Current Network — Live Snapshot¶
Baseline capture: 2026-08-09 (read-only UniFi API dump of UDM SE) Prior baseline: 2026-06-03 (superseded for topology / clients / DNS evidence)
DNS authoritative on AdGuard
Per-VLAN DHCP DNS is 192.168.6.17 (AdGuard) on GenPop, Personal,
Appliances, Servers, IoT, Security, and Management. WAN1 manual DNS is
AdGuard. Legacy PiHole LXC 104 was destroyed 2026-06-17.
Servers VLAN was corrected 2026-08-09 (was gateway .1; now .17).
Source: uv run python -m scripts.labctl unifi dump →
unifi-live/unifi-dump-2026-08-09.sanitized.json
Controller: UDM SE — UniFi Network 10.5.67 (previous at last reboot
path: 10.4.x era); gateway firmware 5.1.27; uptime ~9 days at capture
This document is the as-built picture of the network at capture time. It is hand-authored from a live scan, not generated from inventory, so where inventory or the older device-VLAN mapping disagree, this document reflects reality. For the intended/design view see network.md; for firewall posture see firewall-live.md.
Regenerate anytime with labctl
unifi dump(prefer infra-services/etc/homelab/labctl.env). Sanitize before commit — see unifi-live/README.md.
1. Physical topology¶
How the wired backbone and access points are actually cabled, from the UniFi device table (uplink MAC + port).
graph TD
ISP["ISP — Cable"]
MODEM["Cable Modem (UCI)<br/>192.168.100.1<br/>d0:21:f9:05:8f:21"]
UDM["UDM SE (Gateway)<br/>WAN1 98.167.204.33 / eth8<br/>60:22:32:26:2f:89"]
WAN2["WAN2 / eth9<br/>(enabled, failover-only)"]
SW["USW Pro Max 16 PoE<br/>192.168.1.58<br/>28:70:4e:32:67:6d"]
FLEX["USW Flex Mini<br/>192.168.1.95"]
APH["Hallway AP — U7 Pro<br/>192.168.1.110 · 17 clients"]
APD["Dining AP — AC Pro<br/>192.168.1.34 · 11 clients"]
WIRED["Wired endpoints<br/>(servers, cameras, IoT, printers)"]
WIFI["Wi-Fi clients<br/>(4 SSIDs → VLANs)"]
ISP --> MODEM --> UDM
WAN2 -.-> UDM
UDM -->|port 11| SW
SW -->|port 2| FLEX
SW -->|port 13| APH
SW -->|port 14| APD
SW --> WIRED
FLEX --> WIRED
APH --> WIFI
APD --> WIFI| Device | Model | Mgmt IP | Firmware | Uplink → | Clients |
|---|---|---|---|---|---|
| UDM SE | UDMPROSE | 98.167.204.33 (WAN) / LAN 192.168.1.1 |
5.1.27 | Cable modem (port 1) | 51 |
| USW Pro Max 16 PoE | USPM16P | 192.168.1.58 |
7.5.9 | UDM port 11 | 22 |
| USW Flex Mini | USMINI | 192.168.1.95 |
2.1.6 | Pro Max port 2 | 1 |
| Hallway AP (U7 Pro) | U7PRO | 192.168.1.110 |
8.7.11 | Pro Max port 13 | 17 |
| Dining AP (AC Pro) | U7PG2 | 192.168.1.34 |
6.9.1 | Pro Max port 14 | 11 |
| Cable Modem | UCI | 192.168.100.1 |
1.4.3 | — (WAN) | 1 |
Dual-WAN: WAN1 weighted; WAN2 failover-only (no second ISP expected).
2. Layer-3 / VLAN topology¶
Every routed network on the UDM SE and the firewall zone it belongs to (zones drive the inter-VLAN policy — see firewall-live.md).
