# Project Blueprint: High-Availability DNS Stack, Network Honeypot & UDM Pro Network Security ## 1. Executive Summary & Live UDM Pro Topology Assessment Based on the live UDM Pro controller diagnostics, we have mapped the exact network topography, identified critical security exposures, and tailored the implementation plan. --- ### 1.1 Live Network & VLAN Topography | VLAN ID | Network Name | Subnet / CIDR | Gateway IP | Active Leases | Security Classification | |:---:|---|---|---|:---:|---| | **1** | **LAN** | `14.44.4.0/25` | `14.44.4.1` | 14 / 117 | Trusted Internal Clients | | **2** | **Management** | `140.44.44.0/24` | `140.44.44.1` | 9 / 51 | Out-of-band (iDRAC, Switches, APs) | | **3** | **Spacedock** | `140.44.1.0/24` | `140.44.1.1` | 0 / 249 | Harvester VM / Hypervisor Tenant | | **20** | **Compute** | `140.44.4.0/25` | `140.44.4.1` | 1 / 15 (Static Nodes) | Mission-Critical K3s Clusters, Swarm | | **30** | **Media** | `192.168.1.0/25` | `192.168.1.1` | 1 / 91 | Streaming & Entertainment Devices | | **40** | **Storage** | `14.10.10.0/25` | `14.10.10.1` | 2 / 125 | Synology NAS (`.71`, `.72`) NFS / iSCSI | | **50** | **Smart Home** | `14.4.4.0/25` | `14.4.4.1` | 53 / 85 | IoT Devices, Gaming Host (`14.4.4.15`) | | **60** | **HA** | `140.4.4.0/25` | `140.4.4.1` | 0 / 7 | High-Availability Interconnects | | **VPN** | **WireGuard / Teleport** | `192.168.3.0/24` / `.2.0/24` | UDM Pro | Remote | Ingress Remote Access | --- ### 1.2 Critical Security Findings from UDM Pro Diagnostics 1. **Default Security Posture is `Allow All`:** * Currently, the UDM Pro routes traffic freely between all subnets without restriction. * **Risk:** The 53 IoT devices in Smart Home (`14.4.4.0/25`) and Media devices can directly initiate connections to Kubernetes nodes, etcd ports, SSH, and Synology NAS shares in `Compute` (`140.44.4.0/25`) and `Storage` (`14.10.10.0/25`). 2. **WAN Port Forwarding to Smart Home Host (`14.4.4.15`):** * Port forwards for game servers (`FS25` ports 8443/10823, `Stationeers` ports 6443/27015) point directly from WAN (`174.106.252.96`) to host `14.4.4.15` on the Smart Home VLAN. * If an exploit compromises this host, an attacker currently has unhindered lateral access to the entire homelab infrastructure. 3. **DNS Leaks & Lack of Local Filtering:** * UDM Pro WAN is set to `Auto DNS Server` (Spectrum ISP DNS `0.0.0.0`). * No DNS ad/malware filtering or split-horizon DNS caching is currently active across the subnets. --- ## 2. High-Availability DNS Stack (Pi-hole + Technitium) ```mermaid flowchart TD subgraph Clients["LAN Clients across all VLANs (VLAN 1, 20, 30, 50, VPN)"] Devices["IoT Devices (53), Laptops, Servers, Hypervisors"] end subgraph UDM["UniFi Dream Machine Pro (140.44.4.1)"] DHCP["DHCP Option 6 per VLAN:
Primary DNS: 140.44.4.35 (Aerodrome VIP)
Secondary DNS: 140.44.4.65 (Spaceport VIP)"] NAT["DNS Redirection Rule:
Capture port 53 to hardcoded DNS (8.8.8.8) -> Redirect to VIPs"] end subgraph AeroCluster["Aerodrome K3s Cluster (VLAN 20)"] AeroVIP["MetalLB VIP: 140.44.4.35:53 (UDP/TCP)"] AeroPihole["Pi-hole Instance 1
(Ad-blocking, Caching, FTL rate-limit: 0)"] AeroTech["Technitium Instance 1 (Primary Authoritative)
