# Chris's IT Infrastructure

Authoritative read-only documentation of the UniFi network, VLANs, wireless networks, infrastructure devices, cameras, firewall zones, and connected clients. Snapshot collected 2026-09-12 UTC.

# Overview

Book scope, source systems, topology summary, and navigation.

# Network Overview

# Chris's IT Infrastructure

## Purpose

This book documents the UniFi-managed network and connected infrastructure as a read-only snapshot collected **2026-09-12 UTC**.

## Topology at a glance

- **Gateway/router:** UDM Pro Max, LAN gateway **192.168.1.1**, WAN address observed as **203.213.121.194**.
- **Switch:** USW Pro Max 24 PoE at **192.168.1.225**; uplinked to the UDM Pro Max.
- **Access point:** U7 Pro at **192.168.1.153**; uplinked to the USW Pro Max.
- **Networks/VLANs:** 5 gateway networks, VLAN IDs 1–5.
- **Wireless networks:** 5 configured SSIDs; 4 enabled and 1 disabled.
- **Connected clients:** 23 in the UniFi Network Integration API snapshot.
- **Protect cameras:** 6 camera devices identified among connected clients, all on the Camera network/subnet.
- **Firewall:** 8 zones and 148 policies reported by the API.

## Navigation

- [Core Network Infrastructure](https://book.stargrid.com.au/books/chriss-it-infrastructure/chapter/core-network-infrastructure)
- [Networks, VLANs & Wireless](https://book.stargrid.com.au/books/chriss-it-infrastructure/chapter/networks-vlans-wireless)
- [Cameras & Protect](https://book.stargrid.com.au/books/chriss-it-infrastructure/chapter/cameras-protect)
- [Connected Clients](https://book.stargrid.com.au/books/chriss-it-infrastructure/chapter/connected-clients)
- [Firewall & Access Policy](https://book.stargrid.com.au/books/chriss-it-infrastructure/chapter/firewall-access-policy)

## Data notes

UniFi returned device/client relationships and addresses. It did not expose a per-client switch port in this API response, so wired clients are documented as connected through the USW Pro Max rather than assigned to specific physical ports. Secrets, API keys, and passwords are intentionally excluded.

# UniFi Services

# UniFi Services

UniFi provides the network, wireless, switching, gateway and Protect camera services documented across this book. OpenClaw treats UniFi as an external service integration: inventory and topology are documented, while API keys remain protected and are never placed in BookStack pages.

## Relationships

- UniFi gateway, switches and access points carry the VLAN and wireless topology.
- UniFi Protect supplies camera inventory; the current documented inventory includes six cameras on `192.168.30.0/24` (VLAN 3).
- OpenClaw may use approved UniFi workflows for read-only inventory and documentation updates.
- The UniFi cloud API and local controller access are distinct scopes; use the documented endpoint and protected credential for the intended scope.

## Operational references

See **Network Overview**, **VLAN and Wireless Inventory**, **Protect Camera Inventory** and **Network Topology Diagram** for the current infrastructure views. Exact credentials, API keys and undocumented switch ports are intentionally omitted.

# Core Network Infrastructure

Gateway/router, switch, access point, uplinks, ports, and health.

# Gateway, Switch & Access Point

# Core Network Infrastructure

## Gateway/router

| Field | Value |
|---|---|
| Device | UDM Pro Max |
| LAN address | 192.168.1.1 |
| Observed WAN address | 203.213.121.194 |
| MAC | 28:70:4e:38:cb:1a |
| State | ONLINE |
| UniFi OS firmware | 6.0.7 |
| Timezone | Australia/Perth |
| WAN interfaces | Internet 1, Internet 2 |
| Controller state | Network controller active and healthy |

The UDM Pro Max is the default gateway for the Default network and provides the DHCP scopes for all five gateway-managed networks.

## Switch

| Field | Value |
|---|---|
| Device | USW Pro Max 24 PoE |
| IP | 192.168.1.225 |
| MAC | 0c:ea:14:1a:4c:1d |
| State | ONLINE |
| Firmware | 7.5.15 |
| Uplink | UDM Pro Max |
| Ports | 26 total; 8 reported UP, 18 DOWN |
| Uplink port | Port 26, SFP+, 10 Gbps |

The switch is the wired attachment point for the Proxmox host, OpenClaw host, Home Assistant, PaperlessNGX, NPMPlus, phone, and wired cameras.

## Access point

| Field | Value |
|---|---|
| Device | U7 Pro |
| IP | 192.168.1.153 |
| MAC | 9c:05:d6:db:0a:c5 |
| State | ONLINE |
| Firmware | 8.7.11 |
| Uplink | USW Pro Max 24 PoE |
| 2.4 GHz | Channel 13, 20 MHz |
| 5 GHz | Channel 112, 80 MHz |
| 6 GHz | Channel 37, 160 MHz |

Wireless clients in the inventory are associated with this U7 Pro.

