps and 12 x 2.5 Gbps, all PoE+, plus two SFP+; the Enterprise 48 PoE has 48 x 2.5 Gbps PoE+ and four SFP+. The Enterprise XG24 has 24 x 10 Gbps RJ45 and two 25G SFP28, no PoE, and he has not tested it.
• The Enterprise 24 PoE's single port row is better for racks. Unlike older 24-port UniFi switches with stacked ports, all ports sit in a line suited to a 1U patch panel. It adds the 1.3-inch touchscreen with AR port view, a locking power connector like the UDM SE's, and a USP RPS port; the host guesses from a teardown that a separate upper board handles PoE power.
• The switch adopts and behaves like any UniFi switch. On a UDM Pro running early-access firmware, it adopted and updated to switch firmware 5.76.7 and uplinked at 10 Gbps over a 10G-SR SFP module, with the usual port profiles, VLAN, PoE and aggregation settings; the host confirmed a 2.5 Gbps full-duplex link to a test device.
• Their layer 3 switching cannot yet replace true L3 switches. The host says it handles inter-VLAN routing on the switch, offloading the UDM Pro or firewall, but little more as of recording; networks must be designed around Ubiquiti's limits, which he hopes later firmware removes.

2022-02-23 · open the original ↗

• The short carries no argument beyond its title. Its entire transcript is the three words "Breaking the seal", with nothing to say what is being unsealed or why.

2022-02-16 · open the original ↗

• The host 3D-printed an Among Us figure for his kids. He judges that it came out pretty well; the short is a personal aside with no networking content.

2022-02-14 · open the original ↗

• The U6 Enterprise is Ubiquiti's first announced Wi-Fi 6E access point. Per Ubiquiti's launch video it adds a 6 GHz radio to 4x4 MIMO, claims over 10 Gbps combined over-the-air throughput and 600+ clients, runs on PoE+ rather than PoE++, and upgrades the LAN port to 2.5 Gbps, which the host calls its most notable feature.
• Over-the-air speed ratings exceed what single-gigabit ports can deliver. The host explains Ubiquiti's 1.5 Gbps U6 Lite and 5.3 Gbps U6 Pro (300+ clients) figures are client-to-client totals behind 1 Gbps ports. He calls the $99 U6 Lite the best bang-for-buck AP he has tested, enough for most homes at one or two units; he has not yet reviewed the U6 Pro.
• Ubiquiti's Enterprise switches target small-enterprise cores, not homes. The host cites $1,298 for the Enterprise XG24 (24 x 10G RJ45, two 25G SFP28) and about $1,599 for the Enterprise 48 PoE. He believes all but the Enterprise 8 have layer 3 features, though not yet a full layer 3 implementation.
• Ubiquiti appears to be moving toward home automation. All U6 APs carry Bluetooth Low Energy for UniFi IoT devices such as the $59 UP Sense multi-sensor; the U6 In-Wall, U6 Extender and UniFi Protect door lock were early access at recording, while the U6 Mesh is available. The host's expectation of more such devices is his suspicion.
• WiFiman's signal mapper now maps coverage room by room. The host says it works with a UDM Pro or UDM SE on the latest firmware plus the current WiFiman phone app, walking a floor plan to find dead zones; he defers his assessment to a later video.

2022-02-11 · open the original ↗

• The host split test gear into its own rack to protect production. He bought a NavePoint 15U Performance Series rack for about $320, kept his 12U StarTech rack for production, and took about 1.5 hours to assemble it. Its sides lock and lift off for access, the back is bolted, and it rolls on casters or bolts down.
• The rack's shallow depth limits it to networking gear. At 450 mm deep, the host found the Patchbox 365 needed about 1.5 cm more, its cable arms would hit the door, and the deeper of two shelves clashed with rear power cables. He moved the Patchbox and the USP RPS to the deeper rack, and shifted the front rails back to give fiber room to bend; a 600 mm version exists.
• The rack's bundled fans are loud enough to leave off. His meter read about 55–56 dB ambient and about 70 dB with the fans on. He runs them from an early-access UniFi PDU so they can be switched from UniFi, keeps them off for now, and may swap in quieter fans.
• Old phone jacks wired with Cat5e made easy cross-connects. The host traced two RJ11 runs to the attic and re-terminated them as Cat5e keystones into a USW Industrial switch carrying all his house VLANs. He recommends the Untwist Tool version 2 from TechToolSupply, with six channels, a rubberized back and an optional Wow Stick driver, for anyone terminating cable regularly.
• Any toolless cage-nut replacement beats standard cage nuts. The host used Rack Studs Series 2 Duo, which Rack Studs sent him, holding both screws of a 1U device in one piece, and also showed Patchbox's metal clip-on alternative. He found both worked and did not know which is cheaper.

2022-02-02 · open the original ↗

• Starlink Premium costs five times standard service. Starlink's announcement lists a larger dish with more than double the antenna capacity, 150–500 Mbps down, 20–40 ms latency, 24/7 priority support and delivery from Q2 2022, at a $500 deposit, $2,500 dish and $500 a month. Standard service is a $100 deposit, $500 dish plus $50 shipping and $99 a month.
• The host judges Premium not worth the extra cost for homes. The extra is $400 a month. His own standard dish gets about 80–160 Mbps (162.9 Mbps that morning), fine for a home user. He sees little in priority support for a set-and-forget dish, having needed only about two email RMAs for a modem or power brick.
• Unlimited service locations is the real business benefit. Managing many dishes from one account suits firms moving between sites, the host argues, such as construction crews on six-to-eight-month projects or a Crosstalk client, a TV and film production company that shoots at remote locations for a few weeks at a time.
• The host suspects throttling and a cash grab. He asks whether standard users will be deprioritized to deliver Premium speeds. He notes buyers waiting since early 2021 may be overtaken, and that someone estimated the original dish cost $2,000–2,400 to make against a $500 price. Talk of SpaceX financial trouble he labels pure speculation.
• A static IP and bridge mode would make Premium attractive. Standard Starlink uses CGNAT, which the host says hampers VoIP and inbound access to a NAS or intranet. Businesses also want the modem to bridge through to their own firewall, and neither feature had been announced at recording.

2022-02-01 · open the original ↗

• Patchbox replaces loose patch cables with retractable cassettes. Its frame holds 24 cassettes of Cat6A UTP or STP copper or fiber, which extend to length and lock; the Patchbox 365 suits shallower network racks and the Patchbox Plus spans a 42U rack. The host configured 20 Cat6A and four OM4 multimode LC-LC cassettes. Patchbox, an Austrian company, sent him one unit plus a second for a giveaway.
• A fully populated unit costs several hundred dollars. A Patchbox 365 with Cat6A cassettes is $540 from Synergy Micro Solutions, the only US distributor the host found. Built piecemeal, cassettes are $17 each for Cat6A and $20.50 for fiber on top of the frame. He also liked Patchbox's Setup.exe arm, a temporary shelf for seating heavy servers.
• The short-depth model would not fit his shallow test rack. In the 450 mm-deep 15U rack the Patchbox 365 needed about 1.5 cm more depth and stuck out enough to hit the door, so he moved it to his deeper production rack. There its side-mounted cable management arms do not fit because the rack's sides are closed.
• The host calls it overkill for a small rack. It works best beside a 24-port patch panel. In his rack it gives exact-length runs to four link-aggregated NAS ports, an EdgeRouter 4 and Raspberry Pis, and serves as a quick temporary patch for adopting new UniFi gear.
• The price is justified only by admin time in large racks. Against the cost of 24 plain patch cables, the host argues the savings come from labelled cassettes, tracing a link with a tug, and always having the right cable length. The heavy packaging he received was an ordering mistake; Patchbox says units normally ship pre-assembled in one box.

2022-01-21 · open the original ↗

• The UDM SE is worth its premium only for PoE or faster-than-gigabit internet. At $499 against the UDM Pro's $379, the host says the extra $120 pays off if you want to power a few cameras, access points or VoIP phones without a separate PoE switch or injectors, or if your connection is 1 Gbps or more; his 600 Mbps plan tested at 712/42 Mbps.
• The SE fixes the UDM Pro's most-requested gap: PoE on the LAN ports. All eight front ports are gigabit RJ45; two are 802.3at PoE+ and six are 802.3af PoE. The WAN port moves from 1 Gbps to 2.5 Gbps, the two 10G SFP+ ports remain, and the power cord now locks in, which the host's older UDM Pro lacks.
• The built-in 128 GB SSD is too small for real Protect use. The host says even one or two 1080p cameras fill it quickly and recommends adding a drive of around 8 TB (he guesses that is the maximum), such as a WD Purple. With only the internal SSD, Protect offered no always-on recording, just "never" or "detections", in his test.
• Opened up, the SE carries a much larger power section and a separate PoE board. Side by side with the UDM Pro, he found a bigger power board (he assumes for PoE), a raised PoE management board, a Kingston M.2 SSD and a revised display board; the airflow layout is unchanged. He notes he is not a component expert.
• He disables automatic updates during setup and runs them manually. Setup works via the UniFi app or 192.168.1.1; the default is a daily 3 a.m. update check, which he turns off so that any breakage can be tied to an update he just ran. Updating the base UniFi OS on his unit also updated Network and Protect.

2022-01-07 · open the original ↗

• Ubiquiti's official announcement confirms the leaked G4 Doorbell Pro's dual cameras. Per the announcement video the host reacts to, it pairs a 5 MP main camera with a downward-facing package camera; he reads it as the main camera doing person and vehicle detection while the package camera does motion only, and judges its wide view big enough for most porches.
• The reader is fingerprint plus NFC, so it should pair with UniFi Access. Ubiquiti says you can unlock the door by finger or card swipe but does not say how it ties to a lock; the host suspects Ubiquiti smart locks are coming soon, while admitting he has no inside knowledge, and wonders whether it works directly with Access-controlled door strikes.
• Power options now include PoE via an adapter, answering earlier complaints. It runs from existing doorbell wiring, USB-C, or a USB-C-to-Ethernet PoE adapter; the host defends the original's lack of PoE because few homes have Ethernet at the door, and notes the adapter shown is bulky to leave inside the wall.
• Other announced features: custom screen messages, chime support, flashlight and weatherproofing. The 1.3-inch colour screen shows custom messages (the promo also shows weather), it works with mechanical and digital chimes, has IR night vision and a motion-triggered white LED, and two-way audio.
• At $299 the host calls it reasonably priced, and it sold out fast. It went on sale in Ubiquiti's Early Access store around 7:30 a.m. Hawaii time and sold out in under 20 minutes; he notes EA pricing is subject to change and says he would have bought one to replace his G4 Doorbell.

