Firewall & Access Policy
Read-only summary of UniFi firewall zones and policy observations.

Firewall and Access Policy Summary
Firewall & Access Policy
Zones
UniFi reports 8 zones:
Zone
Networks
Internal
Default / VLAN 1
Trusted Zone
Home / VLAN 2
Untrusted Zone
Camera / VLAN 3; IOT Network / VLAN 4
Hotspot
Guest Network / VLAN 5
Gateway
No user network assigned
External
Internet 1 and Internet 2
Vpn
No network assigned
Dmz
No network assigned
Policy inventory
The controller reports 148 firewall policies. This page records the high-level read-only API result and selected named policies observed at the start of the policy list; it is not a replacement for the UniFi policy editor.
Observed named rules include:
t14 — allow rule using a MAC address list within Internal.
streamer — block rule from Internal to External.
NPMPlus — block rule from Internal to External.
NMPLUSAllow (Return) — derived established/related return rule.
Block Invalid Traffic — system rule from Internal to External.
allow again — selected MAC addresses allowed to Gateway.
Block Traffic from 192.168.1.221 to 192.168.1.1 — host-specific block to the gateway.
Block Traffic from 192.168.1.221 — host-specific block to the gateway.
allow devices — selected MAC addresses allowed to Gateway.
Proxmox access — currently disabled.
Allow mDNS — system mDNS allowance.
allow homeassistant — selected devices allowed to the Untrusted Zone.
Allow Port Forward dns — system port-forward allowance to 192.168.1.117 on ports 80/443.
Review notes
Camera and IoT networks are grouped in the Untrusted Zone.
The default/system policy set contains broad terminal “Allow All Traffic” rules between some zone pairs; review ordering and intent before relying on isolation.
The API exposed policy definitions but not a complete human-friendly rule matrix in one response; use the UniFi dashboard for full ordering and per-rule detail.
No firewall changes were made during this documentation run.