Unifi for Newbies - Securing with Firewall Rules

[@koputai]

Wow! Great video Tim, I didn’t expect to learn so much about firewall rules all at once. Thanks for this whole series, it’s fantastic stuff for a Unifi newb like me.

[@ethernetblueprint]

I'm so glad to hear that. Thanks for watching!

[@monkeyaround2066]

I want to thank you again for this whole series. For the amount of effort that you put into this series, I truly think you deserve much more recognition.

[@ethernetblueprint]

It’s truly my pleasure. I’m so glad that you’ve found it helpful.

[@kashisrinath007]

This is well thought out and a great set up. Thanks for walking us through this.

[@bendonahue101]

This series is amazing! I love the way you teach. I've learnt a lot about the Unifi system so far, but not just that, I've learnt a lot about networks in general, firewalls, ports etc. I had a basic understanding of them before, but these vids have built on that a lot. Thank you so much. Keep it up :)

[@ethernetblueprint]

Wow... That is great to hear. Thank you. I will do my very best to keep making content like this. I will have a Firewalls -part 2 coming out in the near future...

[@MadMike78]

Great video! I felt like this video was for my setup since it was Unifi, IOT, firewall and Sonos. I was able to setup everything! Subscribed.

[@ethernetblueprint]

I am so glad it was helpful to you! I appreciate the kind comment.

[@IsakBurger]

This is the best VLAN explanation and instruction video I have ever watched. It helped me so much!

[@ethernetblueprint]

I’m humbled by that. Thank you so much.

[@chopperdan6425]

Best video yet. PDF is a bonus that I was going to create. I like the way you've cleaned up the firewall rules from a previous video. Thanks for doing these.

[@ethernetblueprint]

You are very welcome. I hope it helps you out.

[@QruiseDoqtor]

@@ethernetblueprinti need to contact you directly for some help and advice

[@ethernetblueprint]

[e-mail]

[@edwind6580]

Thank you for making this video Tim. You explained the Firewall rules very well. Lot's of other peoples video's race through without thoroughly explaining them.

[@ethernetblueprint]

It truly is my pleasure. Thanks for watching.

[@QruiseDoqtor]

@@ethernetblueprinthow do i contact you directly pls

[@ethernetblueprint]

You can email me at [e-mail]

[@gregn267]

Wow! Complete coverage to help us with Unify/Ubiquity devices... Very well done, Thank you!

[@ethernetblueprint]

You are quite welcome. I hope you find it helpful and sub'd to the channel!

[@TommyBaugh-vq3sy]

Thank you for these videos. I now have the Unifi I have always wanted. Your delivery is spot on. Hope folks step up and contribute for all the effort you put into this.

[@ethernetblueprint]

Thank you for your kind words... Congrats on your setup and welcome to Unifi

[@CTJonathan333]

Thank you for creating this video!! Simple, slow and well explained I finally have implemented these firewall rules on my Unifi home network. Others content creators making Unifi videos even though there content is great also forget that some of us are newbies and then need to slow down as you did a phenomenal job doing. I had all this fancy hardware and for the last year I knew that it was only nice looking and not what it was designed to do. Now with these rules, I feel more like my network is more secure and I thank you again for making that happen.

[@ethernetblueprint]

Hey, that’s great. Congrats. Glad I could help. Thanks for watching.

[@sidetrack3d901]

I have to say a massive thank you! Not only for this video but for the previous ones too, you have not only helped my sort my unifi setup into something much better than it was, but also helped me understand the basics of networking in general. Clear and useful information which makes me much more confident in managing my network. Also the PDF is a great resource. I can't thank you enough.

[@ethernetblueprint]

You are quite welcome. I'm glad you found it helpful! All the best with your setup!

[@danightryder]

Amazing video, I just got a cloud gateway max and everything worked flawlessly. I can talk to my phillips hue bridge and other IoT devices with no issues.

[@ethernetblueprint]

Boom (Mic Drop). Nice work! Thanks so much for watching.

[@ot7302]

Got my Unifi gear month ago and your videos have been supper helpful. Thank you !!

[@ethernetblueprint]

Thanks for sharing that. I’m so happy to hear that.

[@GilbertP57]

That is a very good tutorial. I had a lot of that already but I have reorganised my FW rules using your nomenclature and it is now pretty much self-documented. I love it. Thank you

[@ethernetblueprint]

So glad it helped you! Appreciate your kind comment!

[@edseckler4472]

Fantastic video. I just migrated an EdgeRouter and Cloud Key Gen2 to the UCG-Ultra. Your video was a great help. Thank you.

[@ethernetblueprint]

Sweet. Congrats! You are so welcome!

[@edhead76]

I found this so helpful. Thank you for the thorough walk-through. It helped clear up some confusion on some of the more complex settings.

[@ethernetblueprint]

Great! I love hearing that. Congrats on your setup!

[@jasonluong3862]

The fact that this video is over 1 hour long shows that firewalls are a beast.

[@ethernetblueprint]

They can be.

[@BartNL]

Hi Tim, I'm new to UniFi, and thanks to your guidance, my firewall is now nicely set up! I really appreciate all the effort you put into your videos.

[@ethernetblueprint]

That's great. Congrats. Welcome to Unifi!

[@BartNL]

@@ethernetblueprint Thanks!

[@DigitalPainting]

I just brought the UDMse and was trying to set it up. This is the best video I've seen so far. You explained the firewall rules exceptionally well and easy to understand. Thank you for making this video!

[@ethernetblueprint]

I’m so happy to do it. Thank you for watching.

[@ImaITman]

Hi I work as a network engineer - Firewall rules should ALWAYS encompass every single possible eventuality. So if you're going super secure then you want to allow exactly what you want and then at the bottom if no traffic matches any other parameter you want a deny all rule. Something new comes online that you need to communicate and it's failing then you can add a rule for it. Basically you always want your last rule to be a catch all bucket of some kind.

[@ethernetblueprint]

I appreciate the insight. Thanks for watching!

[@kevinoconnor6570]

That is already in place with the use of rule #4 "Drop All Private IP Networks" that he has to prevent Inter-VLAN routing. To enforce this, you'd have to remove rule #1 "Allow Established and Related Traffic" and move these actions into each rule that was created for the granular level of access. At least that's how I see it but I may have overlooked something. I'm not a Unifi magician.

