Wi-Fi
A single access point carries four networks over one cable: its own management network untagged, and three Wi-Fi networks as VLANs. It is managed by a UniFi controller running on the cluster's sixth board, with a local account only.
- Access point
- UniFi, ceiling mounted, one cable
- Controller
- UniFi OS Server in Podman, on a Raspberry Pi CM5
- Account
- Local only, no cloud, remote access off
- Isolation
- Client isolation on IoT and Guest
How the networks are split#
- Management, untagged. The access point's own network. It may talk to its controller and nothing else; it has no internet at all, and firmware arrives through the controller.
- Trusted, VLAN 10. Phones and the laptop. They can reach Home Assistant and the media player's remote control.
- IoT, VLAN 20. Devices that need a cloud but deserve no trust. Clients cannot see each other; Home Assistant can reach them, not the other way round.
- Guest, VLAN 30. Internet only, directly via the provider, with every attempt to reach a home network blocked and logged.
Why self-host the controller#
Ubiquiti's cloud is optional. Running the controller locally keeps the configuration, the device list and the logs at home, and the access point's management network can be fully cut off from the internet.
In the configuration#
description "Trusted Wi-Fi"
parent igc2 vnetid 10
inet 192.168.10.1 255.255.255.0- On OpenBSD a VLAN is just another interface file, so pf treats it like any other network.