Black Pearl Head Office
10 GbE UniFi Network
QUICK SURF NETWORK
Unleashing Digital Excellence
Black Pearl Head Office · SMB Deployment
Enterprise-Grade
10 GbE Office Topology
10 GbE Office Topology
A fully managed UniFi deployment operated by QSN as a reference SMB architecture — 10 GbE end-to-end fibre backbone, UDM SE gateway, 5-node access-switching layer with wireless mesh bridging, Wi-Fi 7 access points across 5 zones, 8 segmented VLANs, zone-based firewall with 129 enforced policies, CyberSecure IDS/IPS with 72,102 active signatures, geo-blocking, region-routed VPN egress, encrypted DNS, UniFi Access physical entry integration, and 24/7 honeypot deception across every subnet. The same posture QSN delivers to every managed SMB and commercial client site.
10 GbE Aggregation
10 GbE Wi-Fi 7 APs
10 GbE NAS
Wireless Mesh Bridge
72k IDS Signatures
129 Firewall Policies
UniFi Access Integrated
1
Gateway
UDM SE · UniFi OS 5.1.26
5+1
Switches + Mesh Bridge
1 × AGG · 4 × ACCESS · 1 × UDB
4
Wi-Fi 7 / 6 APs · 5 Zones
10 GbE / 2.5 GbE UPLINK
8
VLANs · 6 SSIDs
ZONE-SEGMENTED
39
Active Clients
9 WIRED · 30 WIRELESS
129
Firewall Policies
7-ZONE MATRIX
Layer 0 — WAN Edge · Gateway Core · Cloud Operations
⇲ Internet · Single WAN
WAN 1 · Fibre
Primary ISP · GbE handoff
•••.•••.•••.•••
Uptime
Continuous since deployment
100%
Peak Util.
24h Down · Up envelope
49% · 4%
BLACK PEARL HEAD OFFICE
UDM SE · UNIFI OS 5.1.26
10 GbE Edge · 7-Zone Firewall · IDS/IPS Active
☁ Cloud Operations
UniFi Cloud Access
Connected · UTC+04:00
LIVE
UniFi OS Release
5.1.26 · Official channel
UP TO DATE
Apps Managed
Network 10.5.67 · Protect 7.2.101 · Access 4.3.3 · Connect 3.24.22 · InnerSpace 1.3.21
5 APPS
Auto-Update Discipline
Daily · Staggered schedule
ENFORCED
Layer 1 — Zone-Based Firewall · 7 Zones · 129 Policies
7 Security Zones
Source × Destination Policy Matrix
Internal
7 networks
External
WAN + VPN egress
Gateway
UDM SE itself
VPN
Teleport WG
Hotspot
Guest VLAN 30
DMZ
Reserved
All Policies
129 active
| → Internal | → External | → Gateway | → VPN | → Hotspot | → DMZ | |
|---|---|---|---|---|---|---|
| Internal | Allow All12 | Allow All11 | Allow All7 | Allow All9 | Allow All10 | Allow All2 |
| External | Allow Return5 | Allow Return3 | Allow Return7 | Allow Return3 | Allow Return3 | Allow Return3 |
| Gateway | Allow All | Allow All | — | Allow All | Allow All | Allow All |
| VPN | Allow All | Allow All2 | Allow All | Allow All | Allow All | Allow All |
| Hotspot | Allow Return4 | Allow All7 | Allow Return12 | Allow Return4 | Block All3 | Block All2 |
| DMZ | Allow Return | Allow All2 | Allow Return | Allow Return | Block All | Block All |
Layer 2 — 8 VLAN Segmentation · Per-Subnet Isolation
8 VLAN Segments
Subnet · DHCP · Inter-VLAN ACL Enforced
Default
VLAN 1 · INFRA
/27 · Management
Infra mgmt · 8 leases
Corporate LAN
VLAN 10
/25 · 124 IPs
Primary staff · 22 leases
IoT
VLAN 20
/24 · 249 IPs
Smart devices · 28 leases
Guest
VLAN 30 · HOTSPOT
/27 · 29 IPs
Visitor isolated
VPN Egress
VLAN 40 · ROUTED
/28 · 12 IPs
PBR → outbound VPN
Alt-VPN
VLAN 50 · ROUTED
/29 · 4 IPs
Secondary VPN egress
PBX / Voice
VLAN 60 · QoS
/27 · 28 IPs
Grandstream · 4 phones
Protect
VLAN 70 · CCTV
/28 · 12 IPs
UniFi Protect cameras
Layer 3 — Wi-Fi Architecture · 6 SSIDs · Tri-Band · Wi-Fi 7 · 5-Zone Roaming
BP-CORP
5 + 6 GHz · Tri-band
Corporate · VLAN 10
13 active clients
WPA2/WPA3
BP-IOT
2.4 GHz · Isolated
IoT · VLAN 20
20 active clients
WPA2
BP-VPN-X
2.4 GHz · Egress-Routed
VPN Egress · VLAN 40
On-demand · PBR enforced
WPA2
BP-PBX
2.4 GHz · QoS prioritized
PBX · VLAN 60
2 wireless phones
WPA2
BP-GUEST
2.4 + 5 + 6 GHz
Hotspot · VLAN 30
Captive portal · bandwidth-capped
WPA2/WPA3
BP-UID
5 GHz · 802.1X
UniFi Identity · Native
Per-user certificate auth
WPA2/WPA3 ENT
Layer 4 — 10 GbE Backbone · Aggregation Core · Access Distribution
USW Aggregation · 8-Port 10 GbE Fibre Core
SFP+ aggregation switch · STP Root (priority 0)
10 GbE fibre core fanning out to USW Pro XG 10 PoE (SFP+ uplink), USW Lite 8 PoE, and downstream access switches. Spanning Tree root anchor, IGMP querier, and inter-VLAN L3 routing handoff to UDM SE.
