To carry out the tasks, a UniFi Controller is necessary. You can find an installer for the Proxmox UniFi Controller LXC in our Homelab repository.

The hardware in this recipe uses:

• UniFi Controller v8 or later
• 1x PiHole server
• 1x Ubiquiti UniFi Security Gateway 3P (USG)
• 1x Ubiquiti UniFi Switch 24
• 1x Ubiquiti UniFi Switch 8 POE-150W
• 1x Ubiquiti UniFi AP-AC-Pro
• 1x Ubiquiti UniFi AP-Lite
• 1x pfSense with 4 NICs
• Proxmox cluster (for UniFi Controller LXC)

Network prerequisites are:

• Layer 2 Network Switches
• Network Gateway is 192.168.1.5
• PiHole CT DNS server. Configured with Conditional Forwarding addresses:
  • Router DNS server (i.e 192.168.1.5 - UniFi DNS)
  • New LAN-vpngate-world DNS Server (i.e 192.168.30.5 - pfSense VLAN30)
  • New LAN-vpngate-local DNS Server (i.e 192.168.40.5 - pfSense VLAN40)

Other Prerequisites are:

• Installation of UniFi Controller on your PC or Proxmox UniFi Controller LXC

Before proceeding, we strongly advise that you familiarize yourself with network Local DNS and the importance of having a PiHole server. To learn more, click here.

It is essential to set your network's Local Domain or Search domain. For residential and small networks, we recommend using only top-level domain (spTLD) names because they cannot be resolved across the internet. Routers and DNS servers understand that ARPA requests they do not recognize should not be forwarded onto the public internet. It is best to select one of the following names: local, home.arpa, localdomain, or lan only. We strongly advise against using made-up names.

• 1. UniFi Controller
• 2. UniFi System Settings
• 3. UniFi Networks
  • 3.1. Edit Default LAN network
  • 3.2. Create UniFi Networks
  • 3.3. Global Network Settings
  • 3.4. Global Switch Settings
• 4. UniFi Wireless Networks
• 5. UniFi Profiles - IP Groups
• 6. UniFi Routing - Static Routes
• 7. UniFi Security
  • 7.1. General
  • 7.2. Firewall - Internet Out
    • 7.2.1. Firewall Internet Out - Block DNS list from all local LAN (excluding LAN-smart)
  • 7.3. Firewall - LAN IN
    • 7.3.1. Firewall LAN IN - Allow All Established and Related Sessions
    • 7.3.2. Firewall LAN IN - Accept all NTP Requests
    • 7.3.3. Firewall LAN IN - Allow Home interlan connectivity
    • 7.3.4. Firewall LAN IN - Allow NoT to MQTT
    • 7.3.5. Firewall LAN IN - Allow IoT to Home Assistant
    • 7.3.6. Firewall LAN IN - Allow LAN-smart to Media Server
    • 7.3.7. Firewall LAN IN - Block IoT from LAN
    • 7.3.8. Firewall LAN IN - Block IoT from NoT
    • 7.3.9. Firewall LAN IN - Block all NoT
  • 7.4. Firewall - Guest IN
    • 7.4.1. Firewall GUEST IN - Allow PiHole DNS in
  • 7.5. Port Forwarding
    • 7.5.1. Port Forwarding - HAProxy 80
    • 7.5.2. Port Forwarding - HAProxy 443
    • 7.5.3. Port Forwarding - HAProxy 8443

A Proxmox UniFi-Controller LXC installer is available in our Homelab repository.

Set your basic UniFi site (i.e home, location of site etc) preferences.

1. Navigate to Settings > System > General: -- Device Name: Unifi Controller -- Country: Select your nation -- Language: Select your language -- Timezone: Select your Timezone -- Time format: 24hrs
2. Navigate toSettings > System > Updates: -- Network Application Release Channel: official -- Device Firmware Release Channel: official -- Automate Device Updates: Daily at 03:00
3. Navigate to Settings > System > Advanced: -- Interface: new -- Network Time Protocol (NTP): Auto -- Email Services: SSO email -- Network Discovery: Enable -- Device Authentication: enable (set username and password)

We use VLANs to separate networks for easier management and to apply security policies.

