Skip to content

Phase 7R — ZBF remediation (owner decisions)

Date: 2026-06-18 Context: Phase 7R audit questionnaire + HA API evidence (§0.3).

Apply policies before existing BLOCK rules in each zone pair. After changes, re-test HA integrations, AirPlay, and printing from Personal WiFi.

Phase 7R outcome (2026-06-18)

Item Status
SLZB-06M / HA → IoT ✅ Settled after Allow HA → IoT zone
Samsung printer ✅ Personal → printer allow (reordered above block)
HomePod AirPlay ✅ Allow Personal → IoT — Action Allow + Allow return traffic (2026-06-26)
Apple TV Plex ✅ Allow Apple TV → Plex — IoT 192.168.7.106 → Internal 192.168.6.243 TCP 443 (live 2026-06-21)
Fiio AirPlay ⏸ Low priority — same VLAN; see device-vlan-mapping.md
Aqara hub / TP-Link moves ⏸ Deferred — Aqara HA needs Servers→GenPop when owner returns; TP-Link hardware backburner

Cohort closed (2026-06-22): Phase 7R firewall work for this cycle is done. Deferred items documented above; see 2026-06-21 check-in.

Owner decisions

ID Decision
Q3.1 B — 192.168.6.227 → IoT zone only (HA IP, not all of Servers)
Q3.1b B — Move TP-Link plugs to IoT or Appliances WiFi and re-pair
Q3.2 Yes — AirPlay / casting from Personal to IoT
Q3.3 Not intentional — add Personal → IoT VLAN 5 (see Q3.3 explained)
Q3.4 Yes — IoT → 192.168.6.17:53 when AdGuard is live (defer)
Q2.1 Printer stays GenPop .167; Aqara stays GenPop (WPA2-PSK only); OnePlus → Personal (done)

Q2.1 — GenPop device placement

IP Device Decision
192.168.1.167 Samsung printer Stay on GenPop — print from Personal devices; GenPop → Servers already allowed for scan-to-server / NAS features
192.168.1.82 Aqara Hub M2 Stay on GenPop (The LAN Before Time, WPA2-PSK) — hub does not support WPA2-EAP on IoT/Personal/Appliances SSIDs
192.168.1.218 OnePlus 8 Pro Personal VLAN 2 — was guest SSID for testing; owner moved back

Printer firewall gap: Personal → GenPop is blocked today. GenPop → Servers is already allowed — no rule needed for “send to Servers.” Add Policy 3 so phones and laptops on Personal can reach the printer. Optional Policy 4 if HA IPP integration should work.

Q3.3 explained

UniFi groups Appliances (VLAN 3) and IoT (VLAN 5) into one IoT zone. You already had Personal → Appliances ALLOW but not Personal → IoT (VLAN 5). HomePod / Apple TV live on VLAN 5 — discovery worked, streaming did not.

UDM click-through (apply policies 1–4)

Prerequisite: UniFi Network 9.x+, gateway on 4.1+ (you are on 10.5.43). Optional: Settings → System → Backup before changes.

Open the zone matrix

  1. Open UniFi Network (https://192.168.1.1 or unifi.ui.com).
  2. Select your UDM SE site.
  3. Go to Settings (gear, bottom-left).
  4. Security → Policy Engine (or Zone-Based Firewall / Zones).
  5. Open the Zone Matrix (grid: source zones on the left, destination across the top).

Policies are evaluated top to bottom within each zone pair. New Allow rules must sit above Block inter-VLAN / default deny for that pair.

Policy 1 — Home Assistant → IoT zone

Goal: HA at 192.168.6.227 reaches SLZB (IoT), Aqara hub (GenPop), TP-Link (on IoT/Appliances), doorbell repeater — without opening all of Servers VLAN.