graph TD
UDM["UDM SE<br/>inter-VLAN router + DHCP"]
subgraph EXTERNAL["Zone: External"]
W1["WAN1 / Internet 1<br/>98.167.204.33"]
W2["WAN2 / Internet 2"]
end
subgraph INTERNAL["Zone: Internal (trusted)"]
V1["VLAN 1 · GenPop<br/>192.168.1.0/24"]
V2["VLAN 2 · Personal<br/>192.168.3.0/24"]
V4["VLAN 4 · Servers<br/>192.168.6.0/24"]
V10["VLAN 10 · Management<br/>192.168.10.0/24"]
end
subgraph IOTZ["Zone: IoT (untrusted)"]
V5["VLAN 5 · IoT<br/>192.168.7.0/24"]
V3["VLAN 3 · Appliances<br/>192.168.5.0/24"]
end
subgraph SECZ["Zone: Security"]
V6["VLAN 6 · Security/Cameras<br/>192.168.8.0/24"]
end
subgraph VPNZ["Zone: Vpn"]
VPN["VPN Server pool<br/>192.168.2.0/24"]
end
UDM --- W1
UDM -.- W2
UDM --- V1 & V2 & V4 & V10
UDM --- V5 & V3
UDM --- V6
UDM --- VPN| VLAN | Name | Subnet | Gateway | DHCP pool | Zone | DHCP-handed DNS |
|---|---|---|---|---|---|---|
| 1 | GenPop | 192.168.1.0/24 | .1 | .6–.254 | Internal | AdGuard 192.168.6.17 |
| 2 | Personal | 192.168.3.0/24 | .1 | .6–.254 | Internal | AdGuard 192.168.6.17 |
| 3 | Appliances | 192.168.5.0/24 | .1 | .6–.254 | IoT | AdGuard 192.168.6.17 |
| 4 | Servers | 192.168.6.0/24 | .1 | .6–.254 | Internal | AdGuard 192.168.6.17 |
| 5 | IoT | 192.168.7.0/24 | .1 | .6–.254 | IoT | AdGuard 192.168.6.17 |
| 6 | Security | 192.168.8.0/24 | .1 | .6–.254 | Security | AdGuard 192.168.6.17 |
| 10 | Management | 192.168.10.0/24 | .1 | .10–.100 | Internal | AdGuard 192.168.6.17 |
| — | VPN Server | 192.168.2.0/24 | .1 | — | Vpn | (DHCP DNS off) |
Note: Appliances (VLAN 3) is in the IoT firewall zone, not Internal.
Wi-Fi SSID → VLAN (live)¶
| SSID | Security | Network → VLAN |
|---|---|---|
| The LAN Before Time | WPA2-PSK | GenPop → 1 |
| IsThisTheKrustyKrab | WPA2-EAP | Personal → 2 |
| Rebellious Amish Family | WPA2-EAP | Appliances → 3 |
| HotSignalsInYourArea | WPA2-EAP | IoT → 5 |
Many IoT/Appliances clients still report association to The LAN Before Time while UniFi places them on IoT/Appliances networks — treat SSID column in §4 as association evidence, not as the VLAN truth (network name wins).
3. DNS resolution path¶
3a. Baseline at capture (2026-06-03)¶
At the June scan, every VLAN handed out the UDM gateway as DNS and WAN1
forwarded to PiHole 192.168.6.80. AdGuard existed but was not in path. See
observation O1.
3b. Live path (2026-08-09 dump)¶
graph LR
C["Clients (all VLANs)"]
ADG["AdGuard + Unbound<br/>192.168.6.17:53<br/>infra-services"]
UB["Root DNS"]
RW["Rewrites<br/>*.lab.local<br/>*.infra.realemail.app"]
C -->|"DHCP DNS"| ADG
ADG --> RW
ADG --> UB| Item | Status (2026-08-09) |
|---|---|
| AdGuard + Unbound running | Yes (ops — not from UniFi dump) |
Per-VLAN DHCP DNS → .17 |
Yes — all data VLANs (Servers fixed 2026-08-09 via UniFi API) |
UDM WAN1 DNS → .17 |
Yes (wan_dns1) |
| WAN1 IPv6 DNS | Manual link-local-style addr on UDM (not AdGuard) |
| PiHole decom (LXC 104) | Done (2026-06-17) |
Servers VLAN note: AdGuard lives on this VLAN (192.168.6.17). Pointing
Servers DHCP at .17 (same as other VLANs) does not worsen the failure
domain vs using the UDM gateway as DNS: WAN1 upstream DNS is already AdGuard, so
if .17 is down recursive resolution fails either way. Direct .17 keeps
Servers consistent with GenPop/Personal/IoT and avoids an extra hop. Remaining
caveat is Tailscale prefer-main on hosts that advertise 192.168.6.0/24 — see
AdGuard — Servers VLAN caveat.
Verify from any VLAN:
4. Live device inventory (by VLAN)¶
51 clients associated at capture (stat/sta). Names are UniFi hostnames /
friendly names from the dump.
