Skip to content

Phase 7R — ZBF remediation (owner decisions)

Date: 2026-06-18 Context: Phase 7R audit questionnaire + HA API evidence (§0.3).

Apply policies before existing BLOCK rules in each zone pair. After changes, re-test HA integrations, AirPlay, and printing from Personal WiFi.

Phase 7R outcome (2026-06-18)

Item Status
SLZB-06M / HA → IoT ✅ Settled after Allow HA → IoT zone
Samsung printer ✅ Personal → printer allow (reordered above block)
HomePod AirPlay ✅ Allow Personal → IoT — Action Allow + Allow return traffic (2026-06-26; recurred 2026-10-22 — quick recovery)
Apple TV Plex ✅ Allow Apple TV → Plex — IoT 192.168.7.106 → Internal 192.168.6.243 TCP 443 (live 2026-06-21)
Fiio AirPlay ⏸ Low priority — same VLAN; see device-vlan-mapping.md
Aqara hub / TP-Link moves ✅ Closed 2026-08-09 — Aqara moved; all TP-Link smart plugs failed → deprecate EP10 path

Cohort closed (2026-06-22): Phase 7R firewall work for this cycle is done. Deferred items documented above; see 2026-06-21 check-in.

Owner decisions

ID Decision
Q3.1 B — 192.168.6.227 → IoT zone only (HA IP, not all of Servers)
Q3.1b Superseded 2026-08-09 — EP10 plugs failed; path deprecated (was B: move to IoT/Appliances)
Q3.2 Yes — AirPlay / casting from Personal to IoT
Q3.3 Not intentional — add Personal → IoT VLAN 5 (see Q3.3 explained)
Q3.4 Yes — IoT → 192.168.6.17:53 when AdGuard is live (defer)
Q2.1 Printer stays GenPop .167; Aqara stays GenPop (WPA2-PSK only); OnePlus → Personal (done)

Q2.1 — GenPop device placement

IP Device Decision
192.168.1.167 Samsung printer Stay on GenPop — print from Personal devices; GenPop → Servers already allowed for scan-to-server / NAS features
192.168.1.82 Aqara Hub M2 Stay on GenPop (The LAN Before Time, WPA2-PSK) — hub does not support WPA2-EAP on IoT/Personal/Appliances SSIDs
192.168.1.218 OnePlus 8 Pro Personal VLAN 2 — was guest SSID for testing; owner moved back

Printer firewall gap: Personal → GenPop is blocked today. GenPop → Servers is already allowed — no rule needed for “send to Servers.” Add Policy 3 so phones and laptops on Personal can reach the printer. Optional Policy 4 if HA IPP integration should work.

Q3.3 explained

UniFi groups Appliances (VLAN 3) and IoT (VLAN 5) into one IoT zone. You already had Personal → Appliances ALLOW but not Personal → IoT (VLAN 5). HomePod / Apple TV live on VLAN 5 — discovery worked, streaming did not.

UDM click-through (apply policies 1–4)

Prerequisite: UniFi Network 9.x+, gateway on 4.1+ (you are on 10.5.43). Optional: Settings → System → Backup before changes.

Open the zone matrix

  1. Open UniFi Network (https://192.168.1.1 or unifi.ui.com).
  2. Select your UDM SE site.
  3. Go to Settings (gear, bottom-left).
  4. Security → Policy Engine (or Zone-Based Firewall / Zones).
  5. Open the Zone Matrix (grid: source zones on the left, destination across the top).

Policies are evaluated top to bottom within each zone pair. New Allow rules must sit above Block inter-VLAN / default deny for that pair.

Policy 1 — Home Assistant → IoT zone

Goal: HA at 192.168.6.227 reaches SLZB (IoT), Aqara hub (GenPop), and doorbell repeater — without opening all of Servers VLAN. (Former TP-Link EP10 plugs are retired; not a reachability target.)

