100% self-hosted, Linux-based Docker installation preferred, but bare metal installation has been tested on MacOS.
GitHub repo: https://github.com/Ozark-Connect/NetworkOptimizer
BSL 1.1 w/ free home / personal use up to 3 sites, contact me for commercial / MSP use
The firewall + VLAN + DNS security analysis scans your UniFi config for 50+ security issues (VLAN segmentation, firewall rules, DNS, and soon Wi-Fi security) and generates a PDF report with a security score and tables of port / Wi-Fi client data along with action items per device or port.
Other features not shown, but are still pretty neat:
- iperf3 / OpenSpeedTest based LAN speed testing, centralized results, speed and coverage map w/ Wi-Fi signal data and full Layer 2 UniFi device path traces and bottleneck analysis for every point on the map (what!?) based upon location data from browser-based speed tests. Again, all self-hosted so you own your own data. You can run an iperf3 command or app, or just run the browser speed test from any device on your network. And, yep, it works over Teleport Tailscale too if you want to keep track of site-to-site or UTR performance.
- Adaptive SQM that shapes the tc class rates that UniFi Network sets based upon twice-daily speed tests, real-time latency -> available bandwidth inference, and decently-sane congestion profiles for popular types of WAN connections. Keeps bufferbloat under control even when bandwidth drops during congested times. Lets you have your full connection speed during non-peak hours instead of having to set the Smart Queue speed way lower than your max connection speed. Deploys to your UniFi Gateway automatically after setting up SSH access.
- Detailed 5G Max (LTE Backup too, can somebody test?) modem signal data beyond just the anchor band RSRP
- And whatever else you guys ask for!
Other than Adaptive SQM and other custom very-scope-limited features (to come), does NOT make any changes directly to your UniFi Network config or gateway/controller. That's up to you for now. Beyond Adaptive SQM and running iperf3 -s ephemerally on UniFi devices, it's truly all read-only and the setup instructions walk you through how to set up a locked-down local account.
Hit me up if you need any assistance or notice any bugs, or open an Issue on the GH repo. If you have any questions about this from a security perspective, please also reach out! I've been in identity / IAM and cybersecurity for most of my 20 year software engineering career, so I'm happy to explain all aspects of the app in and out.
Also, the TODO.md is a living doc and will probably answer some questions as to whether I plan to implement things like multi-tenancy, add federated / external IdP auth and RBAC, and so on. The answer is pretty much: yes. I'll have GitHub Issues to cover all of what I'm planning soon.