  1. In the matrix, click Internal → IoT (source Internal, destination IoT).
  2. Create Policy (or + / Add rule).
  3. Set fields:
Field Value
Name Allow HA → IoT zone
Action Allow
Source zone Internal
Source IP address → 192.168.6.227
Destination zone IoT
Destination Any (all networks in IoT zone: Appliances + IoT)
Protocol All / Any
  1. Save / Apply changes.
  2. If the UI offers Move up / drag reorder, place this above any Block rule for Internal → IoT.

Policy 2 — Personal → IoT (AirPlay)

Goal: Phone on Personal WiFi can stream to HomePod / Apple TV on IoT VLAN 5.

  1. Click Internal → IoT again (same cell as Policy 1).
  2. Create Policy.
  3. Set fields:
Field Value
Name Allow Personal → IoT
Action Allow
Source zone Internal
Source Network → Personal Devices (VLAN 2)
Destination zone IoT
Destination Network → IoT (VLAN 5)
Protocol All / Any
Allow return traffic On (UniFi UI; API: create_allow_respond: true)
  1. Save / Apply.
  2. Order: Allow rules above Block for Internal → IoT.

Note: Allow without return traffic lets discovery and outbound SYN through (Graylog shows LAN_CUSTOM1-A hits) but AirPlay streaming fails until return is enabled — verified 2026-06-26 on HomePod 192.168.7.124.

Policy 3 — Apple TV → Plex (IoT → Internal, IP-scoped)

Goal: Bedroom Apple TV on IoT can reach Plex on saltierpoop via Traefik (plex.realemail.app → 192.168.6.243:443) without opening all of IoT to Servers.

Plex uses customConnections=https://plex.realemail.app:443; port 32400 is not published on the host. Relay is disabled — a narrow 443 allow is sufficient.

  1. Click IoT → Internal in the zone matrix.
  2. Create Policy.
  3. Set fields:
Field Value
Name Allow Apple TV → Plex
Action Allow
Source zone IoT
Source IP address → 192.168.7.106
Destination zone Internal
Destination IP address → 192.168.6.243
Protocol TCP 443
  1. Save / Apply — place above IoT → Internal block rules.
  2. Optional: DHCP fixed IP for the Apple TV so the rule stays valid.

Verify: Plex app on Apple TV plays; other IoT devices still cannot reach 192.168.6.243.

Policy 3 — Personal → Samsung printer (GenPop)

Goal: Print from laptops/phones on Personal to printer at 192.168.1.167 on GenPop. Narrow destination = printer IP only (guests on GenPop stay isolated).

  1. Click Internal → Internal (both sides Internal zone).
  2. Create Policy.
  3. Set fields:
Field Value
Name Allow Personal → Samsung printer
Action Allow
Source zone Internal
Source Network → Personal Devices (VLAN 2)
Destination zone Internal
Destination IP address → 192.168.1.167
Protocol All / Any
  1. Save / Apply.
  2. Place above Block inter-VLAN (Internal) (policy index 10004 in your live config).

Already works without a new rule: GenPop → Servers (existing allow) covers the printer initiating traffic to NAS / print server on Servers VLAN.

Policy 4 — Home Assistant → Samsung printer (optional)

Goal: Fix HA ipp / syncthru integrations for the Samsung (currently setup_retry in §0.3). Skip if you do not use the printer in HA.

  1. Click Internal → Internal.
  2. Create Policy:
Field Value
Name Allow HA → Samsung printer
Action Allow
Source zone Internal
Source IP address → 192.168.6.227
Destination zone Internal
Destination IP address → 192.168.1.167
Protocol All / Any
  1. Save / Apply — above Block inter-VLAN.

Apply to gateway

  1. Click Apply changes if the UI shows pending updates.
  2. Wait ~30–60 seconds.

When creating each policy, double-check Action = Allow before saving. The Name field alone does not set allow vs block.

Reference only: rule evaluation order (not a click checklist) UniFi evaluates rules top-to-bottom. Allow rules must sit above **Block inter-VLAN**. See [Troubleshooting](#troubleshooting) if traffic still fails.