2022-01-06 · open the original ↗

• The AI 360 is a top-down ceiling camera the host loves for wide spaces. It is UniFi Protect's first 360 camera: 5 MP, a square 1920x1920 fisheye image at 30 fps, 802.3af PoE, IPX4 and IK08 rated, $299 from Ubiquiti. He sees it suiting retail stores, cash registers and mechanics' shops.
• De-warping works on live view and on recorded playback. Using arrow keys or the mouse he could pan around footage already recorded and follow a subject, or look somewhere other than the main action; a chosen view can be saved into a live view.
• Software limits at launch: one shared angle, and no de-warp on Viewport. Whatever direction you set in one live view carries over to all live views, and the UniFi Viewport shows only the raw fisheye circle; he hopes firmware fixes both.
• Smart detection only appeared after reopening the camera's settings. The host also gives his fix for a UNVR that stopped person and vehicle detection: add a new smart detection zone covering the whole frame, set sensitivity to about 80 with both types selected, then delete the default zone.
• The vandal-resistant dome cover made no visible difference to the picture. The box includes a second, IK08 dome cover and a rubber wrench for swapping it; side-by-side screenshots looked almost identical. Adoption was automatic, but the firmware update took five to six minutes, longer than any camera he has seen.

2022-01-04 · open the original ↗

• The host rates Insty Connect well for RVers who need fine control. He likes that it gives nomadic users tools to tune their signal, built by an RV owner unhappy with existing products; it is a small company with 3D-printed antennas. The base 4G package (router, LTE modem, 15 ft USB cable, omnidirectional Angel Wings antenna) is $549; a 5G version was expected in Q1 2022.
• The directional Binoculars antenna roughly doubled his roadside speeds. Off Interstate 5 in Oregon, under a quarter mile from a tower, his iPhone 13 on LTE got 4.7/4.7 Mbps; Angel Wings gave 19.8/8.8 Mbps, and Binoculars (about $250, LPDA antennas) pointed at the tower gave almost double. He expects a bigger gain farther from towers.
• Tower and band locking lets you hold the best connection found. The wizard lists nearby towers and bands with RSRP/RSRQ colour-coded; you pick an all-green option and lock it so the modem does not drift. Towers can be cross-referenced on CellMapper to aim the directional antenna.
• In the field it failed to see the SIM until factory reset. It worked perfectly in his office (about 55/17.5 Mbps on Angel Wings indoors), but on the road it lost the SIM and internet; he suspects the cold, possibly the SIM, and a reset and rerun of the setup wizard fixed it.
• Crosstalk sells the SIMs he recommends, AT&T-backed and unthrottled. The host advises a major-carrier SIM and pitches Crosstalk's own unlimited, unthrottled AT&T-based SIMs, the one he used in testing (it registered as FirstNet LTE). Setup is phone-friendly via an open "Insty Connect Setup" SSID that the wizard removes at the end; run a software update first.

2021-12-28 · open the original ↗

• The rack genuinely needs no tools to assemble or load. The Ubiquiti U-Rack-6U-TL lists at $249 and ships with a blank 1U 24-port patch panel, locking casters and handles; side rails push into slots and carry captive screws, with engraved alignment lines, that also take Phillips or flathead drivers for snugging.
• It fits only newer UniFi hardware, not mixed racks. The captive screws match newer UniFi rack-ear patterns; older UniFi gear with built-in ears will not mount, and the host's QNAP NAS sat loose because its length and ear pattern don't match. Only non-UniFi gear with identical width and screw pattern would fit.
• Short-depth UniFi gear can also mount at the rear. The back rails carry captive screws too, so equipment designed to go in either the front or rear of a rack can be secured from behind.
• Desktop use works but the feet may scratch. With the casters removed, hard, non-rubberized plastic nubs remain underneath and can mark wood surfaces; the host knows of no wall-mount option, though a shelf would do.
• The host sees it suiting all-UniFi networks and customer staging. He suggests it for matching UniFi aesthetics and for staging small-business or prosumer deployments, not for racks mixing in a NAS, EdgeRouter or pfSense box. The patch panel takes standard keystone jacks; he wishes Ubiquiti sold silver keystones or blanks, a larger (e.g. 15U) version, and advises removing casters once wall cabling is punched down.

2021-12-21 · open the original ↗

• Update UniFi consoles now because of Log4j. Recording in mid-December 2021, the host urges updating any UDM Pro, Cloud Key or hosted controller, and specifically getting UniFi Network to 6.5.55, which he says addresses two separate Log4j vulnerabilities.
• Back up first, then update UniFi OS before the apps. He downloads a configuration backup from Advanced settings, updates UniFi OS from 1.10.0 to 1.10.4 (the console reboots, which he watches with a persistent ping -t to 192.168.1.1), then updates Network, Protect (to 1.20.1, under two minutes), and even uninstalled Access and Talk so they're current when installed.
• Stay on the official release channel in production. The release-candidate channel carries builds still being tested, and the beta channel is bleeding-edge software that has not been properly QA'd and may cause problems.
• The host turns auto-update off so breakage is traceable. If an unattended update breaks something, he might not realize the update was the cause and would troubleshoot the wrong thing; he prefers manual updates followed by checking that each app still works.
• New app versions can bring device firmware updates. After the Network update his USW Pro 24 PoE showed a firmware update, which he applied; the UniFi OS update also added UID, a beta identity-as-a-service access-control app he has not yet explored.

2021-12-16 · open the original ↗

• Use a queue when calls outnumber agents; otherwise a ring group. Both distribute calls to several people, but queues add ring strategies, agent login and pausing, and capacity and timing limits; the host builds a sales queue (5050) and a customer service queue (5051), each failing over to its department's voicemail with the unavailable greeting.
• Turn on autofill so later callers don't wait on the first. With autofill off, a second caller sits until the first is connected, even while the first rings agent after agent; with it on, each waiting call rings the next agent in the round-robin-with-memory order. Skip busy agents is set to "queue calls only" so personal or internal calls don't block queue calls.
• Static agents always ring; dynamic agents log in, with priorities. A dynamic agent such as a manager can join only for overflow, and priority 1 agents get calls only when every priority 0 agent is busy, paused or unavailable. The host sets a 10-second agent timeout with 5-second retry, 10-second wrap-up, and auto-pause so an absent agent stops adding 15 seconds per caller.
• Timing and capacity rules decide when callers hit failover. Max wait (e.g. 5 minutes, strict or loose), max callers (e.g. 10, then the 11th goes straight to voicemail), and the host's usual join-when-empty no, leave-when-empty yes keep calls from stranding; position and hold-time announcements, an IVR breakout and an SLA service level for reports are also available. He declines iSymphony over its licensing.
• BLF keys beat feature codes for agent login and pause. 45 logs in or out (optionally 45extqueue) and *46 pauses, but users struggle to learn them; a BLF key using the __SIP_USER_1__ template variable shows status by colour. The host, whose firm sells them, says this variable works only on Crosstalk/Clearly IP phones, not Yealink, and cites it as why he promotes them.

2021-12-09 · open the original ↗

• Ring groups suit lines where answerers outnumber calls. The host's rule of thumb: a receptionist or accounting group that gets occasional calls should ring everyone at once, while a call centre with more callers than agents needs a queue. Anything beyond the ring-all strategy, he says, usually means you want a queue.
• Every ring group needs a failover destination so calls aren't stranded. His reception group (5000) rings two extensions for 20 seconds (about four rings at roughly 5 seconds each), then goes to the general voicemail's unavailable greeting. Accounting (5001) goes to an announcement and then to a voicemail box with instructions only. A test showed that with no members registered, calls skip straight to failover.
• Callers to a front desk should hear ringing, not hold music. For a small organization whose receptionist answers every inbound call, hold music sounds wrong to callers on first contact. Queues can use hold music while callers wait.
• Caller-ID prefixes and alert info tell staff which group rang. A prefix such as "GEN" marks ring-group calls. Alert info sets a distinct ringtone on Sangoma, Crosstalk, Clearly IP and Digium phones. The host typically uses separate internal and external ringtones, and a ringer volume override is also available.
• The host usually enables "ignore call forwarding settings". Otherwise a receptionist at lunch with Find Me/Follow Me on would have group calls forwarded out to them. Skip busy agent is situational. With it on, a third caller while both receptionists are busy goes to failover. He thinks receptionists should be able to put a caller on hold and pick up the second call instead.

2021-12-09 · open the original ↗

• An announcement plays a recording, then moves on without caller input. Unlike an IVR, the caller cannot press keys to skip or choose. The host builds weather, holiday and general closure announcements, each sending callers to the general voicemail box (6000), leaving the other options at their defaults.
• Pair an announcement with "instructions only" voicemail to replace a personal greeting. The accounting no-answer announcement drops callers into an individual's mailbox with instructions only. Callers hear the department message plus the standard "leave a message after the tone" prompt, not that user's own outgoing greeting. The other choices are the busy greeting, the unavailable greeting, or no message.
• Announcements suit messages callers must not bypass. The host's example is "your call may be recorded for quality assurance purposes" before a queue. He describes this as serving as two-party consent where call recording requires it.

2021-12-02 · open the original ↗

• The DOJ says the 2021 Ubiquiti "whistleblower" was the attacker. Citing BleepingComputer and a Southern District of New York indictment, the host reports that former senior developer Nickolas Sharp was charged with stealing data using his own cloud-admin credentials. The indictment alleges Sharp then posed first as an anonymous hacker and then as a whistleblower; he faces four counts carrying a maximum of 37 years if convicted on all.
• The indictment says an internet outage exposed his home IP address. The alleged sequence: he cloned about 155 GitHub repositories over SSH in December 2020 through Surfshark VPN, but one clone command came from his home IP in Portland, Oregon right after his internet went down. The host blames a missing VPN kill switch and recommends Private Internet Access for having one.
• The indictment alleges he covered his tracks and lied to investigators. He set a one-day log-retention policy on AWS, joined Ubiquiti's own incident-response team, and denied using Surfshark. His ransom email asked 25 bitcoin for the data plus 25 for a "backdoor"; the host puts the 50 at about $1.9 million. Sharp then lied to the FBI after its March 24, 2021 search.
• His planted stories allegedly cost Ubiquiti over $4 billion in a day. Per the reporting, the stock fell roughly 20%, from $349 on March 30 to $290 on April 1, 2021, after the Krebs on Security story. Sharp's claim that Ubiquiti kept no logs was, by the indictment's account, a result of his own tampering.
• The host retracts his April 2021 criticism of Ubiquiti and apologizes. He says he fell for the story "hook, line and sinker" because Krebs on Security is a trusted source. His advice on resetting credentials and MFA still stands, but he calls everything else in that video baseless.

2021-12-01 · open the original ↗

• A general voicemail box is a virtual extension shared by a group. The host creates virtual extensions that never SIP-register: 6000 for general/after-hours, 6001 for sales and 6002 for customer service. Each has voicemail enabled, a password matching the extension so the first dial-in runs the setup wizard, and email notification with the WAV file attached.
• *97 checks your own mailbox; *98 checks any other. *97 assumes the calling extension, like the envelope button, while *98 prompts for which mailbox. Dialing * plus an extension (*6000) goes straight to that mailbox to leave a message.
• A BLF key on *98+mailbox lights when messages wait. The host sets a template line key to BLF with value *986000, which turns green when the box is empty and red when it holds messages. Because it lives in the phone template, every phone using that template gets the shared indicator, and he suggests separate templates for receptionist, sales or service phones.
• Test voicemails shorter than 5 seconds aren't kept. The host warns that a quick "test test" message never appears because the system ignores recordings under 5 seconds, which he says has tripped people up.

