Quickstart

Unifi released the Zone Based Firewall a while back and at first it was a little confusing. I have gotten much better with it since its release and wanted to give some tips and tricks as well as some information how to use it.

What is a Zone?

A Zone is basically a collection of networks that allows you to apply a firewall policy to the collection or individual addresses to block or allow certain network traffic.

How do I add a Firewall Rule to a Zone?

  • Open the Unifi Console

  • Click the Gear Icon on the Left near the bottom

  • Click Policy Engine

  • Scroll down and click Create Policy

You will need a name. I normally start with what it does, then a descriptive target: Allow Internal to Guest for as an example.

Source Zone: the zone the device lives in. Then Any, Device, Network, or IP. Source port is usually Any because clients pick random ports.

Action: Block (default, looks closed), Allow, or Reject (tells the source it was blocked).

Destination Zone: where the traffic is going. External for the internet. Then Any, App, IP, Domain, Region, and a destination port.

IP Version is Both in most cases. Protocol is All, TCP/UDP, TCP, UDP, or Custom (ICMP). Connection State defaults to All.

Firewall policies go down the list. First match wins. Less restrictive allow rules sit above a broad block. If you want one client on the internet while a zone is blocked, allow DNS/HTTP/HTTPS for that IP above the block.

Validate in Flows. Kick off traffic and watch whether it is allowed or blocked. You may need to move the policy so it matches first.

Network Objects Profiles

These streamline rules you reuse.

  • Gear → Profiles → Network Objects → Create New

  • Port, port range, IPv4, or IPv6. SMB, internet access, and standard deny lists belong here.

Region Blocking

Gear → Cybersecure → Region Blocking. Block selected regions, or allow only selected regions. Both directions, outgoing, or incoming. This is the “stop random scanners from half the planet” switch.

Honeypot

Gear → Cybersecure → Honeypot → Create New. Pick a network and an unused IP. It opens commonly used ports with no services behind them so you can see if a compromised machine is scanning you.

Detections and Intrusions

Detection Mode can Notify or Notify and Block. Categories include botnets, malware, exploits, P2P/dark web, recon, and protocol vulns. You can exclude IPs or networks if blocking is too hot.

Intrusion Prevention on enables DPI for calls that look like they will compromise the network.

I have found these less intrusive while still being effective. Content filtering, encrypted DoH, and app blocking exist if you want a house with no Spotify. Bandwidth is less of a concern now, so I usually skip those unless there is a reason.