Skip to content

BidnessForB/sample-config

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

2 Commits
config
config
 
 
docs
docs
 
 
scripts
scripts
 
 
README.md
README.md
 
 
package.json
package.json
 
 

Repository files navigation

Ubiquiti Router Configuration

Three Isolated Networks: IoT, Guest, and Private

This repository contains a complete configuration setup for a Ubiquiti router (UniFi or EdgeRouter) with three isolated network segments designed for maximum security and proper network segregation.

📋 Table of Contents

🏗️ Overview

This configuration creates three isolated network segments:

Private Network (VLAN 10)

  • Subnet: 192.168.10.0/24
  • Gateway: 192.168.10.1
  • Purpose: Trusted devices (computers, phones, tablets)
  • Access: Full access to all networks and internet

Guest Network (VLAN 20)

  • Subnet: 192.168.20.0/24
  • Gateway: 192.168.20.1
  • Purpose: Guest devices (visitors)
  • Access: Internet only, isolated from all other networks
  • Features: Client isolation, bandwidth limits (50Mbps down / 10Mbps up)

IoT Network (VLAN 30)

  • Subnet: 192.168.30.0/24
  • Gateway: 192.168.30.1
  • Purpose: Smart home and IoT devices
  • Access: Internet access, manageable from Private network
  • Features: Isolated from Guest network, limited local access

🌐 Network Architecture

                         Internet
                            |
                     [WAN Interface]
                            |
                    [Ubiquiti Router]
                            |
              +-------------+-------------+
              |             |             |
          [VLAN 10]     [VLAN 20]     [VLAN 30]
           Private        Guest          IoT
        192.168.10.1   192.168.20.1  192.168.30.1
              |             |             |
         Managed Switch / Access Points
              |             |             |
        +-----+-----+  +----+----+  +-----+-----+
        |           |  |         |  |           |
    Computers   Phones  Visitors  Smart Home  Security
    Laptops     Tablets           Devices     Cameras

Network Isolation Rules

From → To Private Guest IoT Internet
Private ✅ Full ✅ Full ✅ Full ✅ Full
Guest ❌ Block ❌ Block* ❌ Block ✅ Allow
IoT ❌ Block ❌ Block ✅ Allow ✅ Allow

*Guest devices cannot communicate with each other (client isolation)

📁 Directory Structure

.
├── README.md                           # This file
├── config/
│   ├── unifi/
│   │   └── networks.json              # UniFi network definitions
│   ├── edgerouter/
│   │   └── setup.sh                   # EdgeRouter CLI setup script
│   ├── firewall/
│   │   └── rules.json                 # Firewall rules configuration
│   └── wifi/
│       └── wireless-networks.json     # WiFi/SSID configuration
├── docs/
│   ├── DEPLOYMENT.md                  # Deployment guide
│   ├── ARCHITECTURE.md                # Architecture documentation
│   ├── TROUBLESHOOTING.md            # Troubleshooting guide
│   └── SECURITY.md                    # Security best practices
└── scripts/
    └── validate-config.sh             # Configuration validation script

✅ Prerequisites

Hardware Requirements

  • Ubiquiti UniFi Dream Machine (UDM/UDM Pro) OR EdgeRouter
  • Managed switch with VLAN support (UniFi Switch recommended)
  • UniFi Access Points (for WiFi networks)

Software Requirements

  • UniFi Network Controller (v7.0+) OR EdgeOS (v2.0+)
  • SSH access to router
  • Basic understanding of VLANs and networking

Knowledge Requirements

  • Familiarity with VLAN configuration
  • Basic firewall rule concepts
  • Understanding of network isolation

🚀 Quick Start

For UniFi Devices

  1. Access UniFi Controller

    # Open browser to your controller
https://unifi.ui.com
# or local controller
https://192.168.1.1:8443

  2. Import Network Configuration

    • Navigate to Settings → Networks
    • Use the JSON configurations in config/unifi/
    • Create each network with specified VLAN IDs

  3. Configure Firewall Rules

    • Navigate to Settings → Firewall & Security
    • Import rules from config/firewall/rules.json
    • Ensure rules are in correct order

  4. Set Up WiFi Networks

    • Navigate to Settings → WiFi
    • Create SSIDs using config/wifi/wireless-networks.json
    • Assign VLANs to each SSID

For EdgeRouter

  1. SSH to EdgeRouter

    ssh admin@192.168.1.1

  2. Run Configuration Script

    # Copy script to router
scp config/edgerouter/setup.sh admin@192.168.1.1:/tmp/

# SSH and run
ssh admin@192.168.1.1
chmod +x /tmp/setup.sh
sudo /tmp/setup.sh

  3. Review and Commit

    # Review configuration
compare

# Commit if satisfied
commit
save

📄 Configuration Files

1. Networks Configuration (config/unifi/networks.json)

Defines all three networks with their properties:

  • IP addressing and DHCP ranges
  • DNS servers
  • VLAN assignments
  • Guest policies and bandwidth limits

2. Firewall Rules (config/firewall/rules.json)

Contains all firewall rules for network isolation:

  • Block rules for IoT → Private/Guest
  • Block rules for Guest → Private/IoT
  • Allow rules for Private → IoT management
  • Client isolation for Guest network

3. WiFi Configuration (config/wifi/wireless-networks.json)

Defines wireless networks:

  • SSID names and passwords
  • Security settings (WPA2/WPA3)
  • VLAN assignments
  • Radio settings and bandwidth limits

4. EdgeRouter Script (config/edgerouter/setup.sh)

Complete CLI configuration for EdgeRouter:

  • VLAN interface creation
  • DHCP server configuration
  • Firewall rule implementation
  • NAT configuration

🔧 Deployment

Step 1: Backup Current Configuration

UniFi:

# Download backup from Settings → System → Backup

EdgeRouter:

# SSH to router
ssh admin@192.168.1.1
show configuration commands > /tmp/backup-$(date +%Y%m%d).txt

Step 2: Configure Physical Infrastructure

  1. Connect managed switch to router

    • Ensure switch port is configured as trunk (all VLANs)
    • Tag VLANs 10, 20, 30

  2. Configure switch ports

    • Access points: Trunk mode with all VLANs
    • Wired devices: Access mode with appropriate VLAN

Step 3: Deploy Network Configuration

Follow the Quick Start guide for your specific hardware.

