Im folgenden wird das einrichten der Firewall Regeln behandelt. Diese Sektion danke ich dem UniFi Forum.
Da die Antwort Ursprünglich in Englisch kam, werde ich diese so übernehmen:
Initial setup:
1- In addition to your default WiFi network (which is not associated to a VLAN), create a new WiFi network („IoT“) that's associated to VLAN 20 (Wireless Networks > IoT > Advanced Options > VLAN: Use VLAN > 20). Make sure „Block LAN to WLAN Multicast and Broadcast Data“ is unchecked (disabled) and „Enable multicast enhancement (IGMPv3)“ is checked (enabled) on both WiFi networks.
2- Configure two „corporate“ networks: LAN and IoT (names don't matter). Leave LAN untagged but tag the IoT VLAN as 20 so that clients joining your IoT WiFi network fall on your IoT VLAN. Make sure „Enable IGMP snooping“ is enabled (checked) on both networks. Let's say your LAN's subnet is 192.168.1.1/24. Since the IoT VLAN is tagged as 20, I used 192.168.20.1/24 as its subnet but you can really use anything you want. Everything below will assume that your IoT VLAN is tagged as 20 using that subnet.
3- Go to Services > MDNS and enable „Enable Multicast DNS“
4- Join your Sonos speakers to the IoT WiFi network. Your Sonos controller (iPhone, laptop, etc.) remains on your LAN WiFi.
Now that your networks are set up, we can proceed to making things work between your Sonos speakers (on your IoT network) and your LAN.
Put the following into your config.gateway.json file and reprovision your USG:
{
"protocols": {
"igmp-proxy": {
"interface": {
"eth1": {
"role": "upstream",
"threshold": "1"
},
"eth1.20": {
"role": "downstream",
"threshold": "1"
}
}
}
}
}
Go to Routing & Firewall > Firewall > Groups to set up your groups:
Group 1: IoT
Type: Address IPv4
Address: 192.168.20.0/24 (your IoT network's subnet)
Group 2: LAN
Type: Address IPv4
Address: 192.168.1.0/24 (your LAN subnet)
Group 3: RFC1918_Private_IPs
Type: Address IPv4
Address: 10.0.0.0/8
Address: 172.16.0.0/12
Address: 192.168.0.0/16
Group 4: Sonos TCP Ports
Type: Port
Port: 3400
Port: 3401
Port: 3500
Group 5: Sonos UDP Ports
Type: Port
Port: 1900
Port: 1901
Port: 1902
Group 6: Sonos Speakers
Type: Address IPv4
Address: This one may be tricky to set up until you have things working since your Sonos speakers don't have a reserved (static) IP address on your IoT network yet. For now, find out what their addresses are and enter them here, their IP addresses probably won't change. Alternatively, go and set static IP addresses for each of your Sonos speakers on the IoT network then come back here.
Now you're ready to tie everything together.
Go to Routing & Firewall > Firewall > Rules IPv4 > LAN IN
You'll be creating a total of 5 rules here. I'll list the relevant settings for each.
Rule 1: Allow all Established/Related traffic
Rule Applied: Before predefined rules
Action: Accept
IPv4 Protocol: All
States: Established, Related
Source Type: Address/Port Group
IPv4 Address Group: Any
Port Group: Any
Destination Type: Address/Port Group
IPv4 Address Group: Any
Port Group: Any
Rule 2: Allow LAN to access all VLANs
Rule Applied: Before predefined rules
Action: Accept
IPv4 Protocol: All
States: <all unchecked>
Source Type: Network
Network: LAN / IPv4 Subnet
Destination Type: Address/Port Group
IPv4 Address Group: RFC1918_Private_IPs
Port Group: Any
Rule 3: Allow Sonos players to LAN (TCP)
Rule Applied: Before predefined rules
Action: Accept
IPv4 Protocol: TCP
States: <all unchecked>
Source Type: Address/Port Group
IPv4 Address Group: Sonos Speakers
Port Group: Any
Destination Type: Address/Port Group
IPv4 Address Group: LAN
Port Group: Sonos TCP Ports
Rule 4: Allow Sonos players to LAN (UDP)
Rule Applied: Before predefined rules
Action: Accept
IPv4 Protocol: UDP
States: <all unchecked>
Source Type: Address/Port Group
IPv4 Address Group: Sonos Speakers
Port Group: Any
Destination Type: Address/Port Group
IPv4 Address Group: LAN
Port Group: Sonos UDP Ports
Rule 5: Block all inter-VLAN communication
Rule Applied: Before predefined rules
Action: Drop
IPv4 Protocol: All
Logging: Enable Logging (on) - this one's optional but it'll help you identify whether any critical traffic from the Sonos speakers to your LAN is being blocked if things aren't working
States: <all unchecked>
Source Type: Address/Port Group
IPv4 Address Group: RFC1918_Private_IPs
Port Group: Any
Destination Type: Address/Port Group
IPv4 Address Group: RFC1918_Private_IPs
Port Group: Any
Rule #5 is the one that prevents VLANs from talking to each other and which isolates your IoT devices from your LAN.
Make sure these rules are applied in this order (drag and drop them in the „LAN IN“ firewall rules list if the order doesn't match).
Now… assuming I haven't left anything out, reboot EVERYTHING. Like, power cycle everything, including the Sonos speakers and your Sonos controller. Even after doing all this, my setup didn't work immediately. I'm guessing it's because some network configs had to be refreshed, which a power cycle resolved.
Start everything back up and HOPEFULLY it all works. If your Sonos controller can't see your speakers, check your USG logs (you did enable logging on the VLAN→VLAN deny rule, right?) to see what's getting blocked.
Once it's all working, remember to give your Sonos devices static IP addresses so that you can keep them properly mapped in the „Sonos Speakers“ firewall group.