Networking on myl3z.me

Handing Out Pi-hole via DHCP (UDM)

Mon, 01 Jan 0001 00:00:00 +0000

Handing Out Pi-hole via DHCP#

A DNS server nobody asks filters nothing. After installing Pi-hole the service is running, but every device in the house still gets told the gateway’s address as its nameserver when it joins, and it obediently uses it. The filter sits next to the traffic and watches.

The place where this is decided is a single field in the gateway’s DHCP server — on a UniFi Dream Machine that means the network configuration, not the box Pi-hole runs on.

Understanding VLANs

Mon, 01 Jan 0001 00:00:00 +0000

Understanding VLANs#

A switch forwards frames by MAC address and knows nothing about networks. Everything attached to it sits in the same broadcast domain: an ARP request reaches every port, every device sees every other one. That is precisely what segmentation ends — and a VLAN is the means by which a single switch pretends to be several.

The tag#

The basis is IEEE 802.1Q: four additional bytes in the Ethernet frame, right behind the source MAC. Among other things they carry twelve bits of VLAN ID, so 4094 usable numbers — 0 and 4095 are reserved.

Network Layout with VLANs

Mon, 01 Jan 0001 00:00:00 +0000

Network Layout with VLANs#

The network used to consist of a single segment: 10.10.0.0/16, everything inside it, from the gateway through the thin client to the television. That works as long as you own one machine. It also means every device reaches every other one directly — the robot vacuum reaches the work laptop, the TV reaches the UDM’s management interface.

Since 23 August 2026 there are six segments. This note describes the layout and the reasoning behind it; the rebuild procedure is under Setting Up VLANs on the UDM, the terminology under Understanding VLANs.

Setting Up VLANs on the UDM

Mon, 01 Jan 0001 00:00:00 +0000

Setting Up VLANs on the UDM#

The order in which the rebuild from a flat 10.10.0.0/16 to six segments actually worked — including the two places where the planned order did not. The layout behind it is under Network Layout with VLANs, the terminology under Understanding VLANs.

First: shrink the old network#

The plan was to create the new networks while leaving the existing one untouched, and to shrink the old network to /24 only at the very end. That cannot be sustained.

Firewalling Between Segments

Mon, 01 Jan 0001 00:00:00 +0000

Firewalling Between Segments#

Segments on their own separate nothing. Once the networks are routed — and they are, otherwise nobody reaches the internet — the ruleset on the gateway alone decides who reaches whom. The VLAN only ensures the traffic passes the gateway at all and can be judged there.

The base rule#

Deny by default, permit by exception. Every segment may reach the internet, none may reach another — and departures from that need a concrete reason.

Mapping WLANs to VLANs

Mon, 01 Jan 0001 00:00:00 +0000

Mapping WLANs to VLANs#

On a wire the switch port decides which segment a device lands in. On WLAN there is no port — there the SSID decides. Every wireless network maps to exactly one VLAN, and whatever a device associates with determines where it sits.

One SSID per segment#

SSID	Network	Particularity
`xlab`	Clients (20)	WPA3/WPA2 mixed, both bands
`xlab-IoT`	IoT (30)	2.4 GHz only, WPA2, PMF off
`xlab-Kids`	Kids (25)	like clients, plus time windows
`xlab-Guests`	Guests (40)	client device isolation

The mapping lives in UniFi under Settings → WiFi → SSID → Network. Depending on the version the field is called Network or VLAN; it always means the same thing.