Just a tip; not sure if it’s possible with these udm’s, but with the edgerouter it’s pretty easy to redirect all dns traffic to your dns server of choice. So, even devices with hardcoded dns entries that don’t use the dhcp provided dns will be requesting that from your pihole/udm whatever. Same for ntp; I have a ntp server running in my LAN and it’s also publishef through dhcp, but every packet on port 123 will be delivered to that ntp server irrespective of the setting on the client. Very powerful. Also, for dns, be sure not to just block 53, but also 853 (DoT) and 8053 (DoH).
Thank you so much! I had some rules set up to lock down dns and could not figure out why it wasn't working. The part at about 4:30 where you point out that there is a bug when ad blocking enabled saved me. Subscribed.
I would like to see a video on detailed logging for DNS and such. Also how would you make the firewall rules to apply to only a guest network for instance and not every Vlan.
Great video Willie. I do want to add that locking down the DNS could and probably will break some apps. I had that problem when I tried this recently. Turns out some apps have hard coded DNS settings so they stop working. Just keep that in mind
it would help some of us who are a little slower on the uptake to track what things you have done on the FW, if you could white board the changes and effects as visual aid.
Hi Willie. What is the difference between the DNS settings in the internet section, the settings in the vlan section and the settings in the AP/Switch section when I enable fixed IP?
Thanks for the video Willie, I need to watch the prior videos on firewall rules. I have a UDM Pro at home just upgraded to ver 3. Question, does that rotary phone have dial tone and does it work?
@@WillieHowe I have one on my desk at work hooked up to an AudioCodes MP118 FXO. Got dial tone, it can receive but can't make calls. Phone system is all IP. Also the bell doesn't work.
i wonder why this works, the gw should also be unable to get dns requests out, since "ALL" was blocked from sending dns requests to the interface "internet"
I'm curious on this as well. To me, it would seem like 'all' outbound DNS would be blocked unless you specified a rule just before that allowed only the ones you want first.
Willie, Is there a way to block all IPs outside the US? I want to protect my family from scams and honestly, I don't need any services hosted outside the US. Thanks for your input.
How about a video for masquerading firewall rules for dns? Especially for iot devices hardcoded dns that will break with these rules. Besides iptables directly, is there a way to do it within unifi gui?
Take a look at Firewalla Gold or purple, it makes content filtering so simple. I can so easily block apps for any device just from my phone. For soho sure a firewall and ip filtering rules are good but managing that hassle free for home fwg makes it easy, I wish I could replicate it on other firewalls with as much ease as your beholden to them on the predefined apps lists. But few things still go through, google and bing image search stills works. Unless you block all of google am not sure how you can filter these.
If you keep DNS Server set to Auto, where does it gets its DNS server IP address from? Is it using the upstream ISP's DNS servers that are issued automatically?
Please make a video on same setup with local pi-hole server with any public DNS as a forwarding on that pi-hole ...
Thank in advance
Just a tip; not sure if it’s possible with these udm’s, but with the edgerouter it’s pretty easy to redirect all dns traffic to your dns server of choice. So, even devices with hardcoded dns entries that don’t use the dhcp provided dns will be requesting that from your pihole/udm whatever. Same for ntp; I have a ntp server running in my LAN and it’s also publishef through dhcp, but every packet on port 123 will be delivered to that ntp server irrespective of the setting on the client. Very powerful.
Also, for dns, be sure not to just block 53, but also 853 (DoT) and 8053 (DoH).
Good video Willie. Im actually interested in the alerting/logging aspect.
Thank you so much! I had some rules set up to lock down dns and could not figure out why it wasn't working. The part at about 4:30 where you point out that there is a bug when ad blocking enabled saved me. Subscribed.
I would like to see a video on detailed logging for DNS and such. Also how would you make the firewall rules to apply to only a guest network for instance and not every Vlan.
