Overview

This guide provides step-by-step instructions to secure a small business network with:

• A single LAN
• Ubiquiti UniFi Ultra as the gateway
• No port forwarding or open inbound ports
  

Threat vectors addressed include phishing, lateral movement, internal misconfiguration, and remote exploitation.

🔧 1. Edge Router & Firewall: Lock Down the Gateway

✅ UniFi Ultra Firewall Rules

• Deny by default all inbound WAN traffic
• Allow only established/related connections
• Explicitly drop all other WAN IN traffic
  

Recommended Rules (WAN IN):

Rule 1: Accept ESTABLISHED,RELATED → WAN IN
Rule 2: Drop All → WAN IN

WAN LOCAL (UI & service protection):

Rule 1: Allow DNS, DHCP (if hosted here)
Rule 2: Drop All → WAN LOCAL

Additional Router Hardening:

• ❌ Disable UPnP
• ❌ Disable IPv6 (unless used securely)
• ✅ Disable UniFi Cloud Access (or restrict to admin IPs)
• ✅ Restrict GUI management access to VLAN 10 (trusted)
  

🧱 2. LAN Segmentation (Minimal VLAN Strategy)

VLAN	Purpose	Devices
10	Trusted LAN	Admin PCs, Servers
20	IoT / Untrusted	Smart TVs, IP Cams, Printers
30	Guest or BYOD	Visitors, Staff Personal Devices

VLAN Rules:

• 🚫 Block inter-VLAN by default
• ✅ Allow VLAN 10 → VLAN 20/30 (if needed)
• ❌ VLAN 20/30 should not access VLAN 10
  

🧑‍💻 3. Endpoint Hardening

Workstations:

• ✅ OS auto-updates
• ✅ EDR/AV (e.g. Defender with ASR or CrowdStrike)
• ❌ No RDP unless secured internally
• 👤 Daily users: non-admin accounts
  

Servers:

• 🔥 Local firewall enabled
• 🧱 Block all except trusted LAN IPs
• 🔄 Scheduled, off-site backups
• ❌ Disable unused remote protocols (e.g. WinRM, RDP)
  

🔒 4. DNS & Outbound Filtering

DNS-Level Defence:

Use one of:

• NextDNS
• Cloudflare Gateway
• Cisco Umbrella / OpenDNS
  

Features:

• 🚫 Malware & phishing domain block
• 📊 DNS logging and analytics
  

Outbound Rules (LAN → WAN):

• ❌ Block:
• TCP 445 (SMB)
• TCP 3389 (RDP)
• FTP, Telnet
• 🔐 Optional: whitelist-only outbound for VLAN 20
  

🔐 5. Authentication & Monitoring

• 🔐 Enable MFA on all admin accounts
• 📉 Enable UniFi Threat Management (IDS/IPS: Balanced mode)
• 📜 Log to Syslog or external collector
• 👥 Disable unused users, rotate passwords periodically
  

🔄 6. Backup & Recovery

• 🧊 Immutable, versioned backups (on NAS, PBS, or cloud)
• 📁 Backup:
• Router config
• Servers & domain controller
• Business data
• 🧪 Test restores quarterly
  

🚫 7. Remote Access (Optional)

If required:

• ✅ Use Tailscale or WireGuard
• ❌ Do not expose RDP, UniFi GUI, NAS, or printers
• 🔐 Device approval and 2FA for VPN accounts
  

🧪 8. Security Audit Checklist

Item	Frequency	Status
OS & firmware patched	Weekly	☐
Open ports scan (nmap)	Monthly	☐
IDS/IPS alerts reviewed	Weekly	☐
Endpoint AV/EDR status	Weekly	☐
Backups tested	Quarterly	☐
VLAN rules audited	Quarterly	☐

Tip: For central visibility, consider using a self-hosted Grafana + Loki + Promtail or Graylog stack to aggregate firewall, system, and DNS logs.

National Cyber Security Centre certificates