1. Navigate to Settings > Networks > Default: -- Network name: default -- Gateway IP/Subnet: Host address 192.168.1.5, Netmask 24, 254 Usable hosts -- Advanced: Manual -- IGMP Snooping: enable -- Multicast DNS: disable -- DHCP Mode: DHCP Server -- DHCP Range: 192.168.1.150 - 192.168.1.250 -- Default Gateway: Auto -- DNS Server: 192.168.1.6, 1.1.1.1 (Note 192.168.1.6 is PiHole. If no PiHole use 192.168.1.5) -- Lease Time: 86400 -- Domain Name: local

Create the following new networks. Navigate to Settings > Networks > New Virtual Network and set the values as follows, remembering to click Save at the end of each new network. There is an OpenOffice calc file 'unifi_network_configuration.ods' in the repository for easy viewing.

1. Navigate to Settings > Networks: -- Global Network Settings -- IPv6 Support: disabled -- Multicast DNS: LAN-open, LAN-smart, LAN-medialab, LAN-homelab, LAN-IoT -- IGMP Snooping: Default, LAN-open, LAN-smart, LAN_guest, LAN-medialab, LAN-vpnserver, LAN-homelab, LAN-IoT, LAN-NoT, VPN-egress, LAN-transit-pfsense -- DHCP Snooping: enabled

1. Navigate to Settings > Networks: -- IPv6 Support: disable -- Multicast DNS: LAN-Open, LAN-smart, LAN-medialab, LAN-homelab, LAN-IoT -- IGMP Snooping: Default, LAN-open, LAN-smart, LAN-guest, LAN-medialab, LAN-vpnserver, LAN-homelab, LAN-IoT, VPN-egress, LAN-transit-pfsense

1. Navigate to Settings > Networks: -- DHCP Snooping: enable -- Spanning Tree Protocol: RSTP

Here we create wireless networks in VLAN increments of 10 (i.e VLAN10, VLAN20) which correspond to our Network settings.

1. Navigate to Settings > WiFi > +Create New and set the values as follows, remembering to click Apply Changes when done: -- Name/SSID: name-open (Choose your own SSID such as banana-open) -- Password: Common passphrase (Between 8 and 63 ASCII-encoded characters) -- Network: LAN-open -- Broadcasting APs: Group, All -- Advanced: Manual -- WiFi Band: 2.4 GHZ, 5 GHz -- BSS Transition: enabled -- Multicast enhancement: enabled -- 802.11 DTIM Period: Auto enabled -- Security Protocol: WPA2 -- Group rekey interval: 3600 Sec -- WiFi Scheduler: Off

Now repeat the procedure, using the above values except where shown (i.e Guest/IoT/NoT passphrase(s), Name/SSID, Guest Policy), creating new wireless networks on the following VLAN's:

Your finished configuration should resemble the image below:

You should create all your Profile Groups before creating firewall rules.