Great video Willie. I do want to add that locking down the DNS could and probably will break some apps. I had that problem when I tried this recently. Turns out some apps have hard coded DNS settings so they stop working. Just keep that in mind
Yes, I want a full video on logging and everything you mentioned at the end.
it would help some of us who are a little slower on the uptake to track what things you have done on the FW, if you could white board the changes and effects as visual aid.
Don't forget to allow NTP, often forgotten about.
Awesome video, would love one on in-bound rules. Perhaps another on splitting the home network into multiple (iot, guest, secure, etc...)
would love to see this setup with Adguard local DNS sinkhole
Simple and to the point! I like it! Thanks, Willie as always for sharing your knowledge and expertise.
Defo like to see same video with Pi-hole running dns please? I use Pi-hole a but not sure i have it setup correctly now after seeing this. Thanks
Any idea why unifi's ad-blocking breaks this? I haven't heard enough details about it yet to know why.. just curious. Thanks for mentioning this part
"Please, sir, I want some more."
I noticed your Block Kids 1 traffic rule. Do you have a video on what you do to block your kids access?
Hi Willie.
What is the difference between the DNS settings in the internet section, the settings in the vlan section and the settings in the AP/Switch section when I enable fixed IP?
Thanks for the video Willie, I need to watch the prior videos on firewall rules. I have a UDM Pro at home just upgraded to ver 3. Question, does that rotary phone have dial tone and does it work?
Yes and yes
@@WillieHowe I have one on my desk at work hooked up to an AudioCodes MP118 FXO. Got dial tone, it can receive but can't make calls. Phone system is all IP. Also the bell doesn't work.
What does my Default network DNS setting have to be set to in order for this to work ?
i wonder why this works, the gw should also be unable to get dns requests out, since "ALL" was blocked from sending dns requests to the interface "internet"
I'm curious on this as well. To me, it would seem like 'all' outbound DNS would be blocked unless you specified a rule just before that allowed only the ones you want first.
Helpful video Willie. You got my 'like' 🙂
Thank you for another great video!
Willie, Is there a way to block all IPs outside the US? I want to protect my family from scams and honestly, I don't need any services hosted outside the US. Thanks for your input.
You can do the country blocking in UniFi.
Can you used Azure AD and sync the users to the Synology?
@@chrisrjrose yes
How about a video for masquerading firewall rules for dns?
Especially for iot devices hardcoded dns that will break with these rules.
Besides iptables directly, is there a way to do it within unifi gui?
The content filer does it automagically
@@WillieHowe Can you elaborate please. Not sure I follow what the content filtering has to do with blocking DNS outbound on Internet Out.
Take a look at Firewalla Gold or purple, it makes content filtering so simple. I can so easily block apps for any device just from my phone. For soho sure a firewall and ip filtering rules are good but managing that hassle free for home fwg makes it easy, I wish I could replicate it on other firewalls with as much ease as your beholden to them on the predefined apps lists. But few things still go through, google and bing image search stills works. Unless you block all of google am not sure how you can filter these.
have built opnsense with proxy ip and dns filter for free also nice firewall has all what the big devices have for free
If you have extra hardware, sure.
My UDM SE doesn't have the option to set DNS servers on the Internet page in the Network app like yours does. I am on 3.0.18 firmware.
Do you have a static IP or are you using PPPoE?
@@WillieHowe It is a dynamic IP given to me by my ISP (but rarely changes) if you are talking about my WAN IP.
@@WillieHowe Never mind, I found it. It was buried a page deeper than I was at.
Is that phone in the back connected via VOIP?
Yes
@@WillieHowe just watched the video where you set it up.
Can we inverse the adult filter?
What's that mean?
Just noticed my windows 11 workstation said my dns was unencrypted 🤦🏽♂️
Thumbnail: DNS Hub 😂😂
👍
If you keep DNS Server set to Auto, where does it gets its DNS server IP address from? Is it using the upstream ISP's DNS servers that are issued automatically?
Yes
It's always DNS
How can I heart this like 10,000 times?