Firewall & Access Policy

• Firewall and Access Policy Summary

Firewall and Access Policy Summary

Firewall & Access Policy

Zones

UniFi reports 8 zones:

Zone	Networks
Internal	Default / VLAN 1
Trusted Zone	Home / VLAN 2
Untrusted Zone	Camera / VLAN 3; IOT Network / VLAN 4
Hotspot	Guest Network / VLAN 5
Gateway	No user network assigned
External	Internet 1 and Internet 2
Vpn	No network assigned
Dmz	No network assigned

Policy inventory

The controller reports 148 firewall policies. This page records the high-level read-only API result and selected named policies observed at the start of the policy list; it is not a replacement for the UniFi policy editor.

Observed named rules include:

• t14 — allow rule using a MAC address list within Internal.
• streamer — block rule from Internal to External.
• NPMPlus — block rule from Internal to External.
• NMPLUSAllow (Return) — derived established/related return rule.
• Block Invalid Traffic — system rule from Internal to External.
• allow again — selected MAC addresses allowed to Gateway.
• Block Traffic from 192.168.1.221 to 192.168.1.1 — host-specific block to the gateway.
• Block Traffic from 192.168.1.221 — host-specific block to the gateway.
• allow devices — selected MAC addresses allowed to Gateway.
• Proxmox access — currently disabled.
• Allow mDNS — system mDNS allowance.
• allow homeassistant — selected devices allowed to the Untrusted Zone.
• Allow Port Forward dns — system port-forward allowance to 192.168.1.117 on ports 80/443.

Review notes

• Camera and IoT networks are grouped in the Untrusted Zone.
• The default/system policy set contains broad terminal “Allow All Traffic” rules between some zone pairs; review ordering and intent before relying on isolation.
• The API exposed policy definitions but not a complete human-friendly rule matrix in one response; use the UniFi dashboard for full ordering and per-rule detail.
• No firewall changes were made during this documentation run.