diff --git a/docs/01-NETWORK-MAP.md b/docs/01-NETWORK-MAP.md
index 558bf3a..a59de4b 100644
--- a/docs/01-NETWORK-MAP.md
+++ b/docs/01-NETWORK-MAP.md
@@ -251,6 +251,14 @@ For complete device-to-VLAN mapping, see `06-VLAN-DEVICE-ASSIGNMENT.md`.
 | 62.73.120.142:80 | 192.168.10.20:8001 | Traefik HTTP |
 | 62.73.120.142:443 | 192.168.10.20:44301 | Traefik HTTPS |
 
+### IoT miIO Masquerade (2026-10-28)
+
+Xiaomi miIO/MIoT devices reject UDP from source IPs outside their subnet. This SRCNAT rule masquerades VLAN 10 → VLAN 30 traffic on UDP 54321 so HA can control IoT WiFi devices locally.
+
+| Source | Destination | Action |
+|--------|-------------|--------|
+| 192.168.10.0/24 | 192.168.30.0/24:54321/udp | masquerade (to 192.168.30.1) |
+
 ### AdGuard DNS (pending - not configured yet)
 
 | External Port | Destination | Service |