• STP Root
8 × SFP+ 10G
IGMP Querier
RSTP
UDM SE Gateway
10 GbE
UniFi Dream Machine Special Edition · UniFi OS 5.1.26
All-in-one routing, firewall, IDS/IPS, threat intelligence, VPN termination (Teleport/WireGuard, OpenVPN client), and 7-zone policy engine. SFP+ to aggregation core.
Edge · Routing · Security
USW Aggregation
10 GbE
8-port 10G SFP+ aggregation switch
L3 fibre core handing off to USW Pro XG 10 PoE and direct-attached 10G hosts. STP root anchor for the entire LAN. IGMP querier for multicast services.
Core Aggregation
USW Pro XG 10 PoE
10 GbE
10-port managed multigig L2/L3 PoE switch
Primary access switch — aggregates two Wi-Fi 7 flagship APs, IT cabinet camera (PoE), NAS (10G), aggregation uplink, plus distribution to zone-level switches. Multigig 2.5/10G, PoE++ budget for high-power APs and PTZ cameras.
Distribution + PoE Access
USW Flex 2.5G · Zone A Distribution
10 GbE
8-port 2.5G PoE access switch · 10G uplink
Zone A room-level access and PoE distribution: workstations at 2.5G, PoE+ for smart-home bridges and cameras, 10G fibre uplink back to USW Pro XG 10 PoE core.
Zone A Access
USW Lite 8 PoE
GbE
8-port managed PoE access switch
Auxiliary PoE distribution for media / entertainment zone: smart TV, PlayStation, room-attached AP, and door-access gateway. GbE uplink to USW Pro XG 10 PoE.
Media & Access Zone
UDB Mesh Bridge
2.5 GbE
UniFi wireless building-distribution bridge
Wireless-mesh Ethernet extension to an isolated workstation area with no cable path. Uplinks over-the-air to AP Zone B, presents wired 2.5 GbE downstream. Demonstrates QSN’s capability to extend structured LAN into hard-to-cable zones without disruptive works.
Wireless Mesh Distribution
AP Zone A
10 GbE
UniFi U7 Pro XG · Wi-Fi 7 tri-band
Flagship Wi-Fi 7 AP — 2.4 / 5 / 6 GHz radios, 320 MHz 6 GHz channel width, multi-link operation (MLO) capable, 10 GbE uplink for true Wi-Fi 7 line rate.
Primary Coverage
AP Zone B
10 GbE
UniFi U7 Pro XG · Wi-Fi 7 tri-band
Second flagship Wi-Fi 7 AP with overlapping seamless-roaming cell to AP Zone A. 10 GbE uplink, MLO-capable. Also serves as the mesh anchor for the UDB wireless building bridge.
Secondary Coverage & Mesh Anchor
AP Zone C
2.5 GbE
UniFi U7 · Wi-Fi 7 dual-band
Wi-Fi 7 AP serving the far-end of the office footprint. 2.5 GbE multigig uplink for extended-coverage throughput; roaming-paired with Zone A/B.
Extended Coverage
AP Zone E — Kitchen Area
2.5 GbE
UniFi U7 · Wi-Fi 7 dual-band
Added coverage AP for a fifth roaming zone in the kitchen / break-out area. 2.5 GbE PoE uplink, seamless roaming into Zones A/B/C for uninterrupted client handoff across the entire footprint.
Kitchen / Break-Out Coverage
IT Cabinet Camera
FE
UniFi G5 Flex
Physical security camera attached to the rack itself — rack-cabinet surveillance, motion-triggered recording on UniFi Protect, part of zero-trust physical posture.
Physical Security
DS-Class NAS
10 GbE
5-bay Synology NAS · 10G NIC
Centralized storage and Plex media server for the office. Connected at full 10 GbE to USW Pro XG 10 PoE. Port-forwarded for remote-only Plex access (no SMB exposure to WAN).
Storage · Media
UAG Access Gateway
FE
UniFi Access door/entry gateway
UniFi Access physical entry-control gateway integrated with Protect and Network layers. Door open/close events correlate with camera recordings and network client-connection logs, giving unified physical + digital security telemetry.
Physical Access Control
Layer 5 — Layered VPN Architecture · Inbound & Outbound
Multi-Tier VPN Strategy
Inbound Remote Access · Outbound Region Routing · Alt Egress
Primary Outbound VPN
↑ Egress · OpenVPN
Selected source devices on VLAN 40 are policy-routed outbound through a commercial OpenVPN endpoint in the US region. Used for region-locked services and privacy isolation while the rest of LAN egresses normally over WAN1.
Inbound Remote Access
↓ Ingress · WireGuard (Teleport)
UniFi Teleport / WireGuard hosted on the UDM SE for secure remote staff access. Invite-only via short-lived URL tokens with full invitation audit history. No always-open inbound ports.
Alt Egress Channel
↑ Egress · Reserved VPN
Secondary outbound VPN egress on VLAN 50 as policy-based-routing fallback or for clients needing a distinct egress identity from the primary VPN. All-traffic policy when in use.
Layer 6 — Defense in Depth · IDS/IPS · Geo-Block · Honeypot Deception
CyberSecure Enhanced · Proofpoint + Cloudflare Threat Intelligence
Active · 23,807 events / 24h
72,102
Active IDS Signatures
All 7 categories enabled
23,807
Blocked Events / 24h
96% LOW · 3.9% SUSPICIOUS
129
Firewall Policies
ZONE MATRIX ENFORCED
8 / 8
Honeypot Subnets
DECEPTION ON EVERY VLAN
Threat Intelligence · IDS/IPS · Category Coverage
✓Botnets and Threat Intelligence
5 / 5✓Viruses, Malware and Spyware
4 / 4✓Hacking and Exploits
5 / 5✓Peer to Peer and Dark Web
3 / 3✓Attacks and Reconnaissance
7 / 7✓Protocol Vulnerabilities
12 / 12✓CINS Army Reputation List
CURATED✓DShield Block List
CURATEDNetwork & Geographic Hardening
✓Region Block · High-Risk Geography
BLOCKED BOTH✓Encrypted DNS · Cloudflare + Google
AUTO✓Honeypot Deception (per-VLAN)
8 SUBNETS✓UniFi SSL Identity Certificate
DISTRIBUTED✓Memory-Optimized Detection
ENABLED✓Detection Mode
NOTIFY + BLOCKPhysical Security · UniFi Access Integration
✓UAG Access Gateway · Door Event Correlation
INTEGRATED✓Protect × Network × Access Cross-Log
UNIFIED✓G5 Flex Camera · Motion + Entry Trigger
ACTIVE✓Rack-Cabinet Surveillance
24/7L3 Network Lists · Inter-VLAN ACL Object Groups
RFCRFC1918 Private Ranges (3 CIDRs)
IPv4GIoT-to-Gateway Block (2 entries)
IPv4GCorp-to-Gateway Block (2 entries)
IPv4GGuest-to-Gateway Block (2 entries)
IPv4PManagement Ports (HTTP/HTTPS/SSH)
PORTPPrinter Object & Service Pins
IPv4Layer 7 — Application Visibility · Flow Telemetry · Region Insights
Application & Region Insights · 24h Window
Flow telemetry · Top affected entities
Top Triggered Policies
Inter-VLAN Block (Primary)11,255
Inter-VLAN Block (Secondary)11,186
CINS Army Reputation List725
DShield Block List220
Simple-App Block (Epic Games)193
Top Affected Regions
🇺🇸 United States193
🇦🇪 United Arab Emirates (local)29
🇮🇷 High-Risk Region (blocked)—
Total Flow Records / 24h10,000+
Flow Summary96% LOW
Operational Excellence · SMB Reference Deployment
100%
WAN Uptime
FAILOVER MODE · SINGLE WAN
10 GbE
Backbone Speed
END-TO-END FIBRE
36
Concurrent Clients
9 WIRED · 27 WIRELESS
23.8k
Threats Blocked / 24h
96% LOW · 0 BREACH
The Black Pearl Head Office is one of QSN’s SMB managed deployments — designed as the reference architecture that QSN brings to every commercial client engagement. The full UniFi stack runs on a 10 GbE end-to-end fibre backbone with Wi-Fi 7 wireless edge across 5 seamless-roaming zones (including a wireless mesh bridge extension to a hard-to-cable workstation), eight segmented VLANs governed by a 7-zone firewall enforcing 129 active policies, IDS/IPS with 72,102 signatures across all 7 threat categories, region blocking, encrypted DNS, layered VPN (inbound Teleport + outbound region-routed egress), honeypot deception on every subnet, and UniFi Access physical entry integration correlating door events with camera recordings and network client-connection logs for unified physical + digital security telemetry. Over the last 24 hours alone the network blocked 23,807 threat events with zero successful breaches and zero unplanned downtime — the same operational posture QSN delivers to every managed SMB and commercial site.
Deep Purple · 10 GbE Identity
UDM SE · Edge Gateway
Aggregation Core
Outbound VPN
Access / Wi-Fi 7
PBX / Voice
IoT VLAN
Protect / CCTV
Alt VPN Egress
Designed · Deployed · Operated by QSN
quicksurfnetwork.com · +971 4 288 2335 · Port Saeed, Deira, Dubai · info@quicksurfnetwork.com