  1. In the matrix, click Internal → IoT (source Internal, destination IoT).
  2. Create Policy (or + / Add rule).
  3. Set fields:
Field Value
Name Allow HA → IoT zone
Action Allow
Source zone Internal
Source IP address → 192.168.6.227
Destination zone IoT
Destination Any (all networks in IoT zone: Appliances + IoT)
Protocol All / Any
  1. Save / Apply changes.
  2. If the UI offers Move up / drag reorder, place this above any Block rule for Internal → IoT.

Policy 2 — Personal → IoT (AirPlay)

Goal: Phone on Personal WiFi can stream to HomePod / Apple TV on IoT VLAN 5.

  1. Click Internal → IoT again (same cell as Policy 1).
  2. Create Policy.
  3. Set fields:
Field Value
Name Allow Personal → IoT
Action Allow
Source zone Internal
Source Network → Personal Devices (VLAN 2)
Destination zone IoT
Destination Network → IoT (VLAN 5)
Protocol All / Any
Allow return traffic On (UniFi UI; API: create_allow_respond: true)
  1. Save / Apply.
  2. Order: Allow rules above Block for Internal → IoT.

Note: Allow without return traffic lets discovery and outbound SYN through (Graylog shows LAN_CUSTOM1-A hits) but AirPlay streaming fails until return is enabled — verified 2026-06-26 on HomePod 192.168.7.124.

Policy 3 — Apple TV → Plex (IoT → Internal, IP-scoped)

Goal: Bedroom Apple TV on IoT can reach Plex on saltierpoop via Traefik (plex.realemail.app → 192.168.6.243:443) without opening all of IoT to Servers.

Plex uses customConnections=https://plex.realemail.app:443; port 32400 is not published on the host. Relay is disabled — a narrow 443 allow is sufficient.

  1. Click IoT → Internal in the zone matrix.
  2. Create Policy.
  3. Set fields:
Field Value
Name Allow Apple TV → Plex
Action Allow
Source zone IoT
Source IP address → 192.168.7.106
Destination zone Internal
Destination IP address → 192.168.6.243
Protocol TCP 443
  1. Save / Apply — place above IoT → Internal block rules.
  2. Optional: DHCP fixed IP for the Apple TV so the rule stays valid.

Verify: Plex app on Apple TV plays; other IoT devices still cannot reach 192.168.6.243.

Policy 3 — Personal → Samsung printer (GenPop)

Goal: Print from laptops/phones on Personal to printer at 192.168.1.167 on GenPop. Narrow destination = printer IP only (guests on GenPop stay isolated).

  1. Click Internal → Internal (both sides Internal zone).
  2. Create Policy.
  3. Set fields:
Field Value
Name Allow Personal → Samsung printer
Action Allow
Source zone Internal
Source Network → Personal Devices (VLAN 2)
Destination zone Internal
Destination IP address → 192.168.1.167
Protocol All / Any
  1. Save / Apply.
  2. Place above Block inter-VLAN (Internal) (policy index 10004 in your live config).

Already works without a new rule: GenPop → Servers (existing allow) covers the printer initiating traffic to NAS / print server on Servers VLAN.

Policy 4 — Home Assistant → Samsung printer (optional)

Goal: Fix HA ipp / syncthru integrations for the Samsung (currently setup_retry in §0.3). Skip if you do not use the printer in HA.

  1. Click Internal → Internal.
  2. Create Policy:
Field Value
Name Allow HA → Samsung printer
Action Allow
Source zone Internal
Source IP address → 192.168.6.227
Destination zone Internal
Destination IP address → 192.168.1.167
Protocol All / Any
  1. Save / Apply — above Block inter-VLAN.

Apply to gateway

  1. Click Apply changes if the UI shows pending updates.
  2. Wait ~30–60 seconds.

When creating each policy, double-check Action = Allow before saving. The Name field alone does not set allow vs block.

