brianpooe/homelab-blueprint
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document exact UniFi address policies

Browse source
This commit is contained in:
Brian Pooe 2026-06-14 14:12:02 +02:00
parent b114487ede
commit 933af8bdd6
1 changed files with 116 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

138
docs/network/udm-pro-zones-migration.md
View file

@ -73,32 +73,126 @@ UniFi 9.x permits custom zones. The defaults (`Internal`, `IoT`, `Hotspot`, `DMZ
| `Gateway` | Built-in (mandatory) | — | UDM Pro SE itself | — |
| `External` | Built-in (mandatory) | — | WAN | — |
## 5. Address Sets Used in Policies
## 5. Create Address-Specific Policies in UniFi 10.4.57
In **UniFi Network 10.4.57**, these names are design shorthand, not standalone
objects that must be created first. The Policy Engine **Objects** page applies
Secure, Route, and QoS policies to selected clients or networks; it is not an
address-group editor.
UniFi Network **10.4.57** does not expose reusable named IP-address groups for
zone-based policies. The names `CADDY`, `DNS`, `BACKEND_APPS`,
`IOT_BACKENDS`, and `RFC1918` in this document are design labels only.
Create firewall rules under **Settings → Policy Engine → Policy Table**. For
each rule, select its source and destination zones, then add the listed host
addresses or CIDRs directly to the source or destination IP-address match
field. A field can contain multiple addresses/CIDRs. Re-enter the same values
in each policy that needs them; Network 10.4.57 does not expose reusable named
IP-address groups for zone-based Policy Table rules.
Do not use **Settings → Policy Engine → Objects** for this step. That page
applies Secure, Route, and QoS policies to selected clients or networks.
| Design label | Inline IP-address match values | Purpose |
|---|---|---|
| `CADDY` | `10.0.15.5` | Reverse-proxy destination |
| `DNS` | `10.0.10.3` (Technitium) | Internal resolver |
| `BACKEND_APPS` | Every TRUSTED destination proxied by Caddy: app hosts, Technitium, and explicitly published infrastructure UIs | DMZ → TRUSTED pinhole targets |
| `IOT_BACKENDS` | `10.0.30.5` (SLZB-06U), `10.0.30.6` (Home Automation host) | IoT services proxied by Caddy |
| `RFC1918` | 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 | Private-space matcher |
Open **Settings → Policy Engine → Policy Table** and use the definitions below
when the migration sequence tells you to create each policy. Do **not** enable
all policies at once: create the DNS and Caddy allows first, test them, and add
the broad block policies only at the end of each zone's rollout.
For example, the MEDIA-to-Caddy allow policy uses source zone `MEDIA`,
destination zone `DMZ`, destination IP address `10.0.15.5`, and TCP ports
`80,443`. The `CADDY` label is only how this document refers to that repeated
match.
For each policy:
1. Select the first Policy Engine icon, **Policy Table**.
2. Create a new firewall policy and enter the listed policy name.
3. Select the listed action, source zone, and destination zone.
4. Enable the source IP-address match only when a source IP is listed.
5. Enable the destination IP-address match and enter every listed destination
IP or CIDR.
6. Select the listed protocol and destination ports. Leave source ports as
`Any`.
7. Save the policy and place specific allow policies above broad block
policies.
Leave a source or destination IP-address field unrestricted when the
instructions say `Any`.
### 5.1 Policies targeting Caddy (`CADDY`)
Create both policies:
| Policy name | Action | Source zone | Source IP | Destination zone | Destination IP | Protocol / destination ports |
|---|---|---|---|---|---|---|
| `ALLOW FAMILY to CADDY web` | Allow | `FAMILY` | Any | `DMZ` | `10.0.15.5` | TCP `80,443` |
| `ALLOW MEDIA to CADDY web` | Allow | `MEDIA` | Any | `DMZ` | `10.0.15.5` | TCP `80,443` |
These policies do not clash with zones. The zone selects the broad path, such
as `MEDIA` to `DMZ`; destination IP `10.0.15.5` narrows that path to Caddy