# Network Topology Diagram

Read-only UniFi topology snapshot collected 2026-09-12 UTC.

![Chris's UniFi network topology](https://book.stargrid.com.au/attachments/2)

[Download the PNG diagram](https://book.stargrid.com.au/attachments/2) · [Download the SVG source](https://book.stargrid.com.au/attachments/1)

*Exact physical switch-port assignments were not returned by the UniFi API.*

# Networks, VLANs & Wireless

VLANs, zones, SSIDs, WANs, and segmentation.

# VLAN and Wireless Inventory

# Networks, VLANs & Wireless

## Gateway networks

| Network | VLAN | Gateway | DHCP range | Zone | Internet | mDNS |
|---|---:|---|---|---|---|---|
| Default | 1 | 192.168.1.1/24 | 192.168.1.6–192.168.1.254 | Internal | Enabled | Enabled |
| Home | 2 | 192.168.20.1/24 | 192.168.20.6–192.168.20.254 | Trusted Zone | Enabled | Enabled |
| Camera | 3 | 192.168.30.1/24 | 192.168.30.6–192.168.30.254 | Untrusted Zone | Enabled | Enabled |
| IOT Network | 4 | 192.168.40.1/24 | 192.168.40.6–192.168.40.254 | Untrusted Zone | Enabled | Enabled |
| Guest Network | 5 | 192.168.99.1/24 | 192.168.99.6–192.168.99.254 | Hotspot | Enabled | Enabled |

All five networks are enabled and gateway-managed. The Camera and IOT Network share the Untrusted Zone; Guest Network uses the Hotspot zone.

## Wireless networks

| SSID | State | Network assignment | Security | Bands |
|---|---|---|---|---|
| Hells Kitchen | Enabled | Camera / VLAN 3 | WPA2/WPA3 Personal | 2.4, 5, 6 GHz |
| WiFi8789 | Disabled | Native/default | WPA2/WPA3 Personal | 5, 6 GHz |
| Lst1 | Enabled | Native/default | WPA2/WPA3 Personal | 2.4 GHz |
| stalingrad | Enabled | Native/default | WPA2/WPA3 Personal | 2.4, 5, 6 GHz |
| Starbase | Enabled | IOT Network / VLAN 4 | WPA2 Personal | 2.4 GHz |

The SSID-to-network mapping is taken directly from the UniFi API. Wireless clients shown on 192.168.1.x are using a native/default assignment; camera and IoT assignments should be confirmed against the intended SSID design in the dashboard.

# Cameras & Protect

Camera inventory, addresses, and connection paths.

# Protect Camera Inventory

# Cameras & Protect

Six Protect camera devices were identified among the connected UniFi clients. They are all on the Camera subnet **192.168.30.0/24 (VLAN 3)**.

| Camera | IP | MAC | Connection | Uplink |
|---|---|---|---|---|
| G5 Flex | 192.168.30.35 | f4:e2:c6:0e:2b:8f | Wired | USW Pro Max 24 PoE |
| G5 Turret Ultra Garage | 192.168.30.52 | 28:70:4e:12:16:5e | Wired | USW Pro Max 24 PoE |
| G5 Turret Ultra | 192.168.30.88 | 28:70:4e:16:11:cf | Wired | USW Pro Max 24 PoE |
| G6 Instant | 192.168.30.2 | 84:78:48:28:b9:90 | Wireless | U7 Pro |
| G4 Doorbell Pro | 192.168.30.219 | f4:e2:c6:74:21:e0 | Wired | USW Pro Max 24 PoE |
| G6 Turret | 192.168.30.234 | 8c:ed:e1:9e:c9:18 | Wired | USW Pro Max 24 PoE |

The API did not return physical switch-port assignments for individual clients. The five wired cameras are therefore associated with the switch at the device level; exact ports should be confirmed from the UniFi topology/port panel if needed.

# Connected Clients

Client inventory with IP, MAC, medium, and uplink device.

# Connected Client Inventory

# Connected Clients

This is the 23-client snapshot returned by UniFi on **2026-09-12 UTC**. Wireless clients are uplinked through the U7 Pro; wired clients are uplinked through the USW Pro Max 24 PoE.

