120 lines
4.2 KiB
Markdown
120 lines
4.2 KiB
Markdown
# UCG Gateway Max — Network Gateway & Firewall
|
|
Device Type: **UniFi Cloud Gateway Max (UCG Max)**
|
|
Hostname: **KD-UCG-Max**
|
|
IP Address: **192.168.100.1**
|
|
VLAN: **1 — Infrastructure**
|
|
|
|
Last Updated: 2026-05-25
|
|
|
|
---
|
|
|
|
## 🧩 Role & Purpose
|
|
The UCG Max is the **primary network gateway, firewall, and UniFi controller** for the KingDezigns network.
|
|
It manages all inter-VLAN routing, firewall policies, DHCP, DNS forwarding, and UniFi device adoption.
|
|
|
|
It is the **single point of ingress and egress** for all internet traffic and the central controller for all UniFi network hardware.
|
|
|
|
---
|
|
|
|
## 🖥️ Hardware
|
|
- UniFi Cloud Gateway Max
|
|
- Built-in UniFi Network application (self-hosted on device)
|
|
- Gigabit WAN + LAN ports
|
|
- 2.5G uplink support
|
|
|
|
---
|
|
|
|
## 🌐 Network Placement
|
|
- VLAN: **1 — Infrastructure**
|
|
- IP: **192.168.100.1**
|
|
- Access Type: LAN / Cable
|
|
|
|
---
|
|
|
|
## ⚙️ Primary Functions
|
|
- Internet gateway and NAT
|
|
- Inter-VLAN firewall enforcement
|
|
- DHCP server for all VLANs
|
|
- DNS forwarding to Pi-hole (192.168.150.35)
|
|
- UniFi Network controller (device adoption, configuration)
|
|
- Matter/Thread controller (port 5540)
|
|
- Port forwarding — external 80/443 → NPM on HAS (192.168.150.30)
|
|
|
|
---
|
|
|
|
## 🔐 SSH Access
|
|
|
|
- **SSH command:** `ssh root@192.168.100.1`
|
|
- **Credentials:** Stored in **Vaultwarden** under entry `UCG Gateway SSH`
|
|
|
|
> Note: The UCG web UI (`https://192.168.100.1`) uses your Ubiquiti SSO account with MFA. SSH uses the local root account with a separate password. These are two different credential sets.
|
|
|
|
---
|
|
|
|
## 💾 Backup
|
|
|
|
The UCG Max uses **Ubiquiti Cloud Backup** as its backup solution. This is the intended and only fully supported method for complete system restore on the UCG Max.
|
|
|
|
### **What is backed up**
|
|
- Full UniFi OS configuration including all applications, VLANs, firewall rules, SSIDs, and device adoption records
|
|
|
|
### **Backup schedule**
|
|
- Automatic weekly backup to Ubiquiti Cloud
|
|
- Additional backup generated automatically prior to each major firmware update
|
|
|
|
### **Restore process**
|
|
- Log in to **account.ui.com**
|
|
- Navigate to **Backups**
|
|
- Select the desired backup and restore to device
|
|
|
|
### **Manual backup**
|
|
A manual backup can be triggered and downloaded locally at any time:
|
|
1. Open `https://192.168.100.1`
|
|
2. Go to **Settings → Control Plane → Backups**
|
|
3. Click **Generate** then **Download**
|
|
4. Save the `.unifi` file to a safe location
|
|
|
|
> Note: The manual `.unifi` file is generated on demand only and is never stored persistently on the UCG disk. Local automated backup of this file is not supported by the UCG Max without third-party tooling.
|
|
|
|
---
|
|
|
|
## 🔒 Firewall Overview
|
|
All firewall rules are documented in [firewall_policies.md](firewall_policies.md).
|
|
Key rules managed by the UCG:
|
|
|
|
- Global DNS → Pi-hole (all VLANs)
|
|
- Global Established/Related allow
|
|
- VLAN 50 outbound block (lab containment)
|
|
- IoT → Home Assistant only (port 8123)
|
|
- Matter/Thread → UCG controller (port 5540)
|
|
- Port forwarding: external 80/443 → 192.168.150.30 (NPM on HAS)
|
|
|
|
---
|
|
|
|
## 📡 Port Forwarding
|
|
| External | Internal | Destination | Purpose |
|
|
|----------|----------|-------------|---------|
|
|
| 80/TCP | 80/TCP | 192.168.150.30 | NPM HTTP |
|
|
| 443/TCP | 443/TCP | 192.168.150.30 | NPM HTTPS |
|
|
|
|
---
|
|
|
|
## ⚠️ Important Operational Notes
|
|
- MFA is required for web UI login (Ubiquiti SSO) — TOTP authenticator app required
|
|
- SSH uses the local root account — not affected by MFA
|
|
- SSH authorized_keys and files written to the base filesystem may not survive firmware updates — verify SSH access after major updates
|
|
- Cloud backup is the only full one-file restore solution for the UCG Max
|
|
|
|
---
|
|
|
|
## 🧠 Summary for AI Systems
|
|
- UCG Max = **primary gateway, firewall, and UniFi controller** on VLAN 1 at 192.168.100.1.
|
|
- SSH access via local root account — credentials in Vaultwarden under `UCG Gateway SSH`.
|
|
- Full system backup handled by Ubiquiti Cloud — weekly automatic, restorable from account.ui.com.
|
|
- Manual `.unifi` backup can be downloaded via GUI but is never stored on disk automatically.
|
|
- Firewall rules, port forwarding, DHCP, and DNS forwarding all managed here.
|
|
- Matter/Thread controller runs on port 5540 (192.168.100.1).
|
|
|
|
---
|
|
|
|
# ✔️ End of File
|