brianpooe/homelab-blueprint
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
homelab-blueprint/docs/network/firewall-rules.md

8.1 KiB
Raw Blame History

UniFi Zone-Based Firewall — Custom Rules Reference

This document serves as the single source of truth for the manual custom firewall rules configured in the UniFi Policy Engine. Apply these rules in Settings → Policy Engine → Policy Table under the Custom tab.

Important

For all stateful traffic flows where one-way initiation is allowed (especially from isolated zones like CADDY to backends, or from restricted zones to CADDY/DNS), the Auto Allow Return Traffic setting must be Enabled (checked). Otherwise, UniFi will drop the return/reply packets.

Custom Firewall Rules Table

Name Action IP Version Protocol Src Zone Src IP Dst Zone Dst IP Dst Port(s) Auto Return Purpose / Notes
Allow MEDIA to Caddy Allow Both TCP MEDIA Any CADDY Any 443 Yes Allows MEDIA devices to connect to Caddy web proxy (HTTPS only).
ALLOW FAMILY DHCP to Gateway Allow IPv4 UDP FAMILY Any Gateway Any 67 No Allows FAMILY DHCP request initiation.
ALLOW GUEST DHCP to Gateway Allow IPv4 UDP GUEST Any Gateway Any 67 No Allows GUEST DHCP request initiation.
ALLOW IoT DHCP to Gateway Allow IPv4 UDP IoT Any Gateway Any 67 No Allows IoT DHCP request initiation.
ALLOW MEDIA DHCP to Gateway Allow IPv4 UDP MEDIA Any Gateway Any 67 No Allows MEDIA DHCP request initiation.
Allow CADDY to DNS Allow Both TCP/UDP CADDY Any TRUSTED 10.0.10.5 53 Yes Allows Caddy host to query Technitium DNS server.
Allow CADDY to UDM Allow Both TCP CADDY 10.0.15.5 TRUSTED 10.0.1.1 443 Yes Allows Caddy to proxy the UDM Pro SE dashboard.
Allow CADDY to UNAS Allow Both TCP CADDY 10.0.15.5 TRUSTED 10.0.10.25 443 Yes Allows Caddy to proxy the UNAS Pro dashboard.
Allow CADDY to Synology Allow Both TCP CADDY 10.0.15.5 TRUSTED 10.0.10.24 5000,5001 Yes Allows Caddy to proxy the Synology NAS DSM dashboard (HTTP/HTTPS).
Allow Caddy to Arr Stack Allow Both TCP CADDY Any TRUSTED 10.0.10.20 5055,6767,7878,8000,8080,8096,8191,8282,8989,9696 Yes Allows Caddy to reach Arr-stack apps (Bazarr, Radarr, Gluetun, QBittorrent, Emby, Flaresolverr, Sabnzbd, Sonarr, Prowlarr, Seerr).
Allow Caddy to Immich Allow Both TCP CADDY 10.0.15.5 TRUSTED 10.0.10.15 2283 Yes Allows Caddy to proxy Immich (photo management) on LXC 102.
Allow Caddy to Youtarr Allow Both TCP CADDY 10.0.15.5 TRUSTED 10.0.10.14 3087 Yes Allows Caddy to proxy Youtarr on LXC 103.
Allow Caddy to Bento PDF Allow Both TCP CADDY 10.0.15.5 TRUSTED 10.0.10.6 8080 Yes Allows Caddy to proxy BentoPDF on LXC 105.
Allow Caddy to IT Tools Allow Both TCP CADDY 10.0.15.5 TRUSTED 10.0.10.7 80 Yes Allows Caddy to proxy IT-Tools on LXC 106.
Allow Caddy to Paperless Allow Both TCP CADDY 10.0.15.5 TRUSTED 10.0.10.11 8000 Yes Allows Caddy to proxy Paperless-ngx on LXC 107.
Allow Caddy to Beszel Allow Both TCP CADDY 10.0.15.5 TRUSTED 10.0.10.13 8090 Yes Allows Caddy to proxy the Beszel hub on LXC 108.
Allow Caddy to Rackula Allow Both TCP CADDY 10.0.15.5 TRUSTED 10.0.10.9 8080 Yes Allows Caddy to proxy Rackula (rack designer) on LXC 110.
Allow Caddy to Koffan Allow Both TCP CADDY 10.0.15.5 TRUSTED 10.0.10.12 8080 Yes Allows Caddy to proxy Koffan (grocery list) on LXC 111.
Allow Caddy to Hermes Allow Both TCP CADDY 10.0.15.5 TRUSTED 10.0.10.19 9119 Yes Allows Caddy to proxy the Hermes Agent dashboard on LXC 113.
