{"id":16,"date":"2026-07-05T07:56:00","date_gmt":"2026-07-05T05:56:00","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/?p=16"},"modified":"2026-08-20T17:51:18","modified_gmt":"2026-08-20T15:51:18","slug":"how-to-safely-host-public-servers-on-a-unifi-network","status":"publish","type":"post","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/it-networks\/how-to-safely-host-public-servers-on-a-unifi-network\/","title":{"rendered":"How to Safely Host Public Servers on a UniFi Network"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Hosting a public accesible server\u2014like a Raspberry Pi running a web server, Nextcloud, or a custom application\u2014is a great way to take control of one&#8217;s own data. However, exposing a device on the local network to the internet introduces significant security risks. If that Raspberry Pi gets compromised, a flat network architecture gives the attacker a free pass to the personal computers, NAS, and smart devices behind it.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"446\" src=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/blog4-1024x446.jpg\" alt=\"Network diagram: the trusted internal LAN with computers and NAS on the left, a Raspberry Pi in the DMZ on the right, reachable from the internet through port forwarding; the firewall blocks the way back into the LAN\" class=\"wp-image-402\" srcset=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/blog4-1024x446.jpg 1024w, https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/blog4-300x131.jpg 300w, https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/blog4-768x334.jpg 768w, https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/blog4-1536x669.jpg 1536w, https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/blog4-2048x892.jpg 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The solution is <strong>Network Separation using VLANs (Virtual Local Area Networks)<\/strong>. In a proper Demilitarized Zone (DMZ) architecture, the Raspberry Pi should be accessible from the internet and from the trusted internal network, but the Pi itself must be completely blocked from initiating connections to those trusted devices.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here is a technical deep dive into setting up this architecture using Ubiquiti&#8217;s UniFi ecosystem, highlighting the differences between the legacy firewall approach and the modern Zone-based setup.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Objective<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before diving into the configuration, let&#8217;s define the exact traffic flow requirements for the Raspberry Pi (RPI) residing on a dedicated VLAN (e.g., VLAN 50 &#8211; DMZ):<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Internet to RPI:<\/strong> Allowed (restricted to specific forwarded ports like 80\/443).<\/li>\n\n\n\n<li><strong>Internal LAN to RPI:<\/strong> Allowed, for SSH management and access to internal dashboards.<\/li>\n\n\n\n<li><strong>RPI to Internet:<\/strong> Allowed (for software updates and outbound API calls).<\/li>\n\n\n\n<li><strong>RPI to Internal LAN:<\/strong> <strong>Strictly Blocked<\/strong> (to contain any potential breaches).<\/li>\n<\/ul>\n\n\n\n<figure class=\"lw-diagram\">\n<img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/diagrams\/public-servers-in-a-private-unifi-lan-a-network-separation-en.png\" width=\"1120\" height=\"576\" alt=\"Diagram for the article: Internet to RPI, Internal LAN to RPI, RPI to Internet \u2026\">\n<figcaption>The sequence from the article in 6 steps: Internet to RPI, Internal LAN to RPI, RPI to Internet, RPI to Internal LAN \u2026.<\/figcaption>\n<\/figure>\n\n<h2 class=\"wp-block-heading\">The &#8220;Old&#8221; Setup: Legacy Firewall Rules (LAN IN)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before Ubiquiti revamped its firewall interface, network separation required a deep understanding of iptables-style packet flow\u2014specifically the <code>LAN IN<\/code>, <code>LAN OUT<\/code>, and <code>LAN LOCAL<\/code> chains.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Isolating the Raspberry Pi VLAN with the old method meant manually stacking rules in the <strong>LAN IN<\/strong> tab (which governs traffic entering the router from a local network before it gets routed elsewhere).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here is how the legacy rule sequence looked:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>Rule 1: Allow Established and Related Traffic<\/strong>\n<ul class=\"wp-block-list\">\n<li><strong>Action:<\/strong> Accept<\/li>\n\n\n\n<li><strong>Protocol:<\/strong> All<\/li>\n\n\n\n<li><strong>States:<\/strong> Checked &#8220;Established&#8221; and &#8220;Related&#8221;<\/li>\n\n\n\n<li><strong>Source:<\/strong> Any<\/li>\n\n\n\n<li><strong>Destination:<\/strong> Any<\/li>\n\n\n\n<li><em>Why?<\/em> This ensures that when a trusted PC initiates an SSH connection to the RPI, the RPI&#8217;s reply traffic is allowed back through the firewall.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Rule 2: Drop DMZ to Trusted LAN<\/strong>\n<ul class=\"wp-block-list\">\n<li><strong>Action:<\/strong> Drop<\/li>\n\n\n\n<li><strong>Protocol:<\/strong> All<\/li>\n\n\n\n<li><strong>Source:<\/strong> Network -&gt; DMZ VLAN (the RPI&#8217;s network)<\/li>\n\n\n\n<li><strong>Destination:<\/strong> Network -&gt; Trusted LAN (or an RFC1918 IP Group containing all private subnets)<\/li>\n\n\n\n<li><em>Why?