UNIFI FIREWALL RULES EXPLAINED

Let's talk about the UniFi firewall rules and how to use them.
Get your UniFi UDM Here (affiliate link): amzn.to/2VcDAio
Consulting/Contact/Newsletter: www.williehowe.com
Affiliate Links:
My AmazonLink: www.amazon.com/shop/williehowe
Patreon: / williehowe
IP Video Talk 10% off: refprg.co/idn8mh8
Private Internet Access: www.privateinternetaccess.com...
Netool: netool.io use code WILLIEHOWE to save at least 10%!
Digital Ocean Referral Link: m.do.co/c/39aaf717223f
Contact us for network consulting and best practices deployment today! We support all Grandstream, DrayTek, Obihai, Poly, Ubiquiti, MikroTik, Extreme, Palo Alto, and more!
Come back for the next video!
Twitter - @WillieHowe
Instagram - @howex5
SUBSCRIBE! THUMBS-UP! Comment and Share!

[@markpuls7]

Much appreciated, this is where I need the most focus with my new equipment- IoT, privileged and guest network sharing things like my printer:) keep up the great work!

[@905jay]

Excellently done. Thank you

[@asdf51501]

Good content. Thanks for posting.

[@nathanbatchelder180]

Love your videos

[@AnotherCupofTea2]

Classic quote alert, "It's not magic, it's firewall rules" 😊👍. Thanks Willie!

[@BarryArendt]

Anohter excellent video.

[@dyarmzere3469]

Thanks for the video, be careful with the candle you are holding.

[@dpresson]

Great instructional video, as usual :) Can you elaborate on the concept of blocking certain websites, or is that even possible?

[@offlimits4622]

Nice closet!

[@mikemckenna4816]

Willie, thanks for the video. I've been spinning my wheels for 4 nights trying to figure out how to allow Ping/ICMP reply from my IoT network.

[@rijckholt1]

Hi Willie, Thanks for your video. I tried to replicate this with "Guest Network" to LAN (instead of between to corporate networks) and then this all seems to work differently ;-) as the Guest network are much more restricted. Can you please explain how to make this work or do video on that? Real world example: Let a guest user use the printer on the LAN....

[@stephanedelaval6525]

Good 👍 Quick question. Does Established applies to TCP and Related to UDP ? Since UDP does not establish a session, the return of packet to LAN is not allowed by the Establish rule. So I suppose it is done by the Related. Am I wrong ?

[@mvboynton]

What about VPN Tunnel (Site-to-Site VPN), they don't show up as an available network. Trying to only allow access to one single IP via Tunnel

[@juesch23]

Could you made one day a short vid how to build a firewall rule on an edge router 4 to allow automatic letsencrypt renewals to a Synology without showings ER4 Admin Interface to the public world as soon I open port 80 and 443 on it? I am somehow lost

[@RichardSmith-ik5rp]

do you have any experience with UDMP and having sonos work on an ioT network?

[@MactelecomNetworks]

Great video Willie. Hows the Mikrotik ap? Been looking for other gear to test out

[@MactelecomNetworks]

Willie Howe I’ll have to take a look

[@bandorodimas1965]

have you try connect mikrotik to lan ?

[@peterkulka470]

Do you have video about how to block multiple IPs on WAN In and WAN OUT. I like to create rule to block on Incoming and outgoing on WAN to block around 34 IPs. Can you please help?

[@cacososa]

Hi Willi. In my USG, everytime I make a firewall rule change, the device provisions. is this normal? I see in you video the changes apply immediately

[@twf-fpv9388]

Hi, is there a way to block wifi calling on a UDM Pro. I hope so.

[@TheRealAnthony_real]

So I run a controller on my Lan on a VM ... And I'm hosting 3 sites ... 2 of them in another country and 1 the Lan ;) The problem is I can't make the other sites see my controller due to the firewall .. I have recently moved from edge to usg pro (rack mounted). If I try wan local I can ping, ssh, web no probs .. However it seems that the port forwarding doesn't work .. or any other wan in towards my internal Lan controller up/port .. I've set groups of ip's and ports still no luck .. So I had to allow all traffic ultimately and I'm running an untangle in bridge behind the usg which I eventually like to delete at some point ..

[@justinjarrett4816]

Rule 2000 under GUEST IN, inbound on guest interface but source of LAN and destination of MikroTik? That's not right, right? Inbound on guest interface is all going to be source guest traffic. To allow or block LAN to guest traffic using guest rules it would need to be outbound direction on guest interface, right?

[@thegamerfour9508]

I'm trying to allow my Guest network clients to my LAN printer. On GUEST IN I permitting my Guest Network to my printer on the LAN network, but I cannot ping the printer from the Guest network. There is a LAN IN rule to permit all Established and Related traffic. Any suggestions?