[@ImaITman]

@@kevinoconnor6570 I was actually speaking more to what's good practice and why you have a catch all. However, after reading your comment I went and actually reviewed the rules. I'm ignoring rule 1 because I don't know what Unifi calls related traffic - that's not an industry term. Rule 4 should be drop any any, instead of private addresses. Layer 3 switches can't distinguish between what is a public or private IP address, so unless Unifi builds tables into their switches that have the classifications then I could maliciously get onto the network using a static "public" IP and communicate within the network. This is more of a deeper discussion with firewall rules, so I'm not sure if it's worth discussing the topic. I do love networking though so I enjoy the communication, and I'm Always seeking to be proven wrong as that means I get to learn something new!

[@sekritskworl-sekrit_studios]

​@ethernetblueprint I'd love to see how this is written, and also printer access for guests.

[@wscottfunk]

Tim, these tutorials are awesome! Thank you for your time and effort in creating them! You're an excellent teacher and I appreciate you helping me get my network setup. Still learning and appreciate having your videos as a resource for setup and reference. 👍

[@ethernetblueprint]

Thanks Scott. Happy to help in any way I can. All the best!!

[@PeteBrownNZ]

OMG, thank you for this. It is the best I have found that helped me set up my new unifi network and vlans. The PDF was so helpful. Thank you for your time and effort :)

[@ethernetblueprint]

It was my pleasure! Thank you for watching!

[@John-if8sx]

Just what I was looking for. Thank you

[@ethernetblueprint]

That's all I can ask for!

[@TerrorswellFPV]

Easy to understand and well done. Thanks!

[@ethernetblueprint]

Thanks! I hope it was helpful to you in some way!

[@dwinterx]

What a fantastic tutorial. I already had some rules and VLANs set up, but the way Unifi implements this stuff is a bit odd compared to other firewalls. Your explanation was fantastic and very easy to follow, thanks again!

[@ethernetblueprint]

I'm so happy you found it helpful!

[@dirkh5088]

Very well made... i like the way you point out to all the small things which are obvius for those who are using this GUI for a long time. One thing for the naming convention of firewall rules: There are several auto-generated rules, which appear and disapperar depending on some checkboxes, i.e. Guest Network, Isolate Network, Port Forwarding and so on. For a better overwview i chosse names in this way: all rules from myself have only small chars, all auto-generated are starting with a capital letter, so it is very clear which ones i made and wich ones are system generated. All Profile IP groups are named , i.e. "ipg block vLAN gateways block 24 28 29". All Port groups are named , i.e. , and all Port Forwarings are named , i.e. "pf wan to 443 for HomeConfig"

[@ethernetblueprint]

That is so smart... I'm glad you took this info and changed it to fit you. That is what it is all about. Thanks so much for watching.

[@ParcoUpchurch]

I am subscribed. As a newbie, I feel so much better with these settings I added to my simple vlan. I will keep learning and reading however thank you Sir for a HUGE leap forward for someone who knew nothing about vlans/firewalls. I was just told by a friend to get Unifi equip and APs for my new home but had no idea of the rest, LOL

[@ethernetblueprint]

I am super glad it was helpful to you. Best of luck with your project!

[@ParcoUpchurch]

@@ethernetblueprint Question Sir. Trying to intergrate Unifi into my Home Assistant. My Unifi is on my default LAN, and my Home Assistant is on my IoT. I do have firewalls set up following your video. Do I need some form of firewall rule to see my Unifi? If yes do I need to make a LanIN or a LanOut for Home Assistant to see the IP for Unifi?

[@scottglinski]

Thanks, this was an incredibly useful video. I struggled following along with other walk throughs because they were outdated for the current Unifi UI. This video and the companion pdf was incredibly helpful for setting the rules I needed, which were slightly different from yours.

[@ethernetblueprint]

I’m so glad to hear that. Thank you so much for watching.

[@ITOuwegem]

Thank for this series of videos. Very helpfull and clear explanation

[@ethernetblueprint]

So glad you found it helpful. Thanks for watching.

[@antant7522]

Thank you. Awesome. Quite possibly the most helpful video on the entire internet.

[@ethernetblueprint]

Best compliment Ever!! Thanks.

[@flobow8446]

Thank you for the video, the established connections rules , was missing at my rules now its working. I like the approach to just drop any other Private IP if the rules don't match. Thanks for your guide , get everything working as I needed. I restricted my Default Network a little bit more, it should not get to all networks. So i created a restricted network group instead of the Private Address All Group.

[@ethernetblueprint]

That is perfect. This is meant to give a good starting point and hopefully teach the basics so you can add rules in your home to customize your needs... Thanks for watching! Glad it helped!

[@zertyfield]

Wow, this is incredibly helpful and exactly what I wanted to know. Thank you very much!

[@ethernetblueprint]

You are so welcome! Thanks for watching!

[@mar1video]

Great tutorial ! Thank you so much for posting it !

[@ethernetblueprint]

You are quite welcome. The series has been a lot of work, but I am happy to share it!

[@1205matthew]

This is the best tutoirial ive seen on here that is relevant to eexactly what i needed.

[@ethernetblueprint]

Thanks very much. I am glad you found it helpful.

[@davidweiner3365]

Tim.... thanks very much for that video on firewall rules, very helpful. It was fantastic. I greatly appreciate you building on the previous version of this and providing the lists of profiles and rules in nice consolidated lists.

[@ethernetblueprint]

I am so happy to do it as long as you all find it helpful. Thanks so much for watching!

[@kamarleyj]

There's nothing more annoying than when different brands use different terminologies for the same thing. I usually work with FortiGates, so it took me a minute to wrap my brain around UniFi's way of doing things. Thank you for saving me a lot of time and headache-I've finally got everything secured correctly.

[@ethernetblueprint]

I hear you. I came from the Cisco world myself. Glad you’re good to go now.

[@ozmosyd]

Having in the last week moved into the Unifi eco system this was exactly what I was looking for. See how things are done then configure away ... -SUB'd

[@ethernetblueprint]

Hey thanks! Glad you found it helpful!

[@plrpilot]

Excellent. I would suggest adding some rules to cover the following services, which you'll find in many IOT networks. mDNS (your rules will start blocking some of the automatic mDNS rules), DHCP and NTP. I haven't watched all of your videos, so you may cover this later, but having the logging enabled for the rules (at least for a while) will allow the user to look at "flows" under "insights" and see what traffic they may be inadvertently blocking in their setup. Very good tutorial -- thanks for posting.

[@ethernetblueprint]

I appreciate your comment and suggestion. I will say that with this series especially, I am trying to keep this very beginner level since many of my followers are new to this. I think logging rules and checking flows would be a bit advanced. Either way, you are very correct. If DNS, DHCP, and NTP are things you want to control, then you would probably need rules for that. Unifi does have an mDNS checkbox that allows you to add the VLANs you want to talk and that does allow that to happen outside the firewall...