<\/em> This is the kill switch. Because it sits below Rule 1, the RPI can reply to incoming requests, but any new connection the RPI attempts to make into the private network is forcefully dropped.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">While effective, this method was prone to user error. A simple mistake in rule ordering or misunderstanding the difference between <code>LAN IN<\/code> and <code>LAN LOCAL<\/code> often resulted in broken setups or false senses of security.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The &#8220;New&#8221; Setup: Zone-Based Traffic Rules<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">With UniFi Network 9.0, Ubiquiti introduced a modern <strong>zone-based firewall<\/strong>. It replaced the separate views for Firewall Rules and <strong>Traffic Rules<\/strong> as the place where network separation is configured; existing rules are converted into zone policies during the migration. This shift abstracts away the complex routing chains (<code>LAN IN<\/code>\/<code>OUT<\/code>) and focuses on intent-based networking.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Instead of thinking about how packets traverse the router&#8217;s internal interfaces, policies are defined between zones. A zone is not a single network but a group of networks and interfaces: the DMZ VLAN goes into a DMZ zone, the trusted networks into an internal zone, and a policy then selects a source zone and a destination zone. The steps below refer to UniFi Network 10.4 (as of August 2026).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here is how the exact same isolation works in the modern UniFi interface:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Open <strong>Settings &gt; Policy Engine<\/strong> and switch to the zone matrix (in UniFi Network 9.x this section was located under Settings &gt; Security).<\/li>\n\n\n\n<li>Assign the networks to zones: the DMZ VLAN to a DMZ zone, the trusted networks to an internal zone.<\/li>\n\n\n\n<li>In the matrix, open the cell where the source zone <strong>DMZ<\/strong> meets the destination zone <strong>Internal<\/strong> and create a policy there.<\/li>\n\n\n\n<li><strong>Action:<\/strong> Block (or Reject, if the sender should receive an error message instead of a silent drop)<\/li>\n\n\n\n<li><strong>Source:<\/strong> zone DMZ, narrowed down to the Raspberry Pi if required<\/li>\n\n\n\n<li><strong>Destination:<\/strong> zone Internal, narrowed down to the networks that need protecting if required<\/li>\n\n\n\n<li>Save the policy. The opposite direction, Internal to DMZ, has its own cell in the matrix and stays allowed.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The Magic of Zones:<\/strong> Under the hood, the UniFi controller automatically handles the stateful inspection. It inherently knows to allow &#8220;Established and Related&#8221; traffic without a dedicated rule. Trusted devices can still talk to the Raspberry Pi, but if the Pi gets compromised and tries to ping the NAS, the Zone rule acts as a brick wall. This makes the configuration significantly cleaner, highly readable, and much less error-prone.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A Note on Port Forwarding<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Once the Raspberry Pi is securely isolated in its own VLAN, it still has to be reachable from the outside world. Historically, enterprise firewalls required a manually created Destination NAT (DNAT) rule and a corresponding WAN IN firewall rule to allow the traffic through.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ubiquiti makes this incredibly streamlined.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To expose the web server:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Go to <strong>Settings &gt; Policy Engine &gt; Port Forwarding<\/strong> (path as of UniFi Network 10.4).<\/li>\n\n\n\n<li>Click <strong>Create New Port Forwarding Rule<\/strong>.<\/li>\n\n\n\n<li>Define the <strong>Port<\/strong> (e.g., 443 for HTTPS).<\/li>\n\n\n\n<li>Input the <strong>Forward IP<\/strong> (the static IP of the Raspberry Pi).<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">That is it. The UniFi controller automatically provisions the necessary NAT translations and dynamically injects the <code>WAN IN<\/code> firewall rules to allow external traffic to reach that specific port on the isolated VLAN. The public-facing server is now online and safely compartmentalized from the private network.<\/p>\n\n\n<div class=\"lw-quellen\">\n<h2>Sources<\/h2>\n<ul>\n<li><a href=\"https:\/\/help.ui.com\/hc\/en-us\/articles\/360012192813-Introduction-to-UniFi\" target=\"_blank\" rel=\"noopener noreferrer\">Introduction to UniFi<\/a><\/li>\n<li><a href=\"https:\/\/www.raspberrypi.com\/documentation\/computers\/os.html\" target=\"_blank\" rel=\"noopener noreferrer\">Raspberry Pi OS documentation<\/a><\/li>\n<\/ul>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Hosting a public accesible server\u2014like a Raspberry Pi running a web server, Nextcloud, or a custom application\u2014is a great way to take control of one&#8217;s own data. However, exposing a device on the local network to the internet introduces significant security risks. If that Raspberry Pi gets compromised, a flat network architecture