brianpooe/homelab-blueprint
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
homelab-blueprint/docs/network/firewall-rules.md
Brian Pooe 3a314b16d6 feat: add Koffan, Rackula, and SnapOtter stacks; expose Hermes dashboard 
- new compose templates + READMEs for the three LXC apps (110-112)
- Makefile deploy targets (rackula pre-owns its data dir for uid 1001)
- Caddy vhosts for all four, incl. Hermes /auth/login redirect workaround
- firewall docs: CADDY->TRUSTED rules for LXCs 110-113
2026-07-06 20:50:34 +02:00

62 lines
8.3 KiB
Markdown
Raw Blame History

# UniFi Zone-Based Firewall — Custom Rules Reference
This document serves as the single source of truth for the manual custom firewall rules configured in the UniFi Policy Engine. Apply these rules in **Settings → Policy Engine → Policy Table** under the **Custom** tab.
> [!IMPORTANT]
> For all stateful traffic flows where one-way initiation is allowed (especially from isolated zones like `CADDY` to backends, or from restricted zones to `CADDY`/`DNS`), the **Auto Allow Return Traffic** setting must be **Enabled** (checked). Otherwise, UniFi will drop the return/reply packets.
---
## Custom Firewall Rules Table
| Name | Action | IP Version | Protocol | Src Zone | Src IP | Dst Zone | Dst IP | Dst Port(s) | Auto Return | Purpose / Notes |
| :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :---: | :--- |
| `Allow MEDIA to Caddy` | Allow | Both | TCP | `MEDIA` | Any | `CADDY` | Any | `443` | **Yes** | Allows MEDIA devices to connect to Caddy web proxy (HTTPS only). |
| `ALLOW FAMILY DHCP to Gateway` | Allow | IPv4 | UDP | `FAMILY` | Any | `Gateway` | Any | `67` | No | Allows FAMILY DHCP request initiation. |
| `ALLOW GUEST DHCP to Gateway` | Allow | IPv4 | UDP | `GUEST` | Any | `Gateway` | Any | `67` | No | Allows GUEST DHCP request initiation. |
| `ALLOW IoT DHCP to Gateway` | Allow | IPv4 | UDP | `IoT` | Any | `Gateway` | Any | `67` | No | Allows IoT DHCP request initiation. |
| `ALLOW MEDIA DHCP to Gateway` | Allow | IPv4 | UDP | `MEDIA` | Any | `Gateway` | Any | `67` | No | Allows MEDIA DHCP request initiation. |
| `Allow CADDY to DNS` | Allow | Both | TCP/UDP | `CADDY` | Any | `TRUSTED` | `10.0.10.5` | `53` | **Yes** | Allows Caddy host to query Technitium DNS server. |
| `Allow CADDY to UDM` | Allow | Both | TCP | `CADDY` | `10.0.15.5` | `TRUSTED` | `10.0.1.1` | `443` | **Yes** | Allows Caddy to proxy the UDM Pro SE dashboard. |
| `Allow CADDY to UNAS` | Allow | Both | TCP | `CADDY` | `10.0.15.5` | `TRUSTED` | `10.0.10.25` | `443` | **Yes** | Allows Caddy to proxy the UNAS Pro dashboard. |
| `Allow CADDY to Synology` | Allow | Both | TCP | `CADDY` | `10.0.15.5` | `TRUSTED` | `10.0.10.24` | `5000,5001` | **Yes** | Allows Caddy to proxy the Synology NAS DSM dashboard (HTTP/HTTPS). |
| `Allow Caddy to Arr Stack` | Allow | Both | TCP | `CADDY` | Any | `TRUSTED` | `10.0.10.20` | `5055,6767,7878,8000,8080,8096,8191,8282,8989,9696` | **Yes** | Allows Caddy to reach Arr-stack apps (Bazarr, Radarr, Gluetun, QBittorrent, Emby, Flaresolverr, Sabnzbd, Sonarr, Prowlarr, Seerr). |