[@blewis7359]

Nice video series. As a newbie to the ecosystem this is very helpful. Perhaps in a related video you can detail how parents can secure the network fro social media for our kids - that would be a huge plus. Thanks again!

[@ethernetblueprint]

Check out this video I created on my channel... kzbin.info/www/bejne/oZKXY2ilrth9ask. I do have another video coming soon that talks about a device called Firewalla, which is what I use at my house for this...

[@32Senna46]

Thank you Tim this was really helpful.

[@ethernetblueprint]

You are quite welcome!

[@teammoderngeeks]

Great video, thank you so much!

[@ethernetblueprint]

You are so welcome. Thanks for watching!

[@Kixbox78]

This is absolutely fantastic! Thank you for taking the time to put this out in the universe. I can only imagine the amount of time and thought it took - well done mate. I have few questions and looking for your thoughts. For context, i have the exact same network hardware you have. I am a HomeKit ecosystem user and use Homebridge to bring Samsung TVs to Apple Home. I’d like to use that to bring the Unifi Protect to Apple Home as well. My Homebridge VM is on the IoT vlan. 1) what is the best way to get the Homebridge VM to engage w the NVR and cameras - in firewall terms? 2) should I move the Homebridge VM to a trusted network for ease access to protect controller (UDM Pro in my case)? Thoughts? I suspect Rule #8 will limit a good implementation of Homebridge>Unifi Protect>HomeKit... I recognize this could be out of scope for the series but I think the use case is real. I am sure you will have good perspectives to share :). Thanks in advance Always willing to learn from others.

[@ethernetblueprint]

You should be able to create a rule(s) that allows your cameras to talk to your homebridge VM... Make sure that is a static or reserved IP so it never changes, then put all of your camera IPs into an IP group and then allow communication from that IP group to your Homebridge IP. Make sure that rule is moved up in the order so it is executed before the block all rule. I don't have a ton of experience with homebridge, but you should be able to do with FW rules and not need to move your server to another VLAN...

[@Kixbox78]

@ thank you. I am going to give this a shot tonight. Appreciate you

[@paulstemmler9879]

Your videos are absolutely awesome

[@ethernetblueprint]

Thanks so much. I appreciate that. Thanks for taking the time to watch them.

[@Frulvolaya]

Fantastic videos. Keep it up!

[@ethernetblueprint]

Thanks so much.

[@underseavision6771]

This is an excellent video. Thank you

[@ethernetblueprint]

Thanks. I am glad you found it helpful!

[@underseavision6771]

@@ethernetblueprint would you know if this also works across a site to site VPN. Limit remote subnet access to local default and controller.

[@ethernetblueprint]

Yes, it would. As long as you had the firewall rules set for the local subnets use in the VPN....

[@chrisjchalifoux]

Thank you for the video it is helping me out a lot

[@ethernetblueprint]

Happy to help. Thanks for watching!

[@ahmadsti]

Great video very helpful love the pihole setup, would love to know how to do some of the common homelab stuff such as plex, home assistant and youtube cast and other lovely project that made me get started with unifi but i am still newbie

[@ethernetblueprint]

I can say that I have done this exact setup in homes that are using Home Assistant with Sonos, Lutron, unifi cameras and all sorts of other smart gadgets... The users of that space were able to be on the secure VLAN and still communicate with home assistant devices.... Sonos was the only challenge, but I think we found a workaround for that as well...

[@jsnleary]

Excellent instructional video

[@ethernetblueprint]

Thanks so much. Appreciate you watching.

[@CBHTech]

Many thanks, Tim, for taking the time to explain this so clearly. It is the most confusing aspect for a newbie like me. Can you also explain when you would use rules under the categories not covered in this video - the Internet rules and the LAN Out rules. What are they used for?

[@ethernetblueprint]

Well, LAN out Rules can be used for VLANs too but would be setup differently than these to achieve the results you’re looking for. WAN Rules are for allowing or blocking access from the internet. Then there are the IPv6 rules (the ones we were setting are IPv4) which are a different type of IP addressing. That may require its own video to explain that.

[@anpc86]

Thanks Tim for this video. I am only part way through the journey. Got the networks setup and wifis setup, going to add some IOT devices to check if i did this correctly. I'll continue after Prime Day or Black Friday and add the doorbell/cameras. I hope you do one with Unify Protect 5.0, I heard they allow now non-Ubiquiti cameras via ONVIF.

[@ethernetblueprint]

I do plan on doing something on that, but I have to buy all my own devices for testing and I don't have any ONVIF devices at the moment. Now, that being said, I have heard that the FW rules in Protect 5.0 is a little buggy at the moment... so I am hoping that gets a little more stable soon.

[@anpc86]

@@ethernetblueprint makes sense, look forward to it I'm looking at the reolink cameras I didn't know about the buggy firewall rules but did hear Protect 5.0 needs improvement with the onvif support but as first iteration it's heading in the right direction Thanks again for the help, I did get my iot device on the IoT network and it works!

[@ethernetblueprint]

Nice. Congrats. I definitely expect to see a lot of improvements with the ONVIF Support soon.

[@koncknoc]

Very helpful!!! Thank you

[@ethernetblueprint]

Thank you very much for your generosity! You are too kind!

[@user-r1g5i]

Thank you so much!

[@ethernetblueprint]

You are quite welcome. I hope it helped!

[@zero604]

I was watching your other VLAN video "NEW to UNIFI VLANs?? START HERE!!!" where you created a port group that included all gateway IPs except for IOT. I was thinking to myself, couldn't I create a port group that includes ALL gateways and just add an Allow rule for IOT to access it's own gateway. This way we don't have to create separate port groups whenver we add more VLANs. This video answered my question :D

[@ethernetblueprint]

I got that question a lot in the comments of that video so I had to find out for myself. Glad I was able to answer it for you as well.

[@LarryF-v3k]

Thank you for all the time and effort to create this course. I must have missed it watching all the videos in one sitting - If connecting directly hardwired from device to switch which VLAN is connected? Is each input on the switch mapped to a specific VLAN is settings? If you covered this the timestamp would be great. Thanks again

[@ethernetblueprint]

If you plug either a "dummy switch" or a Unifi switch into a port that is assigned to the IOT VLAN (for example), yes, all the ports on that new switch will be in that VLAN... AND, if that switch is a managed switch that can do VLANs, then you will break its ability to change ports to a different VLAN. To do VLANs on the secondary switch, it would need to be set as a trunk port.

