UniFi Firewall

Modern UniFi Network replaced the old LAN-IN / LAN-LOCAL / WAN-IN rule groups with a zone-based firewall. Every network belongs to a zone, and policies govern traffic between zone pairs rather than between interfaces. This is a better model and a worse migration, because the old API endpoint still exists and still answers.

Why your firewall rules look empty

udm raw GET /proxy/network/api/s/default/rest/firewallrule
# []

An empty array. The endpoint is alive, authenticated, and lying by omission: on a zone-based controller your rules are not there. They are here:

udm policies    # GET /proxy/network/v2/api/site/default/firewall-policies
udm zones       # GET /proxy/network/v2/api/site/default/firewall/zone

An agent that reads rest/firewallrule, sees [], and concludes the network is unfirewalled will confidently propose rebuilding rules that already exist. If a gateway reports zero firewall rules and it is clearly not wide open, you are on the wrong endpoint.

The zone endpoint is singular. /firewall/zone works, /firewall/zones 404s. There is no reason for this; just remember it.

The trap: new zones default to BLOCK against Internal

The single most expensive thing to learn the hard way.

Creating a new custom zone auto-generates default policies, and the Internal↔zone pair defaults to BLOCK in both directions. External and Gateway pairs default to allow, and custom→External allows, so the new zone reaches the internet fine. What it loses, instantly and completely, is the trusted LAN: DNS resolvers, the media server, the home-automation hub, the NAS.