rufusking/infrastructure
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
infrastructure/firewall_policies.md

179 lines
7.7 KiB
Markdown
Raw Normal View History

describe what changed
2026-07-26 22:12:38 -04:00
# Firewall Policies — KingDezigns Network
Last Updated: 2026-05-24
This document contains the **complete firewall policy set** for all VLANs in the KingDezigns network.
Rules are grouped by VLAN and presented in a clean, AI‑friendly table format.
---
# 🌐 Global Firewall Rules (Affect All VLANs)
| Rule ID | Name | Action | Protocol | Source | Destination | Port | Notes |
|--------|-------|---------|----------|---------|--------------|--------|--------|
| 20000 | Allow Established / Related | Accept | All | Any | Any | Any | Required for normal TCP/UDP flows |
| 20001 | DNS → Pi‑hole | Accept | TCP/UDP | All VLANs | Pi‑hole (192.168.150.35) | 53 | All VLANs use Pi‑hole DNS |
---
# 🌍 External Access Architecture
All inbound internet traffic enters the network through a single ingress point:
```
Internet → NPM on HAS (192.168.150.30:80/443) → Backend Services (NAS08/NAS16)
```
**Nginx Proxy Manager (NPM)** runs as a Home Assistant add-on on HAS and terminates all external HTTPS connections.
It forwards requests to backend servers inside VLAN 50 using internal IPs.
Because all proxied traffic originates from HAS (192.168.150.30), backend servers are configured to extract real client IPs from the `X-Forwarded-For` header:
- **nginx on NAS16** — `/etc/nginx/conf.d/real_ip.conf` sets `set_real_ip_from 192.168.150.30`
- **Apache on NAS16** — `/etc/apache2/conf-available/real_ip.conf` sets `RemoteIPTrustedProxy 192.168.150.30`
- **Fail2Ban on NAS16** — `ignoreip` includes `192.168.150.0/24` to prevent HAS from being banned
This ensures real attacker IPs are logged and banned, not the proxy IP.
---
# 🔧 VLAN 1 — Infrastructure (192.168.100.0/24)
## Inbound Rules
| Rule ID | Action | Source | Destination | Notes |
|--------|---------|---------|--------------|--------|
| 20008 | Drop | VLAN 30 (IoT) | VLAN 1 | IoT cannot reach Infrastructure |
| 20009 | Drop | VLAN 50 (Lab) | VLAN 1 | Lab cannot reach Infrastructure |
## Outbound Rules
Outbound access for VLAN 1 is handled by UCG Max auto-generated rules (60000-series), allowing Infrastructure to reach all internal VLANs.
---
# 🔧 VLAN 10 — Management (192.168.110.0/24)
## Inbound Rules
| Rule ID | Action | Source | Destination | Notes |
|--------|---------|---------|--------------|--------|
| 20002 | Accept | VLAN 10 | All VLANs | Management can reach all internal VLANs |
| 20003 | Accept | VLAN 20 | VLAN 10 | Trusted → All VLANs Except Trusted |
## Outbound Rules
*(No explicit outbound rules — UCG Max 60000-series and default policy applies.)*
---
# 🔧 VLAN 20 — Trusted Devices (192.168.120.0/24)
## Inbound Rules
| Rule ID | Action | Source | Destination | Notes |
|--------|---------|---------|--------------|--------|
| 20007 | Drop | VLAN 30 (IoT) | VLAN 20 | IoT cannot reach Trusted |
| 20010 | Drop | VLAN 50 (Lab) | VLAN 20 | Lab cannot reach Trusted |
## Outbound Rules
| Rule ID | Action | Source | Destination | Notes |
|--------|---------|---------|--------------|--------|
| 20003 | Accept | VLAN 20 | All VLANs Except 20 | Trusted can reach all other VLANs |
---
# 🔧 VLAN 30 — IoT (192.168.130.0/23)
## Inbound Rules
| Rule ID | Action | Source | Destination | Notes |
|--------|---------|---------|--------------|--------|
| 20005 | Accept | Home Assistant (192.168.150.30) | VLAN 30 | HA → IoT Control |
| 20011 | Drop | VLAN 50 (Lab) | VLAN 30 | Lab cannot reach IoT |
## Outbound Rules
| Rule ID | Action | Source | Destination | Port | Notes |
|--------|---------|---------|--------------|--------|--------|
| 20004 | Accept | VLAN 30 | 192.168.150.30 | 8123/TCP/UDP | IoT → Home Assistant |
| 20006 | Accept | VLAN 30 | 192.168.100.1 | 5540/TCP | IoT → UCG Max Matter controller |
| 20007 | Drop | VLAN 30 | VLAN 20 | Any | IoT cannot reach Trusted |