2021-12-01 · open the original ↗

• A system recording is a reusable audio entity. One recording, such as the main IVR greeting, can be used in many places across the PBX. The host makes five for his design: main IVR, closed general, closed weather, closed holiday, and an accounting no-answer message. He concedes a single "closed" recording would serve.
• Recordings can be made in three ways. You can call an extension and record over the phone, which must then be named and saved. You can record in the browser, which needs a valid HTTPS certificate such as Let's Encrypt for microphone access. Or you can upload a WAV or MP3 file. For customer systems the host records with a good microphone in Audacity, trimming the silence at each end.
• Linking a recording to a feature code lets staff re-record without the admin GUI. In the host's example, *291 re-records the main IVR. This suits often-changed weather or holiday messages, with a printed sheet of codes by the responsible person's phone. A feature-code password stops accidental or unauthorized re-recording.
• An announcement in front of a mailbox replaces the personal greeting. Unanswered accounting calls get a department message first. They then drop into an individual's mailbox with no outgoing greeting. The host notes Allison Smith, the voice of Asterisk's prompts, can be hired so custom recordings match the system voice.

2021-11-30 · open the original ↗

• Inbound calls pass a manual weather toggle before anything else. The host's design for the fictional Dunder Mifflin starts with a call flow control (a feature code, *280, flips it) that, when switched, sends every call to a closed-due-to-weather announcement and then the general voicemail box.
• Two time conditions follow: holidays first, then business hours. A holiday match plays a holiday announcement; outside Monday–Friday 8 am–5 pm and Saturday 8 am–12 pm a closed announcement plays. Both end in the general voicemail box, and only open-hours calls reach the main IVR.
• Each IVR option ends in its own fallback voicemail. Pressing 0, timing out or pressing an invalid digit rings the receptionist ring group, then general voicemail; 1 rings the sales queue, then a sales voicemail; 2 a customer service queue and its voicemail; 3 an accounting ring group, a no-answer announcement, then one named person's voicemail.
• The design is deliberately broader than most real IVRs. The host built it to touch many FreePBX features and will implement it over roughly the next ten videos, starting with system recordings; he says it mirrors what Crosstalk builds live with customers as part of its turnkey installation service, and offers the diagram as a PDF download.

2021-11-29 · open the original ↗

• Backup YubiKeys must all be enrolled in the same setup. The host says you cannot add TOTP to one key and add backups later; you disable 2FA on the site (here the Ubiquiti account at account.ui.com), re-enable it, and scan the one QR code into Yubico Authenticator on every key before confirming with a code.
• Generate fresh backup codes after re-enrolling. The host treats the site's backup codes as the final fail-safe if every key and phone is lost, so you are not left begging the company to restore access; he stores them somewhere safe.
• The host splits codes between YubiKeys and Google Authenticator. He prefers hardware keys because switching from an iPhone 8 to a new iPhone carried the Google Authenticator app over but none of its codes; he puts daily-use codes on his YubiKey 5 NFC and 5Ci keys and rarely used ones on the phone, while noting apps like Authy do sync across devices.
• A keychain YubiKey has held up for over a year. The host reports no durability problems from daily pocket carry, and mentions a new Yubico protective sleeve for those worried; product links in the video are affiliate links, he says.

2021-11-28 · open the original ↗

• The G4 Instant's case rests on lens, weatherproofing and smart detection. Ubiquiti lists it at $99 in early access (already sold out) against $29 for the G3 Instant; it moves from 1080p to 2K at up to 30 fps, though Ubiquiti's video says 4 megapixels and its product page 5, and it adds IPX5 weatherproofing.
• Smart detection is the host's assumption, not Ubiquiti's claim. G4 cameras generally detect people and vehicles and G3 ones do not, so he expects it here, but the launch video never says so; the field of view also narrows from 133° to 102.4°, still wide angle in his view.
• It is still not battery powered. It joins the network over Wi-Fi but needs power, likely USB-C like the G3 Instant, the host suspects; he puts little stock in its two-way audio, which he found not very usable on earlier UniFi cameras.
• Buy the cheaper G3 Instant indoors, the G4 outdoors. The host uses his $29 G3 Instant in his garage to see whether a car is there and thinks it ideal for that; he would pay $99 only for an outdoor camera, and warns availability is unknown given chip shortages, with the G3 itself long out of stock.

2021-11-23 · open the original ↗

• Report even attempted scams to the FBI. Within four hours of the earlier video an agent from the FBI's Oregon Cyber Task Force in Portland asked the host to file at IC3.gov, which he did without hearing back; the agent wrote that aggregated complaints tie cases to rings, and that Oregon business email compromise losses this year were $1.2 million from just 15 reports, likely about three times higher.
• A tracking link exposed only a VPN exit and the browser. The host sent the scammer a Grabify link, which logs a visitor's details before redirecting; it showed a Los Angeles VPN or proxy, Windows 10 and Chrome. He warns scammers use the same tool.
• Reporting the domain early cost him contact with the scammer. Namecheap took down the fake clemsonedu.school domain after the host emailed [email protected], and the scammer stopped responding; he calls this premature because he had hoped to keep the scammer engaged.
• An AirTag parcel stalled at the reshipper. Sewn into a Clemson stuffed animal and mailed 13 October 2021, it went via Portland and Dallas–Fort Worth to Newark on 16 October and a reshipping company in Sayreville, New Jersey on 18 October. As of 18 November it had not moved, with about 80% battery left.

2021-11-18 · open the original ↗

• A plausible billing email fooled the host into clicking. The "problem authorizing your payment method" message claimed to be WordPress with a WooCommerce Subscriptions logo, matching his site and store; the only visual clue was a small, low-resolution, off-centre logo, and he clicked without hovering over the link.
• His password manager's silence was the first real warning. LastPass offered no saved login on the page, which it would for a genuine WordPress site, and every link, even "back to wordpress.com", led to the same unfamiliar domain.
• The link domain's age was the strongest lookup clue. The domain the link first resolved to passed scam-checker sites and blacklists and dated from 2014 behind Cloudflare privacy; the one it redirected to by filming was registered about two months earlier, which the host calls typical of scams.
• The hidden sender address settled it. His ticketing system showed only "WordPress" until expanded, revealing an unrelated, apparently compromised business address; the host's only remedy is to delete it and mark it spam.
• Such campaigns can target any WordPress-WooCommerce site. The host reasons that attackers can scrape sites using both platforms plus a public email address, and harvest logins from the share who click; user education is his answer.

2021-11-16 · open the original ↗

• Caller ID follows a hierarchy across extension, route and trunk. An extension's caller ID overrides the outbound route's, which overrides the trunk's, unless the route's "override extension" is set; trunks in a route's sequence are tried in order, failing over to the next.
• The host normalizes every dialed number to 11 digits. Using the wizard's 7-, 10- and 11-digit patterns (N for 2–9, X for 0–9), he prepends 1272 to seven-digit dials and 1 to ten-digit ones, and adds a +1 pattern because some Yealink phones, at least historically, redialed from history with a plus and would otherwise fail.
• Toll-free callers need their own route with a local caller ID. Most US toll-free providers will not accept calls from another toll-free number, so a company whose outbound ID is toll-free needs a route matching 800, 888, 877, 866, 855, 844 and 833 placed above the default, since the first matching route wins.
• The emergency route is what the host calls the series' most important step. Under Kari's Law and RAY BAUM'S Act every extension must reach 911, and he says the company or even the installer could be held responsible otherwise; flagged as emergency, the route uses each extension's own emergency caller ID, so a home worker's 911 call carries their home E911 address.
• The host's emergency route also covers 933, 988, alerts and recording. It matches 911 variants, 933 (which reads back the provisioned E911 address on Crosstalk SIP, his own firm's trunk service, and other good providers), and 988 for the suicide hotline. It sits at the top of the route list, emails a group on each match, and forces recording, though he notes he is no lawyer on consent rules.

2021-11-09 · open the original ↗

• Start every PBX with a blank catch-all inbound route. Leaving both DID number and caller ID number empty matches any call, making it the route of last resort; more specific routes, by dialed DID or by the caller's number (say, sending VIP clients to a priority queue), take precedence.
• Match the DID in the format your carrier sends. Crosstalk SIP, the host's own firm's trunk service, sends 11-digit numbers by default, so a 10-digit DID will not match; his second route matches 12727700266 and sends it to Jim Halpert's extension while the main number falls to the catch-all.
• Inbound routes can tell staff what kind of call is ringing. Alert info sets distinct ringtones on Clearly, Sangoma and Digium phones (the host defaults to one for internal calls, another for outside ones), ring volume override forces levels 1–14, and a caller ID name prefix like "Sales:" shows which line was dialed.
• Privacy manager stops robocalls with blank caller ID. It intercepts calls without caller ID and asks for a number of up to 10 digits; automated calls never answer, while a human should. External caller ID lookups, such as CRM names, are possible but out of scope.

2021-11-04 · open the original ↗

• The host rates the floodlight a worthwhile Protect add-on. The $99 UP-FloodLight has 550 lumens, motion detection to 5 m (16 ft), 802.3af PoE power and an IPX5 housing; at night it lit his roughly 21 ft (6.5 m) side yard easily, and he estimates effective range at about double that.
• A paired camera's motion also switches the light on. The host did not expect this: his paired camera saw passing cars and lit the floodlight, which he fixed with a motion zone from the fence top down; setup on UniFi OS 2.2.10 and Protect 1.19.2, latest stable at recording, also set a 15-second auto-off and on-motion-when-dark.
• Installation is easier than a camera and drains water clear. The upward-facing PoE port, an overlapping mount lip and a bottom cable channel keep water off the connection, the host says; an angle mount suits siding. Ubiquiti never explains when to use the included diffused cover, which he did not test.
• The host wants three software changes from Ubiquiti. A dim-until-motion mode at about 20–25%, an option to ignore the paired camera's motion, and, most important, a light toggle in the paired camera's live view, missing from both the app and browser at recording.