1. Navigate to Settings > Profiles > IP Groups > +Create New -- Profile Name: All DNS ports -- Type: Port Group -- Port: 53,853
2. Navigate to Settings > Profiles > IP Groups > +Create New -- Profile Name: All Home App/Nest/Chromecast/Netflix ports -- Type: Port Group -- Port: 1900,5353,5556,5558,8008,8009
3. Navigate to Settings > Profiles > IP Groups > +Create New -- Profile Name: All printer host IP addresses -- Type: IPv4 Address/Subnet -- Address: 192.168.1.91
4. Navigate to Settings > Profiles > IP Groups > +Create New -- Profile Name: All printer ports -- Type: Port Group -- Port: 137 Default generic SMB (works with Brother laser) -- Port: 138 Default generic SMB -- Port: 139 Default generic SMB -- Port: 631 ASCII laser printer (works with Brother laser) -- Port: 6310 ASCII laser printer -- Port: 9100 ASCII laser printer - IBM, Ricoh, HP, Lexmark -- Port: 9101 ASCII laser printer - Jetdirect, Marknet server
5. Navigate to Settings > Profiles > IP Groups > +Create New -- Profile Name: All Home host IP addresses -- Type: IPv4 Address/Subnet -- Address: 192.168.110.0/24, 192.168.80.0/24, 192.168.50.0/24, 192.168.20.0/24, 192.168.10.0/24
6. Navigate to Settings > Profiles > IP Groups > +Create New -- Profile Name: All IP addresses -- Type: IPv4 Address/Subnet -- Address: 0.0.0.0/1, 128.0.0.0/2, 192.0.0.0/3, 224.0.0.0/4
7. Navigate to Settings > Profiles > IP Groups > +Create New -- Profile Name: All local addresses -- Type: IPv4 Address/Subnet -- Address: 192.168.1.0/24, 192.168.10.0/24, 192.168.20.0/24, 192.168.50.0/24, 192.168.60.0/24, 192.168.80.0/24
8. Navigate to Settings > Profiles > IP Groups > +Create New -- Profile Name: All not LAN-smart local addresses -- Type: IPv4 Address/Subnet -- Address: 192.168.1.0/24, 192.168.10.0/24, 192.168.30.0/24, 192.168.40.0/24, 192.168.50.0/24, 192.168.3.0/28
9. Navigate to Settings > Profiles > IP Groups > +Create New -- Profile Name: All PiHole IP addresses -- Type: IPv4 Address/Subnet -- Address: 192.168.1.6
10. Navigate to Settings > Profiles > IP Groups > +Create New -- Profile Name: Block DNS IP addresses -- Type: IPv4 Address/Subnet -- Address: 8.8.4.4, 8.8.8.8
11. Navigate to Settings > Profiles > IP Groups > +Create New -- Profile Name: CCTV host IP addresses -- Type: IPv4 Address/Subnet -- Address: 127.0.0.1
12. Navigate to Settings > Profiles > IP Groups > +Create New -- Profile Name: CCTV ports -- Type: Port Group -- Port:
13. Navigate to Settings > Profiles > IP Groups > +Create New -- Profile Name: Home Assistant host IP addresses -- Type: IPv4 Address/Subnet -- Address: 192.168.110.131
14. Navigate to Settings > Profiles > IP Groups > +Create New -- Profile Name: LAN-vpngate-local addresses -- Type: IPv4 Address/Subnet -- Address: 192.168.40.0/24
15. Navigate to Settings > Profiles > IP Groups > +Create New -- Profile Name: LAN-vpngate-world addresses -- Type: IPv4 Address/Subnet -- Address: 192.168.30.0/24
16. Navigate to Settings > Profiles > IP Groups > +Create New -- Profile Name: Media server IP addresses -- Type: IPv4 Address/Subnet -- Address: 192.168.50.111 (or whatever your Jellyfin/Emby server IP is)
17. Navigate to Settings > Profiles > IP Groups > +Create New -- Profile Name: Media server ports -- Type: Port Group -- Port: 8096,8097,8920,32400,32410-32414, 32469 (these are Jellyfin, Emby and Plex ports)
18. Navigate to Settings > Profiles > IP Groups > +Create New -- Profile Name: MQTT ports -- Type: Port Group -- Port: 1883,8883
19. Navigate to Settings > Profiles > IP Groups > +Create New -- Profile Name: SSDP ports -- Type: Port Group -- Port: 1900

Set the values as follows, remembering to click Save at the end.

1. Navigate to Settings > Routing > +Create Entry -- Name: Route access to VLAN30 -- Distance: 1 -- Destination Network: 192.168.30.0/24 -- Type: Next Hop -- Next Hop: 192.168.3.1

2. Navigate to Settings > Routing > +Create Entry -- Name: Route access to VLAN40 -- Distance: 1 -- Destination Network: 192.168.40.0/24 -- Type: Next Hop -- Next Hop: 192.168.3.1

Here we create our Firewall rules, Port Forwarding and general security. Set the values as follows, remembering to click Save at the end.

1. Navigate to Settings > Security > General: -- Traffic Identification: enable -- Suspicious Activity: Advanced -- Network: Default, LAN-open, LAN-smart, LAN-guest, LAN-medialab, LAN-vpnserver, LAN-homelab, LAN-IoT, VPN-egress, LAN-transit-pfsense -- Filtering Action: No Action

Here we create most of our firewall rules under the Internet Tab. Navigate to Settings > Security > Firewall Rules > Internet and create the entries as follows, remembering to click Save at the end.

Here we create most of our firewall rules under the LAN Tab. Navigate to Settings > Security > Firewall Rules > LAN and create the entries as follows, remembering to click Save at the end.

Here we create most of our firewall rules under the Guest Tab. Navigate to Settings > Security > Firewall Rules > Guest and create the entries as follows, remembering to click Save at the end.

Here we create our port forwarding rules. Navigate to Settings > Security > Port Forwarding and set the values as follows, remembering to click Save at the end.