Kernaali ToolsCheck which firewall your site uses
Current UniFi documentation describes zone-based firewalling, introduced in Network 9.0.108, with a supported UniFi gateway. Older deployments may still use the previous rule architecture. Inspect the active policy model before following a guide: “LAN IN” and “WAN LOCAL” are not names to transplant into a zone matrix.
Zones group interfaces or networks by policy. External covers WAN-facing/untrusted traffic; Internal commonly contains trusted networks; Gateway represents traffic to or from the router itself. VPN, Hotspot and DMZ cover other roles. A network belongs to one zone; simply naming a VLAN “IoT” does not assign a restrictive policy.
Read a zone pair in both directions
The source zone is where a flow starts; the destination zone is where it goes. Trusted-to-IoT permission and IoT-to-Trusted permission are different decisions. A reply should be accepted by connection state without granting IoT permission to start arbitrary new sessions.
| Policy in an original example | Scope | Why |
|---|---|---|
| Allow Trusted → IoT service | Admin PC 10.42.10.25 to 10.42.30.20 TCP 443 | Only the controller service needed |
| Allow return traffic | Established/related reply path | Allows replies without a reverse new-session permit |
| Block IoT → Trusted | Remaining new traffic | Stops device-initiated LAN access |
| Block Guest → local zones | Required local destinations including IoT | Guest should not inherit device control |
| Restrict Guest/IoT → Gateway | Preserve DHCP/DNS; block management | Protects router services separately |
Order exceptions before broad blocks
Create and test the specific allow first, then put the broader block below it. Inspect both custom and built-in rules and use the actual ordered policy table. UniFi can create extra policies for port forwarding or VPN features, so revisit effective rules after enabling those features.
Auto Allow Return Traffic can supply a return policy when it is needed. Confirm that it matches the intended stateful reply behavior and does not conflict with an earlier rule. Networks grouped in one Internal zone may communicate under a permissive Internal-to-Internal policy: use a dedicated IoT zone or carefully scoped rules within that zone.
Protect management without losing infrastructure
A rule blocking IoT-to-Trusted does not automatically block IoT access to the router’s own UI. Gateway is a separate destination. IPv4-only rules do not protect parallel IPv6 paths; choose the intended IP families and retain required IPv6 control traffic.
Test what the rule is meant to stop
Use a fresh connection from a real source in each network. Confirm a trusted controller reaches the selected IoT port, that another port remains blocked, and that IoT cannot initiate a new session to the controller. Check logs or counters where exposed. Same-VLAN traffic may never reach the gateway, so use AP/switch isolation for that requirement.
Isolation by enforcement point · Review generated inbound policies · IPv6 control-plane reminders
These guides use the current UniFi Network concepts. Menu wording and location vary by release; check the policy’s actual scope and result. Kernaali Tools is not affiliated with Ubiquiti.
Technical references
Found an issue? Send a correction with a reproducible example.