WiFi moves (no firewall change)

Aqara Hub M2 — stays on GenPop (192.168.1.82)

Decision (2026-06-20): Do not move the hub to IoT (HotSignalsInYourArea), Personal (IsThisTheKrustyKrab), or Appliances (Rebellious Amish Family). Those SSIDs use WPA2-EAP; the Aqara Hub M2 only supports open / WPA2-PSK networks.

The hub remains on The LAN Before Time (WPA2-PSK → GenPop VLAN 1).

Home Assistant (validated 2026-06-21): Policy 1 (HA → IoT) does not cover a GenPop hub. Live check:

Check Result
homekit_controller Aqara-Hub-M2-7E74 setup_retry (not loaded)
Aqara child entities (24) all unavailable
TCP from Servers (192.168.6.17) → 192.168.1.82 timeout (ZBF blocks Servers→GenPop new flows)
SLZB / doorbell repeater / Matter loaded

Required: Internal → Internal allow Servers (192.168.6.227) → GenPop (192.168.1.82) — narrow IP rule — above Block inter-VLAN. GenPop → Servers already exists (hub-initiated traffic is not the blocker).

  1. Confirm hub IP in Aqara app (192.168.1.x).
  2. Apply UDM rule; wait 1 min.
  3. In HA: remove stale Aqara-Hub-M2-7E74 if still stuck; re-add via HomeKit.
  4. Confirm integration → loaded and entities leave unavailable.

Status (2026-06-21): Owner deferred indefinitely — plugs have physical/wiring issues; powering them risks connected electronics. No UDM or HA work until hardware is fixed.

Constraint (same as Aqara): EP10 plugs support WPA2-PSK only — they cannot join WPA2-EAP SSIDs (IoT/Personal/Appliances). Use The LAN Before Time + UDM per-client network override to place each plug on IoT (VLAN 5) or Appliances (VLAN 3) without changing SSID in the Kasa app.

Plug Last known IP Target VLAN UDM override
ProxBox EP10 192.168.1.248 IoT LAN Before Time → IoT
MotoPlug EP10 192.168.1.107 IoT LAN Before Time → IoT
Living Room Lamp EP10 192.168.1.39 IoT LAN Before Time → IoT

Steps (each plug, when powered and online):

  1. UniFi → Clients → select plug (or find by MAC from Kasa app).
  2. Network override → IoT (or Appliances if preferred).
  3. Optional: Fixed IP in 192.168.7.x (IoT) for stable HA entities.
  4. Wait for DHCP renew (~1 min); confirm 192.168.7.x in UniFi and Kasa app.
  5. In HA: remove stale TP-Link entities → Settings → Devices → Add integration (or reload TP-Link integration).

Live scan (2026-06-21): none of the three .1.x addresses appeared in UniFi — plugs likely offline/unplugged. Repeat override when each device reconnects.

Firewall: With plugs on IoT, HA (192.168.6.227) reaches them via existing Servers → IoT policy — no GenPop rule needed.

Troubleshooting

Printer allow rule exists but PC still cannot print (2026-06-18)

Live API pull after Action was fixed to Allow:

Index Rule Action Hits
10004 Block inter-VLAN BLOCK 8
10005 Allow Personal → Samsung printer ALLOW 527k+
10002 Allow Personal → IoT BLOCK 8k+

Root cause: UniFi evaluates rules top → bottom by index. Block inter-VLAN (10004) runs before Allow Personal → Samsung printer (10005). New sessions from 192.168.3.17 → 192.168.1.167 hit the block rule first and never reach the printer allow.

The high hit count on 10005 is misleading — it does not mean printing works.

Fix — reorder (Internal → Internal):

  1. Settings → Security → Policy Engine → Zone Matrix
  2. Click Internal → Internal
  3. Move up (or drag) Allow Personal → Samsung printer so it sits above Block inter-VLAN — directly under Allow Personal → Servers is fine.
  4. Same for Allow HA → Samsung printer if you use HA printing.
  5. Apply changes → wait 30–60 s.

