UniFi Security Operations

API mode requirements:

• Zone-based firewall, firewall rules/zones/groups: local only
• ACLs, traffic matching lists: local only (the console's integration API)
• Port forwarding, VPN: local only

Roles: with bearer tokens, creating or updating firewall policies, ZBF policies, legacy firewall rules and network-to-zone assignments needs the admin role. The operator role can still manage ACL rules, port forwards, groups, zones and traffic matching lists.

Traditional Firewall Rules

Firewall Groups

Groups are reusable IP/port sets referenced by rules.

Zone-Based Firewall (requires Network 9.0+, local API)

Zones

ZBF Policies

ZBF Matrix

ACL Rules (local API)

Port Forwarding

VPN

Content Filtering

Example Workflows

# Audit firewall posture
Get ZBF matrix to see all zone-to-zone policies, then list firewall policies
for zones with "allow all" rules

# Block a new threat IP
Create address group "Blocked-IPs", add the malicious IP, then create a
firewall rule to drop traffic from that group

# Set up IoT isolation
Create zone "IoT", assign IoT VLAN to it, then create ZBF policy blocking
IoT → LAN (action: drop) but allowing IoT → WAN (action: allow)

# Expose a home server
Create port forward: external port 443 → 192.168.1.50:443 (tcp)