Step 4: Configure Access Points

UniFi:

  • Access points automatically adopt network configuration
  • Ensure all SSIDs are enabled on desired APs

Other APs:

  • Configure SSID → VLAN mappings manually
  • Enable WPA2/WPA3 as appropriate

Step 5: Validate Configuration

# Run validation script
cd /path/to/nick-demo
chmod +x scripts/validate-config.sh
./scripts/validate-config.sh

See DEPLOYMENT.md for detailed deployment instructions.

🧪 Testing & Validation

Automated Testing

Run the validation script:

./scripts/validate-config.sh

Manual Testing

Test Network Isolation

From Private Network (192.168.10.x):

# Should succeed
ping 192.168.30.100    # Access to IoT
ping 8.8.8.8          # Internet access

# Should succeed
ssh admin@192.168.10.1  # Router access

From Guest Network (192.168.20.x):

# Should FAIL
ping 192.168.10.1     # Blocked to Private
ping 192.168.30.1     # Blocked to IoT
ping 192.168.20.100   # Client isolation

# Should succeed
ping 8.8.8.8          # Internet access

From IoT Network (192.168.30.x):

# Should FAIL
ping 192.168.10.100   # Blocked to Private
ping 192.168.20.100   # Blocked to Guest

# Should succeed
ping 8.8.8.8          # Internet access

Test DHCP

Each network should receive appropriate IP:

# Private: 192.168.10.10-250
# Guest:   192.168.20.10-250
# IoT:     192.168.30.10-250

Test DNS

nslookup google.com
# Should resolve using configured DNS servers

🔍 Troubleshooting

Common Issues

1. Device Can't Get IP Address

Check:

  • VLAN configuration on switch
  • DHCP server is running
  • Device is on correct SSID/port

Solution:

# UniFi: Check DHCP leases
Settings → Networks → [Network] → DHCP

# EdgeRouter: Check DHCP
show dhcp leases
show dhcp statistics

2. Can't Access Internet

Check:

  • NAT rules are configured
  • Default route exists
  • DNS is resolving

Solution:

# EdgeRouter
show nat rules
show ip route
show dns forwarding statistics

3. Firewall Rules Not Working

Check:

  • Rule order (block before allow)
  • Source/destination addresses
  • Applied to correct interface

Solution:

# EdgeRouter
show firewall statistics
show firewall name [RULESET_NAME]

# UniFi
Check Settings → Firewall & Security → Traffic Rules

See TROUBLESHOOTING.md for detailed troubleshooting.

🔒 Security Considerations

Default Passwords

⚠️ CRITICAL: Change all default passwords in config/wifi/wireless-networks.json

"password": "CHANGE_ME_PRIVATE_PASSWORD"
"password": "CHANGE_ME_GUEST_PASSWORD"
"password": "CHANGE_ME_IOT_PASSWORD"

Best Practices

  1. Use WPA3 for Private network when possible
  2. Regular firmware updates for router and APs
  3. Monitor firewall logs for suspicious activity
  4. Disable unused services (UPnP, WPS, etc.)
  5. Use strong admin passwords for router access
  6. Enable 2FA on UniFi account
  7. Regular security audits of connected devices

IoT Device Security

  • Review IoT device permissions regularly
  • Update IoT device firmware
  • Use separate credentials for each device
  • Consider MAC filtering for critical devices
  • Monitor IoT network traffic

See SECURITY.md for comprehensive security guidance.

🛠️ Maintenance

Regular Tasks

Weekly:

  • Review DHCP leases for unknown devices
  • Check firewall logs for blocked attempts

Monthly:

  • Update router firmware
  • Update AP firmware
  • Review and rotate WiFi passwords if needed
  • Audit connected devices

Quarterly:

  • Full security audit
  • Review and update firewall rules
  • Test disaster recovery procedures
  • Document any configuration changes

Backup Configuration

UniFi:

Settings → System → Backup → Download Backup

EdgeRouter:

show configuration commands > backup-$(date +%Y%m%d).txt

Monitoring

Set up monitoring for:

  • Unusual traffic patterns
  • Failed authentication attempts
  • DHCP pool exhaustion
  • Bandwidth usage by network

📚 Additional Documentation

🤝 Contributing

Improvements and suggestions are welcome! Please:

  1. Test changes thoroughly
  2. Update documentation
  3. Follow security best practices

📄 License

ISC License - See package.json

⚠️ Disclaimer

This configuration is provided as-is. Always test in a non-production environment first. The authors are not responsible for any network outages or security incidents resulting from use of this configuration.

📞 Support

For issues or questions:

  1. Check TROUBLESHOOTING.md
  2. Review Ubiquiti documentation
  3. Consult with network professional if needed

Version: 1.0.0
Last Updated: January 9, 2026
Tested With: UniFi Network v8.x, EdgeOS v2.0.9

About

No description, website, or topics provided.

Resources

Readme
Activity
Custom properties

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

No releases published

Packages

No packages published

Languages