Everything that needs to be configured across all devices. Organized by device.
# Src Dst Proto Port Action Notes
1 VLAN1 ANY ANY ANY ALLOW trusted, full access
2 VLAN20 INTERNET TCP 80,443 ALLOW family web
3 VLAN20 INTERNET UDP 443 ALLOW family QUIC/HTTP3
4 VLAN20 STARGATE TCP 53 ALLOW DNS to AdGuard
5 VLAN20 STARGATE UDP 53 ALLOW DNS to AdGuard
6 VLAN20 VLAN1 ANY ANY DENY no LAN access
7 VLAN20 VLAN30 ANY ANY DENY no IoT access
8 VLAN30 INTERNET TCP 443 ALLOW IoT HTTPS only
9 VLAN30 STARGATE UDP 53 ALLOW DNS to AdGuard
10 VLAN30 STARGATE TCP 53 ALLOW DNS to AdGuard
11 VLAN30 INTERNET UDP 53 DENY block DNS bypass
12 VLAN30 INTERNET TCP 53 DENY block DNS bypass
13 VLAN30 ANY LAN ANY ANY DENY full isolation
14 ANY ANY ANY ANY DENY implicit default
NAT Type Src Dst Translated to
---------------------------------------------------------
Dynamic PAT VLAN1 INTERNET WAN interface IP
Dynamic PAT VLAN20 INTERNET WAN interface IP
Dynamic PAT VLAN30 INTERNET WAN interface IP
All three VLANs share the single public IP via PAT. No inbound NAT unless you explicitly need to expose a service (you probably don't -- use Tailscale instead).
# Src Dst Proto Port Action Notes
1 ANY WAN ICMP echo DENY no ping from internet
2 ANY WAN TCP ANY DENY no inbound services
3 ANY WAN UDP ANY DENY nothing open
Zero inbound ports. All remote access goes through Tailscale, which is outbound-initiated and punches through NAT. The ASA never needs to accept inbound connections.
VLAN Subnet Gateway DNS Lease
--------------------------------------------------------------
1 10.0.1.0/24 10.0.1.1 10.0.0.142 24h
20 10.0.20.0/24 10.0.20.1 10.0.0.142 12h
30 10.0.30.0/24 10.0.30.1 10.0.0.142 6h
Device MAC IP VLAN
-------------------------------------------------------------
STARGATE (get from ifconfig) 10.0.1.142 1
moirai (get from ifconfig) 10.0.1.100 1
krislaptop (get from ifconfig) 10.0.1.101 1
VLAN ID Name Subnet
---------------------------------
1 TRUSTED 10.0.1.0/24
20 FAMILY 10.0.20.0/24
30 IOT 10.0.30.0/24
Port Mode VLAN(s) Device
---------------------------------------
1 access 1 STARGATE
2 access 1 moirai
3 access 1 (spare)
4 trunk 1,20,30 AP (Aironet)
5 access 20 (family wired)
6 access 20 (family wired)
7 access 30 (IoT wired)
8 trunk 1,20,30 uplink to ASA
Feature Setting Why
---------------------------------------------------------
MAC address limit 2 per port prevents rogue devices
BPDU guard enabled prevents rogue switches
DHCP snooping enabled prevents rogue DHCP servers
Dynamic ARP inspection enabled prevents ARP spoofing
Storm control broadcast 20% prevents broadcast storms
These are all switch-level protections that cost nothing to enable and prevent common LAN attacks.
SSID VLAN Auth Band Notes
------------------------------------------------------------
YOTAM 1 WPA3-Personal 2.4+5 trusted devices only
YOTAM-family 20 WPA2-Personal 2.4+5 family devices
YOTAM-iot 30 WPA2-Personal 2.4 IoT (most are 2.4 only)
SSID Client isolation
---------------------------------
YOTAM off (trusted devices can see each other)
YOTAM-family on (family devices can't see each other)
YOTAM-iot on (IoT devices fully isolated from each other)
Client isolation on VLAN 30 is important. A compromised IoT device can't even scan other IoT devices.
