fizzlepoof/truenas-stacks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden UniFi restricted-lane gateway access
Some checks failed
secret-guardrails / artifact-secret-scan (push) Has been cancelled
Details
secret-guardrails / gitleaks (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Fizzlepoof
2026-05-23 02:48:49 +00:00
parent 462b39e572
commit 080ba83989
6 changed files with 442 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

148
automation/bin/unifi_stage_policy_engine_firewall.py
View File

@@ -33,6 +33,7 @@ def load_helper(path: Path):
def desired_policies() -> list[dict[str, Any]]:
restricted_subnets = ['10.5.10.0/24', '10.5.20.0/24', '192.168.1.0/24']
return [
{
'name': 'Allow Internal to Untrusted',
@@ -76,14 +77,14 @@ def desired_policies() -> list[dict[str, Any]]:
'match_opposite_protocol': False,
'icmp_typename': 'ANY',
'icmp_v6_typename': 'ANY',
'description': 'Block IoT, Camera, and Old IoT clients from UniFi gateway admin TCP ports while preserving existing zone defaults for DHCP, DNS, mDNS, and internet access.',
'description': 'Block IoT, Camera, and Old IoT clients from UniFi gateway admin TCP ports while preserving explicit DHCP and mDNS exceptions plus external DNS via 10.5.30.53.',
'source_zone_name': 'Untrusted',
'destination_zone_name': 'Gateway',
'schedule': {'mode': 'ALWAYS'},
'source': {
'matching_target': 'IP',
'matching_target_type': 'SPECIFIC',
'ips': ['10.5.10.0/24', '10.5.20.0/24', '192.168.1.0/24'],
'ips': restricted_subnets,
'match_mac': False,
'match_opposite_ips': False,
'match_opposite_ports': False,
@@ -99,6 +100,149 @@ def desired_policies() -> list[dict[str, Any]]:
'port': '22,80,443,8443,9443',
},
},
{
'name': 'Allow Untrusted to DNS Resolver',
'enabled': True,
'action': 'ALLOW',
'protocol': 'tcp_udp',
'ip_version': 'IPV4',
'logging': False,
'create_allow_respond': False,
'connection_state_type': 'ALL',
'connection_states': [],
'match_ip_sec': False,
'match_opposite_protocol': False,
'icmp_typename': 'ANY',
'icmp_v6_typename': 'ANY',
'description': 'Allow IoT, Camera, and Old IoT clients to reach the Pi-hole DNS resolver on PD after DHCP DNS cutover.',
'source_zone_name': 'Untrusted',
'destination_zone_name': 'Internal',
'schedule': {'mode': 'ALWAYS'},
'source': {
'matching_target': 'IP',
'matching_target_type': 'SPECIFIC',
'ips': restricted_subnets,
'match_mac': False,
'match_opposite_ips': False,
'match_opposite_ports': False,
'port_matching_type': 'ANY',
},
'destination': {
'matching_target': 'IP',
'matching_target_type': 'SPECIFIC',
'ips': ['10.5.30.53'],
'match_opposite_ips': False,
'match_opposite_ports': False,
'port_matching_type': 'SPECIFIC',
'port': '53',
},
},
{
'name': 'Block Untrusted to Gateway Default Services',
'enabled': True,
'action': 'BLOCK',
'protocol': 'all',
'ip_version': 'BOTH',
'logging': False,
'create_allow_respond': False,
'connection_state_type': 'ALL',
'connection_states': [],
'match_ip_sec': False,
'match_opposite_protocol': False,
'icmp_typename': 'ANY',
'icmp_v6_typename': 'ANY',
'description': 'Block general access from IoT, Camera, and Old IoT to gateway services after DNS cutover, preserving only explicit DHCP and mDNS exceptions.',
'source_zone_name': 'Untrusted',
'destination_zone_name': 'Gateway',
'schedule': {'mode': 'ALWAYS'},
'source': {
'matching_target': 'IP',
'matching_target_type': 'SPECIFIC',
'ips': restricted_subnets,
'match_mac': False,
'match_opposite_ips': False,
'match_opposite_ports': False,
'port_matching_type': 'ANY',
},
'destination': {
'matching_target': 'ANY',
'match_opposite_ports': False,
'port_matching_type': 'ANY',
},
},
{
'name': 'Allow Untrusted to Gateway DHCP',
'enabled': True,
'action': 'ALLOW',
'protocol': 'udp',
'ip_version': 'BOTH',
'logging': False,
'create_allow_respond': False,
'connection_state_type': 'ALL',
'connection_states': [],
'match_ip_sec': False,
'match_opposite_protocol': False,
'icmp_typename': 'ANY',
'icmp_v6_typename': 'ANY',
'description': 'Preserve DHCP from IoT, Camera, and Old IoT to the gateway while the broader gateway shield is in place.',
'source_zone_name': 'Untrusted',
'destination_zone_name': 'Gateway',
'schedule': {'mode': 'ALWAYS'},
'source': {
'matching_target': 'IP',
'matching_target_type': 'SPECIFIC',
'ips': restricted_subnets,
'match_mac': False,
'match_opposite_ips': False,
'match_opposite_ports': False,
'port_matching_type': 'SPECIFIC',
'port': '68',
},
'destination': {
'matching_target': 'ANY',
'match_opposite_ports': False,
'port_matching_type': 'SPECIFIC',
'port': '67',
},
},
{
'name': 'Allow Untrusted to Gateway mDNS',
'enabled': True,
'action': 'ALLOW',
'protocol': 'udp',
'ip_version': 'IPV4',
'logging': False,
'create_allow_respond': False,
'connection_state_type': 'ALL',
'connection_states': [],
'match_ip_sec': False,
'match_opposite_protocol': False,
'icmp_typename': 'ANY',
'icmp_v6_typename': 'ANY',
'description': 'Preserve mDNS multicast from IoT, Camera, and Old IoT while the broader gateway shield is in place.',
'source_zone_name': 'Untrusted',
'destination_zone_name': 'Gateway',
'schedule': {'mode': 'ALWAYS'},
'source': {
'matching_target': 'IP',
'matching_target_type': 'SPECIFIC',
'ips': restricted_subnets,
'match_mac': False,
'match_opposite_ips': False,
'match_opposite_ports': False,
'port_matching_type': 'SPECIFIC',
'port': '5353',
},
'destination': {
'matching_target': 'IP',
'matching_target_type': 'SPECIFIC',
'ips': ['224.0.0.251'],
'match_opposite_ips': False,
'match_opposite_ports': False,
'port_matching_type': 'SPECIFIC',
'port': '5353',
},
},
]