2021-10-28 · open the original ↗

• The YubiKey Bio adds a fingerprint factor the 5 Series lacks. With a YubiKey 5, someone holding your password and your key can still get in by touching it; with the Bio they also need your fingerprint. Yubico sent the host the USB-A YubiKey Bio ($80 MSRP) and the USB-C YubiKey C Bio ($85), both labelled "FIDO Edition" and supporting FIDO2/WebAuthn and U2F.
• The Bio cannot do one-time codes, so it rarely covers everything. Unlike the 5 Series with Yubico Authenticator, it has no TOTP support, so services without FIDO2 need a phone authenticator app or a second YubiKey. Per Yubico's compatibility list, Google, AWS, Coinbase, GitHub, 1Password and Bitwarden support FIDO2, but LastPass supports only Yubico OTP.
• Enrolment requires a PIN before any fingerprint can be added. It can be done in Windows 10 version 1903 or later, any Windows 11, Chrome 90 or later on macOS, Linux and ChromeOS, or Yubico Authenticator 5.1. The PIN runs 4 to 128 characters; the key stores up to five fingerprints, and the host enrols both index fingers and both thumbs.
• The Bio cannot provide passwordless login to ordinary Windows machines. FIDO2 Windows login works only on clients joined to Azure Active Directory. Yubico Login for Windows uses challenge-response, so it works with the 5 Series but not the Bio, and Windows Hello accepts only TPM-based authenticators. The Bio does work for signing into a Microsoft account on the web.
• The host rates the 5 Series the better value for most people. He sees the Bio as a key for organizations using Azure AD, or for users whose specific apps support FIDO2, and advises checking compatibility before buying. He would like an all-in-one key with TOTP, but suspects it would need a thicker body. The product links are affiliate links.

2021-10-26 · open the original ↗

• The host uses ClearlyIP for complex deployments because of its E911 tools. It is one of Crosstalk's three recommended SIP providers, alongside voip.ms and Crosstalk's own Crosstalk SIP. He picks it for schools and hospitals, praising its uptime and call quality and calling its E911 setup (callback profiles, dispatchable locations, 911 notifications) far better than any he has seen.
• ClearlyIP sets itself up in FreePBX from one key code. You paste the location's key code from the trunking.clearlyip.com portal into Connectivity > Clearly Trunking. This creates four redundant trunks, two in US Central and two in the East, and can auto-configure outbound routes and, if ClearlyIP is your only trunk, inbound routes too.
• Redundancy across carriers works for outbound calls, not inbound. The host recommends several outbound SIP providers, especially when one is metered (billed only per minute used). Inbound numbers cannot really be load-balanced across carriers because one carrier owns each number, though call forwarding offers some workarounds.
• Adjust ClearlyIP's auto-generated dial patterns before going live. The defaults already include 988, the suicide prevention line. The host prepends 1 plus the area code to seven-digit dialling, prepends 1 to ten-digit dialling, and adds a +1 NXXNXXXXXX pattern for phones that redial numbers with a leading plus.

2021-10-26 · open the original ↗

• Crosstalk SIP, the firm's own trunking service, sells US channel bundles. By the company's own figures, five channels cost $69.99 a month with 4,000 minutes and ten channels $129.99 a month with 8,500 minutes. It claims Kari's Law and RAY BAUM'S Act E911 compliance and charges a one-time $50 setup fee, waived if you mention this video. The video carries an ad read for Crosstalk SIP.
• Crosstalk SIP uses IP-based authentication over five redundant paths. Trunks use chan_pjsip, not the deprecated chan_sip, with authentication set to none. The inbound trunk points to 64.136.174.30 and lists the other four IPs under match permit, with port 5060 the default. Status can be checked with asterisk -rvvv and pjsip show endpoints, or in Reports > Asterisk Info > Peers.
• Whitelisting the provider IPs is optional, but the host does it anyway. FreePBX already trusts IPs used by a PJSIP trunk. As a safety net, he adds all five to the firewall's Local zone rather than Trusted, because Local already covers SIP, and also whitelists them under intrusion detection.
• Emergency routes need a correct per-extension 911 caller ID. The emergency route tries the five outbound trunks in order. Ticking "emergency" makes it use each extension's emergency caller ID, so a home worker's 911 call sends responders to the house, not the office. The host's patterns cover 911, the 933 address test, 9-prefixed misdials and 988, and he always forces call recording on this route.
• The default outbound route normalizes every common dialling format. Seven-digit numbers get 1 plus the local area code prepended, ten-digit numbers get a 1, and eleven-digit numbers pass unchanged. The host also adds a leading-plus eleven-digit pattern, because some phones redial with a plus, and uses this by default on all Crosstalk setups.

2021-10-15 · open the original ↗

• Crosstalk's own Cloud PBX sells phones outright rather than renting them. The host argues that RingCentral leases phones monthly for as long as you stay, even after they are paid off. With Crosstalk the customer owns the phones and can take them to another system. Service is month to month with no contract, and setup (call flows, IVR, extension names) is done for the customer.
• Crosstalk's calculator prices a 12-user example at $9,519 over five years. The example has six 250 phones, two 270s, one cordless handset, one conference phone and two softphone-only users. Upfront cost, including setup and shipping, is $2,409. Monthly cost is $118.50 for one number, one toll-free number, 4,000 minutes and 1,000 toll-free minutes, plus taxes the host puts at 15–20%. That gives about $3,831 in year one and $1,422 a year after.
• The host's RingCentral comparison comes to $20,569.20 over five years. It uses RingCentral's annual price of $19.99 per user per month, which he notes is $10 per user cheaper than month to month, for $239.88 a month. Phone rental adds $102.94 a month, with the Cisco 8851, Polycom VVX 350 and Polycom IP5000 ($34 a month) as equivalents. Year one is $4,113.84.
• The host frames hosted PBX vendors as working against customers. He says he structured the Crosstalk Cloud PBX this way because RingCentral, Jive, Vonage Business and 8x8 "are out to rip you off". By his figures, his own product costs less than half as much as RingCentral over five years and is cheaper even in year one.

2021-10-14 · open the original ↗

• POTS lines persist where SIP providers cannot port rural numbers. They connect through an FXO card or gateway; FXS ports are for analog phones and fax machines. A hunt group gives as many concurrent calls as lines, but outbound calls show the caller ID of whichever line they use. The host recommends that mission-critical sites such as schools and hospitals keep one or two POTS lines as backup.
• PRIs make migrating phone systems easy but cost $500–750 a month. A PRI carries 23 voice B channels and one D channel for data such as caller ID. The older T1 had 24 B channels and no caller ID; Europe uses E1s with 30 B and two D channels. PRIs are increasingly delivered over IP circuits, so a provider can often hand off SIP directly, and a fibre cut can take them down.
• SIP providers bill per minute, per channel, or for enterprise circuits. Metered providers (voip.ms, Twilio, ClearlyIP as an option) do not cap concurrent calls. Per-channel providers sell fixed concurrency, like Crosstalk's own Crosstalk SIP, which comes in five- and ten-channel packages with minutes. Enterprise SIP over a dedicated circuit (Level 3, Comcast, Charter) guarantees quality but costs about as much as a PRI. Trunks authenticate by username and password or by WAN IP.
• SIP trunking typically pays back a FreePBX system within a year. The host reports an average ROI of 8 to 12 months for customers moving to SIP. It deploys in minutes, offers the most flexible caller ID options and makes E911 easier. Its downsides are poor internet (wireless ISPs, very rural areas), exposure to outages and often poor provider setup documentation.
• Hybrid trunking lets each line type cover the others' gaps. The host's examples are SIP as primary with POTS as backup, and a PRI kept for domestic calls with SIP used for cheaper international calls. Where a main number cannot be ported, POTS can stay inbound-only while SIP carries all outbound calls under the main caller ID.

2021-10-12 · open the original ↗

• The host believes the G4 Doorbell Pro "leak" is Ubiquiti marketing. He says he is 99.9% sure but cannot prove it. His evidence is that the Lone Wolf DIY channel's 25–26 videos are all about UniFi, its production has been polished since its first upload on March 19, 2021, and its about page says only "some vids may be sponsored". The creator also cites details, such as wiring that works with either polarity, without having opened the documentation.
• Ubiquiti's "legal team" comment did not get the video removed. Ubiquiti posted, then edited, a comment saying its legal team had contacted the creator. Three weeks later the video, with about 5,000 views, was still up. The host says Ubiquiti's early-access terms would make him take down any such video of his own, and he reacts only because the video is public.
• The fingerprint reader and package camera are the reasons to upgrade. The prototype has a USB-C power input beside the doorbell wires, shown fed by a PoE-to-USB-C adapter. The host infers that its screen is the 1.3-inch touchscreen from the UDM Pro and Gen 2 switches, and that this explains the extra power. It also has a downward-facing second camera and an angle mount. He criticizes its large exposed reset button as easy to trigger by accident.
• The host would replace his G4 Doorbell, knowing almost nothing else. He has no price, performance figures or release date, and the device is not yet in the Early Access store; the creator could not adopt it in Protect. He expects that running PoE to his doorbell would mean hiring someone.
• The host calls Ubiquiti's Networking Awesome channel an expensive flop. It launched March 26, 2021, says it is brought to you by ui.com, and used the Reckless Comedy duo (1.06 million subscribers). Its 14 videos mostly drew under 1,000 views, its best 33,000, and he guesses it cost hundreds of thousands of dollars. He argues Ubiquiti should send gear to reviewers such as himself, Tom Lawrence and Linus Tech Tips; the video carries a Private Internet Access sponsorship.

2021-09-30 · open the original ↗

• The FreeStyl 2 uses 900 MHz, not DECT or Wi-Fi. EnGenius rates it at about 25,000 sq ft or six floors through concrete, wood and drywall; the host suggests large buildings or construction sites, but notes the handsets are not rugged and need shelter from weather.
• It is an analog phone, so SIP needs an ATA. The base takes a POTS line on its "line" RJ11 jack (a "tel" jack passes through to an answering machine); to reach a VoIP PBX the host suggests an ATA such as the Grandstream HT802, about $50. The base lists at $349 MSRP and supports up to nine handsets.
• The handset battery ships with a plastic pin protector to remove. The host's handset kept powering off and falsely showing "charge complete" until he found and pulled it. Base and handset both use 5 V 1 A adapters that appear interchangeable.
• In the host's walk test, usable range was about 500 ft. On a call to his cell from a base at his house, audio held to about 720 ft with partial line of sight, began breaking up around 800 ft through houses, trees and a concrete wall, and a call still connected at about 1,400 ft under an underpass. He judges this well beyond the 25,000 sq ft rating.
• The host tested only range, not the other features. Intercom, broadcast, phone book and handset paging exist but went untested; his one complaint is that it is not SIP-enabled out of the box.

2021-09-28 · open the original ↗

• Serve the UCP on its own port to hide the admin GUI. The UCP is reachable at the FQDN plus /ucp, or on a dedicated port; the host recommends disabling the insecure HTTP port 81 and enabling HTTPS on 4443 (secured by the Let's Encrypt certificate), so only 4443 need be opened through a corporate firewall.
• Users log in with their extension and user-management password. The login name defaults to the extension number; a new password takes effect only after Apply Config, and "submit and send email" mails the credentials to the user.
• Widgets and permissions set what each user can see and do. Dashboard widgets include call forwarding, call history, contacts, Do Not Disturb, device management (user button changes override the Endpoint Manager template), Find Me/Follow Me (external numbers end with #) and voicemail; sidebar widgets include a browser softphone. Seeing another extension's call history needs CDR access granted in User Management, then a logout and login.
• New UCP templates finally give users a default dashboard. Previously every user logged in to a blank screen unless an admin set each one up by hand; Sangoma's template creator builds a template from scratch or imports one from an existing user's dashboard.
• Assign the template through groups, not individual users. The host assigns it on the All Users group's UCP tab and shows a user who had never logged in receiving it on first login.