AdGuard supports different filter profiles per client IP range:
Client group IPs Filters
-----------------------------------------------------
trusted 10.0.1.0/24 minimal (ads + malware only)
family 10.0.20.0/24 moderate (ads + malware + adult + tracking)
iot 10.0.30.0/24 aggressive (block everything except allowlist)
List Purpose
-----------------------------------------------------
AdGuard DNS filter ads + trackers
OISD (full) comprehensive ad/malware
Steven Black unified malware + fakenews + gambling
Hagezi Pro trackers + telemetry
NoCoin cryptomining
Phishing Army phishing domains
For VLAN 30, flip the model: block everything by default and only allow domains each device actually needs to function. Build the allowlist by:
Category Action Why
-----------------------------------------------------
Malware-CnC drop block command & control callbacks
Exploit-Kit drop block exploit kit delivery
Blacklist drop known bad IPs/domains
App-Detect alert log application identification
Policy-Social alert detect social media on IoT (shouldn't happen)
Server-Webapp drop block web app exploits
OS-Windows drop block Windows exploits
File-Flash / File-Java drop block Flash/Java delivery (always malicious now)
# Block IoT devices phoning home to China/Russia
# (GeoIP filtering on ASA)
deny ip VLAN30 any country CN
deny ip VLAN30 any country RU
# Alert on any device trying DNS over HTTPS (bypasses AdGuard)
alert tcp any any -> any 443 (content:"dns.google"; msg:"DoH bypass attempt";)
alert tcp any any -> any 443 (content:"cloudflare-dns.com"; msg:"DoH bypass attempt";)
alert tcp any any -> any 443 (content:"dns.quad9.net"; msg:"DoH bypass attempt";)
Tailscale stays as your remote access layer. No changes needed to the mesh, but tighten the ACLs:
// tailscale ACL policy
{
"acls": [
// kris can reach everything
{"action": "accept", "src": ["kris@"], "dst": ["*:*"]},
// STARGATE can reach other tailscale nodes
{"action": "accept", "src": ["tag:server"], "dst": ["*:*"]},
// nothing else
{"action": "deny", "src": ["*"], "dst": ["*:*"]}
]
}
Things to configure, in order, once hardware arrives:
PHASE 1 (ASA only)
[ ] Flash ASA to latest firmware
[ ] Set WAN interface (DHCP from modem)
[ ] Set LAN interface (10.0.1.1/24)
[ ] Enable PAT on WAN
[ ] Set DHCP server for VLAN 1
[ ] Point DHCP DNS to STARGATE
[ ] Enable FirePOWER IPS with default Talos ruleset
[ ] Block all inbound on WAN
[ ] Test: internet works, STARGATE reachable, no open inbound ports
PHASE 2 (add switch)
[ ] Create VLANs 1, 20, 30 on switch
[ ] Set trunk port to ASA
[ ] Set trunk port to AP slot
[ ] Set access ports per plan above
[ ] Create VLAN interfaces on ASA (10.0.20.1, 10.0.30.1)
[ ] Set DHCP pools for VLAN 20 and 30
[ ] Apply inter-VLAN firewall rules
[ ] Enable port security features
[ ] Test: VLAN 20 can reach internet, cannot reach VLAN 1
PHASE 3 (add AP)
[ ] Flash Aironet to Mobility Express
[ ] Configure three SSIDs with VLAN tags
[ ] Set WPA3/WPA2 per SSID
[ ] Enable client isolation on VLAN 20 and 30
[ ] Test: each SSID gets correct VLAN, isolation works
PHASE 4 (hardening)
[ ] Set up per-client DNS profiles in AdGuard
[ ] Build IoT domain allowlist
[ ] Enable DoH bypass detection
[ ] Configure GeoIP blocking on ASA
[ ] Set up Zeek/ntopng on STARGATE (if TAP purchased)
[ ] Tighten Tailscale ACLs
[ ] Run nmap from outside to verify zero open ports