| Client | IP | MAC | Medium | VLAN/subnet | Uplink |
|---|---|---|---|---|---|
| Hisense 65U7KAU TV | 192.168.1.192 | bc:5c:17:f1:72:1c | Wireless | Default / 1 | U7 Pro |
| H100 54:1d | 192.168.1.245 | 3c:64:cf:d9:54:1d | Wireless | Default / 1 | U7 Pro |
| Entryway Light | 192.168.1.6 | 9c:9c:1f:81:f9:c3 | Wireless | Default / 1 | U7 Pro |
| Stairway light | 192.168.1.13 | 9c:9c:1f:81:fa:5a | Wireless | Default / 1 | U7 Pro |
| Google Streamer 4K fe:1d | 192.168.1.107 | 5e:df:9d:d4:fe:1d | Wireless | Default / 1 | U7 Pro |
| Grandstream GXP2130 66:7e | 192.168.40.230 | ec:74:d7:44:66:7e | Wired | IOT / 4 | USW Pro Max |
| Aqara-Hub-M2-5430 93:9c | 192.168.40.110 | 18:c2:3c:45:93:9c | Wired | IOT / 4 | USW Pro Max |
| t14s f3:8d | 192.168.1.69 | 4c:77:cb:f6:f3:8d | Wireless | Default / 1 | U7 Pro |
| Pixel-Tablet ae:c7 | 192.168.1.50 | a6:d2:53:93:ae:c7 | Wireless | Default / 1 | U7 Pro |
| openvino 96:89 | 192.168.1.77 | bc:24:11:72:96:89 | Wired | Default / 1 | USW Pro Max |
| Proxmox c9:af | 192.168.1.115 | 10:ff:e0:c5:c9:af | Wired | Default / 1 | USW Pro Max |
| Blustu | 192.168.1.78 | 98:88:e0:10:6c:f8 | Wireless | Default / 1 | U7 Pro |
| HOMEASSISTANT | 192.168.1.49 | 02:2e:a2:a5:b6:ae | Wired | Default / 1 | USW Pro Max |
| G5 Flex | 192.168.30.35 | f4:e2:c6:0e:2b:8f | Wired | Camera / 3 | USW Pro Max |
| G5 Turret Ultra Garage | 192.168.30.52 | 28:70:4e:12:16:5e | Wired | Camera / 3 | USW Pro Max |
| G5 Turret Ultra | 192.168.30.88 | 28:70:4e:16:11:cf | Wired | Camera / 3 | USW Pro Max |
| G6 Instant | 192.168.30.2 | 84:78:48:28:b9:90 | Wireless | Camera / 3 | U7 Pro |
| G4 Doorbell Pro | 192.168.30.219 | f4:e2:c6:74:21:e0 | Wired | Camera / 3 | USW Pro Max |
| G6 Turret | 192.168.30.234 | 8c:ed:e1:9e:c9:18 | Wired | Camera / 3 | USW Pro Max |
| Pixel-10-Pro-XL 06:39 | 192.168.1.220 | 5e:83:e2:3e:06:39 | Wireless | Default / 1 | U7 Pro |
| claw ae:24 | 192.168.1.100 | bc:24:11:1b:ae:24 | Wired | Default / 1 | USW Pro Max |
| NPMPlus | 192.168.1.117 | bc:24:11:7b:45:88 | Wired | Default / 1 | USW Pro Max |
| PaperlessNGX Docker | 192.168.1.116 | bc:24:11:24:64:14 | Wired | Default / 1 | USW Pro Max |

Exact physical switch ports were not included in the API response.

# Firewall & Access Policy

Read-only summary of UniFi firewall zones and policy observations.

# Firewall and Access Policy Summary

# Firewall & Access Policy

## Zones

UniFi reports 8 zones:

| Zone | Networks |
|---|---|
| Internal | Default / VLAN 1 |
| Trusted Zone | Home / VLAN 2 |
| Untrusted Zone | Camera / VLAN 3; IOT Network / VLAN 4 |
| Hotspot | Guest Network / VLAN 5 |
| Gateway | No user network assigned |
| External | Internet 1 and Internet 2 |
| Vpn | No network assigned |
| Dmz | No network assigned |

## Policy inventory

The controller reports **148 firewall policies**. This page records the high-level read-only API result and selected named policies observed at the start of the policy list; it is not a replacement for the UniFi policy editor.

Observed named rules include:

- **t14** — allow rule using a MAC address list within Internal.
- **streamer** — block rule from Internal to External.
- **NPMPlus** — block rule from Internal to External.
- **NMPLUSAllow (Return)** — derived established/related return rule.
- **Block Invalid Traffic** — system rule from Internal to External.
- **allow again** — selected MAC addresses allowed to Gateway.
- **Block Traffic from 192.168.1.221 to 192.168.1.1** — host-specific block to the gateway.
- **Block Traffic from 192.168.1.221** — host-specific block to the gateway.
- **allow devices** — selected MAC addresses allowed to Gateway.
- **Proxmox access** — currently disabled.
- **Allow mDNS** — system mDNS allowance.
- **allow homeassistant** — selected devices allowed to the Untrusted Zone.
- **Allow Port Forward dns** — system port-forward allowance to 192.168.1.117 on ports 80/443.

## Review notes

- Camera and IoT networks are grouped in the Untrusted Zone.
- The default/system policy set contains broad terminal “Allow All Traffic” rules between some zone pairs; review ordering and intent before relying on isolation.
- The API exposed policy definitions but not a complete human-friendly rule matrix in one response; use the UniFi dashboard for full ordering and per-rule detail.
- No firewall changes were made during this documentation run.

# Notes

# Notes

- 2026-09-13: Reviewed Portainer and UniFi infrastructure.
- 2026-09-12: Verified BookStack permissions.