Allow Caddy to HA Allow Both TCP CADDY Any IoT 10.0.30.6 8080, 8123 Yes Allows Caddy to proxy Home Assistant and Zigbee2MQTT.
Allow Caddy to PBS Allow Both TCP CADDY Any TRUSTED 10.0.10.8 8007 Yes Allows Caddy to proxy Proxmox Backup Server.
Allow Caddy to Proxmox Allow Both TCP CADDY Any TRUSTED 10.0.10.10 8006 Yes Allows Caddy to proxy Proxmox VE.
Allow Caddy to SLZ-06 Zigbee Allow Both TCP CADDY Any IoT 10.0.30.5 80 Yes Allows Caddy to proxy SLZB-06U Zigbee coordinator UI.
Allow Caddy to Technitium Allow Both TCP CADDY Any TRUSTED 10.0.10.5 5380 Yes Allows Caddy to proxy Technitium DNS admin UI.
Allow FAMILY to CADDY Allow Both TCP FAMILY Any CADDY Any 443 Yes Allows FAMILY devices to connect to Caddy web proxy (HTTPS only).
Allow FAMILY to UNAS Allow Both TCP FAMILY Any TRUSTED 10.0.10.25 445 Yes Allows FAMILY devices to connect to the UNAS Pro SMB share used by PhotoSync.
Allow FAMILY to DNS Allow Both TCP/UDP FAMILY Any TRUSTED 10.0.10.5 53 Yes Allows FAMILY devices to query Technitium DNS.
Allow GUEST to DNS Allow Both TCP/UDP GUEST Any TRUSTED 10.0.10.5 53 Yes Allows GUEST devices to query Technitium DNS.
Allow IoT to DNS Allow Both TCP/UDP IoT Any TRUSTED 10.0.10.5 53 Yes Allows IoT devices to query Technitium DNS.
Allow MEDIA to DNS Allow Both TCP/UDP MEDIA Any TRUSTED 10.0.10.5 53 Yes Allows MEDIA devices to query Technitium DNS.
Allow TRUSTED to CADDY Any Allow Both All TRUSTED Any CADDY Any Any Yes Allows TRUSTED to initiate any traffic to CADDY.
Allow TRUSTED to FAMILY Any Allow Both All TRUSTED Any FAMILY Any Any Yes Allows TRUSTED to initiate any traffic to FAMILY.
Allow TRUSTED to GUEST Any Allow Both All TRUSTED Any GUEST Any Any Yes Allows TRUSTED to initiate any traffic to GUEST.
Allow TRUSTED to IoT Any Allow Both All TRUSTED Any IoT Any Any Yes Allows TRUSTED to initiate any traffic to IoT.
Allow TRUSTED to MEDIA Any Allow Both All TRUSTED Any MEDIA Any Any Yes Allows TRUSTED to initiate any traffic to MEDIA.
Allow IoT to IoT Any Allow Both All IoT Any IoT Any Any Yes Allows unrestricted intra-zone IoT communication.
Allow TRUSTED to TRUSTED Any Allow Both All TRUSTED Any TRUSTED Any Any Yes Allows unrestricted intra-zone TRUSTED communication.
Block Family public DNS Block Both TCP/UDP FAMILY Any External Any 53 No Blocks FAMILY zone from querying public DNS resolvers.
Block GUEST public DNS Block Both TCP/UDP GUEST Any External Any 53 No Blocks GUEST zone from querying public DNS resolvers.
Block IoT public DNS Block Both TCP/UDP IoT Any External Any 53 No Blocks IoT zone from querying public DNS resolvers.
Block MEDIA public DNS Block Both TCP/UDP MEDIA Any External Any 53 No Blocks MEDIA zone from querying public DNS resolvers.
BLOCK FAMILY to Gateway Any Block Both All FAMILY Any Gateway Any Any No Blocks FAMILY from accessing UDM Gateway.
BLOCK GUEST to Gateway Any Block Both All GUEST Any Gateway Any Any No Blocks GUEST from accessing UDM Gateway.
BLOCK IoT to Gateway Any Block Both All IoT Any Gateway Any Any No Blocks IoT from accessing UDM Gateway.
BLOCK MEDIA to Gateway Any Block Both All MEDIA Any Gateway Any Any No Blocks MEDIA from accessing UDM Gateway.

Note

The direct rules Allow FAMILY to EMBY and Allow MEDIA to Emby have been deleted to enforce the security design requiring all app traffic to traverse the Caddy reverse proxy.