{"id":15430335,"url":"https://github.com/davidjenni/udm-pro-network","last_synced_at":"2026-01-07T06:19:59.989Z","repository":{"id":137301190,"uuid":"398662158","full_name":"davidjenni/udm-pro-network","owner":"davidjenni","description":"Unifi UDM-Pro prosumer network configuration","archived":false,"fork":false,"pushed_at":"2023-03-11T00:55:39.000Z","size":849,"stargazers_count":71,"open_issues_count":1,"forks_count":12,"subscribers_count":7,"default_branch":"main","last_synced_at":"2024-10-18T05:57:42.381Z","etag":null,"topics":["configuration","networking","ubiquiti","udm-pro","unifi","vlan"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"cc0-1.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/davidjenni.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-08-21T21:48:27.000Z","updated_at":"2024-09-05T17:51:44.000Z","dependencies_parsed_at":null,"dependency_job_id":"c70b3240-6fb0-45eb-b6c5-f6897c80af76","html_url":"https://github.com/davidjenni/udm-pro-network","commit_stats":{"total_commits":8,"total_committers":3,"mean_commits":"2.6666666666666665","dds":0.5,"last_synced_commit":"023c85fc0b84bf93078ade726d155b253c9879f2"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/davidjenni%2Fudm-pro-network","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/davidjenni%2Fudm-pro-network/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/davidjenni%2Fudm-pro-network/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/davidjenni%2Fudm-pro-network/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/davidjenni","download_url":"https://codeload.github.com/davidjenni/udm-pro-network/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245976911,"owners_count":20703553,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["configuration","networking","ubiquiti","udm-pro","unifi","vlan"],"created_at":"2024-10-01T18:15:21.852Z","updated_at":"2026-01-07T06:19:54.948Z","avatar_url":"https://github.com/davidjenni.png","language":null,"funding_links":[],"categories":["Dream Machine Utilities"],"sub_categories":["Other Platforms"],"readme":"# Prosumer network configuration using Unifi/Ubiquiti gear\n\n[Ubiquiti](https://www.ui.com/) is a creative and proliferate producer of really cool networking gear\nat reasonably attractive prices.\nBut what they are ahead in hardware and software, they lack on documentation.\nThe basics are documented in their help pages, but many of the more involved\nnetworking configurations have gaps.\n\nThis repo was initially intended to capture and document my own home network's configuration. Hope is, this\nwill also help others in their quest for a more solid networking experience.\n\n## Goals\n\n- run a reliable, secure and well performing home network with little complaints from my customer base (aka spouse \u0026 family)\n- design with Principle of Least Privilege (PoLP).\n  One definition by [NIST, see page 91](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-12r1.pdf)\n- keep my customer base reasonably sheltered from online privacy mining and spying.\n- allow me to tinker and learn, hence this network setup is indeed over-engineered.\n  A simple modern ISP's router \u0026 gateway could get the basic job done (but would be less fun to interact with).\n\n## Design choices\n\nDisclaimer: I have no relationship with, no sponsoring from nor financial interests in Ubiquiti,\nI'm just a mostly happy customer of their products.\n\nAbout ~10 years ago, I discovered Ubiquiti's prosumer networking hardware that is indeed disruptive,\nfor the price they are able to offer their hardware. My journey with UI started with just an AP or 2,\ncombined with an EdgeRouterLite 3, adding a couple PoE capable switches to it over time.\nThis summer I finally took the plunge to replace my ERL3 (which started to exhibit some\nthermal stability issues) with the UDM Pro [Unifi Dream Machine Pro](https://www.ui.com/consoles/)\n\n### Basic topology\n\nThis is the current physical wired topology, with the UDM-Pro as the gateway,\nand one PoE-enabled UI switch on each floor. House ethernet wiring is good for up to 1 Gbit/s,\nwith all runs made in CAT5e; same for patch cables.\n\n![backhaul topo](/assets/UDP-Pro-topo.png)\n\n### Network segmentation\n\nFollowing the Least Privilege principle, the LAN is separated into multiple logical segments, using\nVLANs:\n| VLAN | CIDR | Medium | SSID | Purpose |\n| ---: | ---: | ------ | ---- | ------- |\n| 1  | 10.0.90.0/24 | Wired 1GbE | n/a | backhaul, management |\n| 10 | 10.0.10.0/24 | Wired/Wireless | jenni.ap | trusted home net |\n| 20 | 10.0.20.0/24 | Wireless | jenni.guest | guests, internet only |\n| 30 | 10.0.30.0/24 | Wireless | jenni.iot | IoT devices, internet only |\n| 40 | 10.0.40.0/24 | Wireless | jenni.media | media devices, internet only |\n| 50 | 10.0.50.0/24 | Wired | n/a | PoE camera devices, no internet |\n\nFor my network, I chose ranges from the 10/8 private address space, feel free to pick different ranges\nfrom [RFC1918](https://datatracker.ietf.org/doc/html/rfc1918), e.g. from the 172.16/12 or 192.168/16 ranges.\nI find it useful to reflect the sub range, e.g. ```.10.*```, to also be the VLAN id, but there is no\ntechnical need to do so.\n\nNote the 5 switches shown below are purely logical; the physical HW has the UDM and the 2 switches above.\nBy default, the UDM Pro allows full inter-VLAN access, but this site's configuration will by default block\nany inter-VLAN connectivity, and only allow the trusted ```home (10)``` VLAN to initiate connections to the\n```IoT (30)``` and ```media (40)``` VLANs. Access from/to the ```management (1)``` LAN and trunk is\nnot allowed from any VLAN; sole exception is allowing access to the UDM-P itself from the ```home (10)``` (10.0.10.1).\n\nDetails see [Firewall](#Firewall)\n\n![logical network](assets/UDM-P_logical_network.svg)\ndiagram created with: \u003chttps://lucid.app/documents/view/2e7294c0-6628-45b6-8b2d-1b2a5b47b208\u003e\n\n## Configuration\n\n- [Initial Setup of UDM-Pro](/configuration/1-UDM-Pro-Setup.md)\n- [Backhaul: Switches, AccessPoints](/configuration/2-Backhaul-switches-APs.md)\n- [Define networks](/configuration/3-Networks.md)\n- [Define WiFi](/configuration/4-Wifi.md)\n- [Firewall groups and rules](/configuration/5-Firewall-rules.md)\n- [Cloudflare tunnel to LAN](configuration/6-Cloudflare-tunnel.md)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdavidjenni%2Fudm-pro-network","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdavidjenni%2Fudm-pro-network","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdavidjenni%2Fudm-pro-network/lists"}