# Firewall & Network Rules Everything that needs to be configured across all devices. Organized by device. ## ASA Firewall Rules ### Inter-VLAN Policy ``` # Src Dst Proto Port Action Notes 1 VLAN1 ANY ANY ANY ALLOW trusted, full access 2 VLAN20 INTERNET TCP 80,443 ALLOW family web 3 VLAN20 INTERNET UDP 443 ALLOW family QUIC/HTTP3 4 VLAN20 STARGATE TCP 53 ALLOW DNS to AdGuard 5 VLAN20 STARGATE UDP 53 ALLOW DNS to AdGuard 6 VLAN20 VLAN1 ANY ANY DENY no LAN access 7 VLAN20 VLAN30 ANY ANY DENY no IoT access 8 VLAN30 INTERNET TCP 443 ALLOW IoT HTTPS only 9 VLAN30 STARGATE UDP 53 ALLOW DNS to AdGuard 10 VLAN30 STARGATE TCP 53 ALLOW DNS to AdGuard 11 VLAN30 INTERNET UDP 53 DENY block DNS bypass 12 VLAN30 INTERNET TCP 53 DENY block DNS bypass 13 VLAN30 ANY LAN ANY ANY DENY full isolation 14 ANY ANY ANY ANY DENY implicit default ``` ### Rule notes - Rule 11-12 are critical: many IoT devices hardcode 8.8.8.8 or 1.1.1.1 to bypass local DNS. Block it and force them through AdGuard. - VLAN 20 gets 80+443 because some captive portals and HTTP redirects still need port 80. - VLAN 30 gets 443 only. If a device breaks, add a specific rule for it rather than opening everything. - Rule ordering matters on the ASA: first match wins. Specific allows before broad denies. ### NAT Rules ``` NAT Type Src Dst Translated to --------------------------------------------------------- Dynamic PAT VLAN1 INTERNET WAN interface IP Dynamic PAT VLAN20 INTERNET WAN interface IP Dynamic PAT VLAN30 INTERNET WAN interface IP ``` All three VLANs share the single public IP via PAT. No inbound NAT unless you explicitly need to expose a service (you probably don't -- use Tailscale instead). ### Inbound (WAN -> LAN) ``` # Src Dst Proto Port Action Notes 1 ANY WAN ICMP echo DENY no ping from internet 2 ANY WAN TCP ANY DENY no inbound services 3 ANY WAN UDP ANY DENY nothing open ``` Zero inbound ports. All remote access goes through Tailscale, which is outbound-initiated and punches through NAT. The ASA never needs to accept inbound connections. ## DHCP Configuration (on ASA) ``` VLAN Subnet Gateway DNS Lease -------------------------------------------------------------- 1 10.0.1.0/24 10.0.1.1 10.0.0.142 24h 20 10.0.20.0/24 10.0.20.1 10.0.0.142 12h 30 10.0.30.0/24 10.0.30.1 10.0.0.142 6h ``` - DNS for all VLANs points to STARGATE (AdGuard Home) - Shorter lease on IoT so devices cycle faster and you catch new ones - STARGATE itself gets a static IP (10.0.1.142 or keep 10.0.0.142 -- just be consistent) ### Static assignments (reserve in DHCP) ``` Device MAC IP VLAN ------------------------------------------------------------- STARGATE (get from ifconfig) 10.0.1.142 1 moirai (get from ifconfig) 10.0.1.100 1 krislaptop (get from ifconfig) 10.0.1.101 1 ``` ## Switch Rules (SG350 / 2960X) ### VLAN Definitions ``` VLAN ID Name Subnet --------------------------------- 1 TRUSTED 10.0.1.0/24 20 FAMILY 10.0.20.0/24 30 IOT 10.0.30.0/24 ``` ### Port Assignments ``` Port Mode VLAN(s) Device --------------------------------------- 1 access 1 STARGATE 2 access 1 moirai 3 access 1 (spare) 4 trunk 1,20,30 AP (Aironet) 5 access 20 (family wired) 6 access 20 (family wired) 7 access 30 (IoT wired) 8 trunk 1,20,30 uplink to ASA ``` ### Port Security (optional but recommended) ``` Feature Setting Why --------------------------------------------------------- MAC address limit 2 per port prevents rogue devices BPDU guard enabled prevents rogue switches DHCP snooping enabled prevents rogue DHCP servers Dynamic ARP inspection enabled prevents ARP spoofing Storm control broadcast 20% prevents broadcast storms ``` These are all switch-level protections that cost nothing to enable and prevent common LAN attacks. ## AP Rules (Aironet) ### SSID Configuration ``` SSID VLAN Auth Band Notes ------------------------------------------------------------ YOTAM 1 WPA3-Personal 2.4+5 trusted devices only YOTAM-family 20 WPA2-Personal 2.4+5 family devices YOTAM-iot 30 WPA2-Personal 2.4 IoT (most are 2.4 only) ``` - WPA3 on trusted SSID if all your devices support it (moirai, laptop do) - WPA2 on family/IoT because older devices choke on WPA3 - Different passwords for each SSID obviously - Hide YOTAM SSID (optional, minor