hi rizvanrp, under the secondary administrator account is there any option to allow VPN passthrough ? my wife's VPN connection problem is still not resolved and Unifi service centre didn't respond to my emails at all. 

why is lan port 4 mapped to WAN 2?

It's bad in this case because the router runs BusyBox. You can sniff the traffic running on other people's home networks.. and since the router runs an SSH daemon (dropbear), you can use it to setup an open/closed SOCKS proxy on their routers and forward data through their connections. Not to mention these are high speed 5-20mbps links..

If I compromised all those nodes I would have 3Gbps of bandwidth at minimum to use as a botnet (assuming everyone is on 5mbps at the very least).

@iipohbee

I don't think they would need to since they're the ISP.. they have logs on their side.

But honestly, this is a bad case security through obscurity. You tell all your customers there's only 1 user/pass to access the router, you tell all your technicians who install for the customers the same thing (even those who are doing Unifibiz installs).. then it turns out there's a second user/pass combo and this user/pass has a higher access level.

At least I found this <2 months into the launch and people will be aware of this now. I actually just thought of leaving it be because it would be too much trouble to fix.. but I'm not the only guy who's decent with security/networking here and if this came out once Unifi's as popular as Streamyx .. good f-ing game sir.

I actually hate this more than when they were throttling BT. At least with a BT throttle my home network is still secure. Not to mention they had me running around like a dog trying to find a way to let people use their own routers when it was possible all along.

I honestly don't know what the hell was running through the minds of the people who set this up.

Sorry I forgot to add this in, Unifi's main VLAN has no caps on it. Every user is capped at the account level only. This means if a 5mbps breaks into a 20mbps users router and takes his user/pass, he will get 20mbps at home. Nice job TM

Since you're going to be implementing an account cap, I can't imagine what people would do to get past it