Reference only: rule evaluation order (not a click checklist) UniFi evaluates rules top-to-bottom. Allow rules must sit above **Block inter-VLAN**. See [Troubleshooting](#troubleshooting) if traffic still fails.

WiFi moves (no firewall change)

Aqara Hub M2 — stays on GenPop (192.168.1.82)

Decision (2026-06-20): Do not move the hub to IoT (HotSignalsInYourArea), Personal (IsThisTheKrustyKrab), or Appliances (Rebellious Amish Family). Those SSIDs use WPA2-EAP; the Aqara Hub M2 only supports open / WPA2-PSK networks.

The hub remains on The LAN Before Time (WPA2-PSK → GenPop VLAN 1).

Home Assistant (validated 2026-06-21): Policy 1 (HA → IoT) does not cover a GenPop hub. Live check:

Check Result
homekit_controller Aqara-Hub-M2-7E74 setup_retry (not loaded)
Aqara child entities (24) all unavailable
TCP from Servers (192.168.6.17) → 192.168.1.82 timeout (ZBF blocks Servers→GenPop new flows)
SLZB / doorbell repeater / Matter loaded

Required: Internal → Internal allow Servers (192.168.6.227) → GenPop (192.168.1.82) — narrow IP rule — above Block inter-VLAN. GenPop → Servers already exists (hub-initiated traffic is not the blocker).

  1. Confirm hub IP in Aqara app (192.168.1.x).
  2. Apply UDM rule; wait 1 min.
  3. In HA: remove stale Aqara-Hub-M2-7E74 if still stuck; re-add via HomeKit.
  4. Confirm integration → loaded and entities leave unavailable.

Update (2026-08-09): Owner moved the Aqara hub; treat the placement/HA re-pair blocker as cleared. Confirm entities in HA when convenient — no further Phase 7R WiFi move required for this hub.

TP-Link EP10 plugs (Q3.1b) — deprecated

Status (2026-08-09): Owner reports every TP-Link smart plug failed. The EP10 WiFi-move / UDM-override plan is cancelled — do not power, re-pair, or replace these devices as part of Phase 7R.

Cleanup (2026-08-09): Owner scrubbed HA entities / UniFi leftovers. No further EP10 work. Leave GenPop / IoT firewall as-is — no EP10-specific rules were required beyond the cancelled override plan.

Historical note (2026-06): plugs were WPA2-PSK-only on GenPop and blocked from Servers until moved; that path is obsolete now that the hardware is gone.

Troubleshooting

Printer allow rule exists but PC still cannot print (2026-06-18)

Live API pull after Action was fixed to Allow:

Index Rule Action Hits
10004 Block inter-VLAN BLOCK 8
10005 Allow Personal → Samsung printer ALLOW 527k+
10002 Allow Personal → IoT BLOCK 8k+

Root cause: UniFi evaluates rules top → bottom by index. Block inter-VLAN (10004) runs before Allow Personal → Samsung printer (10005). New sessions from 192.168.3.17 → 192.168.1.167 hit the block rule first and never reach the printer allow.

The high hit count on 10005 is misleading — it does not mean printing works.

Fix — reorder (Internal → Internal):

  1. Settings → Security → Policy Engine → Zone Matrix
  2. Click Internal → Internal
  3. Move up (or drag) Allow Personal → Samsung printer so it sits above Block inter-VLAN — directly under Allow Personal → Servers is fine.
  4. Same for Allow HA → Samsung printer if you use HA printing.
  5. Apply changes → wait 30–60 s.

Target order (user rules only):

Allow Management → All
Allow GenPop → Servers
Allow Personal → Servers
Allow Personal → Samsung printer    ← must be HERE
Allow HA → Samsung printer          ← optional, same band
Drop invalid state
Block inter-VLAN                    ← after all allows

Historical (2026-06-18): Allow Personal → IoT had Action Block — fixed to Allow. Streaming still failed until Allow return traffic was enabled (2026-06-26). See AirPlay: HomePod / Apple TV below.

