Firewall — Live Zone Posture¶

Captured: 2026-08-09 (read-only UniFi Integration API dump) Source: uv run python -m scripts.labctl unifi dump on infra-services (/etc/homelab/labctl.env); artifact unifi-live/unifi-dump-2026-08-09.sanitized.json Controller: UniFi Network 10.5.67 on UDM SE (gateway firmware 5.1.27) Mode: Zone-Based Firewall (ZBF). Legacy firewallrule endpoint returns [] — enforcement is via zone policies (146 total: 106 system-defined, 20 user-defined, 20 derived return pairs).

This is the as-configured firewall, complementing the design/runbook in firewall-policy.md. Where they differ, this document is the truth.

1. Zones and their networks¶

graph TB
    subgraph INTERNAL["Internal (trusted)"]
        I1["GenPop v1"]
        I2["Personal v2"]
        I4["Servers v4"]
        I10["Management v10"]
    end
    subgraph IOT["IoT (untrusted)"]
        T5["IoT v5"]
        T3["Appliances v3"]
    end
    subgraph SEC["Security"]
        S6["Cameras v6"]
    end
    subgraph VPNZ["Vpn"]
        VP["VPN pool 192.168.2.0/24"]
    end
    subgraph EXT["External"]
        WAN["WAN1 + WAN2"]
    end
    GW["Gateway (UDM itself)"]
    HS["Hotspot (empty)"]
    DMZ["Dmz (empty)"]

Zone	Origin	Member networks
Internal	system (editable)	GenPop (1), Personal Devices (2), Servers (4), Management (10)
IoT	user-defined	Appliances (3), IoT (5)
Security	user-defined	Security (6)
Vpn	system	VPN Server pool
External	system	Internet 1, Internet 2
Gateway	system	(UDM itself — no LAN members)
Hotspot	system	(empty)
Dmz	system	(empty)

2. Effective zone matrix (new connections)¶

Read row → column. Established/related return traffic is always allowed where allowReturnTraffic / derived return policies exist; this matrix is about who may initiate a new connection. Cells marked policies(N) in the live zone_matrix API are summarized below from the user-defined policies in this dump (not invented).

↓ from / → to	Internal	IoT	Security	Vpn	External	Gateway
Internal	partial¹	partial²	BLOCK³	ALLOW	ALLOW	ALLOW
IoT	DNS + Apple TV→Plex⁴	BLOCK	BLOCK	BLOCK	ALLOW	DNS/DHCP only⁵
Security	DNS only⁶	BLOCK	BLOCK	BLOCK	ALLOW	DNS/DHCP only⁵
Vpn	ALLOW	BLOCK	BLOCK	ALLOW	ALLOW	ALLOW
External	port-fwd only⁷	BLOCK	BLOCK	BLOCK	—	services only⁸
Gateway	ALLOW	ALLOW	ALLOW	ALLOW	ALLOW	—

Internal → Internal — see §3 (intra-zone user policies + Block inter-VLAN).
Internal → IoT — Personal → Appliances, Personal → IoT (v5), and HA (192.168.6.227) → IoT zone; all other Internal sources blocked.
No user ALLOW from Internal → Security in this dump (policy_count: 2 are system/return hygiene).
IoT → Internal — IoT → Internal DNS (192.168.6.17:53) and Allow Apple TV → Plex (MAC 48:e1:5c:97:69:9b → 192.168.6.243:443).
IoT/Security → Gateway blocked on port group IoT Obstacles (TCP/UDP 22, 80, 443); mDNS and other gateway services remain for DNS/DHCP.
Security → Internal — Security VLAN cameras → 192.168.6.17:53 only.
Three port-forwards to 192.168.6.243 (80, 8080, 443).
External → Gateway: adoption / IPsec / ESP / L2TP / DHCPv6 / IPv6 ND/RA only.

3. Internal zone — inter-VLAN rules (the important part)¶

GenPop, Personal, Servers, and Management share the Internal zone. New inter-VLAN flows are controlled by user policies (indexes 10000–10010), then Drop invalid state (10005), then Block inter-VLAN (40000).

#	Policy	Action	Effect
10000	Allow Management → All	ALLOW	Mgmt (v10) → Internal any
10001	Allow GenPop → Servers	ALLOW
10002	Allow Personal → Servers	ALLOW
10003	Allow HA → Samsung printer	ALLOW	`192.168.6.227` → `192.168.1.167` (no auto-return)
10004	Allow Personal → Samsung printer	ALLOW	Personal → `192.168.1.167` (no auto-return)
10005	Drop invalid state	BLOCK	Internal → Internal
10006	Servers → Personal (Prometheus)	ALLOW	`192.168.6.17` → `192.168.3.17:8765`
10007	Servers → Personal (LLM)	ALLOW	`192.168.6.17` → `192.168.3.17` TCP 1234, 11434, 8091 (+ return)
10008	Captain → Raven Scanner	ALLOW	MAC `34:5a:60:03:33:51` → `192.168.1.91`
10009	Aqara ↔ HA	ALLOW	MAC `54:ef:44:60:7e:74` → Personal + Servers
10010	Phoenix\|LiteLLM → MBP M4	ALLOW	`192.168.6.17` → `192.168.3.37` TCP 11434, 8091 (+ return); `1234` is explicitly excluded
40000	Block inter-VLAN	BLOCK	all other new Internal → Internal