[@ToddStiggins]

This is an awesome series! Thanks! One issue I'm still having is allowing users on my Guest Network access to my printer using AirPrint. I was able to allow access to the printer by using a fixed IP and going to Insights > Hotspot > Landing Page > Settings > Authorization Access > Pre-Authorization Allowances and putting in the printer's fixed IP. AirPrint works from my Default Network and the Network the printer is on, just not from the Guest Network. Any ideas?

[@ethernetblueprint]

There are Guest FW rules too that automatically get put in place when you check the hotspot, landing page boxes on the network. I would go in those rules and create one that allows the network to talk to the printer IP to see if that helps.

[@alexfernandez9290]

great video

[@ethernetblueprint]

Thanks so much. I hope it helped you in some way!

[@Nerdguy-q9x]

Amazing video that’s helped me setup my home system !! Just a question, I have purchased a g4 Poe doorbell do I put this on the camera network or IOT. Need to get notifications on my mobile for the door ringing and also I assume my Viewpoint (cctv viewing device for tv) needs to go on camera VLAN?

[@ethernetblueprint]

In my firewall rule sheet, you’ll notice that I have a Camera VLAN that is configured differently. That is because the cameras need to talk to their own gateway so they can record their footage. So you can put the doorbell on the IOT network, but you would need to set up the firewall rules like I have the camera network in my example. Or, you can just create a Camera network and put the G4 out there by itself. Up to you, but the firewall rules need to be set up like the camera example.

[@Josh-od6oc]

Awesome video series! I have one question. I have a G4 Instant and therefore thought that I needed to create a Camera Wifi network group for it. You touched on it very briefly. Is there anything I would need to do for that?

[@ethernetblueprint]

Thank you... The Firewall rules affect ANY device on the IOT network (wired or wifi), so you shouldn't have to do anything special for that one camera... The directions here would work for that too - even though it is WiFi. Unless I am missing something in your question...

[@jasonharvey9649]

Great Bootstrap into this, just can you also add the information of the subnets for the IP Profile groups ipv6 ? You have the ranges for the ipv4's but not for the ipv6's

[@ethernetblueprint]

I will have to look into that. I have setup many homes and up to now haven’t had a need to utilize IPv6. Is there a reason you’re planning on using it in your home?

[@JohnDae-f4h]

Hi Tim, just came accross the 8 part series UNIFI FOR NEWBIES, great set of videos. I do have a couple of questions 1. On the Firewall Guide, IP Group #1 Private IP Addresses, please explain what the three (3) addresses are. 2. If you had a SimpliSafe or Ring alarm system with wireless cameras would you suggest putting them in their own vlan with rules to stop all traffic to and from other vlans, and still be able to talk to and from the home (default) vlan. Thanks and once again... Great Series

[@ethernetblueprint]

Can you send me an email? Might be hard to answer all this in the comments… [e-mail]

[@kamarleyj]

1. These IP ranges ensure that the firewall rules apply to all devices within those subnets. These IPs are only used in private networks, meaning any device connected to a router in a local area network will use addresses like 192.168.x.x, 172.16.x.x, or 10.x.x.x. An example of a non-private IP would be something like 8.8.8.8, which is a public IP used on the internet. 2. It can be good practise to seprate your SimpliSage/Ring. A slightly different example but shares the same concept of security, is, separating an access point across different VLANs can help protect it. You might have it give off separate networks for guests, home, CCTV, etc., while dedicating one VLAN purely for remoting into the access point to manage it. This keeps the management interface secure and prevents tampering. Plus, if one system is compromised, the others remain unaffected. While some might see this as overkill, it’s a solid approach to network security.

[@tommychambers9220]

Great videos! Thank you for putting these together! I have a Synology NAS on my network. It hosts a Plex server along with file shares right now. My question for you and the group is, what is the best practice for which vlan to it on?

[@ethernetblueprint]

I run my Synology NAS with Plex on my IOT network where my TVs are networked... I still have access to it from the main network, but I have it IP'd on the IOT VLAN... Works great. Part of my reasoning for that though was because I had plex running in a docker and kind of had to do this way. If you use VMware for you Plex server, I think you have some more options...

[@tommychambers9220]

@@ethernetblueprint Thank you!!!!

[@kevinbs05]

So this is awesome, thanks for putting it together. 2 questions. 1. Why can't we just use standard and just say block iot network from the rest both directions? Then add a rule to allow traffic from the core network to all other networks (or as needed). 2. I tested it out and it seems fine but do I need to add any rules for the guest network or just stick with existing rules and selecting guest network in the network?

[@ethernetblueprint]

There are a ton of different ways of doing this, so if that way works for you, and it’s easy to understand better, go with it. There isn’t a right and wrong way. I just wanted to create this to give people a starting point, but I encourage my viewers to take it from there and adjust things to fit their own Preferences.

[@woojah5819]

Thank you so much for this series. I am learning about VLANs and this was very helpful. The only issue I am running into is that I am unable to ping the Guest VLAN from the Default VLAN. Is this by design with the rules that Unifi created? I am not using the landing page/agreement scenario.

[@ethernetblueprint]

If you setup the Guest network to be isolated, I don't think ping will work. Because we used the built in Guest checkbox to make these rules, you may need to add a rule allow that communication.

[@davidjaymartin]

Great series! Thanks for putting it together. I'm wondering if you would consider adding a video that covers port forwarding. I have a Google WiFi mesh in place that I have attached to my Cloud Gateway Max. I have tried finding information on how best to set this up without setting the Google devices to bridge mode but everything I've found online says that it can't be done without port forwarding. This seems to be a very common problem that there are a ton of forum posts on, but I have yet to find the proper configuration. Thanks!

[@ethernetblueprint]

Thanks. Thanks for the suggestion. I will tell you that if you have your Google mesh in "router mode", it will be difficult to take advantage of the Fw rules in this video... You essentially have multiple routers and the rules you put in place on the CGM, would not affect the devices connected to the Google devices. Bridge mode may solve this, but I guess I'm not sure what you are going for or what you are looking to do with the 2 systems. What would you be looking to do with the port forwarding?

