Follow-up to #1. Phones on the Waters Guest SSID at North Attleboro can now reach translate.watersmedia.org. This PR documents how, and moves the scripts used into this repo (they had been written into the waters-boards repo by mistake).
docs/examples/waters-church-na/README.md: a new section 3 covering the three blockers and their fixes, with undo steps.
docs/examples/waters-church-na/zone-allow-policy.py: creates a UniFi zone firewall policy. Used to allow the Hotspot zone to reach Boba-Fett 10.1.1.4 on TCP 80/443, ahead of the guest block.
docs/examples/waters-church-na/guest-restrictions.py: removes one subnet from the guest hotspot's Post-Authorization Restrictions. Used to drop 10.0.0.0/8. The Integration API refuses to edit the system policies, so it edits the legacy guest_access setting and the gateway policies regenerate from it.
docs/examples/waters-church-na/wifi-broadcast-devices.py: adds or removes access points from an SSID. Used to put Waters Guest on Auditorium Left/Right, Main Lobby Entrance, Admin Offices - U7 and Creative Offices - U7.
docs/PUBLIC-ACCESS.md: the troubleshooting note now names the real guest WiFi trap instead of a generic "client isolation".
Why the restriction list matters
The access points enforce the guest restriction list themselves. With only the firewall allow in place, a phone on Waters Guest loaded the page for about two minutes and then timed out, even to http://10.1.1.4/. Removing 10.0.0.0/8 from the list fixed it. 192.168.0.0/16 and 172.16.0.0/12 stay restricted, and the zone default block still keeps guests away from every other 10.x host.
Verified
The policy order on the NA console was read back after each change: the allow rule sits at index 10000, ahead of the restriction block at 30001 and the default block. Christian confirmed on site that translate.watersmedia.org loads on Waters Guest and stays up.
## What changed
Follow-up to #1. Phones on the **Waters Guest** SSID at North Attleboro can now reach `translate.watersmedia.org`. This PR documents how, and moves the scripts used into this repo (they had been written into the waters-boards repo by mistake).
- `docs/examples/waters-church-na/README.md`: a new section 3 covering the three blockers and their fixes, with undo steps.
- `docs/examples/waters-church-na/zone-allow-policy.py`: creates a UniFi zone firewall policy. Used to allow the Hotspot zone to reach Boba-Fett `10.1.1.4` on TCP 80/443, ahead of the guest block.
- `docs/examples/waters-church-na/guest-restrictions.py`: removes one subnet from the guest hotspot's *Post-Authorization Restrictions*. Used to drop `10.0.0.0/8`. The Integration API refuses to edit the system policies, so it edits the legacy `guest_access` setting and the gateway policies regenerate from it.
- `docs/examples/waters-church-na/wifi-broadcast-devices.py`: adds or removes access points from an SSID. Used to put Waters Guest on Auditorium Left/Right, Main Lobby Entrance, Admin Offices - U7 and Creative Offices - U7.
- `docs/PUBLIC-ACCESS.md`: the troubleshooting note now names the real guest WiFi trap instead of a generic "client isolation".
## Why the restriction list matters
The access points enforce the guest restriction list themselves. With only the firewall allow in place, a phone on Waters Guest loaded the page for about two minutes and then timed out, even to `http://10.1.1.4/`. Removing `10.0.0.0/8` from the list fixed it. `192.168.0.0/16` and `172.16.0.0/12` stay restricted, and the zone default block still keeps guests away from every other 10.x host.
## Verified
The policy order on the NA console was read back after each change: the allow rule sits at index 10000, ahead of the restriction block at 30001 and the default block. Christian confirmed on site that translate.watersmedia.org loads on Waters Guest and stays up.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
The guest network blocks private ranges twice: a zone default on the
gateway, and the guest hotspot's Post-Authorization Restrictions, which
the access points enforce on their own. With only a firewall allow, a
phone on Waters Guest worked for about two minutes and then timed out.
docs/examples/waters-church-na/ gains the three scripts used to fix it:
zone-allow-policy.py (allow Hotspot -> 10.1.1.4 on 80/443),
guest-restrictions.py (drop 10.0.0.0/8 from the restriction list via
the legacy guest_access setting, since system policies cannot be edited
through the Integration API) and wifi-broadcast-devices.py (put the
Waters Guest SSID on the Auditorium, Main Lobby and Offices APs). The
runbook gets a section on all three, and PUBLIC-ACCESS.md points at it
from the troubleshooting notes.
Confirmed on site: translate.watersmedia.org loads on Waters Guest and
stays up.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
What changed
Follow-up to #1. Phones on the Waters Guest SSID at North Attleboro can now reach
translate.watersmedia.org. This PR documents how, and moves the scripts used into this repo (they had been written into the waters-boards repo by mistake).docs/examples/waters-church-na/README.md: a new section 3 covering the three blockers and their fixes, with undo steps.docs/examples/waters-church-na/zone-allow-policy.py: creates a UniFi zone firewall policy. Used to allow the Hotspot zone to reach Boba-Fett10.1.1.4on TCP 80/443, ahead of the guest block.docs/examples/waters-church-na/guest-restrictions.py: removes one subnet from the guest hotspot's Post-Authorization Restrictions. Used to drop10.0.0.0/8. The Integration API refuses to edit the system policies, so it edits the legacyguest_accesssetting and the gateway policies regenerate from it.docs/examples/waters-church-na/wifi-broadcast-devices.py: adds or removes access points from an SSID. Used to put Waters Guest on Auditorium Left/Right, Main Lobby Entrance, Admin Offices - U7 and Creative Offices - U7.docs/PUBLIC-ACCESS.md: the troubleshooting note now names the real guest WiFi trap instead of a generic "client isolation".Why the restriction list matters
The access points enforce the guest restriction list themselves. With only the firewall allow in place, a phone on Waters Guest loaded the page for about two minutes and then timed out, even to
http://10.1.1.4/. Removing10.0.0.0/8from the list fixed it.192.168.0.0/16and172.16.0.0/12stay restricted, and the zone default block still keeps guests away from every other 10.x host.Verified
The policy order on the NA console was read back after each change: the allow rule sits at index 10000, ahead of the restriction block at 30001 and the default block. Christian confirmed on site that translate.watersmedia.org loads on Waters Guest and stays up.
🤖 Generated with Claude Code
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.