Ubiquiti UniFi ZBF - New Zone or New Policy??? 1 of 2 (Zone Based Firewall)

[@REJ509]

I’m so new to this, and it’s all so overwhelming. You explained it in a way that’s much clearer and easier to understand than any of the videos I’ve watched so far. Thank you so much 🙏

[@paulrobinson6297]

Great video, looking forward to part 2

[@nodd85]

Just when I thought I knew it all pertaining to the new zone base firewall, I learned something new. Thank you for all the hard work you put into your videos.

[@TheRealSydneyLi]

This was exactly what I needed to know. I'm looking forward to the next video. Thanks!

[@jj358mhz]

Great videos, I have yet to watch them all thoroughly, but I plan to. Can you consider a ZBF setup video for self-hosted DNS servers on the Regular (Default) network?

[@hz777]

Such as pi-hole? In my channel I already had a video about how to setup firewall rules for pi-hole to support multiple VLANs. Even though that video is not for ZBF, the similar steps should apply to ZBF. If you already watched that video but still think a dedicated ZBF+pi-hole video is needed, please let me know.

[@jj358mhz]

@@hz777 Thank you for the quick reply. I will watch it first and will let you know how it goes. Thanks!

Very clear! Thank you so much, finally I ended understanding these zones.

[@jonnyzeeee]

Thanks for putting together another fantastic lesson. I really liked the way you explained the zone approach. Good point about the block all from new zone to itself only applying to inter VLAN. That was not obvious to me. Device isolation for the IoT network via ACL is an interesting one. Many IoT devices need to communicate with each other. (Phones, plex client, Sonos, etc.)

[@hz777]

Agree with you comment about IoT. Maybe what I described should be more properly called as "suspicious IoT" :)

[@jonnyzeeee]

Perhaps I need 2 separate virtual networks: IoT and IoT_untrusted, then use device isolation on the latter. Now in terms of cameras I don't distinguish. All have no internet access, except to sync time. I was under the impression Protect camera updates are done from the controller, so general internet access not required.

[@hz777]

You are right about protect cameras' internet access as well

[@OHM-fy5zf]

Great video! Explains exactly (one half of) what I'd like to know. I'm looking forward to the second video! One thing I'd still like to know though: Don't you restrict gateway access from untrusted VLANs to necessary ports? (Or at least block ports 22, 80, 443?) I guess the effort to achieve this might be different for both concepts of video 1of2 and 2o2 and therefore worth to be compared as well? I'm looking foreward to video 2of2!

[@NoCPU]

Another fantastic video 👍

[@weholmes5315]

Perfect! I've been holding off switching to zone based firewall as it was a lot of work to get my firewall my rules working correctly and I was worried about issues like this. I'll await upcoming videos 😅

[@jj358mhz]

How did you setup all those Terminal windows on their own networks, that's pretty cool.

[@hz777]

It's not the first time I was asked the same question. I will be working on a video about the same

[@sobih25]

Thanks for your job there! Waiting for part 2.

[@BMXNijkerk]

First of all... a great video. Especially the real world setups. A lot of other youtubers only glace at a high level. This really helps since I am fairly new to the unifi rules. And just when I setup some old ones, the zbf was introduced. Therefore some questions: How would the setup look like when protect is inside a UDM? When you don't own a UNVR? Do you need to setup rules to the gateway? Which? Could you also elaborate in a new video how to 'migrate' from old policies to new? How can you evaluate which rules to delete or replace with ? I've rules for allowing established and related trafiic. And to block non valid trafic. Allow DNS, etc. I am thinking about deleting al the old policies and start from scratch. Because also some old polcies can interfere with the new zbf ones? And does the new zbf also handle the correct order of policies? Does it also know which rules to put on top? Or is that something you always need to check yourself?

[@hz777]

Regarding using UDM for protect, you can take a look at the standard policies from internal to gateway and hotspot to gateway, and modify them to meet your need. Regarding a video for migration, I am afraid that's impossible because every user has their own requirements. Personally, I would start from scratch because I have never trusted the migration tools, no matter from which vendors. Regarding the order of policies, the ZBF has no magic to understand the business logic behind the policies, so you still need to check the order to make sure it makes sense once a new policy is created.

[@gp5173]

Great video as always. Couple of questions: 1 - With your protect VLAN is that assuming that you are running a separate Protect NVR instead of built into UDM Pro etc ? Reason I ask is that Protect NVR doesn’t appear to do well when adding cameras across VLANs (for example ONVIF cams) so was wondering the topology for Protect in this case. 2 - Understand you’re point about trusting Protect cams but wondering why you would not just want to block cameras outbound to Internet, period since there is always a risk of those feeds being exposed like they are with non UI cams. Don’t get me wrong, we all know that ‘other’ cams (even pro security cams) like to phone home but was just interested regarding your decision there. I generally choose to block all here. 3 - When running a UI infrastructure is there a preferred method you have / recommend for handling NTP locally since a number of devices you may want to block from Internet, still have an NTP requirement ? In this same question, is there a way to intercept and redirect NTP requests from a device and force them to use a different NTP server of your choosing (may be your own etc) ? 4 - The only issue I see with the Unsafe NW device isolation is then the cams cannot talk to an NVR on same Unsafe network for recording capabilities. Therefore what is the best way to have cams isolated from each other BUT allow access to an NVR in same VLAN ? Fantastic video and great timing since UI have not done a great job on demonstrating Zone Based firewalls. More a case that they released the feature and left users to figure it out themselves. Thanks as always.