[@davidjaymartin]

@ethernetblueprint My first concern is Home Assistant. I want to make sure HA can communicate with everything, wired or wireless. My current setup is AT&T Fiber Router (in passthrough mode) -> Cloud Gateway Max -> Google Wifi. Anything hardwired goes to a Unifi device. Anything wireless goes through Google, with the exception of the HA sitting on a Pi and hardwired to the Google WiFi router. I have port forwarding set for port 8123 on the Google router and that is enabling me to get to the HA from a wired machine. I have yet to add an IOT device to the wired network, but I didn't know enough to know if it's going to work. My second concern is my Plex server. Am I going to need to wire that into the Google router or can I keep it on the Unifi network and enable port forwarding in a way that my wireless devices can get to it? Thanks!

[@ethernetblueprint]

Can you put the Google WiFi Pucks in "AP Mode" so they are no longer acting as a router and handing out IP Addresses?? If not, I think your setup is going to give you a lot of challenges, even with port forwarding setup.

[@davidjaymartin]

@@ethernetblueprint I think the closest setting to this is to put the Google WiFi router in bridge mode. Unfortunately, this disables the mesh functionality.

[@davidjaymartin]

@@ethernetblueprint I've had some success. For my Plex server which is hardwired on the Unifi network, I set port forwarding for 32400 (TCP/UDP) on the Google router for any device that needs to get to Plex from wifi and it seems to be letting those devices find the server. Google TV, Android tablet and phone. I still need to setup a wired IOT device so I can see if the port forwarding configuration for Home Assistant is working. I'll report back once I get around to that.

[@paultech9385]

Unifi encourages using traffic rules. You may want to do a followup video on those.

[@ethernetblueprint]

I will have a separate video on traffic rules...

[@williamfinlay4403]

Very useful video, thanks. You used firewall rules to isolate a network but could you explain how the "Isolate Network" setting is used? For example could you isolate a network and then use firewall rules to allow certain traffic through? Does the "Isolate Network" check box just automatically do what you set up manually?

[@ethernetblueprint]

You bet. I talk about the isolate network in the Guest WiFi Video 5 (but just briefly). If you check that box, it will block access each of the other VLANs... However, it will not block access to the router like we do in rules 5-8 (LAN Local Rules) - So, if that was important to you, you would need to add those rules in addition to checking the box. Hope that helps and thanks for watching!

[@ulrikstokkebokjr4129]

Awesome video! Finally understood it and got it up and running. One thing I’m not sure about is that other tutorial i see they block only HTTP/HTTPS and SSH ports for gateway, but here it seems we block the whole gateway? Whats the diffrence? Followed your guide, even adding a couple of extra rules but curious!

[@ethernetblueprint]

It is just 2 ways to do the same thing... as a matter of fact, my other VLAN videos just do the HTTP/HTTPS and SSH rules like those other videos... They both offer security... I would go with whatever you are comfortable with....

[@ulrikstokkebokjr4129]

@ thanks, i was in the understanding that this way blocked also internet acess but this way workes for me, and your great explanation made me able to make some custom rules that was needed for my setup..

[@ethernetblueprint]

Perfect. That is exactly what I was hoping for... Good luck!

[@arthurhernandez]

this is fantastic

[@ethernetblueprint]

So glad you liked it. Thanks for watching.

[@haraldschmitt6769]

very, very good, thank you

[@ethernetblueprint]

You are so welcome. Thanks for watching!

[@AlexNapfer-oc8gv]

Thanks a lot for the video & pdf :) Interesting fact: I have a pi-hole for DNS in my Default network. After applying rule 1-4 and 6 i can not ping or use the pihole web interface or the gateways from the IOT network as expected, BUT the nslookup still works and the answer is comming from my pi-hole. I made a wireshark trace and the answer is indeed coming from my pi-hole. I assume this works without rule 5 (allow dns port 53) because i distribute the pi-hole IP as dns server by dhcp with the UDM as the only dns entry and the UDM manages this internally.

[@ethernetblueprint]

Maybe try editing the LAN-IN rule for the IOT Network to the PI hole device to an any any rule and not just limit it to port 53. I haven't used pihole before and don't know if it uses other ports outside of 53. You could pause the rules one at a time to see if any of them fix the issue.. then you know where you need to look. I'm sorry I don't know more about the pihole... never used one.

[@caseyseaborne]

Great video! How does ids/ips play into all this? Is that something we should turn on in addition to firewall rules? Does it affect online gaming experience? (NAT open/closed)

[@ethernetblueprint]

Yes... IDS/IPS are additional security benefits that you can turn on for extra protection benefits like DOS attacks or random overseas IP addresses trying to gain access to your network.. I do recommend having these turned on in addition to FW rules which are for your internal VLANs. These services do add overhead to your router and "can" reduce internet speeds. This depends on your equipment capabilities. In general, your gaming should still work fine though. Or at least that has been my case. I have mine turned on and set to strict and gaming still works fine...

[@cdeh2001]

Tim, this was a great video. Thanks for making it. I did have one question? Can you give an example of the LAN IN rule for the NOTE part of rule #5 for using another DNS server?

[@ethernetblueprint]

Let me see if I can do this in a comment... If you still have questions you can send me an email to [e-mail] and I can give a litte more info. You will need to create an IP Port Group for the DNS Server. It should just include the IP address of the DNS Server. Type - Name - Action - Src Type - Address - Port - Dst Type - Address - Port - Match State LAN IN - "Allow IOT to DNS Server" - Allow - IOT VLAN - Any - Port Grp - New DNS Server - No Action Required

[@mikev1766]

I'm hoping you, or anyone here, can help clarify my understanding a little bit as I'd love to have a firm fundamental grasp on this. First, this is an amazing series. Thank you for the time you have put into making this video series. Amazing wealth of knowledge here. My question, I don't understand HOW the rules block your pinging. If they are executed top down until a match is found, how is the first rule (Allow established ANY-ANY) not satisfied and executed when you try to ping the device on a different VLAN; is that not an established connection? How is a ping not satisfying rule 1 and then, as a result, making its way to rule 4 and then dropped. My surface understanding right now is a ping from Default to VLAN3, lets say, is allowed by rule 3, establishes a connection, so the ping back is they satisfied by rule 1....but why/how? Why is Default to VLAN3 not allowed through with just the 1st rule? Also why is private IP group, listing all private IPs under the sun, needed vs using "ANY"? Thank you SO much!

[@ethernetblueprint]

Its a good question... A ping is not considered part of an established/related traffic. It is viewed different as standard network intercommunication. This is because "it operates on a lower level of the network protocol stack (ICMP) and is essentially a single, short-lived communication used to check reachability" As far as the private IP group. There are many ways to handle this. You could an Any any too. I like using IP groups to allow you to have more control of the rules. Any Any rules can be tougher to troubleshoot IMO...