Target order (user rules only):

Allow Management → All
Allow GenPop → Servers
Allow Personal → Servers
Allow Personal → Samsung printer    ← must be HERE
Allow HA → Samsung printer          ← optional, same band
Drop invalid state
Block inter-VLAN                    ← after all allows

Historical (2026-06-18): Allow Personal → IoT had Action Block — fixed to Allow. Streaming still failed until Allow return traffic was enabled (2026-06-26). See AirPlay: HomePod / Apple TV below.

Fiio R7 (separate issue): At 192.168.3.44 on Personal VLAN 2 — same VLAN as KrustyKrab phones. ZBF Personal → IoT does not apply. UniFi shows Fiio last on The LAN Before Time SSID name; phone is on KrustyKrab. Fix WiFi/mDNS on Personal, not IoT firewall — see AirPlay: Fiio on Personal.

HA / IoT

# From infra-services (WSL SSH)
ping -c2 192.168.7.132

In HA: Settings → Devices & services → reload SLZB-06M / smlight.

AirPlay: HomePod / Apple TV (IoT VLAN 5){ #airplay-homepod--apple-tv-iot-vlan-5 }

Symptom: iPhone on KrustyKrab sees targets sometimes but cannot stream.

Root cause (2026-06-18 → 2026-06-26): Two settings on Allow Personal → IoT:

  1. Action = Block (wrong) → set Allow
  2. Allow return traffic off → enable it (required even after Action is Allow)

Graylog on UDM (source:UDM-SE AND 192.168.7.124) showed outbound SYN allowed (LAN_CUSTOM1-A-10003) while streaming still failed until return traffic was on.

Fix:

  1. Settings → Security → Policy Engine → Zone Matrix → Internal → IoT
  2. Open Allow Personal → IoT
  3. Action → Allow
  4. Allow return traffic → On
  5. Source: Personal Devices (VLAN 2)
  6. Destination: Network → IoT (VLAN 5)
  7. Apply changes

Verify: iPhone on KrustyKrab → AirPlay to HomePod 192.168.7.124 — ✅ 2026-06-26.

HomePod is on IoT VLAN 5 (may still show old SSID name in UniFi; IP matters).

AirPlay: Fiio R7 (same VLAN)

Symptom: Phone on KrustyKrab cannot AirPlay to Fiio.

Live cause: Fiio is 192.168.3.44 — Personal VLAN 2, same subnet family as the phone. Not blocked by Personal → IoT (that rule is for VLAN 5 only).

Device IP VLAN SSID (UniFi)
iPhone 192.168.3.169 2 IsThisTheKrustyKrab
Fiio R7 192.168.3.44 2 The LAN Before Time (stale or wrong SSID)

Fix (WiFi / iOS, not firewall): Owner keeps Fiio on LAN Before Time with Personal network override — see device-vlan-mapping.md. Optional: iOS Local Network for Music; multicast enhancement on KrustyKrab.

Mac/phone on Personal → print to Samsung at 192.168.1.167.

GenPop → Servers (printer outbound)

Should already work; test scan-to-folder or whatever uses Servers if applicable.

Policy to add later — AdGuard DNS (Q3.4)

When: AdGuard running on 192.168.6.17, before UDM DNS cutover.

  1. IoT → Internal → Create Policy
  2. Source zone IoT, source Any
  3. Destination zone Internal, destination IP 192.168.6.17
  4. Allow, ports TCP 53 + UDP 53 only

Post-change HA checklist

  1. Reload smlight / SLZB-06M
  2. Reload mqtt / zigbee2mqtt
  3. Re-pair TP-Link after WiFi move
  4. Re-add / reload Aqara after hub on IoT
  5. Re-auth UniFi Protect
  6. Remove stale synology_dsm entries (192.168.1.88, .105)
  7. Reload ipp / syncthru if Policy 4 added

Re-run audit: uv run python .scratch/audit/ha-pull.py

Rollback

Disable the four new Allow policies in the zone matrix. Isolation posture returns; HA, AirPlay, and Personal→printer break again.