unifi-firewall

# UniFi Firewall Modern UniFi Network replaced the old LAN-IN / LAN-LOCAL / WAN-IN rule groups with a **zone-based firewall**. Every network belongs to a zone, and policies govern traffic between zone pairs rather than between interfaces. This is a better model and a worse migration, because the old API endpoint still exists and still answers. ## Why your firewall rules look empty ```bash udm raw GET /proxy/network/api/s/default/rest/firewallrule # [] ``` An empty array. The endpoint is alive, authenticated, and lying by omission: on a zone-based controller your rules are not there. They are here: ```bash udm policies # GET /proxy/network/v2/api/site/default/firewall-policies udm zones # GET /proxy/network/v2/api/site/default/firewall/zone ``` An agent that reads `rest/firewallrule`, sees `[]`, and concludes the network is unfirewalled will confidently propose rebuilding rules that already exist. If a gateway reports zero firewall rules and it is clearly not wide open, you are on the wrong endpoint. **The zone endpoint is singular.** `/firewall/zone` works, `/firewall/zones` 404s. There is no reason for this; just remember it. ## The trap: new zones default to BLOCK against Internal The single most expensive thing to learn the hard way. **Creating a new custom zone auto-generates default policies, and the Internal↔zone pair defaults to BLOCK in both directions.** External and Gateway pairs default to allow, and custom→External allows, so the new zone reache...