explorer-monorepo/UDM_PRO_INTERNET_BLOCKING_CONFIRMED.md

UDM Pro Internet Blocking - CONFIRMED

Date: 2026-01-21
Evidence Source: UniFi Network Controller Screenshot
Client: NPMplus dot 167 (192.168.11.167)

---

Critical Finding: Zero Internet Activity

UDM Pro Client Overview

• Client Name: NPMplus dot 167
• IP Address: 192.168.11.167
• MAC Address (from UDM Pro): bc:24:11:8d:ec:b7
• 24H Internet Activity: 0 B ⚠️
• Virtual Network: MGMT-LAN (VLAN ID 11)
• Manufacturer: Proxmox Server Solutions GmbH

---

Analysis

✅ Device Recognition

UDM Pro correctly identifies the NPMplus container:

• IP address matches: 192.168.11.167
• Manufacturer correctly identified as Proxmox
• Connected via UDM Pro GbE

❌ Internet Access Blocked

24H Internet Activity: 0 B confirms:

• UDM Pro firewall is blocking outbound internet traffic
• This explains why Docker Hub pulls are timing out
• This explains why container cannot reach 8.8.8.8

⚠️ MAC Address Discrepancy

• UDM Pro shows: bc:24:11:8d:ec:b7
• Container config shows: BC:24:11:A8:C1:5D

Possible explanations:

1. UDM Pro may be showing a different MAC (bridge/veth pair)
2. MAC address may have changed
3. UDM Pro may be tracking a different interface

Action: Verify which MAC is actually active

---

Root Cause Confirmed

The 0 B internet activity definitively proves:

• ✅ Container is recognized by UDM Pro
• ❌ Outbound internet traffic is blocked by UDM Pro firewall
• ❌ This is preventing Docker Hub access
• ❌ This is preventing NPMplus updates

---

Solution: UDM Pro Firewall Rule

Step 1: Access UDM Pro

1. Open: https://192.168.11.1
2. Navigate to: Clients → NPMplus dot 167

Step 2: Check Current Firewall Rules

1. Go to: Settings → Firewall & Security → Firewall Rules
2. Look for rules affecting:
   • Source: 192.168.11.167
   • Virtual Network: MGMT-LAN (VLAN 11)
   • Outbound traffic

Step 3: Add Allow Rule

Create a new firewall rule:

Rule Configuration:

• Name: Allow NPMplus Outbound
• Action: Accept / Allow
• Source:
  • Type: IP Address
  • Address: 192.168.11.167
  • Or use MAC: bc:24:11:8d:ec:b7
• Destination: Any (or Internet)
• Protocol: Any
• Port: Any
• Direction: Outbound or Both
• Virtual Network: MGMT-LAN (VLAN 11)
• Placement: BEFORE any deny/drop rules

Step 4: Verify Fix

After adding the rule, wait 30 seconds, then:

# Test from container
ssh root@r630-01
pct exec 10233 -- ping -c 2 8.8.8.8

# Test Docker Hub
pct exec 10233 -- curl -s https://registry-1.docker.io/v2/ | head -3

# Check UDM Pro client overview again
# Should show internet activity > 0 B

---

Alternative: MAC-Based Rule

If IP-based rules don't work, try MAC-based:

• Source MAC: bc:24:11:8d:ec:b7
• Action: Accept
• Destination: Any

---

Expected Result

After adding the firewall rule:

• ✅ Container can reach internet (8.8.8.8)
• ✅ Container can reach Docker Hub
• ✅ Docker pull will succeed
• ✅ UDM Pro client overview will show internet activity > 0 B

---

Summary

Status: ✅ ROOT CAUSE CONFIRMED

Evidence:

• UDM Pro shows 0 B internet activity for 192.168.11.167
• This confirms firewall blocking outbound traffic

Solution:

• Add UDM Pro firewall rule to allow outbound from 192.168.11.167
• Use IP address or MAC address (bc:24:11:8d:ec:b7)

Next Step: Add firewall rule in UDM Pro Web UI

---

Action Required: Configure UDM Pro firewall rule to allow outbound internet access