Hey, I have been trying to move my IoT devices from my home network onto one network on my lab equipment. Currently they live in my homelan, where I cannot easily deploy VLAN’s without replacing about 6 different AP’s & a few small switches.
Currently, my goal would be to setup a couple of VLAN’s for different cloud ecosystems of IoT devices I have deployed for my home using my Unifi hardware in my homelab, including a cloud gateway ultra, 48 port gigabit Poe switch & one ac-WAP. My goal would be limit these network from being only able to connect to the VLAN gateway & seperately defined IP’s/Domains names to allow communication with the manufacturers cloud. These devices will not be exposed publically to the internet.
I have been mostly able to achive my goals, execpt the setup that the devices can only connect to the whitelisted IP/Domain names.
Do you have suggestions on how this could be done?
I can probably setup a opnsense/pfsense vm’s for these on my lab cluster setup. Thanks for taking the time!
You mentioned these are now on unifi hardware in your homelab? My guess is that you used the stupid checkbox “isolate network” and unchecked the “allow internet access” when making the VLAN which prevents you from making individual allow rules. Instead you should be making a block rule for the VLAN manually instead of using a checkbox to make the same rule automatically. But the checkbox overrides everything, so dont use it if you ever want to have exceptions.
“isolate network” does not override firewall rules that are a higher priority than it in the policy engine of the firewall settings. It is fine to check as long as you have your rules and structure are set up properly.
If it doesn’t override them now then that is something new. Which definitely could be, as Unifi changes how things work quite often. Last year the checkboxes overrode any rules, and the auto-rule it created was a grayed out one in the rule list that you couldnt move or delete. That was before the “policy engine” update though. Ill have to check on this again and see how the behavior is in the current unifi version.
So, I am trying to setup/configure a couple of VLAN’s to block all traffic to sites that are not specifically on the whitelist & being able to use DHCP, DNS etc.
Hopefully I managed to be more clear this time..
I am assuming you meant the Policy engine->Policy table site in the unifi settings?
yeah, things do change. I preferedd the UI of the last version of the dashboard I used. And I have also had my save-file/running config-file getting corrupted with software upgrades, so I try to do that stuff whilist I actually have time to fix it…
Allright, so what you tried to suggest would have been like adding the following policies
For setting the baseline of blocking everything
Policy 1 - block all incoming traffic from VLAN/unifi network
Firewall:
-Source zone: source zone
-Source network: Networks where this policy should apply to
-port: any
-Destination Zone: External
-Schedule: Always
-Desc: Lorem ipsum
And to allow certain connections outside
Policy 2:
Firewall
-Source zone: source zone
-Source network: Networks where this policy should apply to
-Port: any
-Destination Zone: External
-IP/Domain specific list
-Port: required ports
-Connection state: All
-Schedule: always
Desc: Lorem ipsum
This is what I am guessing you meant? Also please try to stand my pseudo-network config policy.
In network 9.5.21 you can go to the policy engine > zones. Create a new rule with the source zone as “Internal”, select “Network” and pick your IoT vlan. Set the access to “Block”. Destination zone would be set to “External”. Choose “IP” then choose “specific”. Add any IPs that you want the vlan to have access to. Select “Match Opposite” so this iist becomes an allow list. You can then set port options and a schedule if you like.