VLAN 4 — Servers (192.168.6.0/24)¶
| IP | Name | Conn |
|---|---|---|
| 192.168.6.17 | infra-services | wired |
| 192.168.6.71 | Proxbox (prox) | wired |
| 192.168.6.98 | recordurbate | wired |
| 192.168.6.100 | ubuncap | wired |
| 192.168.6.101 | sonarqube (Prox guest) | wired |
| 192.168.6.119 | harbor-registry | wired |
| 192.168.6.124 | (Prox guest) | wired |
| 192.168.6.197 | graylog | wired |
| 192.168.6.199 | pulse | wired |
| 192.168.6.214 | Whrrr LAN2 | wired |
| 192.168.6.215 | Whrrr LAN1 | wired |
| 192.168.6.216 | Whrrr LAN3 | wired |
| 192.168.6.222 | octoprint | wired |
| 192.168.6.227 | poopcastle (HAOS) | wired |
| 192.168.6.243 | saltierpoop | wired |
| 192.168.6.252 | postgresql | wired |
VLAN 2 — Personal (192.168.3.0/24)¶
| IP | Name | Conn |
|---|---|---|
| 192.168.3.17 | CaptainKangapoo | wired |
| 192.168.3.37 | Mac (MBP M4) | Wi-Fi (KrustyKrab) |
| 192.168.3.44 | Fiio R7 | Wi-Fi |
| 192.168.3.60 | OnePlus-8-Pro | Wi-Fi (KrustyKrab) |
| 192.168.3.85 | Samsung | Wi-Fi |
| 192.168.3.169 | iPhone | Wi-Fi (KrustyKrab) |
| 192.168.3.234 | Mac | Wi-Fi (KrustyKrab) |
| 192.168.3.240 | LM-L06YF9KDC1 | wired |
VLAN 5 — IoT (192.168.7.0/24)¶
| IP | Name | Conn |
|---|---|---|
| 192.168.7.22 | Xiaomi air purifier | Wi-Fi |
| 192.168.7.81 | Aqara Hub M2 | Wi-Fi |
| 192.168.7.93 | Govee / Whrrr-named AP client | Wi-Fi |
| 192.168.7.106 | Bedroom (Apple TV) | wired |
| 192.168.7.107 | Doorbell (Aqara G4) | Wi-Fi |
| 192.168.7.124 | Kitchen (HomePod) | Wi-Fi |
| 192.168.7.132 | SLZB-06M | wired |
| 192.168.7.145 | PETLIBRO feeder | Wi-Fi |
| 192.168.7.156 | neakasa-M1 | Wi-Fi |
| 192.168.7.159 | Blueair / espressif | Wi-Fi |
| 192.168.7.168 | Google Nest Mini | Wi-Fi |
| 192.168.7.169 | Smart feeder (lwip0) | Wi-Fi |
| 192.168.7.184 | Yale Lock — Front Door | Wi-Fi |
| 192.168.7.212 | roborock-vacuum-a288 | Wi-Fi |
| 192.168.7.217 | ChargePoint-class client | Wi-Fi |
| 192.168.7.241 | BooBEE (ecobee) | Wi-Fi |
VLAN 3 — Appliances (192.168.5.0/24)¶
| IP | Name | Conn |
|---|---|---|
| 192.168.5.39 | Fellow-Aiden | Wi-Fi |
| 192.168.5.59 | prusa-core-one | Wi-Fi |
| 192.168.5.71 | EcoNet water heater | Wi-Fi |
| 192.168.5.239 | GEMODULE (GE) | Wi-Fi |
| 192.168.5.247 | bosch-dishwasher | Wi-Fi |
Rollo label printer not seen in this capture.
VLAN 6 — Security (192.168.8.0/24)¶
| IP | Name | Conn |
|---|---|---|
| 192.168.8.10 | g5-flex — rack monitor | wired |
| 192.168.8.76 | g4frontdoor | wired |
| 192.168.8.173 | g4carport | wired |
VLAN 1 — GenPop (192.168.1.0/24)¶
Infra APs/switches are devices (not always in stat/sta). Client stations:
| IP | Name | Conn |
|---|---|---|
| 192.168.1.91 | android (Raven Scanner target) | Wi-Fi |
| 192.168.1.167 | Samsung printer (SEC30…) | Wi-Fi |
| 192.168.1.178 | A2BUHOVA… | Wi-Fi |
VLAN 10 — Management (192.168.10.0/24)¶
No clients in dump — reserved for admin / out-of-band.
5. WAN exposure (port forwards)¶
| Service | WAN port | → Internal target |
|---|---|---|
| HTTP | 80 | 192.168.6.243:80 (saltierpoop) |
| HTTP_Too | 8080 | 192.168.6.243:8080 |
| HTTPS | 443 | 192.168.6.243:443 |
No SMB/445 forward is present (consistent with the Phase 0 hotfix).
6. Drift & anomalies (2026-08-09)¶
| Finding | Evidence | Notes |
|---|---|---|
| Servers DHCP DNS → AdGuard | PUT networkconf 2026-08-09 → dhcpd_dns_1=192.168.6.17 |
Renew leases / wait TTL on Servers clients |
| Aqara Hub on IoT | 192.168.7.81 |
Was GenPop in June notes; now IoT |
| cam-rack IP | 192.168.8.10 |
Matches inventory (June live doc had .11) |
| postgresql LXC 102 | inventory postgresql + UniFi .252 |
VMID reused after aiproject destroy |
| Inventory firmware drift | UDM/AP/switch versions in dump ahead of some YAML | Docs/pages updated; inventory bump optional |
Older June observations remain in Network Observations (2026-06-03) for historical context; do not treat them as current matrix truth.