gives the attacker [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":12636,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[91318,91321,91243,91181,91237,91707,91324],"class_list":["post-16","post","type-post","status-publish","format-standard","hentry","category-it-networks","tag-firewall","tag-network-security","tag-networking","tag-raspberry-pi","tag-self-hosting","tag-unifi","tag-vlan"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How to Safely Host Public Servers on a UniFi Network - Lukas Wojcik - Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.lukaswojcik.com\/blog\/en\/it-networks\/how-to-safely-host-public-servers-on-a-unifi-network\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Safely Host Public Servers on a UniFi Network - Lukas Wojcik - Blog\" \/>\n<meta property=\"og:description\" content=\"Hosting a public accesible server\u2014like a Raspberry Pi running a web server, Nextcloud, or a custom application\u2014is a great way to take control of one&#8217;s own data. However, exposing a device on the local network to the internet introduces significant security risks. If that Raspberry Pi gets compromised, a flat network architecture gives the attacker [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.lukaswojcik.com\/blog\/en\/it-networks\/how-to-safely-host-public-servers-on-a-unifi-network\/\" \/>\n<meta property=\"og:site_name\" content=\"Lukas Wojcik - Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-05T05:56:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-20T15:51:18+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/08\/hero-16-public-servers-in-a-private-unifi-lan-a--d.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"luky\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"luky\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/it-networks\\\/how-to-safely-host-public-servers-on-a-unifi-network\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/it-networks\\\/how-to-safely-host-public-servers-on-a-unifi-network\\\/\"},\"author\":{\"name\":\"luky\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"headline\":\"How to Safely Host Public Servers on a UniFi Network\",\"datePublished\":\"2026-07-05T05:56:00+00:00\",\"dateModified\":\"2026-08-20T15:51:18+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/it-networks\\\/how-to-safely-host-public-servers-on-a-unifi-network\\\/\"},\"wordCount\":947,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"image\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/it-networks\\\/how-to-safely-host-public-servers-on-a-unifi-network\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/hero-16-public-servers-in-a-private-unifi-lan-a--d.png\",\"keywords\":[\"Firewall\",\"Network Security\",\"Networking\",\"Raspberry Pi\",\"Self-Hosting\",\"UniFi\",\"VLAN\"],\"articleSection\":[\"IT &amp; Networks\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/it-networks\\\/how-to-safely-host-public-servers-on-a-unifi-network\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/it-networks\\\/how-to-safely-host-public-servers-on-a-unifi-network\\\/\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/it-networks\\\/how-to-safely-host-public-servers-on-a-unifi-network\\\/\",\"name\":\"How to Safely Host Public Servers on a UniFi Network - Lukas Wojcik - Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/it-networks\\\/how-to-safely-host-public-servers-on-a-unifi-network\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/it-networks\\\/how-to-safely-host-public-servers-on-a-unifi-network\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/hero-16-public-servers-in-a-private-unifi-lan-a--d.png\",\"datePublished\":\"2026-07-05T05:56:00+00:00\",\"dateModified\":\"2026-08-20T15:51:18+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/it-networks\\\/how-to-safely-host-public-servers-on-a-unifi-network\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/it-networks\\\/how-to-safely-host-public-servers-on-a-unifi-network\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/it-networks\\\/how-to-safely-host-public-servers-on-a-unifi-network\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/hero-16-public-servers-in-a-private-unifi-lan-a--d.png\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/hero-16-public-servers-in-a-private-unifi-lan-a--d.png\",\"width\":1200,\"height\":630,\"caption\":\"How to Safely Host Public Servers on a UniFi Network\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/it-networks\\\/how-to-safely-host-public-servers-on-a-unifi-network\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Safely Host Public Servers on a UniFi Network\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\",\"name\":\"Lukas Wojcik - Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\",\"name\":\"luky\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"width\":424,\"height\":636,\"caption\":\"luky\"},\"logo\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\"},\"sameAs\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\"],\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/author\\\/luky\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Safely Host Public Servers on a UniFi Network - Lukas Wojcik - Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.lukaswojcik.com\/blog\/en\/it-networks\/how-to-safely-host-public-servers-on-a-unifi-network\/","og_locale":"en_US","og_type":"article","og_title":"How