[@RhodecErickson]

Hi Willie, Thanks for another great video. Clarifying question: To allow VoIP signaling traffic from a provider to a pbx a WAN IN firewall rule should be created to Allow all packets from an IP address group (Providers IP addresses) on a port group (5060,5061, etc) to an IP address group (Free PBX) on the same port group. I had this configuration in place for over a year on the USG4 and the UDM Pro but when the provider's IP address' changed and I rebuilt the rule traffic no longer passed though the firewall. To remedy the issue I setup port forward rules on the UDM Pro and that resolved the. problem. Have you experienced any similar issues in recent versions of UniFi? Thanks, -Rhodec

[@Zeric1]

To allow unsolicited traffic on a gateway using NAT, one should put in a port forwarding rule, that is the normal way to do it, which will show up as an un-editable rule on the WAN IN list. One would not normally be adding rules to allow unsolicited traffic from the WAN IN page unless NAT has been disabled through CLI or a json file (few people do this).

[@richardperritt]

So I'm only just under 2 minutes in and I want to clear something up. This video is just about UniFi Firewall Rules and nothing else, correct? 🤣😁👍 (Ya I'll see myself out)

[@mydevices768]

Well, that is the title

[@siiNke]

A bit confusing.. i would only like to know how to block certain websites from access in other country.. Cant do GEO filtering since they are not hosted in that country but in USA. Cant block USA else nothing will work...

[@Jerryhze0129]

Why are the "allow ICMP to and from MikroTik" rules not under "LAN_IN"? I thought your computer is under the corporate LAN, so anything your computer sends out (ICMP pings) should hit "LAN_IN" instead of "GUEST_IN"?

[@DavidCNavas]

Yeah, I admit to similar confusion. I understand why computer -> mikrotik is GUEST_IN, but I'm confused why the response hole didn't need to be in GUEST_OUT. I guess this is a definition of "interface" confusion? I think of the packets as originating from GUEST and entering LAN, but that's because I have a picture of a couple of clouds in my head talking to each other. Is the reality more hardware based? The Mikrotik isn't provisioned on vlan 22, the port it's connected to is, so the traffic from the Mikrotik is considered as "entering" GUEST. Does this change if we associate the SSID of the AP to vlan.22? If so, do we then need to punch the hole in GUEST_OUT?

[@alexclausendk]

@@WillieHowe could you put the ICMP reply rule mikrotik -> LAN in guest out?

[@DavidCNavas]

@@alexclausendk My suspicion is 'no' as the traffic is blocked on "IN". Traffic isn't treated as allowed "in" or blocked "out" of a vlan -- that's not what the in/out means. Rather there are a set of rules that are run on signal entry and on exit from the interface. If the traffic is blocked on entry, you need to make a hole on that side. I suspect most rules are run on the IN side -- filter early! Guess on my part, though -- hopefully a guess is better than a non-response.... :|

[@Zeric1]

@@DavidCNavas Correct, traffic from Guest is blocked at "GUEST IN" for anything other than the internet. The majority of rules one will need are going to be in "LAN IN" and maybe a couple in "GUEST IN". I have several subnets and quite a few rules and none are in "LAN OUT" or "GUEST OUT". I have one in "WAN IN" and one in "LAN LOCAL" but most would not have any there either.

[@Zeric1]

@@alexclausendk No, "guest out" is for making decisions on packets that have entered the router and are on their way out, but the blocking occurred on the way "in" to the router so that's where the exception is needed. It's rare that any rules will be needed in LAN/GUEST OUT or LOCAL. Most rules will be in "LAN IN" and occasionally "GUEST IN".

[@honestsniping1]

I don't know if Unify was actually that stupid to change these things, or if it was explained incorrectly in this video.... I had to do the opposite with the IN and OUT rules. With my GuestIN rule I had to define the ping target device (MikroTik) as source and the LAN network as destination (vice versa with the GuestOUT rule). Can someone explain me when and why this was changed!?!? On their website, they even state the following for their IN Rules: Applies to traffic that is entering the interface (ingress), destined FOR OTHER NETWORKS

[@randomwandererFrosty]

Appreciated. Don't bounce the cursor around nor "rapidly circle" it around what you're referencing.

[@deedubbs4412]

They need to hire someone who knows how to develop software, this is godawful combing through here trying to perform a basic task like block ICMP

[@deedubbs4412]

Could have saved me 2 hours if they would either update their tutorials or stop updating their bloody software.

[@uendarkarplips7263]

What a horrible firewall rule design. I’ll keep my fortigates.

[@RK-ly5qj]

This is a great example why ubi *ucks in FW world, and also how its shouldnt be done xD Its a nighmare who has developed it.. Even today it hasnt changed much.