Skip to content

HomeKit / AirPlay unreachable again

Symptom: iPhone cannot reach Kitchen HomePod (192.168.7.124) and/or Bedroom Apple TV (192.168.7.106) — Home app "No Response", AirPlay missing or fails to stream.

Hubs live on IoT VLAN 5. Streaming/control from a phone is only allowed from Personal Devices VLAN 2 (Allow Personal → IoT + return traffic). There is no GenPop → IoT allow.

First fixed 2026-06-26; recurrence notes in 2026-10-22 journal.

Check 0 — iPhone VLAN (do this first)

Verified 2026-10-22: firewall was already correct; the phone was on GenPop.

Good Bad
SSID IsThisTheKrustyKrab → Personal 192.168.3.x SSID The LAN Before Time → GenPop 192.168.1.x

Fix: iPhone Settings → Wi‑Fi → join IsThisTheKrustyKrab (enterprise / Personal). Forget or avoid auto-join on LAN Before Time for the phone if it keeps falling back.

Confirm in UniFi clients: iPhone IP is 192.168.3.x, network Personal Devices — not GenPop.

Then re-test Home / AirPlay. Stop here if that was the only problem.

Check 1 — ZBF Personal → IoT

If the phone is already on KrustyKrab and hubs are still unreachable:

Usual cause: UniFi policy Allow Personal → IoT drifted to Block, or Allow return traffic turned off. mDNS can still show names while streaming/control fails.

A — UniFi UI (~60s)

  1. Settings → Security → Policy Engine → Zone Matrix → Internal → IoT
  2. Open Allow Personal → IoT
  3. Action → Allow
  4. Allow return traffic → On
  5. Source: Personal Devices (VLAN 2); Destination: IoT (VLAN 5)
  6. Keep this Allow above any Block for Internal → IoT; Apply

B — GitHub Action (LAN runner)

  1. Actions → Fix HomePod AirPlay (Personal → IoT) → Run workflow
  2. dry_run = false
  3. confirmation = APPLY_UNIFI_CHANGE
  4. Workflow runs scripts/fix-personal-iot-airplay.py on homelab-lan

Dry-run first (dry_run true) if you only want current policy state printed.

C — From a LAN shell (infra-services / workstation)

# diagnose
python scripts/fix-personal-iot-airplay.py --dry-run
# apply
python scripts/fix-personal-iot-airplay.py

Needs UNIFI_* / /etc/homelab/labctl.env. On Network 9.x Integration API, if the derived Allow Personal → IoT (Return) policy is missing, the script refuses mutation — use A.

Verify

  1. iPhone on IsThisTheKrustyKrab (192.168.3.x)
  2. Control Center → AirPlay → Kitchen HomePod; stream ~30s
  3. Home app: Kitchen HomePod + Bedroom Apple TV leave "No Response"

From a Personal host (e.g. CaptainKangapoo 192.168.3.17), hubs should ping and open TCP 7000/7100 (AirPlay). That proves L3/ZBF; phone SSID is then the likely gap.

If still broken

Check Expect
Clients online .124 HomePod, .106 Apple TV on IoT
mDNS UDM Gateway mDNS Proxy includes Personal + IoT
GenPop phone Will not work — no GenPop → IoT allow (by design)
Fiio only Same-VLAN Personal issue — not this policy; see device-vlan-mapping

Full Phase 7R context: phase-7r-zbf-remediation.md § AirPlay.