2021-09-24 · open the original ↗

• Assign permissions to groups, never to individual users. The host likens it to Active Directory: do all the work in groups, even single-member ones, because per-user permissions get too messy. Extensions don't need a user at all (a break-room phone); one is created from the extension's User Manager settings, by default with the extension number as username.
• Turn off "send email upon new user creation" before staging. Crosstalk often configures a PBX days or weeks ahead of cutover, and the default can email users their UCP credentials before they should see them.
• Group priority decides conflicts; ties go to the most permissive. A priority-1 group's rules override a priority-5 group's; at equal priority FreePBX applies the most permissive set.
• Groups can grant scoped admin GUI access. An admin can be limited to certain modules (a reports-only login) or an extension range (a per-building administrator on a campus). Other tabs gate Clearly Anywhere softphones, phone apps and VPN; the host suggests a softphone-users group so licences are granted by membership.
• The host disables FreePBX faxing on every install. He strongly recommends against faxing through FreePBX, and leaving it on raises periodic dashboard errors. UCP tabs grant access to other extensions' voicemail or call records (a manager, a CEO's assistant), and a user who can't do something is usually a permissions problem.

2021-09-18 · open the original ↗

• The host expects the Dream Router to make the original UDM obsolete. Reacting to Ubiquiti's announcement video (the device was not yet in early access), he sees it bridging the UDM and UDM Pro, and guesses 6–12 months from early access to general availability.
• Its upgrades are Wi-Fi 6, two PoE ports and a throughput display. The built-in 4x4 access point moves from Wi-Fi 5 to 6, which he thinks small homes will barely notice; the two ports appear to be standard PoE, not PoE+, enough for an extra access point or a couple of cameras.
• The 128 GB SSD is too small for real Protect use. He reckons it holds about five to seven days from a couple of cameras and suspects it is a sales tool to move buyers to a UNVR; he warns against the SD expansion slot because camera recording is write-heavy and SD cards wear out.
• "Connect" may be an IoT hub, the host speculates. The video shows a UniFi Connect app; citing online digging that found Sonos and Ecobee references, he guesses a Home Assistant-like controller, without inside knowledge.
• He rates it a good entry point that buyers will outgrow. It covers Network, some Protect and Access from one device, but he expects enthusiasts soon to add PoE switches and other UniFi gear.

2021-09-07 · open the original ↗

• Free softphones stop being worth it past about five to ten users. The host cites installing on mixed devices, handing out SIP server, username and password, and staff leaving with working credentials. He prefers Clearly Anywhere, which provisions by QR code, never shows users their SIP credentials, and is revoked by removing it from the extension.
• Clearly Anywhere licences cost $15 per user per year. Crosstalk sells them through its own store. A registration token activates the module; mobile and desktop are licensed separately, and his licence was mobile-only.
• API status "contact support" usually means port 2267 or the certificate. Clearly IP opens port 2267 in the FreePBX firewall itself, but Clearly Anywhere must be set to the Let's Encrypt certificate and HTTPS, and a corporate firewall must forward 2267. A first-time setup may need the connection URL (WAN IP on 2267) and PBX domain given to Clearly IP.
• Users enable it by scanning a QR code in the UCP. The admin enables the softphone on the extension, sets a UCP password and applies config; the user adds the softphone provisioning widget and scans it, and *43 runs an echo test.
• Any SIP softphone needs only server, username and password. For Zoiper (free, or about $49 one-time paid, the host thinks), he enters the FQDN, extension number as username and auth username, and the extension's secret.

2021-09-02 · open the original ↗

• Any SIP device registers with three facts. For one-off devices that can't zero-touch provision (paging systems, video door phones, the host's Yealink T58A), you need the PBX IP or FQDN, the SIP username (the extension number) and the SIP password (the extension's "secret"), with server port 5060.
• Keep FreePBX's long default SIP password unless the device can't. The host has had to truncate it to 16 characters or fewer for some legacy equipment that otherwise would not register despite correct settings.
• Change the device's default web password first. Yealink's factory login is admin/admin; auto-provisioning sets this for you, manual setup does not.
• Registration alone leaves voicemail and BLF keys unset. He enables MWI with *97 (own mailbox; *98 is for another user's) and adds BLF keys that turn red when the watched extension is on a call and double as speed dials.
• The host urges auto-provisioning for any sizeable fleet. With manual setup, changing a BLF key means visiting every phone, whereas Clearly Devices or Endpoint Manager pushes a template change to all of them.

2021-09-01 · open the original ↗

• Tune Protect alerts down, because too many get ignored. The host's example is a camera seeing passing cars: constant push alerts train the owner to dismiss the one that matters, so enable alerts only on the cameras and events where they are useful.
• Custom schedules suit after-hours motion alerts. For a retail shop open 8 a.m. to 6 p.m., he schedules motion alerts only outside business hours; the schedule editor is clunky, with blocks clicked and deleted one at a time.
• Use separate alerts for different purposes. He builds an after-hours motion alert plus a 24/7 email-and-push alert for camera connect/disconnect, since a camera knocked offline in daytime needs immediate notice. Email goes to the inbox and push to the Protect app; smart detections were available on G4 cameras but not the G3 Flex.

2021-09-01 · open the original ↗

• Protect roles limit a user to specific cameras. The host creates a "second floor cameras" role with view-only rights to two cameras, for cases such as a manager who should see only their own building on a multi-building campus.
• Users are created in UniFi OS, not in Protect. One user can then hold permissions across Protect, Network, Access and Talk; he makes a limited admin with local-only access (login via the UDM Pro's IP rather than a Ubiquiti cloud account) and sets the other applications to none.
• Remove the default view-only role, or the user sees everything. View-only stays selected when the custom role is added and grants all cameras; with it removed, the test user saw only Protect, only the two cameras, and no settings rights.
• The restricted view is consistent but misreports storage. Live views, detections and time-lapse showed only the two cameras, and the user could set their own alerts for them, but storage utilization showed those two filling 100% of a four-camera system.

2021-08-26 · open the original ↗

• Default settings fill a terabyte surprisingly fast. The host's UDM Pro, with a 1 TB drive and four cameras (one 4K, three 1080p) on default settings, reached 100% storage at just under a week of recording, roughly a week per terabyte for four cameras; recording quality and frame rate move that up or down.
• Live views are what most users will actually watch, so design them deliberately. Custom views can be shared with other Protect users, shown full screen, or sent over HDMI to a TV through the UniFi Protect Viewport, which is how the host shows his cameras in his office. Several cameras can share one tile and cycle either on detected motion or on a timer of 6 to 60 seconds.
• Detections gives a filterable list of every event. Events are marked as motion, person, vehicle or doorbell press and can be filtered by type and by camera. Each clip can highlight where the motion was, change playback speed, take a snapshot or be downloaded.
• Timelapse lets you scrub history and export an exact clip. Dragging the timeline scrubs through footage, with blue dots marking motion events, and zooming the timeline gives finer control. The download tool stretches a selection over the precise span wanted (the host cut 2:35 to 2:38 pm for a mail-truck visit) and saves it as an MP4.

2021-08-24 · open the original ↗

• Endpoint Manager is free only for Sangoma and Digium phones. Provisioning other brands such as Yealink, Snom, Polycom or Cisco needs the paid Endpoint Manager licence, $145, which the host points to in the Crosstalk Solutions store. The video also carries a sponsor segment for NextGenT, an online IT school.
• Force phones to provision over HTTPS before building anything. In System Admin port management the host leaves HTTP provisioning on port 84, turns on HTTPS provisioning on 1443 (the Sangoma default) and secure phone apps on 4443, then sets provisioning authentication to HTTPS only. Endpoint Manager's internal and external addresses can both be the same FQDN on a hosted PBX.
• Use the two firmware slots to stage firmware on test phones. Firmware from 1.35 to 1.66 was available for the S series; the host drags the latest into slot one, and suggests slot two for trying a new release on a few phones before rolling it out.
• Build one template per phone model, starting from a duplicate. Model-specific details such as the background image's pixel size are why; his S500 template also works for the newer S505. He blanks the cluttered default button set, sets BLF long-press to *80 for intercom, and notes that extension-mapping rows turn yellow after template changes until configs are rebuilt.
• Sangoma's free redirect portal makes factory-default phones find your server. At portal.sangoma.com the PBX is found by deployment ID and given its protocol, FQDN, provisioning credentials and port 1443, then the phone's MAC is pointed at that deployment. A factory reset (menu password "admin" before provisioning, 222222 after) produced a registered phone with updated firmware in about two minutes.

2021-08-24 · open the original ↗

• Crosstalk phones are rebranded ClearlyIP phones and need ClearlyIP's module repository. The host, whose firm brands these phones, "highly suggests" them and cites a two-year warranty; the Crosstalk 270 is the ClearlyIP CIP270. FreePBX must be switched to ClearlyIP's repository for the Clearly Devices, Trunking and Anywhere modules to run without dashboard errors.
• Create a hot-desk default even if you never hot-desk. The host says new E911 rules require a logged-out phone to still be able to dial 911, so he assigns an unused extension, 9999, as the logged-out default.
• Use the FQDN everywhere rather than an IP address. If the server is restored from backup onto a different IP, only the DNS A record has to change and every phone follows. Provisioning runs on port 2580 and phone apps on 2579 over HTTPS with the Let's Encrypt certificate; the firewall did not add 2579 automatically, and on-premises PBXs behind a corporate firewall also need those TCP ports forwarded.
• Keep general settings and button layouts as few templates as possible. The settings template carries the phone admin password, 920383 by default (ClearlyIP's Appleton, Wisconsin area code and prefix), a dial timeout cut from four to two seconds, and BLF long-press set to *80 so holding a key intercoms that user. The model layout sets line keys, a voicemail app key and up to six expansion modules.
• ClearlyIP's free redirect server completes zero-touch provisioning. At devices.clearlyip.com a location holds the server's FQDN, protocol, port and credentials, and each phone's MAC is mapped to it with redirection enabled. After a factory reset the phone registered as extension 200 in about two minutes, which the host says lets phones be drop-shipped ready to plug in.

