Overview
This guide provides step-by-step instructions to secure a small business network with:
- A single LAN
- Ubiquiti UniFi Ultra as the gateway
- No port forwarding or open inbound ports
Threat vectors addressed include phishing, lateral movement, internal misconfiguration, and remote exploitation.
🔧 1. Edge Router & Firewall: Lock Down the Gateway
✅ UniFi Ultra Firewall Rules
- Deny by default all inbound WAN traffic
- Allow only established/related connections
- Explicitly drop all other WAN IN traffic
Recommended Rules (WAN IN):
Rule 1: Accept ESTABLISHED,RELATED → WAN IN
Rule 2: Drop All → WAN INWAN LOCAL (UI & service protection):
Rule 1: Allow DNS, DHCP (if hosted here)
Rule 2: Drop All → WAN LOCALAdditional Router Hardening:
- ❌ Disable UPnP
- ❌ Disable IPv6 (unless used securely)
- ✅ Disable UniFi Cloud Access (or restrict to admin IPs)
- ✅ Restrict GUI management access to VLAN 10 (trusted)
🧱 2. LAN Segmentation (Minimal VLAN Strategy)
| VLAN | Purpose | Devices |
|---|---|---|
| 10 | Trusted LAN | Admin PCs, Servers |
| 20 | IoT / Untrusted | Smart TVs, IP Cams, Printers |
| 30 | Guest or BYOD | Visitors, Staff Personal Devices |
VLAN Rules:
- 🚫 Block inter-VLAN by default
- ✅ Allow VLAN 10 → VLAN 20/30 (if needed)
- ❌ VLAN 20/30 should not access VLAN 10
🧑💻 3. Endpoint Hardening
Workstations:
- ✅ OS auto-updates
- ✅ EDR/AV (e.g. Defender with ASR or CrowdStrike)
- ❌ No RDP unless secured internally
- 👤 Daily users: non-admin accounts
Servers:
- 🔥 Local firewall enabled
- 🧱 Block all except trusted LAN IPs
- 🔄 Scheduled, off-site backups
- ❌ Disable unused remote protocols (e.g. WinRM, RDP)
🔒 4. DNS & Outbound Filtering
DNS-Level Defence:
Use one of:
Features:
- 🚫 Malware & phishing domain block
- 📊 DNS logging and analytics
Outbound Rules (LAN → WAN):
- ❌ Block:
- TCP 445 (SMB)
- TCP 3389 (RDP)
- FTP, Telnet
- 🔐 Optional: whitelist-only outbound for VLAN 20
🔐 5. Authentication & Monitoring
- 🔐 Enable MFA on all admin accounts
- 📉 Enable UniFi Threat Management (IDS/IPS: Balanced mode)
- 📜 Log to Syslog or external collector
- 👥 Disable unused users, rotate passwords periodically
🔄 6. Backup & Recovery
- 🧊 Immutable, versioned backups (on NAS, PBS, or cloud)
- 📁 Backup:
- Router config
- Servers & domain controller
- Business data
- 🧪 Test restores quarterly
🚫 7. Remote Access (Optional)
If required:
- ✅ Use Tailscale or WireGuard
- ❌ Do not expose RDP, UniFi GUI, NAS, or printers
- 🔐 Device approval and 2FA for VPN accounts
🧪 8. Security Audit Checklist
| Item | Frequency | Status |
|---|---|---|
| OS & firmware patched | Weekly | ☐ |
Open ports scan (nmap) |
Monthly | ☐ |
| IDS/IPS alerts reviewed | Weekly | ☐ |
| Endpoint AV/EDR status | Weekly | ☐ |
| Backups tested | Quarterly | ☐ |
| VLAN rules audited | Quarterly | ☐ |
Tip: For central visibility, consider using a self-hosted Grafana + Loki + Promtail or Graylog stack to aggregate firewall, system, and DNS logs.
National Cyber Security Centre certificates