Firewall rules control exactly what traffic is allowed to pass between networks, out to the internet, or in from it. Getting the order and specificity right matters as much as the rule itself.

Steps

1. Open the UniFi Network application and go to Settings > Firewall & Security.
2. Click Create Entry (or, on the zone-based firewall, select the source and destination zones first, then add a rule to that zone pair).
3. Choose the rule type — common options include LAN In, LAN Out, or a zone-based rule between specific networks/VLANs.
4. Define the Source (a network, VLAN, IP address, or IP group) and the Destination the same way.
5. Set the Action — Accept, Drop, or Reject — and optionally restrict it to a specific port or protocol.
6. Save the rule, then test the traffic it's meant to affect before assuming it's working correctly.

Common Questions

What order do rules apply in?

Rules are evaluated top to bottom, and the first matching rule wins — a broad "allow all" rule placed above a more specific "block" rule will prevent the block from ever taking effect, so put your most specific rules first.

How do I avoid locking myself out while testing?

Keep a rule allowing management access from your current network above anything you're testing, and consider testing new restrictive rules from a wired connection rather than Wi-Fi, so a mistake doesn't also cut off the access point delivering your connection.