2021-08-24 · open the original ↗

• Zero-touch provisioning chains a vendor redirect server to your own PBX. A factory-default phone takes its IP, gateway and DNS, then asks its maker's redirect server where to get its configuration, giving its MAC address. The redirect server returns the PBX's WAN IP, FQDN or even a LAN IP, plus port and credentials; the PBX serves the config tied to that MAC, and the phone applies it, reboots, updates firmware if needed and registers.
• ClearlyIP and Sangoma redirect servers are free; Yealink's needs a reseller. Crosstalk phones (rebranded ClearlyIP units, which the firm sells) use devices.clearlyip.com and Sangoma uses portal.sangoma.com, both open to anyone who signs up. Yealink, the other brand Crosstalk recommends, uses dm.yealink.com, which requires access granted through a distributor or reseller.
• Redirect servers let phones be drop-shipped straight to customers. Because distributors can supply a phone's MAC address at purchase, the phone can be configured on the redirect server and PBX before it arrives, so the customer only plugs it in.
• Factory-defaulting a misbehaving phone is a quick fix. The host says a reset sends the phone through the whole provisioning process again, which solves a lot of phone problems at customer sites.

2021-08-18 · open the original ↗

• Leave image settings default unless the picture needs fixing. The host keeps lens distortion correction on and notes that changing HDR resets the stream. The IR options now include "filter only, no LEDs", which engages the IR cut filter for sites using an external illuminator; auto-rotate or manual flips handle upside-down mounts such as a G3 Flex.
• Mix recording modes to stretch limited storage. Cameras can record always, never, motion events only, or smart detections only; for a small retail shop he suggests motion-only inside and always-on for the front door and cash register. High frame rate mode gives more than 24 fps but disables 4K and HDR and lowers image quality.
• Require sustained motion before triggering, and pad each clip. His usual settings are two seconds of motion to trigger an event and five seconds recorded before and after, so birds and other brief movement are ignored. Motion and smart-detection zones confine detection to part of the frame, such as cutting out a tree swaying over a walkway.
• Privacy zones black out areas that must never be recorded. Unlike motion zones they remove that part of the image entirely; he advises checking local rules on recording, for example, a neighbour's yard. He also turns off status lights such as the G4 Pro's spinning blue LED so outdoor cameras are less conspicuous.
• RTSP streams feed third-party viewers and NVRs. High, medium or low streams each produce a URL, which he plays in VLC and uses for a Raspberry Pi quad-view display; his preferred overlay shows camera name and time but not the UniFi logo or bitrate. The video carries a sponsor segment for Private Internet Access VPN, which he calls his own VPN and partner.

2021-08-18 · open the original ↗

• Protect shows updates but installs them from UniFi OS. At recording the host ran Protect 1.19.0 on UDM Pro version 1.10.0; the Protect settings page flags an available update, but it is applied from the UniFi OS settings.
• Smart detection of people and vehicles needs newer cameras. It works only on G4-generation cameras and later; once enabled in general settings, smart detections appear as separate clips marked with person or car icons, distinct from plain motion events.
• Without time-based deletion, Protect records until the disk fills. It then overwrites the oldest footage; the host suggests a time limit (his example is 60 days) where local rules restrict how long surveillance video may be kept. He leaves daily backups on but says to download the backup file periodically.
• Access points can bridge Bluetooth Protect devices not yet released. A linked-bridge setting lets U6 Lite and U6 LR access points discover and auto-adopt Bluetooth devices such as the UP Sense, then in early access; he says he has not tried it and is going only by the setting's description.
• Adopted cameras update their firmware automatically. Factory-default cameras on the network appear under add devices, and "find more devices" adds one on another VLAN; his G3 Flex, G4 Bullet, G4 Dome and G4 Pro all updated on adoption. He advises keeping live view at 720p and saving 4K for a 4K monitor, given the extra bandwidth. A sponsor segment for NextGenT runs mid-video.

2021-08-12 · open the original ↗

• A fake university buyer nearly walked off with a large hardware order. Over 23 days a "director of procurement" posing as Clemson University obtained net 30 terms and a purchase order for 104 phones and 18 Yealink CAM50 cameras, almost $10,000, shipped to Sayreville, New Jersey. Crosstalk placed the order; next morning Andy, its salesperson, found Clemson's fraud alert online, and the distributor stopped the shipment before it left the warehouse.
• Each red flag was easy to miss alone. The host lists them: an unsolicited large order for items Crosstalk does not sell, broken English that did not fit the name and location, and the domain clemsonedu.school rather than clemson.edu, which he calls the biggest clue. Others were two-digit phone extensions at a large university, email disclaimers steering everything to email, and a New Jersey ship-to against a South Carolina billing address.
• Convincing paperwork proved nothing about who sent it. Less than two hours after the request, the scammer returned a completed net 30 application, a W-9, a tax-exemption certificate and credit references that all looked legitimate. The host notes EIN and DUNS numbers are public and suspects the rest was found online or leaked in a breach; Clemson's procurement office confirmed the order was not theirs and that the scheme was known.
• Tracing the scammer reached only dead ends. The domain was registered on 14 May 2021 through Namecheap with private registration, and Namecheap acknowledged an abuse report without promising follow-up. The ship-to address belongs to a freight forwarder that reships to Nigeria, which the host declines to name, judging it most likely to be looking the other way; a Grabify tracking link he sent the scammer had not been clicked as of recording.
• Call the number and train the people who buy and pay. The listed number went straight to a generic Asterisk voicemail, which the host says would have been telling had they called before the order. He cites a figure of 70% or more of compromises and successful scams arriving by email, and urges briefing purchasing and accounting staff.

2021-08-06 · open the original ↗

• Build extensions on PJSIP, never chan_sip. FreePBX now labels chan_sip "Legacy"; the host says it is deprecated and that newer Asterisk versions do not even compile it in without a rebuild. PJSIP runs on port 5060, and an extension does not exist for a phone to register against until Apply Config is clicked.
• Choose extension numbers that cannot collide with feature codes. The host wants at least three digits and none starting with 1: extensions such as 101 collide with feature codes: *1 toggles on-demand recording, while transferring to someone's voicemail is * followed by their extension, so the system cannot tell which is meant. He starts at 200.
• Set an emergency caller ID for anyone working away from the office. E911 must send the phone's actual physical location, and a home worker dialing 911 with the office caller ID would send responders to the office, possibly in another state. Outbound caller ID, by contrast, can be left blank to inherit the trunk or route default.
• Voicemail defaults trade convenience against security and lost messages. A PIN equal to the extension forces the setup wizard on first access, useful when an extension passes to a new employee; "require from same extension" makes *97 ask for a PIN. Deleting voicemail after emailing it is tidy, but FreePBX deletes it even if the email never arrives.
• Raise max contacts for multiple devices, and bulk-load by CSV. The default of one contact allows a single device per extension; he raises it to five so desk phones and softphones ring together. On-demand recording (*1) is off per extension by default, and above about 10 extensions Crosstalk uses Bulk Handler CSV import. Sponsor voip.ms is one of three SIP providers Crosstalk recommends to clients.

2021-08-04 · open the original ↗

• The UDM Pro's WAN must hold a routable public IP for client VPN. The host says the ISP connection should be in bridge mode so the real static or dynamic address sits on the UDM Pro's outside interface, avoiding double NAT; otherwise you must port-forward through to it. With a dynamic address, he suggests a dynamic DNS name in the client instead of the IP.
• The series covers only L2TP client VPN, the sole remote-access option offered. Site-to-site VPN is left out because UniFi-to-UniFi, EdgeRouter or Cisco variants all differ. Setup is a new network set to remote access, with a pre-shared key, the hosting WAN, the default RADIUS profile and a user list; his VPN subnet was 192.168.2.0/24.
• Sending all traffic through the tunnel is the simple default. On the iPhone he leaves "send all traffic" on, because sending only UDM Pro-bound traffic needs extra routing rules. Over LTE the phone took 192.168.2.6, showed his static WAN address ending .29 as its public IP, and reached the UDM Pro by direct rather than cloud connection.
• The default client VPN is fairly wide open. He notes that firewall rules are needed to stop VPN users from seeing other networks, beyond this basic setup. The video carries a sponsor segment for voip.ms, one of three SIP providers Crosstalk recommends to clients.

2021-08-03 · open the original ↗

• The UDM Pro offers dual-WAN failover only, not load balancing. The load-balancing setting has just one choice, "failover only", which the host reads as a hopeful sign that Ubiquiti may add balancing later in software.
• The second WAN plugs into the SFP+ port. That port is 10 Gbps; he used a plain SFP module with LC-to-LC fiber because he had no spare SFP+ modules, and notes a DAC cable or an RJ45 SFP module also works. WAN2's advanced settings cover a separate DNS server, an ISP VLAN ID, MAC cloning, smart queues, static addressing and expected speeds.
• Failover and failback each dropped only a ping or two. Pinging 1.1.1.1 at about 14 ms, pulling WAN1 produced two timeouts before traffic resumed on WAN2, and reconnecting it switched back within a few seconds with one drop. His lab used NAT'd addresses on both WANs; in production they would ideally be routable.
• The interface misreports which WAN is active during failover. Rather than flagging WAN2 as in use, the dashboard showed WAN2's address under the primary WAN, which the host calls misleading.

2021-08-02 · open the original ↗

• The new camera is a ceiling-hung fisheye with digital pan-tilt-zoom. Ubiquiti's announcement video presents the AI 360 as a 360-degree digital pan-tilt-zoom camera with enhanced person and vehicle detection, microphone and speaker, infrared, PoE power and two interchangeable bubble lenses. $299 is the early-access price, which the host notes may change; he has not used one and says early-access status would bar him commenting on its function anyway.
• Leaving it zoomed in could miss events elsewhere in the room. No Ubiquiti AI camera yet auto-zooms onto detected people, the host says, so a camera left in PTZ mode records only where it points. He would like it to revert to 360 view after inactivity, or always record 360 and allow PTZ on playback, but does not know whether it does.
• He doubts the speaker and the second lens are useful. Previous Ubiquiti two-way cameras had weak speakers, and this one would sit 8 to 15 feet up or more. He cannot see why a non-weatherproof lens is included when the tamper- and weather-resistant one would seem good enough, though suspects the larger clear dome may affect the view.
• Comparable 360 cameras all cost more. The AI 360 is 5 MP and 1920x1920 in 360 mode; the Axis M3067-P is 6 MP, 2016x2016 in 360 mode and up to 60 fps for $469. Hikvision's 6 MP models run $380 to $550 at 30 fps, and a 5 MP Dahua with IP67 and IK10 ratings costs just over $400, each before any NVR.
• Protect's polish is the trade for proprietary hardware. Compared with NVRs such as Blue Iris, which he runs on a test server, the host finds UniFi Protect a more seamless experience. The cost is that it cannot be installed on your own server, which he says is also what lets Ubiquiti control and refine it.