to Safely Host Public Servers on a UniFi Network - Lukas Wojcik - Blog","og_description":"Hosting a public accesible server\u2014like a Raspberry Pi running a web server, Nextcloud, or a custom application\u2014is a great way to take control of one&#8217;s own data. However, exposing a device on the local network to the internet introduces significant security risks. If that Raspberry Pi gets compromised, a flat network architecture gives the attacker [&hellip;]","og_url":"https:\/\/www.lukaswojcik.com\/blog\/en\/it-networks\/how-to-safely-host-public-servers-on-a-unifi-network\/","og_site_name":"Lukas Wojcik - Blog","article_published_time":"2026-07-05T05:56:00+00:00","article_modified_time":"2026-08-20T15:51:18+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/08\/hero-16-public-servers-in-a-private-unifi-lan-a--d.png","type":"image\/png"}],"author":"luky","twitter_card":"summary_large_image","twitter_misc":{"Written by":"luky","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/it-networks\/how-to-safely-host-public-servers-on-a-unifi-network\/#article","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/it-networks\/how-to-safely-host-public-servers-on-a-unifi-network\/"},"author":{"name":"luky","@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"headline":"How to Safely Host Public Servers on a UniFi Network","datePublished":"2026-07-05T05:56:00+00:00","dateModified":"2026-08-20T15:51:18+00:00","mainEntityOfPage":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/it-networks\/how-to-safely-host-public-servers-on-a-unifi-network\/"},"wordCount":947,"commentCount":0,"publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"image":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/it-networks\/how-to-safely-host-public-servers-on-a-unifi-network\/#primaryimage"},"thumbnailUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/08\/hero-16-public-servers-in-a-private-unifi-lan-a--d.png","keywords":["Firewall","Network Security","Networking","Raspberry Pi","Self-Hosting","UniFi","VLAN"],"articleSection":["IT &amp; Networks"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.lukaswojcik.com\/blog\/en\/it-networks\/how-to-safely-host-public-servers-on-a-unifi-network\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/it-networks\/how-to-safely-host-public-servers-on-a-unifi-network\/","url":"https:\/\/www.lukaswojcik.com\/blog\/en\/it-networks\/how-to-safely-host-public-servers-on-a-unifi-network\/","name":"How to Safely Host Public Servers on a UniFi Network - Lukas Wojcik - Blog","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/it-networks\/how-to-safely-host-public-servers-on-a-unifi-network\/#primaryimage"},"image":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/it-networks\/how-to-safely-host-public-servers-on-a-unifi-network\/#primaryimage"},"thumbnailUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/08\/hero-16-public-servers-in-a-private-unifi-lan-a--d.png","datePublished":"2026-07-05T05:56:00+00:00","dateModified":"2026-08-20T15:51:18+00:00","breadcrumb":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/it-networks\/how-to-safely-host-public-servers-on-a-unifi-network\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.lukaswojcik.com\/blog\/en\/it-networks\/how-to-safely-host-public-servers-on-a-unifi-network\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/it-networks\/how-to-safely-host-public-servers-on-a-unifi-network\/#primaryimage","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/08\/hero-16-public-servers-in-a-private-unifi-lan-a--d.png","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/08\/hero-16-public-servers-in-a-private-unifi-lan-a--d.png","width":1200,"height":630,"caption":"How to Safely Host Public Servers on a UniFi Network"},{"@type":"BreadcrumbList","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/it-networks\/how-to-safely-host-public-servers-on-a-unifi-network\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.lukaswojcik.com\/blog\/"},{"@type":"ListItem","position":2,"name":"How to Safely Host Public Servers on a UniFi Network"}]},{"@type":"WebSite","@id":"https:\/\/www.lukaswojcik.com\/blog\/#website","url":"https:\/\/www.lukaswojcik.com\/blog\/","name":"Lukas Wojcik - Blog","description":"","publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.lukaswojcik.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9","name":"luky","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","width":424,"height":636,"caption":"luky"},"logo":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg"},"sameAs":["https:\/\/www.lukaswojcik.com\/blog"],"url":"https:\/\/www.lukaswojcik.com\/blog\/author\/luky\/"}]}},"_links":{"self":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/16","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/comments?post=16"}],"version-history":[{"count":7,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/16\/revisions"}],"predecessor-version":[{"id":12606,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/16\/revisions\/12606"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media\/12636"}],"wp:attachment":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media?parent=16"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/categories?post=16"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/tags?post=16"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}