Skip to main content

Network

WAN​

Port forwarding​

Firewall rules​

In addition to default rules.

NameActionSource ZoneDestination Zone
Allow UniFi remote accessAllowExternalGateway

Local network​

VLANs​

NameSubnetDescriptionIsolate network
Default192.168.1.0/24Default local network for laptops, family phones and tabletsNo
Pub192.168.50.0/24An isolated VLAN for public servicesNo
Guest192.168.5.0/24An isolated VLAN for guest WiFi accessNo
IoT192.168.6.0/24An isolated VLAN for connected home applianceNo
  • Device Isolation is disabled for all networks

Firewall zones​

NameBuilt inNetworks / Interfaces
Internal✅Default
External✅Primary (WAN1) Secondary (WAN2)
Gateway✅-
VPN✅Hearthstone VPS
Hotspot✅Guest
DMZ✅-
VLAN 50❌Pub
VLAN 6❌IoT

Zones access rules​

Additional Firewall rules allowing or blocking zone-to-zone or subnet-to-subnet communications.

Source ZoneDestination ZoneSourceDestinationActionDescription
InternalVLAN 50AllAllAllow with returnAllow all traffic from Default network to Pub
InternalVLAN 6AllAllAllow with returnAllow all traffic from Default network to IoT
VPNInternalVPS subnetAllAllow only returnAllow return traffic from VPS subnet to Default
VPNInternalVPS subnetAllBlockBlock VPS VPN clients from accessing the Default network
VPNHotspotVPS subnetAllBlockBlock VPS VPN clients from accessing the Guest network
VPNDMZVPS subnetAllBlockBlock VPS VPN clients from accessing the DMZ zone
VPNVLAN 50AllHearthstoneAllow allAllow Hearthstone VPN clients access to Pub network
VPNVLAN 6 (IoT)AllHearthstoneAllow allBlock Hearthstone VPN clients access to IoT network
VLAN 50VLAN 50AllAllAllow allAllow Pub network clients accessing each other

VPN​

There are two Wireguard servers configured:

  1. Hearthstone. Subnet 192.168.3.0/24. For external access to all local networks.
  2. VPS. Subnet 192.168.4.0/24. For accessing VPS servers as local network devices.