[@hz777]

All great questions and all are pointining to some weak points of this video :D A1) I run my UNVR Pro with two cables to a protect vlan and a non-protect vlan. I understand it's tricky to use two ports at the same time for an UNVR, but it does resolve the problems of connecting to non-protect cameras. A2) I agree protect cameras do not need internet either, but still choose to enable it in the video just to make it more "different" than the non-protect vlan. I will clarify this in my coming video. A3)Have you tried NAT? A4) It was already pointed out by another viewer in the comments. To save time, I may over-simplified that vlan. you are right.

[@ufomism]

Excellent explanation, thanks going to set mine up now

[@SY1337]

for the unsafe vlan, you could have enabled 'Isolate Network' in vlan 70 network settings. This will automatically create new firewall rules that block traffic to other zones.

[@AlexSpring-Connell]

Excellent video! Does the block all rule block multicast traffic as well? For streaming to iot, you’d want to allow that.

[@hz777]

Yes, but that type of detailed requirement has to be addressed case by case.

[@OHM-fy5zf]

@@hz777 Oh yes, please do a video on that, too. In particular I see a difference between actual AppleTV vs Android based SmartTVs (Samsung and Hisense) as AirPLay targets. I had no issue to stream (audio/video) from Apple devices on my client-VLAN to an AppleTV on my IoT-VLAN. But in the same setting it did not work to any SmartTV. For SmarTVs I had to fiddle around with additional firewall exceptions I still don't understand.

[@thisperson1654]

One problem with ACL. It will not work on Layer2 switches. For example two devices connected to USW-Flex-Mini will see each-other. And for wifi connected devices there is option Client Device Isolation. But there is warning with list of unsupported switches when you enable ACL.

[@hz777]

In fact ACL does not require L3 switches. The switches listed as exceptions by Ubiquiti to support device isolation are all due to the fact that they are cheap so not powerful enough to support ACL. For those switches, if device isolation is required for a VLAN, my suggestion is to exclude that VLAN in the uplink port.

[@jellevanburen9427]

Is it possible you explain port forwarding with this new setup? I made a new policy which granted access from external 'any' on ports 80 & 443, to an internal ip on those ports, but nothing worked. Ports stayed closed. (Portchecker from mobile phone on cellular network). Even with an any-any rule from external to internal the external ports stayed closed. Only when I made a policy from external to gateway the ports opened up. Which seems strange. Shouldn't the original policy from external to internal fix that?

[@hz777]

Yes I am going to make a video about it. I believe Ubiquiti has a bug here to support Port Forwarding in ZBF. [EDIT] I treid what you described and could reproduce the issue. However, after I looked into the backend config but could not figure out what's wrong, I could not reproduce your issue again: even after I deleted the custom policy from External to Gateway, the Port Forwarding still works. I don't know what happened, but the previous mentioned "bug" does not exist for me anymore... Do you still have the issue even after deleting your new policy for port forwarding from external to gateway? If so that's strange... But anyway I am going to make a video behind it, because I realize the backend NAT and filters are interesting to talk about. But when it comes to the new ZBF or old way, there is no backend difference.

[@1stGruhn]

For the non-unifi cameras in the unsafe zone, if your NVR was something other than the gateway, you'd need to create ACL rules to allow traffic from the unsafe devices to the MAC of the NVR, correct?

[@hz777]

You are absolutely right. In the interest of time, this video is just to convey some ideas. The settings are over-simplified, and need to be modified to be adopted.

[@1stGruhn]

@@hz777 yeah, I've been playing around with a new client's setup before we install it onsite. I often create a port group (now called network object) then rule blocking ports 22, 80, and 443 on the gateway from the vlans I don't want to have access to the login portal or to SSH into it. I have mixed feelings with new setup. One the one hand, it is easier to wade through all the rules since you can target the specific zones you want to change and the direction of traffic. But you have to create so many more rules than before... Which is a bit annoying, se la vi.

[@demomanca]

I haven't tested this yet, but does the auto enable return traffic rule do an allow all, or allow related/established?

[@hz777]

The latter.

[@Fatal_Error-h4c]

How do you get all the terminal windows open on the different networks like that

[@hz777]

VM. Proxmox.

[@jmobsnxgen]

I've configured firewall rules to restrict access to the web interface ie 192.168.1.1, but I can still access it from any VLAN, even though I have Block inter-VLAN rule in place. Could you explain how to correctly block web interface access from all VLANs except the admin VLAN?

[@hz777]

When you say "web interface", do you mean your local unifi network controller, or internet? If former, where did you maintain the rule? it should be from default network to gateway.

[@jmobsnxgen]

@@hz777 i meat the defulte gatway for each subnet ie the 4 vlans i have they each have 192.168.1.1 ,iot vlan has 192.168.2.1, guest, has 192.168.3.1 issues iam having from each of this vlans i can access this IPs though ping and https but only this this IPs everything else works ok ie i can't ping them as expected