| `Allow Caddy to Immich` | Allow | Both | TCP | `CADDY` | `10.0.15.5` | `TRUSTED` | `10.0.10.15` | `2283` | **Yes** | Allows Caddy to proxy Immich (photo management) on LXC 102. |
| `Allow Caddy to Youtarr` | Allow | Both | TCP | `CADDY` | `10.0.15.5` | `TRUSTED` | `10.0.10.14` | `3087` | **Yes** | Allows Caddy to proxy Youtarr on LXC 103. |
| `Allow Caddy to Bento PDF` | Allow | Both | TCP | `CADDY` | `10.0.15.5` | `TRUSTED` | `10.0.10.6` | `8080` | **Yes** | Allows Caddy to proxy BentoPDF on LXC 105. |
| `Allow Caddy to IT Tools` | Allow | Both | TCP | `CADDY` | `10.0.15.5` | `TRUSTED` | `10.0.10.7` | `80` | **Yes** | Allows Caddy to proxy IT-Tools on LXC 106. |
| `Allow Caddy to Paperless` | Allow | Both | TCP | `CADDY` | `10.0.15.5` | `TRUSTED` | `10.0.10.11` | `8000` | **Yes** | Allows Caddy to proxy Paperless-ngx on LXC 107. |
| `Allow Caddy to Beszel` | Allow | Both | TCP | `CADDY` | `10.0.15.5` | `TRUSTED` | `10.0.10.13` | `8090` | **Yes** | Allows Caddy to proxy the Beszel hub on LXC 108. |
| `Allow Caddy to Rackula` | Allow | Both | TCP | `CADDY` | `10.0.15.5` | `TRUSTED` | `10.0.10.9` | `8080` | **Yes** | Allows Caddy to proxy Rackula (rack designer) on LXC 110. |
| `Allow Caddy to Koffan` | Allow | Both | TCP | `CADDY` | `10.0.15.5` | `TRUSTED` | `10.0.10.12` | `8080` | **Yes** | Allows Caddy to proxy Koffan (grocery list) on LXC 111. |
| `Allow Caddy to SnapOtter` | Allow | Both | TCP | `CADDY` | `10.0.15.5` | `TRUSTED` | `10.0.10.18` | `1349` | **Yes** | Allows Caddy to proxy SnapOtter (file toolkit) on LXC 112. |
| `Allow Caddy to Hermes` | Allow | Both | TCP | `CADDY` | `10.0.15.5` | `TRUSTED` | `10.0.10.19` | `9119` | **Yes** | Allows Caddy to proxy the Hermes Agent dashboard on LXC 113. |
| `Allow Caddy to HA` | Allow | Both | TCP | `CADDY` | Any | `IoT` | `10.0.30.6` | `8080, 8123` | **Yes** | Allows Caddy to proxy Home Assistant and Zigbee2MQTT. |
| `Allow Caddy to PBS` | Allow | Both | TCP | `CADDY` | Any | `TRUSTED` | `10.0.10.8` | `8007` | **Yes** | Allows Caddy to proxy Proxmox Backup Server. |
| `Allow Caddy to Proxmox` | Allow | Both | TCP | `CADDY` | Any | `TRUSTED` | `10.0.10.10` | `8006` | **Yes** | Allows Caddy to proxy Proxmox VE. |
| `Allow Caddy to SLZ-06 Zigbee` | Allow | Both | TCP | `CADDY` | Any | `IoT` | `10.0.30.5` | `80` | **Yes** | Allows Caddy to proxy SLZB-06U Zigbee coordinator UI. |
| `Allow Caddy to Technitium` | Allow | Both | TCP | `CADDY` | Any | `TRUSTED` | `10.0.10.5` | `5380` | **Yes** | Allows Caddy to proxy Technitium DNS admin UI. |
| `Allow FAMILY to CADDY` | Allow | Both | TCP | `FAMILY` | Any | `CADDY` | Any | `443` | **Yes** | Allows FAMILY devices to connect to Caddy web proxy (HTTPS only). |
| `Allow FAMILY to UNAS` | Allow | Both | TCP | `FAMILY` | Any | `TRUSTED` | `10.0.10.25` | `445` | **Yes** | Allows FAMILY devices to connect to the UNAS Pro SMB share used by PhotoSync. |
| `Allow FAMILY to DNS` | Allow | Both | TCP/UDP | `FAMILY` | Any | `TRUSTED` | `10.0.10.5` | `53` | **Yes** | Allows FAMILY devices to query Technitium DNS. |