(snarfnet.net Zone, Reverse PTR, DNSSEC)"] AeroStorage["Longhorn Storage Volume"] end subgraph SpaceCluster["Spaceport K3s Cluster (VLAN 20)"] SpaceVIP["MetalLB VIP: 140.44.4.65:53 (UDP/TCP)"] SpacePihole["Pi-hole Instance 2
(Ad-blocking, Caching, FTL rate-limit: 0)"] SpaceTech["Technitium Instance 2 (Secondary Authoritative)
(Zone Transfer AXFR/IXFR from Primary)"] SpaceStorage["Longhorn Storage Volume"] end subgraph Upstream["Encrypted Upstream Resolvers"] DoH["DNS-over-HTTPS (Quad9 / Cloudflare / Mullvad)"] end Devices -->|DNS Queries (UDP/TCP 53)| DHCP DHCP -->|Primary| AeroVIP DHCP -.->|Secondary / Failover| SpaceVIP AeroVIP --> AeroPihole SpaceVIP --> SpacePihole AeroPihole -->|Recursive / Local Lookups| AeroTech SpacePihole -->|Recursive / Local Lookups| SpaceTech AeroTech <==>|Automatic Zone Sync (AXFR)| SpaceTech AeroTech -->|Encrypted DoH| DoH SpaceTech -->|Encrypted DoH| DoH AeroPihole --- AeroStorage AeroTech --- AeroStorage SpacePihole --- SpaceStorage SpaceTech --- SpaceStorage ``` ### 2.1 Addressing the Rate-Limiting & Sluggishness Issue 1. **FTL Rate Limit Bypass:** Set `FTLCONF_RATE_LIMIT=0` so local bursts (such as 53 Smart Home devices polling simultaneously) are never throttled. 2. **Technitium Engine:** Replaces single-threaded Unbound with a high-performance .NET 9 asynchronous resolver capable of servicing tens of thousands of queries per second with sub-millisecond RAM caching. 3. **High Availability:** MetalLB VIPs on Aerodrome (`140.44.4.35`) and Spaceport (`140.44.4.65`) allow continuous service even during node reboots or maintenance. 4. **Authoritative Split-Horizon:** Technitium will authoritatively host the internal `snarfnet.net` forward zone and reverse PTR zones (`4.44.140.in-addr.arpa`, `4.4.14.in-addr.arpa`, `10.10.14.in-addr.arpa`), eliminating slow mDNS or external lookup delays. --- ## 3. Network Honeypot & UDM Pro Firewall Hardening ```mermaid flowchart LR subgraph WAN_Threats["External & Lateral Threats"] Internet["Public Internet"] CompromisedIoT["Compromised IoT / Host (e.g. 14.4.4.15)"] end subgraph UDM_FW["UDM Pro Firewall Rules (LAN IN)"] Rule1["Rule 1: Allow Established & Related"] Rule2["Rule 2: Allow DNS (Port 53 to .35 & .65)"] Rule3["Rule 3: Allow NTP (Port 123 to .11 & .44)"] Rule4["Rule 4: Drop IoT -> Compute (VLAN 50 -> 20)"] Rule5["Rule 5: Drop IoT -> Storage (VLAN 50 -> 40)"] Rule6["Rule 6: Drop Media -> Compute (VLAN 30 -> 20)"] end subgraph HoneypotNet["Honeypot Decoy (VLAN 50 / Decoy IP 14.4.4.99)"] OpenCanary["OpenCanary Honeypot
(Simulating SSH:22, HTTP:80, SMB:445, RDP:3389)"] end subgraph AlertSystem["Alerting & Audit Pipeline"] Gotify["Gotify Push Notification
(Instant alert to your phone)"] Zabbix["Zabbix Security Audit Log"] end CompromisedIoT -.