Configuring UniFi Firewall Rules to Secure Your Network (Complete Guide)

[@FatherJoeMcCorny]

Finally understood when LAN Out is being used!!! 🎉🎉🎉 Thank you Frank ❤️

[@TechMeOut5]

WOW that's by far the best unifi firewall video to date! amazing job Frank! I especially liked how you make everything so easy to understand like the lan in, out and local which are always a bit tricky to understand if you are new to unifi firewalls

[@WunderTechTutorials]

Thanks, Avi! Appreciate you watching!

[@Huberdoggy]

easily the best explanation to date regarding edge cases for LAN OUT, why it’s the only effective solution for blocking Wireguard to Vlans, etc. These videos are gold. I’ve had my server rack running since August and some things you dive into I’d have realized quicker if these vids had been available (i.e, Unfi’s terminology for setting a port to access and restricting all other Vlans on that port)

[@WunderTechTutorials]

Thank you very much! Appreciate the kind words!

[@Justintime631]

Another great video. Thanks for the information, much appreciated 👍🏻

[@gswhite]

Excellent video and very well explained. Thanks

[@Zedris]

this is a really cool concept firewalls using unifi. i think a really great video idea would also be an explanation of saffing portmaster software for windows especially when it comes to the selfhosting angle. what needs to be allowed what doesn't how to block requests not needed etc. along with your videos of firewall unifi, adguard dns a portmaster windows explainer video firewall would give great coverage overall.

[@quinntunharris]

Thanks that was well needed we just moved from a meraki to unfi network and was having issues with blocking my vpn to access the unwanted part of the network

[@michaelpier5272]

Would I be correct to say I can use an Internet out rule to allow site to site VPN traffic to access mobile fleet L2TP? E.G. Internet out -> allow/accept -> Protocol= UDP -> Source : Type= IP Address -> IPv4= Static WAN address for UDM SE (configured on site to site) -> Destination: type= IP Address -> IPv4= Mobile unit VPN connection (L2TP). Edit: Using Unifi hosted VPN servers.

[@kevinoconnor6570]

Thanks for a very clear and well explained video. In the Internet In traffic rule section did you actually need the DROP RDP rule? I only ask this as there is a BLOCK rule further on down Block All Other Traffic that appears to be doing the same thing.

[@WunderTechTutorials]

Thanks! I have to check the order later, but from what I remember, those are the default rules Ubiquiti applies - meaning the port forward created a default "allow" rule for the whole world, and without the deny rule I created, that would be the next rule to apply, so everyone in the world would be able to access it before the other ports get blocked.

[@WunderTechTutorials]

Yes, that's why. The "Allow Port Forward" rule is above the "Block All Other Traffic" rule, so the "DROP RDP" rule blocks all the traffic before it can get to that. If you were doing this for real (I just did this as a demo for the firewall), you'd limit the actual traffic down on the port forwarding rule (if it was only one IP like this example).

[@gernermajlandt]

thanks for a really good video

[@WunderTechTutorials]

Thank you very much!

[@ryanbuster4626]

@wundertech wouldn't it just be easier to call LAN local traffic - WAN facing traffic? Its destined for WAN? Or am I missing something? Not too familiar with Unifi.

[@WunderTechTutorials]

Not exactly. It's traffic that originates from a LAN device, trying to get to something running on the UniFi firewall. Like a DNS server, or VPN server, etc

[@ryanbuster4626]

@@WunderTechTutorials Ahh gotcha

[@MacGyver0]

I like to add a rule to drop all lan-lan communication and add specific allow rules above.

[@homenlok]

Funny enough, after I clicked the box to isolate a vlan, it blocks traffic from both directions.

[@WunderTechTutorials]

That's very strange. Any other firewall rules added?

[@homenlok]

​@@WunderTechTutorials nope, just the one block traffic from iot to other networks. I had to put an any established and related above in order to connect to my nas, which is in iot network.

[@PhElias]

its missing IPv6 :(

[@WunderTechTutorials]

Same principals apply, just different IPs!

[@ArturFronczekPL]

IPv6 was future, is future and will be future ;-)

[@ArturFronczekPL]

Why you're saying "Unifi doesnt block by default"? How about rule "Block all other traffic"? Rule 20001 seems to be redundant to rule with ID "Final rule for this type"...

[@WunderTechTutorials]

With a default setup, all traffic is allowed and must be narrowed down (blocked).

[@ArturFronczekPL]

@@WunderTechTutorials Rule 6 from top in 19:00 of video: "Block All Other Traffic"... Drop | Internet In | from Any/Any | to Any/Any. Or you refer "all traffic" to "LAN only" traffic? Or am I missing something?

[@WunderTechTutorials]

Sorry, I thought you meant on the LAN. For the Internet (Internet in), all traffic is blocked by default and allowed in through port forwarding.