[@mikev1766]

@@ethernetblueprint Thank you for the response and clarification on my questions. Ah, so private IP groups is just good up front "housekeeping" as it were.

[@ethernetblueprint]

You got it! Just covers all your bases. But it is optional.

[@look4terry]

Hi, really nice video. I have a granny unit I rent and supply internet for. It was nice to know how to isolate that traffic from mine, as well and the IoT, camera, and Guest traffic. I used the Guest button for the guest network and started to use the isolate button for IOT and Granny and realize it is not quite the same as the rules you suggest. I used yours. Things seem to be working well but I can't ping devices from default to one of the isolated networks. Is that expected?

[@ethernetblueprint]

Hi there... If you set up the rules like I have in the video and have the "allow default to Any" (right below "allow established and related" and "drop invalid") but still on top of your blocking rules, you should be able to ping from the default to that VLAN. I have found there are other factors the block ping like windows firewalls or maybe you still have the isolate button checked on that VLAN that you can't ping... maybe?!? If you set it up like my rules, you should be able to ping it.

[@look4terry]

@@ethernetblueprint Thanks for the response. Everything looks like the way you set it up. I have seemed to notice that when I have changed things, sometimes incorrectly, and change them back the network gets confused. I assigned a VLAN to a port on my switch and then decided that was not a good thing and changed it back. It seemed to hold on to that setting. When things get quiet I may power cycle a few pieces of equipment.

[@jeremy_317]

Great video! Just jumped right into the Unifi system from the "cookie cutter ISP setups". I noticed that the "Rule #2: Drop Invalid Traffic - This Rule blocks all packets on the LAN that are not Valid" - I noticed on my own network this has triggered/has a lot of initiations from the insights tab ("inspection" section) in the Unifi console...Happening in the middle of the night for a lot of apple/other reputable device (very high number on the ports indicating private usage?)... Are these general updates for the devices, or a little bit of "everything" including suspicious activity. Looks like onto learning wireshark to dive into these data packets

[@ethernetblueprint]

There can be quite a bit of invalid traffic on a network... and this can encompass quite a bit. Many times, this is a network session not properly closing with the correct tags in it...

[@markvk42]

A truly amazing video, Thanks, ill have to watch it a few times to absorb it all but thanks. Any chance of one on setting up VPN server rules? i cant access local guis with wireguard

[@ethernetblueprint]

Thank you. I have it on the list for VPN, but I have tripple NAT going on right now so, I will be looking to talk VPN once I get my new Fiber service running and my verizon is my backup.

[@markvk42]

@@ethernetblueprint cool sounds like you have lots of fun times ahead of you. I sorted the issue with guis, it was a DNS issue (another video for you!) Now i have to solve the issue with the VPN client blocking WiFi Calling.

[@SStrunks]

Hello. I just want to start off by saying thank you very much for this Newbies mini series. It's helped me out a great deal. Regarding your comment about getting all the VLANs, Wifis and devices up first to see if they're working, then create firewall rules after because something can get broken during firewall rule creation. Would it apply to streaming devices and casting feature in those devices? I'm having trouble getting my phone to cast in various apps such as Netflix, KZbin, Disney, etc. I have multicast enhancement on, mDNS is on, IGMP snooping is on. I can't for the life of me get my phone on my default VLAN to cast to my Roku in my IOT VLAN. I CAN however use airplay from my phone to my Roku just fine. I'm wondering if I need to just go ahead and create these rules to see if the casting feature ends up working after all this? I looked up this issue and it seems to be an ongoing thing that was never repaired by Ubiquiti.

[@ethernetblueprint]

Does the casting feature work when your phone and Roku are on the same network? I will say that having VLANs can cause things like this to happen... not all communication protocols play nice with different VLANs... I did a quick google search and it specifically states that Casting to a Roku does not work when VLANs are in play. (but that was a quick 5 min search... I didn't research it any deeper than that)

[@SStrunks]

@@ethernetblueprint Yes, casting works when the Roku is on the same VLAN as my phone. Thank you for your response. I have opened a ticket with Ubiquiti. I did a lot of searching around the internet on this topic as well. I'm surprised it's still an issue to this day. Lots of the reported issues have dates going back like 4 years ago. None of the threads and posts I saw ever has a definitive solution. I hope Ubiquiti can resolve this, it seems like such a common use case to not have work on a system this sophisticated.

[@ethernetblueprint]

And I feel it is a limitation with Roku... Not Ubiquiti...

[@SStrunks]

@@ethernetblueprint yeah casting works perfectly when the phone is on the same VLAN as the Roku. I looked this up and it’s been an ongoing issue forever. Apparently other Ubiquiti routers you’re able to do some work arounds and configure it by editing some .json. Unfortunately you can’t do that on the dream machine pro. But you’re right, it probably can work on Ubiquiti, but whatever settings I need to enable doesn’t seem to be working. I have an open ticket with Ubiquiti, so far they suggested a bunch of things I’ve already tried and still can’t get it to work.

[@Man_Yu]

Thank you for your effort, the great video and the clear instructions and presentations! Three questions came to my mind: 1.) If I select "Block All" to the vlan tagging on the several ports in the port manager..... isn´t it redundant to the firewall rules? 2.) What is the better choice (also for Client Vlans)? To block every other vlan gateway except own gateway (only for http(s) and SSH traffic, so DNS and Ping etc will still work) or block every GW including own GW but allow DNS only? 3.) After isolating VLAN and setting specific allow rules (e.g. Synology to client PC) I can reach the devices by IP, but not by hostname anymore. The hostnames have been filled out with their IP in the Unifi DNS Tab under Routing. Each VLAN has its own Gateway set as DNS Server. Do you have a clue what I am missing? Stay healthy and best regards

[@ethernetblueprint]

Thanks for the reply. 1) The FW rules and the switch port tagging work together to allow or block access. By setting the "block all" setting at the port level, you ensure that the device connected can only communicate on that network. Trunk ports really only come into play with VMWare like servers, switch to switch communication, AP communication... any device that hands out and communicates on multiple VLANs while plugged into a single port. Most of your devices (PCs, IOT Devices, Printers) should be set to Block all and just communicate on the single network. Your Synology may be an exception to this if you have it communicating on different VLANs at the same time. Then leaving it on the allow all port would be best. 2) It is really up to the user. Pros and Cons to both. If you block everything and choose to just allow the ports that need open, if you add a technology into the home (plex server for example), you would have to go open those ports for it to work. If you allow most ports to be open, but just block access to the local device on ssh, https and http, then it can make it easier to add other technologies down the road (IMO) 3) DNS can be tricky. I have my synology on my IOT VLAN and sometimes my PC will get to my files by DNS name and other times not. I don't think is a FW rule that is stopping it. I think it is the fact that Unifi DNS isn't the best. You may be better served to use an outside DNS to avoid some of the finicky issues like this... Its kind of trial and error. Sorry I can't give you a better answer. Hope this helps!

