Overview
This project replaced a flat consumer network with a policy-driven architecture for trusted endpoints, IoT devices, guests, cameras, and servers. The ISP gateway runs in passthrough mode while a UniFi gateway centralizes routing, Wi-Fi, DHCP, VLAN orchestration, and stateful firewall enforcement.
Five logical segments separate Core, IoT, Guest, Camera, and Server workloads while only three active SSIDs carry wireless traffic. Server infrastructure stays wired, reducing wireless management overhead without weakening the network's trust boundaries.
Zone-based firewall policies deny broad inter-VLAN access and place narrow service exceptions first. Core retains administrative access; IoT can reach the internet and home-automation controller; guests are internet-only with network and client isolation; cameras can reach only approved storage and automation services; and inbound external traffic is limited to established and related return flows.
Key design choices preserved existing server addressing, limited IPv6 to the trusted segment during the initial rollout, retained mDNS only where cross-VLAN discovery was required, and protected the ISP gateway management plane from lower-trust networks.
During troubleshooting, a cross-VLAN failure initially resembled a firewall-policy error. Route-table and traceroute analysis instead showed that an endpoint VPN client was capturing local subnet traffic before it reached the UniFi gateway, allowing the client routing issue to be fixed without weakening a working security policy.
The resulting environment provides clear trust boundaries, single-NAT routing through ISP passthrough, least-privilege access to automation and storage services, controlled IPv6 exposure, and a scalable foundation for future access points, cameras, and virtualized services.