security through obscurity but keeps it clean) ### Client Isolation ``` SSID Client isolation --------------------------------- YOTAM off (trusted devices can see each other) YOTAM-family on (family devices can't see each other) YOTAM-iot on (IoT devices fully isolated from each other) ``` Client isolation on VLAN 30 is important. A compromised IoT device can't even scan other IoT devices. ## AdGuard Home Rules (STARGATE) ### Per-client DNS filtering AdGuard supports different filter profiles per client IP range: ``` Client group IPs Filters ----------------------------------------------------- trusted 10.0.1.0/24 minimal (ads + malware only) family 10.0.20.0/24 moderate (ads + malware + adult + tracking) iot 10.0.30.0/24 aggressive (block everything except allowlist) ``` ### Blocklists to enable ``` List Purpose ----------------------------------------------------- AdGuard DNS filter ads + trackers OISD (full) comprehensive ad/malware Steven Black unified malware + fakenews + gambling Hagezi Pro trackers + telemetry NoCoin cryptomining Phishing Army phishing domains ``` ### IoT allowlist approach For VLAN 30, flip the model: block everything by default and only allow domains each device actually needs to function. Build the allowlist by: 1. Set up the IoT device 2. Watch AdGuard logs for blocked queries from its IP 3. Allow only the domains it needs (e.g., *.amazon.com for Alexa) 4. Everything else stays blocked ## FirePOWER IPS Rules (on ASA) ### Rule sets to enable ``` Category Action Why ----------------------------------------------------- Malware-CnC drop block command & control callbacks Exploit-Kit drop block exploit kit delivery Blacklist drop known bad IPs/domains App-Detect alert log application identification Policy-Social alert detect social media on IoT (shouldn't happen) Server-Webapp drop block web app exploits OS-Windows drop block Windows exploits File-Flash / File-Java drop block Flash/Java delivery (always malicious now) ``` ### Custom rules to add ``` # Block IoT devices phoning home to China/Russia # (GeoIP filtering on ASA) deny ip VLAN30 any country CN deny ip VLAN30 any country RU # Alert on any device trying DNS over HTTPS (bypasses AdGuard) alert tcp any any -> any 443 (content:"dns.google"; msg:"DoH bypass attempt";) alert tcp any any -> any 443 (content:"cloudflare-dns.com"; msg:"DoH bypass attempt";) alert tcp any any -> any 443 (content:"dns.quad9.net"; msg:"DoH bypass attempt";) ``` ## Tailscale Integration Tailscale stays as your remote access layer. No changes needed to the mesh, but tighten the ACLs: ```jsonc // tailscale ACL policy { "acls": [ // kris can reach everything {"action": "accept", "src": ["kris@"], "dst": ["*:*"]}, // STARGATE can reach other tailscale nodes {"action": "accept", "src": ["tag:server"], "dst": ["*:*"]}, // nothing else {"action": "deny", "src": ["*"], "dst": ["*:*"]} ] } ``` ## Checklist Things to configure, in order, once hardware arrives: ``` PHASE 1 (ASA only) [ ] Flash ASA to latest firmware [ ] Set WAN interface (DHCP from modem) [ ] Set LAN interface (10.0.1.1/24) [ ] Enable PAT on WAN [ ] Set DHCP server for VLAN 1 [ ] Point DHCP DNS to STARGATE [ ] Enable FirePOWER IPS with default Talos ruleset [ ] Block all inbound on WAN [ ] Test: internet works, STARGATE reachable, no open inbound ports PHASE 2 (add switch) [ ] Create VLANs 1, 20, 30 on switch [ ] Set trunk port to ASA [ ] Set trunk port to AP slot [ ] Set access ports per plan above [ ] Create VLAN interfaces on ASA (10.0.20.1, 10.0.30.1) [ ] Set DHCP pools for VLAN 20 and 30 [ ] Apply inter-VLAN firewall rules [ ] Enable port security features [ ] Test: VLAN 20 can reach internet, cannot reach VLAN 1 PHASE 3 (add AP) [ ] Flash Aironet to Mobility Express [ ] Configure three SSIDs with VLAN tags [ ] Set WPA3/WPA2 per SSID [ ] Enable client isolation on VLAN 20 and 30 [ ] Test: each SSID gets correct VLAN, isolation works PHASE 4 (hardening) [ ] Set up per-client DNS profiles in AdGuard [ ] Build IoT domain allowlist [ ] Enable DoH bypass detection [ ] Configure GeoIP blocking on ASA [ ] Set up Zeek/ntopng on STARGATE (if TAP purchased) [ ] Tighten Tailscale ACLs [ ] Run nmap from outside to verify zero open ports ```