• Creator
  • #2143599

    Multi Level Router Rules

    by thepeachfarmer ·


    First Post!

    I’ve been growing my network on my farm. Its been a crazy journey from a simple dumb switch with a few office clients and a couple servers to NOW… 20 wireless backhauls, pump stations, automation, PLC, remote cameras, the list goes on.

    I made some big changes this summer. We basically created a “backhaul” or “backbone” network that connects all of my sites and locations. “Router 0” is my main firewall and gateway to the WWW. Along this network are wireless links that connect my various locations. I have roughly 20 routers sitting on this network that serve a variety of locations. When I deployed these routers I was careful to create subnets behind them that would be reflective of each location: – Main Office Router – Main Office Management Subnet – MO Data – MO Phone – MO Camera – MO PLC

    I replicated this structure across all of my locations. For example the Grain Elevator location has this structure: – Grain Elevator Router – GE Management – GE Data
    …. and so on

    There are network resources such as file servers, DNS servers, domain controllers, camera NVRs, MQTT brokers, and others that sit behind specific routers. Currently I have everything wide open (as this is basically the security I had prior), with my Router 0 having the main security rules for the WWW.

    Moving forward I would like to add additional users to my network that need limited to zero access to my server resources. Specifically it may be a particular subnet behind a router. For example:

    Router 0 –

    MO Router –
    GE Router –

    MO Server Subnet –
    GE DATA –
    GE GUEST –

    I want the GE DATA subnet to access the MO Server Subnet but I do not want the GE Guest subnet to access the MO Server Subnet.

    One solution that I was thinking of could be to move my global resources (MO Server subnet) to a subnet of the backhaul ( Then grant access to this subnet based on the subnet from which they originated before entering the network.

    Is this possible? What solutions would you recommend?

    My current hardware is as follows:
    Ubiquiti Security Gateway – Router 0 and MO Router
    Ubiquiti Edge Router – GE Router and various endpoints

    I run the unifi and unms platforms and hardware because I am a one man IT show. I am open to small hardware changes if needed.


You are posting a reply to: Multi Level Router Rules

The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our Community FAQs for details. All submitted content is subject to our Terms of Use.

All Answers

  • Author
    • #2421787


      by abartkiewicz ·

      In reply to Multi Level Router Rules

      Well just remember that the internal networks that don’t go through your firewall will not be blocked by your firewall. I recommend directly connecting (or via a switch) any resources that are needed across the network to your firewall. After that it should be a simple matter of controlling access. Hope that helps.

    • #2421784

      Reply again

      by abartkiewicz ·

      In reply to Multi Level Router Rules

      Also I would recommend denying access from you guest network to everything except outside access. This can be done on the router that your guest devices are connected to with some sort of access list depending on the type of routers you have.

Viewing 1 reply thread