| 20008 | Drop | VLAN 30 | VLAN 1 | Any | IoT cannot reach Infrastructure |
---
# 🔧 VLAN 40 — Guest (192.168.140.0/24)
## Inbound Rules
| Rule ID | Action | Source | Destination | Notes |
|--------|---------|---------|--------------|--------|
| 20012 | Drop | VLAN 50 (Lab) | VLAN 40 | Lab cannot reach Guest |
## Outbound Rules
*(No explicit outbound rules — default policy applies.)*
---
# 🔧 VLAN 50 — Lab / Servers (192.168.150.0/24)
## Inbound Rules
| Rule ID | Action | Source | Destination | Notes |
|--------|---------|---------|--------------|--------|
| 20004 | Accept | VLAN 30 | 192.168.150.30 | IoT → Home Assistant (port 8123) |
## Outbound Rules
| Rule ID | Action | Source | Destination | Notes |
|--------|---------|---------|--------------|--------|
| 20009 | Drop | VLAN 50 | VLAN 1 | Lab cannot reach Infrastructure |
| 20010 | Drop | VLAN 50 | VLAN 20 | Lab cannot reach Trusted |
| 20011 | Drop | VLAN 50 | VLAN 30 | Lab cannot reach IoT (except HA exception below) |
| 20012 | Drop | VLAN 50 | VLAN 40 | Lab cannot reach Guest |
| 20013 | Drop | VLAN 50 | All VLANs Except 50 | Global Final Drop |
## VLAN 50 Exceptions
| Rule ID | Action | Source | Destination | Port | Notes |
|--------|---------|---------|--------------|--------|--------|
| 20005 | Accept | 192.168.150.30 (HAS) | VLAN 30 | Any | Home Assistant → IoT control |
| — | Accept | 192.168.150.30 (NPM) | 192.168.150.35 | Various | NPM proxy → NAS08 services |
| — | Accept | 192.168.150.30 (NPM) | 192.168.150.40 | Various | NPM proxy → NAS16 services |
---
# 🔧 UCG Max Auto-Generated Rules (60000-series)
These rules are automatically created by the UCG Max when networks are provisioned.
They allow intra-VLAN and general outbound traffic per subnet. Rule order places these after all 20000-series rules.
| Rule ID | Direction | Action | Source | Destination | Notes |
|--------|-----------|--------|--------|-------------|-------|
| 60001 | LAN In | Accept | 192.168.120.0/24 | Any | VLAN 20 inbound traffic |
| 60002 | LAN In | Accept | 192.168.130.0/23 | Any | VLAN 30 inbound traffic |
| 60003 | LAN In | Accept | 192.168.150.0/24 | Any | VLAN 50 inbound traffic |
| 60004 | LAN In | Accept | 192.168.100.0/24 | Any | VLAN 1 inbound traffic |
| 60005 | LAN In | Accept | 192.168.110.0/24 | Any | VLAN 10 inbound traffic |
| 60001 | LAN Out | Accept | Any | 192.168.120.0/24 | VLAN 20 outbound traffic |
| 60002 | LAN Out | Accept | Any | 192.168.130.0/23 | VLAN 30 outbound traffic |
| 60003 | LAN Out | Accept | Any | 192.168.150.0/24 | VLAN 50 outbound traffic |
| 60004 | LAN Out | Accept | Any | 192.168.100.0/24 | VLAN 1 outbound traffic |
| 60005 | LAN Out | Accept | Any | 192.168.110.0/24 | VLAN 10 outbound traffic |
> Note: 20000-series rules execute first. The 60000-series rules handle remaining traffic including VLAN 1 (Infrastructure) outbound access to all VLANs.
---
# 🧠 Summary for AI Systems
- All VLANs → Pi‑hole DNS allowed
- All VLANs → Established/Related allowed
- VLAN 1 outbound access to all VLANs handled by UCG Max 60000-series rules
- VLAN 10 (Management) can reach all VLANs (Rule 20002)
- VLAN 20 can reach all VLANs except itself
- VLAN 30 can only reach Home Assistant (8123), UCG Max Matter controller (5540), and DNS
- VLAN 30 client isolation was previously enabled — removed to allow Matter/Thread device pairing
- VLAN 40 is isolated except for DNS
- VLAN 50 cannot initiate to any VLAN except IoT (HA exception) and intra-VLAN 50 traffic
- External internet traffic enters exclusively via NPM on HAS (192.168.150.30)
- Real client IPs are forwarded via X-Forwarded-For from NPM to all backend servers
- Fail2Ban on NAS16 ignores 192.168.150.0/24 to prevent proxy IP banning
- Matter/Thread pairing requires IoT → UCG Max (192.168.100.1:5540/TCP) — Rule 20006
- Aqara M100 Thread Border Router has static IP reservation at 192.168.130.30 (VLAN 30)
This file is the **single source of truth** for firewall logic.
---
# ✔️ End of File
Reference in a new issue Copy permalink