Fiio R7 (separate issue): At 192.168.3.44 on Personal VLAN 2 — same VLAN as KrustyKrab phones. ZBF Personal → IoT does not apply. UniFi shows Fiio last on The LAN Before Time SSID name; phone is on KrustyKrab. Fix WiFi/mDNS on Personal, not IoT firewall — see AirPlay: Fiio on Personal.

HA / IoT

# From infra-services (WSL SSH)
ping -c2 192.168.7.132

In HA: Settings → Devices & services → reload SLZB-06M / smlight.

AirPlay: HomePod / Apple TV (IoT VLAN 5)

Symptom: iPhone on KrustyKrab sees targets sometimes but cannot stream / Home app shows No Response for Kitchen HomePod / Bedroom Apple TV.

Recurs: When this breaks again, use the short path first — homekit-unreachable.md (UI, GitHub Action, or script).

Root cause (2026-06-18 → 2026-06-26; again 2026-10-22): Two settings on Allow Personal → IoT:

  1. Action = Block (wrong) → set Allow
  2. Allow return traffic off → enable it (required even after Action is Allow)

Graylog on UDM (source:UDM-SE AND 192.168.7.124) showed outbound SYN allowed (LAN_CUSTOM1-A-10003) while streaming still failed until return traffic was on.

Fix:

  1. Settings → Security → Policy Engine → Zone Matrix → Internal → IoT
  2. Open Allow Personal → IoT
  3. Action → Allow
  4. Allow return traffic → On
  5. Source: Personal Devices (VLAN 2)
  6. Destination: Network → IoT (VLAN 5)
  7. Apply changes

Automation: workflow unifi-fix-airplay.yml or scripts/fix-personal-iot-airplay.py.

Verify: iPhone on KrustyKrab → AirPlay to HomePod 192.168.7.124 — ✅ 2026-06-26.

HomePod is on IoT VLAN 5 (may still show old SSID name in UniFi; IP matters).

AirPlay: Fiio R7 (same VLAN)

Symptom: Phone on KrustyKrab cannot AirPlay to Fiio.

Live cause: Fiio is 192.168.3.44 — Personal VLAN 2, same subnet family as the phone. Not blocked by Personal → IoT (that rule is for VLAN 5 only).

Device IP VLAN SSID (UniFi)
iPhone 192.168.3.169 2 IsThisTheKrustyKrab
Fiio R7 192.168.3.44 2 The LAN Before Time (stale or wrong SSID)

Fix (WiFi / iOS, not firewall): Owner keeps Fiio on LAN Before Time with Personal network override — see device-vlan-mapping.md. Optional: iOS Local Network for Music; multicast enhancement on KrustyKrab.

Mac/phone on Personal → print to Samsung at 192.168.1.167.

GenPop → Servers (printer outbound)

Should already work; test scan-to-folder or whatever uses Servers if applicable.

Policy to add later — AdGuard DNS (Q3.4)

When: AdGuard running on 192.168.6.17, before UDM DNS cutover.

  1. IoT → Internal → Create Policy
  2. Source zone IoT, source Any
  3. Destination zone Internal, destination IP 192.168.6.17
  4. Allow, ports TCP 53 + UDP 53 only

Post-change HA checklist

  1. Reload smlight / SLZB-06M
  2. Reload mqtt / zigbee2mqtt
  3. Re-add / reload Aqara after hub move (if entities still stale)
  4. Re-auth UniFi Protect
  5. Remove stale synology_dsm entries (192.168.1.88, .105)
  6. Reload ipp / syncthru if Policy 4 added
  7. Remove any leftover tplink integration / EP10 entities (hardware retired)

Re-run audit: uv run python .scratch/audit/ha-pull.py

Rollback

Disable the four new Allow policies in the zone matrix. Isolation posture returns; HA, AirPlay, and Personal→printer break again.