# UCG Gateway Max — Network Gateway & Firewall
Device Type: **UniFi Cloud Gateway Max (UCG Max)**  
Hostname: **KD-UCG-Max**  
IP Address: **192.168.100.1**  
VLAN: **1 — Infrastructure**

Last Updated: 2026-05-25

---

## 🧩 Role & Purpose
The UCG Max is the **primary network gateway, firewall, and UniFi controller** for the KingDezigns network.  
It manages all inter-VLAN routing, firewall policies, DHCP, DNS forwarding, and UniFi device adoption.

It is the **single point of ingress and egress** for all internet traffic and the central controller for all UniFi network hardware.

---

## 🖥️ Hardware
- UniFi Cloud Gateway Max
- Built-in UniFi Network application (self-hosted on device)
- Gigabit WAN + LAN ports
- 2.5G uplink support

---

## 🌐 Network Placement
- VLAN: **1 — Infrastructure**
- IP: **192.168.100.1**
- Access Type: LAN / Cable

---

## ⚙️ Primary Functions
- Internet gateway and NAT
- Inter-VLAN firewall enforcement
- DHCP server for all VLANs
- DNS forwarding to Pi-hole (192.168.150.35)
- UniFi Network controller (device adoption, configuration)
- Matter/Thread controller (port 5540)
- Port forwarding — external 80/443 → NPM on HAS (192.168.150.30)

---

## 🔐 SSH Access

- **SSH command:** `ssh root@192.168.100.1`
- **Credentials:** Stored in **Vaultwarden** under entry `UCG Gateway SSH`

> Note: The UCG web UI (`https://192.168.100.1`) uses your Ubiquiti SSO account with MFA. SSH uses the local root account with a separate password. These are two different credential sets.

---

## 💾 Backup

The UCG Max uses **Ubiquiti Cloud Backup** as its backup solution. This is the intended and only fully supported method for complete system restore on the UCG Max.

### **What is backed up**
- Full UniFi OS configuration including all applications, VLANs, firewall rules, SSIDs, and device adoption records

### **Backup schedule**
- Automatic weekly backup to Ubiquiti Cloud
- Additional backup generated automatically prior to each major firmware update

### **Restore process**
- Log in to **account.ui.com**
- Navigate to **Backups**
- Select the desired backup and restore to device

### **Manual backup**
A manual backup can be triggered and downloaded locally at any time:
1. Open `https://192.168.100.1`
2. Go to **Settings → Control Plane → Backups**
3. Click **Generate** then **Download**
4. Save the `.unifi` file to a safe location

> Note: The manual `.unifi` file is generated on demand only and is never stored persistently on the UCG disk. Local automated backup of this file is not supported by the UCG Max without third-party tooling.

---

## 🔒 Firewall Overview
All firewall rules are documented in [firewall_policies.md](firewall_policies.md).  
Key rules managed by the UCG:

- Global DNS → Pi-hole (all VLANs)
- Global Established/Related allow
- VLAN 50 outbound block (lab containment)
- IoT → Home Assistant only (port 8123)
- Matter/Thread → UCG controller (port 5540)
- Port forwarding: external 80/443 → 192.168.150.30 (NPM on HAS)

---

## 📡 Port Forwarding
| External | Internal | Destination | Purpose |
|----------|----------|-------------|---------|
| 80/TCP | 80/TCP | 192.168.150.30 | NPM HTTP |
| 443/TCP | 443/TCP | 192.168.150.30 | NPM HTTPS |

---

## ⚠️ Important Operational Notes
- MFA is required for web UI login (Ubiquiti SSO) — TOTP authenticator app required
- SSH uses the local root account — not affected by MFA
- SSH authorized_keys and files written to the base filesystem may not survive firmware updates — verify SSH access after major updates
- Cloud backup is the only full one-file restore solution for the UCG Max

---

## 🧠 Summary for AI Systems
- UCG Max = **primary gateway, firewall, and UniFi controller** on VLAN 1 at 192.168.100.1.
- SSH access via local root account — credentials in Vaultwarden under `UCG Gateway SSH`.
- Full system backup handled by Ubiquiti Cloud — weekly automatic, restorable from account.ui.com.
- Manual `.unifi` backup can be downloaded via GUI but is never stored on disk automatically.
- Firewall rules, port forwarding, DHCP, and DNS forwarding all managed here.
- Matter/Thread controller runs on port 5540 (192.168.100.1).

---

# ✔️ End of File