Policy 10006 is now obsolete because Reddit Explorer moved from the Personal VLAN workstation to infra-services. This repository change does not modify the live UDM: the rule remains in the last observed configuration and should be removed by the owner after the container target is healthy. No Prometheus configuration depends on it.

graph LR
    MGMT["Management v10"]
    GP["GenPop v1"]
    PERS["Personal v2"]
    SRV["Servers v4"]
    APPL["Appliances v3 (IoT zone)"]
    IOT5["IoT v5"]

    MGMT -->|ALLOW| GP
    MGMT -->|ALLOW| PERS
    MGMT -->|ALLOW| SRV
    GP -->|ALLOW| SRV
    PERS -->|ALLOW| SRV
    PERS -->|ALLOW| APPL
    PERS -->|ALLOW| IOT5
    GP -.->|BLOCK| PERS
    SRV -.->|"BLOCK (new)*"| GP
    SRV -.->|"scoped ALLOW"| PERS

Net result — who can start a conversation with whom (data VLANs):

Source ↓ \ Dest →	GenPop 1	Personal 2	Appliances 3	Servers 4	IoT 5	Security 6	Mgmt 10	Internet
GenPop 1	—	✗	✗	✓	✗	✗	✗	✓
Personal 2	partial⁹	—	✓	✓	✓	✗	✗	✓
Appliances 3	✗	✗	—	✗	✗	✗	✗	✓
Servers 4	✗*	✓†	✗‡	—	✗‡	✗	✗	✓
IoT 5	✗	✗	✗	DNS / Plex§	—	✗	✗	✓
Security 6	✗	✗	✗	DNS only	✗	—	✗	✓
Mgmt 10	✓	✓	✗	✓	✗	✗	—	✓

✓ = new connections allowed · ✗ = blocked ✗* = blocked to initiate; established replies to GenPop-initiated sessions OK ✓† = scoped: Prometheus :8765, LLM ports, and LiteLLM → MBP M4 — not whole Servers → Personal ✗‡ = except HA 192.168.6.227 → entire IoT zone (Appliances + IoT) § = 192.168.6.17:53 and Apple TV MAC → saltierpoop :443 only ⁹ = Personal → Samsung printer 192.168.1.167 only (plus Captain→Raven from Personal MAC)

Intra-VLAN traffic is switched and does not hit these rules.

Notable: Management → Appliances/IoT/Security remains BLOCKED. Allow Management → All is scoped to the Internal zone only.

4. All user-defined policies (verbatim from dump)¶

Cross-zone (and gateway) user policies in addition to §3:

Index	Name	From	To	Action	Notes
10000	Personal → Appliances	Internal: Personal v2	IoT: Appliances v3	ALLOW	+ return
10000	IoT → Internal DNS	IoT	`192.168.6.17:53`	ALLOW	+ return
10000	Security VLAN cameras	Security	`192.168.6.17:53`	ALLOW	+ return
10000	Block IoT → Gateway mgmt	IoT	Gateway ports 22/80/443	BLOCK	group IoT Obstacles
10000	Block Security → Gateway	Security	Gateway ports 22/80/443	BLOCK	group IoT Obstacles
10001	Allow Apple TV → Plex	IoT MAC `48:e1:5c:97:69:9b`	`192.168.6.243:443`	ALLOW	+ return
10001	Allow HA → IoT zone	`192.168.6.227`	IoT (any)	ALLOW	+ return
10002	Allow Personal → IoT	Internal: Personal v2	IoT: IoT v5	ALLOW	+ return (AirPlay path)

System-generated mDNS allows and External port-forward / WAN service rules remain as predefined / system policies (not listed above).

5. External / WAN ingress¶

graph LR
    NET["Internet"]
    UDM["UDM SE"]
    SALT["saltierpoop<br/>192.168.6.243"]
    NET -->|"tcp/udp 80"| UDM --> SALT
    NET -->|"tcp/udp 8080"| UDM
    NET -->|"tcp/udp 443"| UDM
    NET -.->|"all else: BLOCK"| UDM

Only the three saltierpoop port-forwards (80, 8080, 443) and standard gateway service rules accept inbound from the Internet.

6. Cross-checks against design¶

IoT and Security isolation matches firewall-policy.md: ✓
GenPop/Personal → Servers exceptions present: ✓
Personal → Appliances exception present: ✓
Personal → IoT (AirPlay / HomePod path): ✓ present in dump as Allow Personal → IoT with return traffic (reconciles prior journal claim; June 2026 matrix cell that showed ✗ was stale)
Apple TV → Plex (IoT MAC → saltierpoop :443): ✓
Servers → Personal (LiteLLM / Prometheus / MBP): ✓ scoped policies in dump
HA → IoT zone + printer exceptions: ✓ (live since prior journal; now in matrix)