[@Man_Yu]

​@@ethernetblueprint Dear Tim, thank you again for your kind, fast and professional answer. As you mentioned the Unifi DNS in its current state is not reliable for different VLANs, at least from what I have tested the previous days. I switched to a rasberry pi with pihole + unbound installed and together with your best practice tips regarding the firewall rules and the comments, I managed to get it all working, with only the minimum machines and ports allowed for the adblocking and the name resolution. The gateways are not accessible inside the 6 vlans , the 6 vlans are separated and the pihole Interface recognizes every client + I can configure proper A-Records. Thank you so much again for these great videos. Wishing you all the best and best regards from autria.

[@ethernetblueprint]

Thanks for sharing this. I know you are not alone in this as many out there do like to manage their DNS. Nice job on getting things going!

[@joeali3568]

Great helpful videos Tim, I’m struggling with fire rules for home bridge located on IOT vlan, I would like to put Unifi cameras and especially g4 doorbell into HomeKit, can you help with these fire rules. I’m sure I’m not alone with these issue.

[@ethernetblueprint]

Hi there. I may have to do a separate video on this, but let's see if I can push you in the right direction at least... Admittenly, I don't fully understand how HomeKit works since I don't use it myself, so you may have to do a little more research here, but I would try the following: 1) In Settings - Networks, make sure your IOT, Default and Camera VLANs are included in the mDNS box. 2) Create a LAN IN rule that allows IOT VLAN to talk to Camera VLAN. Drag this rule so it is above the Deny all Private IPs rule 3) Create LAN IN rule that allows the Camera VLAN to talk to the IOT VLAN. Drag this rule so it is below the IOT VLAN you just created and above the Deny Private IP to Private IP rule. This will allow communication between those VLANs... I am sure that there are better and more secure ways of doing this, but I just don't have a full understanding on how HomeKit communicates... For example, you may only need to have your cameras talk to the HomePod/Apple TV HomeKit server. The rules I suggested opens up the whole VLAN to each other... So please do a little research on this...

[@KIHUNKIM-d9x]

Thanks for the nice video Tim, I've got a question about 19:01 So even though your local machine and camera vlans are different, you could ping from the machine to camera because trunking? I tried it myself Port 33: Local machine (192.168.1.x) Default VLAN, Allow all Port 35: AP(192.168.20.x) Staff VLAN, Allow all and i was able to ping from PC to AP (I was thinking it's because both ports are trunk port) Then, I changed AP to block all tagged vlan and ping didn't work from local machine > AP (I was thinking because now AP is access port since block all vlans) Is it correct? so, to ping each other both ports should they be always trunk each other's vlans? * I couldn't ping from local PC to AP(blocked all status) once I reboot the AP, I was able to ping right after changing Tagged VLAN on AP without rebooting. **** Soon after I was able to ping from PC to AP again.. how I could ping to AP despite AP blocked all tagged VLAN?

[@ethernetblueprint]

Is there a reason that the AP is on the Staff VLAN? If it were me, I would put the AP on the default VLAN so it gets an IP 192.168.1.x like your PC. The port on the PC can be set to block all (access port) and the AP should be set as Allow All (Trunk) If you have WiFi networks on that are on different VLANs, (ie. guest WiFi, Staff WiFi, Default WiFi...) then you will need the AP to be in trunk mode so it can communicate all the VLANs to your connected devices. But the AP's local IP address (called the Native VLAN) would be best served on the default VLAN.

[@lesgarten]

@Ethernet Blueprint I have a UDM Pro Max and am setting it up like here. Couple of 10GB Agg switches and a couple 48 Port Pro Max switches. I also have a UNVR Pro. Would it go in the Camera VLAN or Default VLAN? Any special considerations for it?

[@ethernetblueprint]

Personally, I would put the NVR in the camera VLAN yes... That way the cameras can talk directly to it with no VLAN challenges.

[@phillipwithers7520]

Had to disable Remote Direct Connection in order to enable the port 443 inclusion to the gateway ports for the camera. Makes sense since they use the same 443 port so I had to choose.

[@ethernetblueprint]

I have had that heard that from other users too... mine was disabled by default but apparently that isn't always the case. Glad you figured it out!

[@danbiondijr]

Hi Tim, as I have been learning how to secure my network with an IOT and guest network, I have found a vulnerability that I have not been able to resolve. In our house, we all have Apple iPhones, when my kids friends come over and try to access our main network, apple allows my kids to share the main network password with their guests. Are you familiar with this and if so, do you by chance have a method to secure this? I was thinking of hiding the main network as a possible solution. What are your thoughts?

[@ethernetblueprint]

You are correct... since that is done on the phone, there is no way to block it on the network... that I have found. Option 1: You could create a kids VLAN that is kind of locked down and put your kids devices on that... then when they share, they are sharing the kids network. Option 2: Install a Firewalla Device on the main network. It won't block the issue from happening, but it will allow you quite a bit more control of the devices on that main network. I will be doing a video on this very soon. That is how I manage my kids devices on my main network.

[@AIInsightsskill]

so good

[@ethernetblueprint]

Glad you found it helpful.

[@Francisco-ke4lx]

Great Video. My cameras won't show up when in a VLAN don't know if it's because is a 3rd party camera using ONVIF, it does work when I take it out of the VLAN back to my default network . My setup UCG Max running my network and protect, 16 Port Poe Switch that I have my cameras plugged in ports using VLAN 3. Spoke to Unifi and they told me that it needs to be in the same VLAN. This was happening even before I blocked anything so can this be a problem with the new update from UNIFI PROTECT do use ONVIF. Any info will be great to test.

[@ethernetblueprint]

I would think this work over VLANs but I haven’t tested with ONVIF since that’s so new. Did you set up the FW rules like I showed in the PDF?

[@Francisco-ke4lx]

@@ethernetblueprint Yes I did all the rules. I searched around the web any alot of users are having the same problem with ONVIF.

[@ethernetblueprint]

the ONVIF is very new so I am sure there are bugs they need to work through. Sorry for your issue.

[@sinclabs]

Appreciate the overview, thank you! in reviewing my setup I see I missed a few things. :-} Tried to download your guide and was unable to. Is the link still working?