2021-07-22 · open the original ↗

• FreePBX ships with no default backup, so you must build one. The host calls Sangoma's removal of default backups astounding; setup takes two parts, a File Store location (local, FTP, Dropbox, SSH or Amazon S3) and then a job in the Backup and Restore module. The SSH store exists for primary/warm-spare setups, which Crosstalk offers to set up for clients.
• A local backup alone is not enough for production. If the drive crashes, the local copies go with it. For both hosted and on-premises clients, Crosstalk keeps a local backup plus an off-site FTP copy on its own servers, and keeps three monthly and three weekly backups.
• Path variables take double underscores, and backup names should become subfolders. The local store points at the spool variable plus /backup (/var/spool/asterisk/backup). Turning on "append backup name as a directory" keeps monthly and weekly jobs in separate subfolders. Retention is set by "delete after runs" (3 keeps three months; 0 never deletes) or by age in days.
• Email on both outcomes at first, then switch to failure only. Inline logs put the backup log in the email body. Once backups have proven reliable, the host only wants to hear about problems. Leave all modules selected unless you know otherwise; add custom folders such as custom sounds or TFTP phone configs and firmware if needed.
• The rewritten module restores backups made on older versions. The module was rewritten in FreePBX 15; earlier releases could only restore onto the same version; the host says cross-version restores from 12, 13 or 14 work pretty well. His near-empty test server produced a 53 MB tar.gz, and backups in the configured File Store appear automatically under the Restore tab.

2021-07-20 · open the original ↗

• IoT devices belong on their own network, away from the main LAN. They phone home to vendor clouds and could be compromised, so isolating them both controls what reaches out and protects the computers holding photos and documents. The host puts every IoT device in his house there, and suggests a separate network for cameras on the same pattern.
• Firewall rules needed the classic UniFi interface at recording time. The IoT network is a corporate network (not guest) on VLAN 20, 192.168.20.0/24, with DHCP widened to .2–.254 and DNS 1.1.1.1 and 9.9.9.9. Its SSID is WPA2 only, since most IoT devices cannot do WPA3, and optionally 2.4 GHz only to spare the 5 GHz band.
• Ordered LAN In rules block inter-VLAN traffic but spare the LAN. First allow established/related; then allow the main LAN to an RFC 1918 address group (192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8); then drop RFC 1918 to RFC 1918. An existing ping kept working until the 30-second ICMP state timeout expired, because of the established/related rule.
• LAN In rules do not stop access to the gateway itself. The IoT network could still ping and open the UDM Pro's UniFi OS at 192.168.1.1. LAN Local drop rules block IoT and guest networks from the other networks' gateway addresses, using per-network address groups.
• Block only the management ports on a network's own gateway. Blocking 192.168.20.1 outright would kill IoT internet access, so the host drops IoT traffic to an all-gateways group on a port group of 80, 443 and 22. He leaves ICMP open for testing; allowing access to a Pi-hole on the main LAN is left out of scope.

2021-07-20 · open the original ↗

• A simple guest network works entirely in the new UniFi interface. The host creates it on VLAN 10 as 192.168.10.0/24, turning off auto-scale network so he can set the subnet and start DHCP at .2. Optional manual DNS (1.1.1.1 and Quad9, or a subscribed service such as OpenDNS) adds content filtering for guests.
• Device isolation is what actually walls guests off. Before it was enabled, his phone on the guest Wi-Fi could ping his main-LAN computer at 192.168.1.144 and the UDM Pro at 192.168.1.1. Enabling it adds a restricted-access list of all RFC 1918 ranges, after which guests reached only the internet, not even their own gateway at 192.168.10.1.
• UniFi bandwidth profiles cap each wireless client, not the network. A "crosstalk guest" profile of 10 Mbps down and 10 Mbps up applies per client on the guest SSID and does not affect wired clients; a speed test showed the cap working. The host wishes UniFi offered an aggregate cap for the whole guest network instead.
• Businesses should schedule guest Wi-Fi to business hours. He recommends it so nobody parked outside can use the connection after hours, especially for passwordless guest networks. Security is set to WPA2/WPA3 mixed mode because his access point is Wi-Fi 6 capable.

2021-07-15 · open the original ↗

• A well-designed tech pouch is the bag's best item. The host's Peak Design Tech Pouch is water resistant, with hand straps underneath for one-handed access and an internal pass-through so a power bank inside can charge a phone in the side pocket. He used that more than expected on his first business trip in over a year, a training in Appleton, Wisconsin.
• He loves one travel router and refuses to recommend another. His GL.iNet Slate rides in a hard case made for the TP-Link AC750 travel router, which he calls absolutely horrendous; he scrapped a planned review of it. Retractable Ethernet cables (a two-pack for under $10) and tough nylon USB cables suit a bag that gets knocked around.
• One brand supplies all his power banks and chargers. It is Anker: the PowerCore 10000 costs $21.99 and the 20000 mAh PowerCore Essential $42.97; the 20 W Nano charger is $16.99, and the 60 W PowerPort Atom III is $37.99 in white or $39.99 in black, as of recording. He says the banks charged his iPad without trouble.
• Bring a streaming stick, plus a flexible HDMI jumper. Both the Amazon Fire TV Stick ($47.49) and the Roku Streaming Stick+ ($49) got past hotel Wi-Fi captive portals and keep your logged-in apps; he prefers Roku from familiarity. Some hotel TVs physically cannot take a stick in the HDMI port, which has happened to him.

2021-07-13 · open the original ↗

• Several FreePBX services need a valid certificate on a real FQDN. The host lists WebRTC, Sangoma's Zulu and Connect, and Clearly Anywhere. He uses Let's Encrypt because it is built into FreePBX, though your own certificates also work.
• Move the plain-HTTP admin GUI so Let's Encrypt can take its port. He moves plain-HTTP admin to 8080 (which can then be kept closed at the firewall) and assigns port 80 to Let's Encrypt. He argues port 80 open this way is not a risk: it serves only the files Let's Encrypt checks to verify the server.
• FreePBX's firewall opens the challenge port only during renewals. The responsive Let's Encrypt rules allow temporary access to the ACME challenge folder during an update. Let's Encrypt always challenges on port 80, so requests fail if an upstream firewall blocks it without redirecting; a forward can stay open permanently.
• Generating the certificate is not enough; install it. After creating it under Certificate Management, where it renews automatically about every two months, make it the default. Then select it under System Admin's HTTPS Setup and click install before the server actually uses it.

2021-07-13 · open the original ↗

• FreePBX has two update types, each runnable from GUI or SSH. System updates patch the base Linux OS; module updates patch the FreePBX software. The host's scheduler applies only security updates automatically and leaves everything else notification-only.
• System updates can take the PBX offline; module updates usually do not. In the GUI his check found 18 system packages, and module updates are typically safe to run in production.
• The host prefers SSH because the GUI handles dependencies poorly. He says the GUI gives little feedback and does not resolve dependencies between modules, while the command line does. Over SSH as root, yum update -y handles system packages (under a minute for him) and fwconsole ma upgradeall handles modules (about 11 minutes for 66).
• fwconsole restart drops calls, so use a maintenance window. He restarts services after a major update, which brings Asterisk down and disconnects calls in progress. Re-running both commands should then report nothing to update, followed by Apply Config in the dashboard.

2021-07-08 · open the original ↗

• A replacement PoE injector did not fix the link-speed fault. The dish kept falling back from gigabit to 10/100, capping throughput at 100 Mbps. The injector RMA was placed May 27, 2021 and arrived June 11; the problem returned after 5–10 hours instead of minutes.
• Starlink's slow RMA shipping would hurt users relying on it. The host notes 15 days for the injector and wants an option to pay for expedited shipping. Starlink did approve a new dish without question on June 25, and it arrived July 2, a week later.
• The new dish appears to have fixed the problem, so far. The next day his port showed a gigabit link, with about 200+ Mbps through his Starlink VLAN to an EdgeRouter X and about 246 Mbps over Starlink's router Wi-Fi; he will keep watching it. The new unit has a smooth face and grey cable and stand, and its cable still cannot be detached.
• The host is skeptical Starlink's economics can work. Citing estimates of $2,000+ per dish sold at $500 and 42,000 satellites at $250,000–500,000 each, he figures his two dishes leave about a $3,000 loss after about $1,000 paid ($500 plus $100 a month since February). He admits this oversimplifies, and worries more users could cut speeds and raise latency.

2021-07-06 · open the original ↗

• WAN settings need changing only for unusual connections. Plain DHCP from the ISP needs nothing; the advanced settings are for a static IP or a block of statics, PPPoE credentials, or internet delivered on a VLAN. The host says the series applies broadly to a USG or a cloud- or PC-hosted controller, not just the UDM Pro.
• Threat management trades throughput for protection. IDS only alerts; IPS blocks and costs more CPU and RAM. Sensitivity levels run from 6 of 35 categories at level 1 to 35 at level 5 (17 at level 3). His roughly 700 Mbps connection should cope, but he advises speed-testing after enabling it.
• Turn off auto-scale network to control the LAN subnet. With it on, the new dashboard hides the gateway IP, subnet and DHCP pool. He sets DHCP to 192.168.1.50–254, keeping .2–.49 for static addresses; the classic interface has no auto-scale setting at all.
• Leave automatic firmware updates off for networks managed for others. He waits to see whether a firmware release is stable and updates in maintenance windows; home users who care less might enable automatic updates.
• Use WPA2/WPA3 mixed mode and keep 2.4 GHz enabled. Not every client or access point does WPA3, and older IoT devices need 2.4 GHz. For the open guest Wi-Fi he set up at real-estate offices, he combined bandwidth limits with a Wi-Fi schedule so it ran only during business hours.

2021-06-29 · open the original ↗

• Unless eth0 is in the Internet zone, the firewall does nothing. Out of the box eth0 sits in "trusted, excluded from firewall", so every rule on the Networks tab is moot. The host then lists each allowed LAN (in CIDR form), VPN subnet and remote WAN IP under Networks, with a description for each ("Bob's home IP"). He prefers the Local zone, which opens only FreePBX's ports, over Trusted, which opens everything, though FreePBX wants at least one trusted entry.
• A double reboot opens a window to undo a firewall lockout. Rebooting twice within five minutes is the safety net: if a mistake on the Networks tab locks you out, the second boot comes up with the FreePBX firewall disabled for five minutes so you can fix it. On a hosted server that means forcing two restarts from the provider's console; on bare metal, pulling the power twice. The host says this has happened to him.
• The host treats the responsive firewall as a last resort. Remote staff on dynamic home IPs can be allowed by dynamic DNS name, but DNS time-to-live can leave FreePBX an hour or more behind an address change. Responsive firewall lets every non-blacklisted address send a few packets, so valid phones authenticate, and jails brute-force attempts for growing periods. He calls it effective, but leaving it off is more secure.
• Sysadmin Pro is mandatory on every FreePBX system Crosstalk installs. It costs $25 once, on what the host thinks is a 25-year licence (his showed expiry in 2046), and is tied to the deployment ID. It adds the built-in VPN server, email/SMTP setup in the GUI and dynamic DNS. It is bought from Module Admin with a Sangoma portal login.
• Whitelist your own addresses in intrusion detection. Intrusion detection works alongside the firewall and had already banned an attacker's IP on his test server, since scripts scan WAN addresses constantly. He also sets a real FQDN hostname instead of freepbx.sangoma.local and disables PnP, which doesn't work hosted. A time-zone change, which time conditions depend on, needs a reboot.

