Networking

A lot of people have one physical and one logical network in their home. I have one physical network split into six logical networks, because I like keeping my primary computers separate from my Internet of Things devices, my servers, and any guests. Since I first wrote this page I’ve moved off pfSense and onto an all-UniFi setup. Last updated October 2026.

The Hardware

  • Gateway – UniFi Cloud Gateway Ultra. This replaced my pfSense box. It handles routing, the firewall, DHCP, the VPN server and IPv6, and it runs the UniFi Network application itself, so I no longer need the separate controller VM I used to run.
  • Main Switch – UniFi USW Lite 8 PoE. Most of my wired gear plugs in here, and it powers the access point over PoE. It replaced my old US-8.
  • Extra Switch – UniFi USW Flex Mini. A small 5-port switch that adds a few ports where I need them.
  • Access Point – UniFi U7 Lite. A Wi-Fi 7 access point on 2.4 GHz and 5 GHz that replaced my old UAP-AC-Lite.

Plugged into all of that:

  • A NAS for file storage and Docker data
  • Two Ubuntu servers that run my Docker containers
  • A small mini PC that handles downloads
  • A network KVM so I can reach a machine’s console remotely
  • My gaming rig and streaming rig

How It’s Connected

Cable internet comes into the Cloud Gateway Ultra. The gateway’s built-in ports feed the NAS, one of the Docker servers, my streaming rig and the uplink to the main switch. The USW Lite 8 PoE then connects the access point (and powers it), my gaming rig, the second Docker server, the downloads mini PC and the KVM. All of the server ports carry every network as tagged VLANs, so containers can live directly on whichever network they serve.

Internet
  └─ Cloud Gateway Ultra (router / firewall / UniFi controller)
       ├─ NAS
       ├─ Docker server 1
       ├─ Streaming rig
       └─ USW Lite 8 PoE (main switch)
            ├─ U7 Lite access point (PoE)
            ├─ Gaming rig
            ├─ Docker server 2
            ├─ Downloads mini PC
            └─ Network KVM

The Networks

  • Main – my computers and phones.
  • Internet of Things – smart plugs, bulbs, cameras, the TV, the Xbox and the other gadgets that don’t need to see anything else.
  • Guest – internet access only, isolated from everything else.
  • Servers – the NAS, the Docker hosts and their containers.
  • Downloads – a network of its own for the downloads mini PC.
  • VPN – a WireGuard VPN so I can get back into my network when I’m away from home.

On the wireless side I run four networks: one for the main network, one for guests, and two for IoT. The second IoT network exists only for a few older devices that can’t handle WPA3. The rest use WPA2/WPA3.

Firewall Approach

The gateway uses UniFi’s zone-based firewall. Every network belongs to exactly one zone, and policies control traffic between zones in both directions. UniFi’s built-in zones are fairly open by default: anything in the built-in Internal zone can reach every other built-in zone. Custom zones are the opposite and block everything until you allow it. So I keep only my main network in Internal and put IoT, Servers and Downloads each in a custom zone of its own. Then I open only what’s needed, and those custom policies take priority over UniFi’s built-in ones:

  • Main network: can reach the servers and the IoT devices. Those allow policies use UniFi’s “Auto Allow Return Traffic” option, so the servers and IoT devices can reply but can never start a connection back into the main network.
  • VPN: uses the built-in VPN zone, so when I connect from away I’m effectively on my main network. I added a policy that lets it reach the servers as well. IoT and Downloads stay blocked.
  • Downloads: can reach the internet, plus file sharing and ping to the NAS. Nothing else on the inside.
  • IoT: also has UniFi’s network isolation turned on. It can reach the internet and the gateway, but nothing else inside. A few devices like the TV are blocked from the internet entirely.
  • Guest: sits in the built-in Hotspot zone, which only gets the internet and basic services from the gateway.
  • From the internet: the built-in External zone blocks everything coming in except replies to traffic I started, the WireGuard VPN, and web traffic to my reverse proxy, whose sites are published through Cloudflare.

Network Services in Docker

Most of my network services run as Docker containers on two Ubuntu servers, managed from a single Portainer instance (one server runs Portainer, the other runs its agent). I recently reworked a lot of this with help from Claude, Anthropic’s AI assistant:

  • AdGuard Home (DNS and ad blocking). I run four AdGuard Home containers: a primary and a secondary for the main and server networks, plus a separate primary and secondary for the IoT network. The primaries live on one server and the secondaries on the other, so DNS keeps working if either server goes down. Both are handed out over IPv4 and IPv6.
  • AdGuard Home Sync. I only make changes on the primaries, and this container copies them to the secondaries automatically.
  • Nginx Proxy Manager. This is the reverse proxy that sits in front of my self-hosted sites and handles their Let’s Encrypt certificates.
  • Cloudflare DDNS. This runs alongside the proxy and keeps my Cloudflare DNS records pointed at home whenever my ISP changes my address, for both IPv4 and IPv6.

The DNS and proxy containers use macvlan networking, so each one shows up on its network as its own device with a fixed address. That makes the firewall rules simple: I can allow or block a specific container the same way I would a physical machine. Container data is kept in organized folders on the servers, so each service can be moved or rebuilt without losing its settings.

This page updated with AI and reviewed by the author