Start with outcomes, not rules
A home network should be understandable at 10pm during an outage. Build only the segmentation that you can document, monitor, and recover.
Your baseline infrastructure includes a UCG Fiber and U6 Pro. Use the existing UniFi UCG Fiber guide for platform-specific context; this cookbook focuses on policy patterns.
A simple trust model
| Network | Typical devices | Default policy |
|---|---|---|
| Trusted | laptops, phones, admin devices | Internet + allowed management access |
| IoT | lights, plugs, appliances, sensors | Internet only if needed; limited access to services such as HA/MQTT |
| Guest | visitor devices | Internet only; no LAN access |
| Infrastructure | router, AP, server/admin plane | Restricted management access |
You do not need all four on day one. The value comes from a clear intent and enforced boundaries.
Firewall rule design
Write rules as sentences before creating them:
IoT devices may reach Home Assistant on required ports.
Trusted devices may administer the network and servers.
Guest devices may reach the internet but no private RFC1918 networks.
No network has broad access to infrastructure by default.Then implement the minimum rules that realise those statements. Keep a rule table outside the controller:
| Rule name | Source | Destination | Ports | Action | Why | Test |
|---|
Avoid rule names like “allow stuff.” Future-you needs intent.
Safe migration to IoT VLAN
- Inventory devices and record their current IP/MAC/integration dependencies.
- Create the VLAN/network and SSID without moving critical devices.
- Add only the required firewall paths (for example, IoT → HA/MQTT).
- Move one non-critical device and test control, discovery, and firmware updates.
- Confirm mDNS/multicast requirements before moving ecosystem devices that rely on discovery.
- Migrate in batches; keep a rollback path.
Do not move the HA host, Zigbee coordinator host, router/AP, and every IoT device simultaneously.
Wi-Fi design
- Prefer WPA2/WPA3 settings that all required devices support.
- Use stable SSIDs; many IoT devices are poor at migrating.
- Keep 2.4 GHz available where older/IoT devices require it.
- Avoid channel changes during diagnosis unless interference is demonstrated.
- Use DHCP reservations for core services/devices that need stable addressability.
Monitoring without false certainty
Track UCG/AP connectivity, uptime, resource trends, and WAN reachability. A single ping monitor cannot prove the cause of an outage; it can prove a symptom. Your WAN watchdog intentionally alerts and records events without automatically rebooting the gateway—keep that safety boundary unless evidence supports a controlled change.
Troubleshooting flow
Client problem
→ Is the AP/network up?
→ Does client receive an IP/DNS?
→ Can it reach gateway?
→ Can it reach required local service?
→ Is firewall rule/order correct?
→ Is discovery/multicast required?
→ Is application/integration, rather than network, at fault?Before any controller/gateway update
[ ] Export UniFi configuration.
[ ] Note current controller/gateway/AP versions and health.
[ ] Review release notes and known issues.
[ ] Avoid updates before travel or high-dependency periods.
[ ] Verify WAN, Wi-Fi, DHCP, DNS, and HA integrations after update.Rule of restraint
The best home network is not the most segmented diagram. It is the one that delivers stable connectivity, reasonable containment, clear recovery, and an accurate runbook.