->|Probes decoy IP| OpenCanary OpenCanary -->|High Priority Webhook| Gotify OpenCanary -->|Syslog Event| Zabbix CompromisedIoT -->|Blocked by Rule 4| UDM_FW ``` ### 3.1 Network Honeypot Deployment * **Tool:** **OpenCanary** (lightweight, zero false-positives). * **Placement:** * Assigned a decoy IP on the Smart Home subnet (e.g., `14.4.4.99`) where the gaming port forwards exist. * Emulates vulnerable services: SSH (`22`), Telnet (`23`), Web admin (`80`/`8080`), SMB (`445`), and RDP (`3389`). * **Alerting:** * When any internal device attempts a port scan or lateral connection to `14.4.4.99`, OpenCanary immediately sends a critical push notification to **Gotify** (`gotify.snarfnet.net`) and generates an alert in **Zabbix**. --- ### 3.2 UDM Pro Firewall Rules Matrix (LAN IN) We will define firewall groups on the UDM Pro: * **RFC1918_Subnets:** All internal private ranges (`140.44.0.0/16`, `14.0.0.0/8`, `192.168.0.0/16`). * **K8s_DNS_VIPs:** `140.44.4.35`, `140.44.4.65`. * **NTP_Servers:** `140.44.4.11`, `14.4.4.44`. | Order | Rule Name | Type | Source | Destination | Action | Purpose | |:---:|---|:---:|---|---|:---:|---| | **2001** | `Allow Established/Related` | LAN IN | Any | Any (State: Established, Related) | **ACCEPT** | Essential return traffic | | **2002** | `Allow Cluster DNS` | LAN IN | All VLANs | `K8s_DNS_VIPs` (Port: 53 UDP/TCP) | **ACCEPT** | Clients resolve DNS | | **2003** | `Allow Cluster NTP` | LAN IN | All VLANs | `NTP_Servers` (Port: 123 UDP) | **ACCEPT** | Chrony time sync | | **2004** | `Allow Trusted to All` | LAN IN | `VLAN 1 (LAN)`, `VLAN 20 (Compute)` | RFC1918_Subnets | **ACCEPT** | Admins & servers access all VLANs | | **2005** | `Isolate SmartHome to Compute` | LAN IN | `VLAN 50 (Smart Home)` | `VLAN 20 (Compute)` | **DROP** | Block IoT pivoting into K8s | | **2006** | `Isolate SmartHome to Storage` | LAN IN | `VLAN 50 (Smart Home)` | `VLAN 40 (Storage)` | **DROP** | Protect Synology NAS from IoT | | **2007** | `Isolate Media to Compute` | LAN IN | `VLAN 30 (Media)` | `VLAN 20 (Compute)` | **DROP** | Block media devices from cluster | | **2008** | `Isolate Guest Network` | GUEST IN | Guest Network | RFC1918_Subnets | **DROP** | Restrict guest traffic to Internet only | --- ## 4. Phased Implementation Roadmap ### Phase 1: Teardown Lingering Stubs * Cleanly delete orphaned, broken deployments and services in `infra` (Aerodrome) and `infrastructure` (Spaceport): * Remove `deployment/pihole`, `deployment/technitium-dns`, and non-functional NodePort services. ### Phase 2: Deploy Dual-Cluster Pi-hole + Technitium * Create Longhorn storage volumes on both clusters for persistent configs and blocklists. * Deploy **Aerodrome Primary Stack**: * Technitium on internal port `5353`. * Pi-hole with MetalLB LoadBalancer VIP **`140.44.4.35:53`** (UDP & TCP). * Deploy **Spaceport Secondary Stack**: * Technitium on internal port `5353` configured for AXFR zone transfers from Aerodrome. * Pi-hole with MetalLB LoadBalancer VIP **`140.44.4.65:53`** (UDP & TCP). * Populate `snarfnet.net` local records and reverse PTR zones. ### Phase 3: Network Honeypot Deployment * Deploy containerized OpenCanary with virtual listener on `14.4.4.99`. * Configure webhook bridge to Gotify server (`140.44.4.70`) for immediate push notification upon any probe. ### Phase 4: UDM Pro Network Configuration & Policy Hardening * Configure DHCP Scope DNS servers on UDM Pro for all VLANs: * Primary: `140.44.4.35` * Secondary: `140.44.4.65` * Set UDM Pro WAN DNS to `140.44.4.35` & `140.44.4.65` (or Quad9 fallback). * Apply LAN IN firewall rule matrix on UDM Pro to enforce strict VLAN isolation. snaisvr44hrvstr0x - AppropriateBeav3r39!