Learn how to configure zone-based firewall policies on the UniFi UCG Ultra — isolate VLANs, block unwanted traffic, and secure your network.
The UniFi Cloud Gateway Ultra runs a zone-based firewall — Internal, External, Guest, VPN, and Hotspot zones, each with policies controlling what traffic can pass between them. The defaults cover the basics, but most home and small-office setups need a few extra policies to actually lock things down. Here’s a practical starting point using the current Policy Engine.
1. Isolate your IoT devices from your main network
If your IoT devices — smart plugs, cameras, cheap Wi-Fi bulbs — sit in the same zone as your laptops and phones, one compromised device can see everything else on the network. Go to Policy Engine → Create New Policy and set:
- Src. Zone: IoT
- Dst. Zone: Internal
- Action: Block
- Protocol: All
UniFi evaluates policies top-down for matching zone pairs, so place this above any broader “allow” policy covering the same zones.
2. Block guest network from reaching internal devices
Don’t rely on the Guest Network’s built-in isolation toggle alone. Add an explicit policy:
- Src. Zone: Guest
- Dst. Zone: Internal
- Action: Block
Check your existing default policies first (things like “Block Intervlan routing” already cover some RFC 1918 pairings) — you may only need to add a policy for a zone combination that isn’t already handled.
3. Restrict management access to your gateway
Anyone who can reach your UCG Ultra’s login page from inside the network is one weak password away from full control. Create two policies:
- Dst. Zone: Gateway, Source: your trusted admin device/subnet, Action: Allow
- Dst. Zone: Gateway, Source: Any, Action: Block (placed below the Allow rule)
4. Geo-IP blocking for inbound traffic
If you’ve forwarded any ports (a security camera NVR, a home server), go to CyberSecure → Geo IP Filtering and restrict inbound connections to the countries you actually expect traffic from. This alone stops a huge share of automated scanning.
5. Log before you block
When testing a new policy, set its logging option on before switching the Action to Block. Check the traffic logs under CyberSecure → Insights for a day to confirm it’s catching what you expect, then commit to Block once you’re confident.
A word of caution: always test policy changes from a wired connection if possible, and keep a way back in — like local console access — before tightening anything affecting the Gateway zone. It’s easy to lock yourself out of your own UCG Ultra.