only.
### 5.2 Policies targeting Technitium DNS (`DNS`)
Create one allow policy for each listed source zone:
| Policy name | Action | Source zone | Source IP | Destination zone | Destination IP | Protocol / destination port |
|---|---|---|---|---|---|---|
| `ALLOW DMZ to DNS` | Allow | `DMZ` | Any | `TRUSTED` | `10.0.10.3` | TCP and UDP `53` |
| `ALLOW FAMILY to DNS` | Allow | `FAMILY` | Any | `TRUSTED` | `10.0.10.3` | TCP and UDP `53` |
| `ALLOW MEDIA to DNS` | Allow | `MEDIA` | Any | `TRUSTED` | `10.0.10.3` | TCP and UDP `53` |
| `ALLOW IOT to DNS` | Allow | `IOT` | Any | `TRUSTED` | `10.0.10.3` | TCP and UDP `53` |
| `ALLOW GUEST to DNS` | Allow | `GUEST` | Any | `TRUSTED` | `10.0.10.3` | TCP and UDP `53` |
### 5.3 Caddy to TRUSTED backend policies (`BACKEND_APPS`)
Create these policies from the current
`docker-compose-files/caddy/Caddyfile_template`. Keep separate policies for
different destination ports so one backend is not accidentally allowed to use
another backend's port.
Every policy in this table uses:
- Action: `Allow`
- Source zone: `DMZ`
- Source IP: `10.0.15.5`
- Destination zone: `TRUSTED`
- Protocol: TCP
| Policy name | Destination IP | Destination port(s) | Current upstream purpose |
|---|---|---|---|
| `ALLOW CADDY to LAN web devices` | `10.0.1.5`, `10.0.1.8` | `80` | Lite-8 and TP-Link switch UIs |
| `ALLOW CADDY to Technitium UI` | `10.0.10.3` | `5380` | Technitium admin UI |
| `ALLOW CADDY to NAS apps` | `10.0.10.24` | `5000,5055,6767,7878,8000,8080,8096,8191,8282,8989,9696` | NAS and media-stack apps |
| `ALLOW CADDY to PBS` | `10.0.10.8` | `8007` | Proxmox Backup Server |
| `ALLOW CADDY to Proxmox` | `10.0.10.10` | `8006` | Proxmox |
| `ALLOW CADDY to Bento PDF` | `10.0.10.6` | `8080` | Bento PDF |
| `ALLOW CADDY to Beszel` | `10.0.10.13` | `8090` | Beszel |
| `ALLOW CADDY to Drawio` | `10.0.10.9` | `8080` | Drawio |
| `ALLOW CADDY to Gramps` | `10.0.10.17` | `5000` | Gramps |
| `ALLOW CADDY to Immich` | `10.0.10.15` | `2283` | Immich |
| `ALLOW CADDY to IT Tools` | `10.0.10.7` | `80` | IT Tools |
| `ALLOW CADDY to Paperless` | `10.0.10.11` | `8000` | Paperless-ngx |
| `ALLOW CADDY to Speedtest` | `10.0.10.16` | `80` | Speedtest |
| `ALLOW CADDY to YTD` | `10.0.10.14` | `3033` | MeTube/YTD |
Delete or disable a policy when its matching Caddy upstream is removed.
### 5.4 Caddy to IOT backend policies (`IOT_BACKENDS`)
Both policies use action `Allow`, source zone `DMZ`, source IP `10.0.15.5`,
destination zone `IOT`, and protocol TCP:
| Policy name | Destination IP | Destination port(s) | Purpose |
|---|---|---|---|
| `ALLOW CADDY to Zigbee` | `10.0.30.5` | `80` | SLZB-06U web UI |
| `ALLOW CADDY to Home Automation` | `10.0.30.6` | `1880,8080,8123` | Node-RED, Zigbee2MQTT, and Home Assistant |
### 5.5 RFC1918 block policies
After the specific allow policies above work, create one RFC1918 block policy
for each restricted source zone. For each policy, set destination zone to
`Any` and enter all three destination CIDRs:
- `10.0.0.0/8`
- `172.16.0.0/12`
- `192.168.0.0/16`
| Policy name | Action | Source zone | Source IP | Destination zone | Destination IPs | Protocol / ports |
|---|---|---|---|---|---|---|
| `BLOCK DMZ to RFC1918` | Block | `DMZ` | Any | Any | All three RFC1918 CIDRs | Any |
| `BLOCK FAMILY to RFC1918` | Block | `FAMILY` | Any | Any | All three RFC1918 CIDRs | Any |
| `BLOCK MEDIA to RFC1918` | Block | `MEDIA` | Any | Any | All three RFC1918 CIDRs | Any |
| `BLOCK IOT to RFC1918` | Block | `IOT` | Any | Any | All three RFC1918 CIDRs | Any |
| `BLOCK GUEST to RFC1918` | Block | `GUEST` | Any | Any | All three RFC1918 CIDRs | Any |
Policy order is mandatory: place the specific Caddy, DNS, and backend allow
policies above these RFC1918 block policies. Otherwise, the broad RFC1918
blocks will match and drop the intended traffic first.
## 6. Public Ingress via Netbird
Home WAN has **no inbound listeners**. Public traffic flow: