Start with a read-only UniFi security review
The review is how we find out what your network is doing today, without changing any of it.
-
Network security review
$250, credited against work approved within 30 days
- Read-only, through a View Only admin account you grant us in UniFi.
- A scan of your public address from outside, the way anyone on the internet sees it.
- A written report: the findings in the order we would fix them, and a quote for each of the jobs below.
Then two jobs on your UniFi gateway and Wi-Fi
Each one is quoted after the review, once we know your gear. You can take one or both, in whatever order the report suggests.
-
Close the internet-facing doors and harden the gateway
Quoted after the review
- Port forwards closed, or paused where something might still depend on them.
- Existing VPN configurations are reviewed.
- Intrusion prevention turned on for every category, and set to block.
- Inbound traffic limited by region.
- DHCP guarding, so a stray device can't start handing out addresses.
- The firewall rebuilt on zones, so guest devices cannot reach the main network.
- Ready for DNS filtering at the router, set up as part of Matano Guard.
-
Wi-Fi and switch tune-up
Quoted after the review
A Wi-Fi cleanup: channels split, bands set and settings tidied, so devices aren't crowded onto one channel.
- 5 GHz and 6 GHz on the main network, with band steering.
- Channels split across your access points.
- Frame protection on the Wi-Fi networks whose devices can be tested with it.
- Devices that need one get a fixed address.
- Resources that don't require internal access are moved to a guest network (we can help set one up if needed).
- A device list by network and address, delivered as a spreadsheet and a PDF.
Optional: Matano Guard
If you want us to keep the filtering running, Matano Guard is an optional add-on: $250 setup, then $49 a month per location; the review and both jobs stand on their own without it.
-
Matano Guard
$250 setup, then $49 a month, optional
- Matano Guard keeps it running: blocking that works on its own around the clock, policy changes by email, text or ticket, with no ticket fee, configuration backups and a change log available to you on request, and an automated alert we act on if filtering ever stops. On UniFi it also keeps the firewall and UniFi CyberSecure current. Month to month, cancel any time, no contract; annual contract discounts available.
- UniFi CyberSecure Enhanced is a $99 a year license you buy from Ubiquiti. We manage it as part of Matano Guard.
Usually quoted alongside
These come up in most reviews and are quoted separately, once we know what you have:
- Email domain protection, the DMARC, SPF and DKIM records that stop somebody sending as you. How we set up email domain protection.
- We can set up a VPN for remote access if you need one.
- Endpoint protection on the computers themselves.
How the work happens
Changing a network that an office runs on is only worth doing if the office keeps running. This is how we make sure it does.
Before the window
- You stay in control of access. You switch our UniFi account to admin for the window, and drop it back to View Only after.
In the window
- Remote, in a window we agree with you. Nobody needs to be on site, and you know in advance when it happens.
- A configuration backup before every single step, kept in your folder, so any step can be put back exactly as it was.
- No Wi-Fi password is ever changed. Nobody in the office has to reconnect a device afterwards.
- Paused, not deleted. Anything a test might still need is paused rather than removed, until a follow-up check with someone in the office.
After
- A written record the same day. A written summary of what changed, and the device-by-device address list.
- If a change causes a problem, it comes back out.
One office, before and after
An example from a real deployment
A six-operatory dental practice in Mercer County, on a UniFi gateway, switch and access points. The practice isn't named, and neither is the doctor.
Showing the network after the windowbefore the review.
- Services reachable from the internet
- 03
- Intrusion prevention categories on
- 35 of 35Partlysome categories on
- Web categories blocked
- 19on both networksNoneDNS to the ISP, unencrypted
- Devices with reserved addresses
- 676
Before the review
- Three services reachable directly from the internet.
- An older VPN, on an address the ISP changes.
- One flat network, with TVs, speakers and tablets next to the server.
- Intrusion prevention partly on.
- DNS sent to the ISP in the clear.
- 27 of 31 wireless devices on one 2.4 GHz channel.
After the window
- Zero services open to the internet.
- 35 of 35 intrusion prevention categories on.
- Guest devices isolated from the practice network.
- 19 web categories blocked on both networks.
- 67 devices with reserved addresses, up from 6.
- The office never went offline during the window.
What is on your network?
Tick what your office has, and you'll see what the work does about each one.
It stays on the main network, and the zone firewall keeps guest devices from reaching it. Any port forward pointing at it is closed or paused.
If it's reachable through a port forward, that door is closed or paused, and we can set up a VPN for remote access if you need one.
Each phone is reserved at a fixed address and listed in the device list, and nothing a phone might need is deleted before someone in the office has checked it.
Reserved at a fixed address on the main network, and listed by network and address in the spreadsheet and PDF.
Resources that don't require internal access are moved to a guest network (we can help set one up if needed).
Listed by network and address, and kept with the guest devices if that's where they belong, behind the zone firewall.
Resources that don't require internal access are moved to a guest network (we can help set one up if needed).
Reserved at a fixed address and listed, and if a port forward exposes one to the internet, that door is closed or paused.
Set up if you need one, and isolated so nothing on it can reach the main network, with its own category blocking and Safe Search.
Questions
Will the office go offline?
The work happens remotely, in a window we agree with you, with a configuration backup taken before every step, so any step can be put back. In the practice above, the office never went offline during the window.
Do you change our Wi-Fi passwords?
No. No Wi-Fi password is ever changed, so nobody has to reconnect a device afterwards.
What access do you need and for how long?
For the review, a View Only admin account in UniFi that you grant us, which is read-only. For the work itself, you switch that account to admin for the agreed window and drop it back to View Only after.
Do you work on UniFi Dream Machine and UDM Pro?
Yes. The review and both jobs are written for UniFi gateways, including the UniFi Dream Machine, the UDM Pro and the Cloud Gateways, along with UniFi switches and UniFi Wi-Fi access points. Matano IT Solutions is independent and is not affiliated with Ubiquiti.
Do I need Matano Guard?
No. Matano Guard is an optional add-on. You can take the review and either job without it.
What if we are not on UniFi?
This page is written for a UniFi network: a Dream Machine or Cloud Gateway, a switch and access points. Matano IT also hardens pfSense, Meraki, Cisco, Fortinet, SonicWall, Barracuda, TP-Link Omada and ISP-supplied routers; see network hardening on other gear, or ask about your network with the form below.
What happens if something breaks after the window?
If a change causes a problem, it comes back out. Every step has a configuration backup in your folder, and anything a test might still need is paused rather than deleted until a follow-up check with someone in the office.
Is the $250 review really credited?
Yes. The $250 is credited against work you approve within 30 days of the review.
What does the $49 a month cover?
That is Matano Guard, an optional add-on: blocking that works on its own around the clock, policy changes by email, text or ticket, with no ticket fee, configuration backups and a change log available to you on request, and an automated alert we act on if filtering ever stops. On UniFi it also keeps the firewall and UniFi CyberSecure current. Setup is $250, then it is month to month, with no contract. If you buy the UniFi CyberSecure Enhanced license from Ubiquiti, we manage it under the same line.