| `Allow GUEST to DNS` | Allow | Both | TCP/UDP | `GUEST` | Any | `TRUSTED` | `10.0.10.5` | `53` | **Yes** | Allows GUEST devices to query Technitium DNS. |
| `Allow IoT to DNS` | Allow | Both | TCP/UDP | `IoT` | Any | `TRUSTED` | `10.0.10.5` | `53` | **Yes** | Allows IoT devices to query Technitium DNS. |
| `Allow MEDIA to DNS` | Allow | Both | TCP/UDP | `MEDIA` | Any | `TRUSTED` | `10.0.10.5` | `53` | **Yes** | Allows MEDIA devices to query Technitium DNS. |
| `Allow TRUSTED to CADDY Any` | Allow | Both | All | `TRUSTED` | Any | `CADDY` | Any | Any | **Yes** | Allows TRUSTED to initiate any traffic to CADDY. |
| `Allow TRUSTED to FAMILY Any` | Allow | Both | All | `TRUSTED` | Any | `FAMILY` | Any | Any | **Yes** | Allows TRUSTED to initiate any traffic to FAMILY. |
| `Allow TRUSTED to GUEST Any` | Allow | Both | All | `TRUSTED` | Any | `GUEST` | Any | Any | **Yes** | Allows TRUSTED to initiate any traffic to GUEST. |
| `Allow TRUSTED to IoT Any` | Allow | Both | All | `TRUSTED` | Any | `IoT` | Any | Any | **Yes** | Allows TRUSTED to initiate any traffic to IoT. |
| `Allow TRUSTED to MEDIA Any` | Allow | Both | All | `TRUSTED` | Any | `MEDIA` | Any | Any | **Yes** | Allows TRUSTED to initiate any traffic to MEDIA. |
| `Allow IoT to IoT Any` | Allow | Both | All | `IoT` | Any | `IoT` | Any | Any | **Yes** | Allows unrestricted intra-zone IoT communication. |
| `Allow TRUSTED to TRUSTED Any` | Allow | Both | All | `TRUSTED` | Any | `TRUSTED` | Any | Any | **Yes** | Allows unrestricted intra-zone TRUSTED communication. |
| `Block Family public DNS` | Block | Both | TCP/UDP | `FAMILY` | Any | `External` | Any | `53` | No | Blocks FAMILY zone from querying public DNS resolvers. |
| `Block GUEST public DNS` | Block | Both | TCP/UDP | `GUEST` | Any | `External` | Any | `53` | No | Blocks GUEST zone from querying public DNS resolvers. |
| `Block IoT public DNS` | Block | Both | TCP/UDP | `IoT` | Any | `External` | Any | `53` | No | Blocks IoT zone from querying public DNS resolvers. |
| `Block MEDIA public DNS` | Block | Both | TCP/UDP | `MEDIA` | Any | `External` | Any | `53` | No | Blocks MEDIA zone from querying public DNS resolvers. |
| `BLOCK FAMILY to Gateway Any` | Block | Both | All | `FAMILY` | Any | `Gateway` | Any | Any | No | Blocks FAMILY from accessing UDM Gateway. |
| `BLOCK GUEST to Gateway Any` | Block | Both | All | `GUEST` | Any | `Gateway` | Any | Any | No | Blocks GUEST from accessing UDM Gateway. |
| `BLOCK IoT to Gateway Any` | Block | Both | All | `IoT` | Any | `Gateway` | Any | Any | No | Blocks IoT from accessing UDM Gateway. |
| `BLOCK MEDIA to Gateway Any` | Block | Both | All | `MEDIA` | Any | `Gateway` | Any | Any | No | Blocks MEDIA from accessing UDM Gateway. |
> [!NOTE]
> The direct rules `Allow FAMILY to EMBY` and `Allow MEDIA to Emby` have been deleted to enforce the security design requiring all app traffic to traverse the Caddy reverse proxy.
Reference in a new issue View git blame Copy permalink