[@ethernetblueprint]

It is still working... I just double checked. www.dropbox.com/scl/fi/x7g4vtqe7tahcdbbwm984/VLAN-FW-Summary.pdf?rlkey=b7wkur9ut9vlg1em9y9gf5907&e=1&st=oahosl3p&dl=0

[@MadMike78]

What would you recommend for blocking external IP"s? a firewall rule?

[@ethernetblueprint]

Are you wanting to block just a few outside IPs or are you wanting to block something like China???

[@MadMike78]

@@ethernetblueprint a few outside IP's. I already have countries blocked. Some how my internal NAS is getting failed admin sign on attempts from an external IP. Not sure how they are getting in.

[@jeken28]

Thanks!

[@ethernetblueprint]

Wow. Thanks a lot. That is super kind of you. Appreciate you watching.

[@erinhickey4214]

Great stuff! Is rule 5 (IOT DNS) necessary if I've already set manual DNS servers for my IOT network?

[@ethernetblueprint]

It depends on the where the DNS server is located. If it is sitting in your network on another VLAN, then yes, you would need to make sure you have a LAN IN rule for DNS to that DNS server... If it is a public DNS on the web, no, it would not be needed...

[@ParcoUpchurch]

@erinhickey4214 Hi....newbie question. So I am using Open DNS for DNS for my unifi which is across my entire network. So you are saying I can just use "Any" here? Thx

[@ParcoUpchurch]

@@ethernetblueprint I have Cloudflare DNS for all my VLANs. If this is the case, are you saying I do not need the "DNS" option for the IoTs and can use ANY? Is this what you did?

[@M.Roberts-s7r]

Fantatic series of videos. Used your videos to set up VLANS which are running. Used Guset Portal grant access to printer on different VLAN. Bagan to work on Firewall Rules but have a question. The "Private IP Addresses" in IP Groups. I just want to confirm my understanding. I have 6 VLANS with addresses like 192.168.610.0/24 to 192.168.660.0/24. So would I just palce those 6 VLANS at my Private IP Addresses or does the 192.168.0.0/16 cover those addresses? Does the 10.0.0.0/8 and 172.16.0.0/12 cover all private addresses able to be used?

[@ethernetblueprint]

Good question. It covers those. It covers ALL 192.168.x.x VLANs.

[@M.Roberts-s7r]

@@ethernetblueprint Thanks Tim, figured it out after a little investigation and testing. I appreciate the quick response and those rules worked out great. Great videos and excellent presentations.

[@ethernetblueprint]

Nice work!

[@clodola1]

Hi Tim , Q: Location for any special FW rules. Example: IOT Device Camera needs to communicate with NAS on Default VLAN; do we need to put a rule in here for a unifi camera using the UDM pro NVR to save its recordings on a Camera Vlan?

[@ethernetblueprint]

Yes you will. That will be a LAN-IN Rule and it will need to go above the Deny all Private to All Private rule. You will want to make an IP group that has your NAS IP address in it and use that in the rule. For the cameras, the LOCAL rules can block access to the UDM Pro NVR. I have an example of how the cameras need to be setup in the video and on my downloadable guide that is in the description.

[@aetherguy881]

I'm still very new to this and following this video right now, how exactly did you populate or decide to populate your IP groups? That's one thing that I didn't quite pick up in the video so far and I won't be able to create a rule without an IP included in the group.

[@ethernetblueprint]

The IP Group simply includes the IP addresses of the devices that you want to control. For example, if you wanted to create a rule for your cameras, you would create an IP group that has the IP Addresses of each of your cameras... and then create a rule for that group.

[@SnowBob302]

Ah this was great! I had the issue of HomeKit not working when I serrated IoT and realized it was because my management VLAN and Primary device VLAN were different. After I added the rule to allow my Primary VLAN to reach the IoT then everything started working. What are your thoughts about having a separate management VLAN?

[@ethernetblueprint]

I like a mgmt VLAN. I use one in my home but that is difficult to explain to super newbies and didn’t want to complicate things. I give my mgmt VLAN the same access as my Default network for the most part.

[@SnowBob302]

@@ethernetblueprint That's what I ended up doing. Thanks very much for this guide - it helped me understand the actual theory.

[@ethernetblueprint]

You are welcome! Thanks for watching. I am glad it helped.

[@1Sbnelson]

Hi again Tim, question for you on my specific set up. I have a Work Network (VLAN 2 - 10.168.2.1/24). This VLAN should of course, have internet access and should not be able to see any other VLAN's. But what I don't want is traffic from the Default Network to be able to send to the Work Network. I assume that I could replicate Rule 5 (IOT) for the Work Network, but to prevent any device on my Default VLAN to see the devices on the Work Network, my guess would be change Rule 1, instead of "Any" in the 2 Address fields, add all my VLAN IP's except my Work Network IP? Does this sound correct? Thanks again

[@ethernetblueprint]

Hi there. You could simply add an additional LAN IN rule above the “allow default to all private IPs” that says “Deny default to work network” which will stop that traffic but still allow default to talk to everything else. You would need to create a new IP group for your work VLAN. Hopefully that makes sense.

[@1Sbnelson]

@@ethernetblueprint That does make sense! Thanks so very much

[@MitchOfCanada]

so painful to do this on the retired USG, cant wait for the gateway max to showup

[@ethernetblueprint]

Very awesome. I hope it arrives fast.

[@blackjedi23]

awesome

[@ethernetblueprint]

Glad you liked. Hope it was helpful!

[@JasonTechSF]

Ah firewall, the Dark Side of the Force.

[@ethernetblueprint]

Take me to it, you will. - Thanks for watching!

[@CrazyAngelfire]

thank you tim, i was stuggling with something, i can ping from my computer on "IOT" network to my phone on the "Main" network. but some how i have no idea i cant access any gateway from my phone on the IOT network but i can get to the main gateway on the computer on IOT. i no its a mouthfull, should i just remove all "Rules and start again?

[@ethernetblueprint]

Email me at [e-mail] and I’ll see if I can help you out.

[@svendobbels]

Hi, thanks for this video. However, I just applied rules 1 to 4 and I still am able to ping devices on other VLANS. I allready rebooted the udmSE. The only difference I have is that my default iprange is within 10.0.0.0/24, other ranges are 10.0.50.0/24, 10.0.100.0/24 and 10.0.200.0/24. Only when I move the fourth rule to the top or the first rule to the bottom, then I can't ping the other devices.

[@ethernetblueprint]

email me at [e-mail] and I can see if can figure out what is going on... That shouldn't be the case...