# Firewall and Access Policy Summary

# Firewall & Access Policy

## Zones

UniFi reports 8 zones:

| Zone | Networks |
|---|---|
| Internal | Default / VLAN 1 |
| Trusted Zone | Home / VLAN 2 |
| Untrusted Zone | Camera / VLAN 3; IOT Network / VLAN 4 |
| Hotspot | Guest Network / VLAN 5 |
| Gateway | No user network assigned |
| External | Internet 1 and Internet 2 |
| Vpn | No network assigned |
| Dmz | No network assigned |

## Policy inventory

The controller reports **148 firewall policies**. This page records the high-level read-only API result and selected named policies observed at the start of the policy list; it is not a replacement for the UniFi policy editor.

Observed named rules include:

- **t14** — allow rule using a MAC address list within Internal.
- **streamer** — block rule from Internal to External.
- **NPMPlus** — block rule from Internal to External.
- **NMPLUSAllow (Return)** — derived established/related return rule.
- **Block Invalid Traffic** — system rule from Internal to External.
- **allow again** — selected MAC addresses allowed to Gateway.
- **Block Traffic from 192.168.1.221 to 192.168.1.1** — host-specific block to the gateway.
- **Block Traffic from 192.168.1.221** — host-specific block to the gateway.
- **allow devices** — selected MAC addresses allowed to Gateway.
- **Proxmox access** — currently disabled.
- **Allow mDNS** — system mDNS allowance.
- **allow homeassistant** — selected devices allowed to the Untrusted Zone.
- **Allow Port Forward dns** — system port-forward allowance to 192.168.1.117 on ports 80/443.

## Review notes

- Camera and IoT networks are grouped in the Untrusted Zone.
- The default/system policy set contains broad terminal “Allow All Traffic” rules between some zone pairs; review ordering and intent before relying on isolation.
- The API exposed policy definitions but not a complete human-friendly rule matrix in one response; use the UniFi dashboard for full ordering and per-rule detail.
- No firewall changes were made during this documentation run.