The UniFi Dream Machine might not be the Ultimate Firewall for your homelab. pfSense might be more Hands on, or running a Palo Alto of Cisco Firewall more Enterprise like. But the Dream Machine does have all the features I require, Good Support and a Pretty Interface.
The Home Datacenter company also considered all there options and in the end the CIO/CTO/CEO and Wife decided UniFi will do the Job.
I started of by following the Deployment guide to get my Dream Machine up and Running. With my Dream Machine and two Unifi switches setup It was time to create the Networks.
I started of creating only the Necessary Networks.
Management / Default – Used as Management VLAN for Switches and Network Devices
- Subnet: 10.11.12.0/24
- Gateway: 10.11.12.10
- DHCP Scope: 10.11.12.15 – 10.11.12.35
THDC-Infra
- Subnet: 10.70.10.1/24
- Gateway: 10.70.1.1
- DHCP Scope: 10.70.10.200 – 10.70.10.254
THDC-AD
- Subnet: 10.70.11.1/24
- Gateway: 10.70.11.1
- DHCP Scope: 10.70.10.20 – 10.70.10.254
THDC-vSphere
- Subnet: 10.70.12.1/24
- Gateway: 10.70.12.11
- DHCP Scope: 10.70.12.200 – 10.70.12.254
THDC-vMotion
- Subnet: 10.70.14.1/24
- Gateway: 10.70.14.1
- DHCP Scope: 10.70.14.200 – 10.70.14.254
THDC-iSCSI-Routed
- Subnet: 10.70.15.1/24
- Gateway: 10.70.15.1
- DHCP Scope: 10.70.15.200 – 10.70.15.254
THDC-vRealize
- Subnet: 10.70.13.1/24
- Gateway: 10.70.13.1
- DHCP Scope: 10.70.13.200 – 10.70.13.254
Security
The next part was to setup my Default security for my Lab. At this time I did not setup any DMZ’s and also no firewall rules between Subnet. I would be a good idea to do the inter subnet firewall rules at this time then you do not need to go back an retrofit them. But another lesson learned on my side as I did not do it.
I used the UniFi Dream Machine Default Sensitivity Setting on High for my Lab. This still allow for nearly Max Speed on my ISP connection
I also Deployed some Internal Honeypot’s to find any Dodgy stuff I deploy in my Lab.
We are now ready to start deploying Hosts and Services. I will need to come back to the network config to change all VLAN’s DHCP setting to distribute my Own DNS Servers but as we do not have them yet I left it out for now.
In Part 2 We will look at setting Up my Synology NAS to Supply Storage and NTP Services.