2021-06-29 · open the original ↗

• Set module updates to email-only but security updates to automatic. A module update that breaks something, such as one not properly QA'd, can leave you facing a dead PBX in the morning with no idea why. Email-only lets you install in a maintenance window, while a zero-day security fix should go on at once. Update checks run at a random time between midnight and 4 a.m. so millions of servers don't hit Sangoma at once.
• Activate the server, because commercial modules attach to its deployment ID. An unactivated FreePBX cannot install commercial modules, and activation needs a free Sangoma portal account. The deployment ID can be moved to a new server or hosting provider, so modules already bought, even Sysadmin Pro, are not lost.
• The host updates through SSH, not the GUI, because SSH resolves dependencies. In the GUI, a module that depends on another forces repeated check-and-update rounds until everything is current; a single SSH run handles it in one pass. He therefore skips the pile of updates offered right after activation.
• On a hosted server, trust only your own IP. The firewall wizard offers to trust the client and then its whole network. Trusting the /24 of a WAN address would let neighbours on the same range reach the login GUI. On a local install, trusting the LAN subnet is usually fine because the phones live there too. He also avoids "admin" as the GUI username, since countless devices use it.
• One Apply Config click covers many changes. The red button appears after almost every edit, but it can be clicked once after a batch of work.

2021-06-24 · open the original ↗

• The UDM-Pro's built-in switch has no PoE. Powering a UniFi access point therefore needs either a PoE injector on a UDM-Pro port or a PoE switch; the host uses a USW-Pro-24-PoE, adopted with one click and then updated, which takes about five minutes including the reboot.
• A solid blue ring means the device belongs to another controller. His U6 Lite showed solid blue, meaning it had already been adopted elsewhere, so he held reset with a paper clip for about 10 seconds. Once reset it showed a solid white ring and could be adopted, after which the ring turned blue again.
• The host avoids leaning on the classic dashboard. At the time of recording, the new UniFi Network dashboard lacked settings he needs, so he expects to switch between the two. He prefers the classic one but tries to use the new one wherever it works.

2021-06-24 · open the original ↗

• The host rates the UDM-Pro for homes, not businesses. For a business he would rather have more robust gear with more redundancy built in. At $379 it is a UniFi OS console that can run UniFi Network, Protect, Access and Talk as separate applications, whereas the standard UDM runs Network only.
• The UDM-Pro cannot be set up without a cloud login. The wizard demands a ui.com account and allows no local login, a point the host calls contentious, so he strongly urges two-factor authentication (he uses a hardware key). Before turning off remote access via unifi.ui.com, he says, create a local-access-only super admin, as he does at the end.
• The host disables automatic updates and turns on SSH. SSH is his way back in if an application update crashes an app and it has to be rolled back to an earlier version. As of recording he was on UniFi OS 1.9.3, UniFi Network 6.1.71 and UniFi Protect 1.17, updated to 1.18.1.
• Scheduled backups survive a factory reset. The wizard offered him backups taken before he reset the unit, so he recommends keeping scheduled backups on; he moves his from Monday 12 a.m. to Sunday 1 a.m.
• Choosing "personal" or "business" setup changes nothing the host could find. He installed both ways and saw no difference beyond extra questions about the business. For Protect storage he recommends a surveillance drive such as a Seagate SkyHawk or WD Purple, sized to the cameras and recording quality.

2021-06-22 · open the original ↗

• Vultr's ISO library gives a one-click FreePBX install. The host picks the newer of two FreePBX images there (version 2011-5), older than the freepbx.org download but equivalent once updated, and a location close to the users. He asks viewers to use his Vultr referral code, which he says gives up to $100 of credit; DigitalOcean and AWS are mentioned as alternatives.
• The host sizes a 20-extension office at the $20-a-month server. The $5 or $10 a month tiers are enough for testing; he demonstrates on $10. Vultr's auto backups, about $2 a month more, are worth turning on in production, but they are snapshots on the same host and are lost with it, so separate off-site backups come later in the series.
• Point a DNS A record at the server before going further. A valid FQDN resolving to the server's IP matters for the Let's Encrypt certificate, WebRTC and remote softphones, and he names the Vultr server after its FQDN to keep many servers straight.
• Remove the ISO in Vultr instead of pressing Reboot. After the 30–40 minute automated install, the virtual ISO is still mounted like a thumb drive. Removing it under the server's settings triggers the reboot itself, and the server then comes up at the initial setup wizard over HTTPS with a certificate warning.

2021-06-22 · open the original ↗

• Any Linux-capable PC will run FreePBX for learning, but not production. For production the host wants something more robust, and installs on the Crosstalk 710 appliance his firm sells. He says it handles up to 100 phones or 30 concurrent calls, is fanless, and comes like all Crosstalk servers with a 2-year warranty and FreePBX pre-installed.
• Start the ISO download early because Sangoma's servers are slow. The full ISO, the 64-bit Sangoma 7 PBX build released in April 2021 at recording, can take a couple of hours to come down from freepbx.org.
• Triple-check the target drive when flashing the USB stick. He writes the ISO with balenaEtcher to a 32 GB stick (he thinks at least 8 GB is needed), warning that picking the wrong device, such as his 12 TB backup drive, would erase it.
• The installer asks only for a root password, then runs itself. With a network cable attached it also updates FreePBX, taking about 30–40 minutes. Pull the stick at reboot, then browse to the DHCP-assigned address shown at the console login to reach the setup wizard.

2021-06-18 · open the original ↗

• Pick on-premises for one building and hosted for scattered sites. The host breaks every phone system into server, service and phones. On-prem suits a single 50-person office, keeps extension-to-extension calls off the internet and takes POTS or PRI cards, but needs IT upkeep and replacing every three to five years. He recommends against virtualized FreePBX unless you really know VMs, because misallocated resources or networking show up as call-quality problems.
• Hosted PBXs double internal-call bandwidth but survive a site outage. Each extension-to-extension call goes out to the server and back, and every site should ideally have a static IP. If a site's internet drops, the hosted server can still answer and send calls to voicemail. The host recommends Vultr, which Crosstalk's own paid PBX hosting runs on, with QA'd monthly updates, snapshots, off-site backups and no contract.
• The host keeps POTS mainly as backup for schools and hospitals. POTS costs about $25–40 or more a month per line before usage, and caller ID follows whichever line a call used. A PRI carries 23 voice channels (an E1 elsewhere, 30) for roughly $500–750 a month. Both are often delivered over an internet circuit now, so ask the provider whether outages take them down.
• SIP trunking is where the host saves customers the most money. It is metered, per-channel or enterprise with SLAs, and fast to deploy with flexible caller ID, but it depends on internet quality and good provider documentation. He ranks first his own Crosstalk SIP: 5 channels with about 4,000 minutes or 10 with about 8,500. Next come ClearlyIP for complex sites needing Kari's Law and RAY BAUM'S Act E911 compliance, then voip.ms for small metered use.
• Standardize on FreePBX-compatible phones and skip over-priced brands. Phone apps for call forwarding, queues and visual voicemail need FreePBX support, and he calls Cisco and Digium phones overpriced at up to $400 a handset. Crosstalk's own phones, sold through its store, are the 270 (receptionist, sidecar, Wi-Fi, Bluetooth), the 250 (standard users) and the 230 (break room), with colour screens, gigabit pass-through and 2-year warranties.

2021-06-15 · open the original ↗

• Ubiquiti sells the airFiber 60 LR as a long-range bridge. The point-to-point radio, model AF60-LR-US lists at $399 a radio, about $800 for the pair. Ubiquiti rates it to 12 km and 1.8 Gbps full duplex, with GPS sync and Bluetooth setup. A Ubiquiti contest's longest link stood at 24.69 km at the time of recording.
• The host measured near full speed across his own test link. At 27 m, which he calls overkill for this radio, the built-in speed test gave 854 Mbps receive and 853 Mbps transmit, just over 1.7 Gbps total, with 0.85 ms ping. A laptop iPerf test through three switches and a few hundred feet of cable gave 681 Mbps single-threaded and 869 Mbps with five threads. A client's 5.8 km link showed 86.5% link potential and 1.75 Gbps capacity.
• Crosstalk typically backs a 60 GHz link with a 5 GHz one. 60 GHz suffers in rain and snow, and the LR has no backup radio. So Crosstalk mounts a second 5 GHz point-to-point on the same poles and runs OSPF between them for failover or load balancing, as on that 5.8 km client link. This also allows upgrading one pair at a time.
• The radios have almost no settings to tune. Wave AI adjusts the link automatically, and there is no power-output setting. The host sets both ends up over Bluetooth from the UISP app. A static IP without DNS servers left the radio unable to reach UISP until he added DNS, after which GPS suggested the nearby UISP site. A precision alignment mount helps aim the dishes.
• For shorter links, the host points to the standard AF60. At $299 a radio and rated to 2 km, it has an integrated 5 GHz backup radio that handles failover itself, with no OSPF needed.

2021-06-10 · open the original ↗

• Wi-Fi phones roam on existing access points, unlike DECT handsets. Crosstalk normally sells DECT cordless systems (Snom, Yealink W60P and Yealink's new multi-cell), which only work within range of their bases. The host's earlier Wi-Fi phone, from another maker, kept losing Wi-Fi. Spectralink is said to be robust, but the first handset with its required support contract, charger, battery and cables comes to over $1,200.
• The host, usually no Grandstream fan, will stock both phones. He says the video is not sponsored. Grandstream phones are normally not fully FreePBX-compatible and its PBXs are convoluted, so Crosstalk doesn't sell them. But he likes the WP810 and WP820 enough to recommend them and add them to the Crosstalk store. Both auto-provision from Crosstalk Cloud or FreePBX Endpoint Manager.
• The host recommends the WP820 over the cheaper WP810. At $145 against $114.95, the extra $30 buys a larger 2.4-inch screen, Bluetooth 4.2, Android 7.0 and video calling. Both have dual-band Wi-Fi, 1,500 mAh batteries, two SIP accounts and a programmable push-to-talk/panic button. The WP820's swivelling belt clip juts out enough to stop him holding it on his shoulder, so he would drop it.
• Roaming between access points worked in the host's home test. On one call he hopped access points five or six times, each hop beeping and cutting about a second of audio, yet the conversation stayed usable. He stresses this depends wholly on the Wi-Fi. Firewall or access-point timeouts on the registration can stop the phone ringing on inbound calls.
• The WP820 shows incoming video but sends none. It has no camera. It displayed 30 frames-per-second video from a Yealink T58A, useful for a video door phone. Calls from the WP820 to the Yealink never started video, and the host could not tell whether that was a limitation or his configuration.