unifi-firewall
Use when working on UniFi firewall rules, zones, or network segmentation: "my firewall rules are empty", "rest/firewallrule returns nothing", "isolate my IoT devices", "block cameras from the internet", "create a firewall zone", "VLAN isolation", "zone-based firewall", "my IoT devices lost DNS after I segmented them", or auditing what a zone actually permits. Covers the zone-based firewall model, where policies live, the block-by-default trap on new zones, and lockout safety. Assumes unifi-connect. Not for assigning devices to VLANs or switch ports (unifi-clients), Wi-Fi and SSID-to-network ma
Profile →npx skills add t3chnaztea/unifi-skills --skill unifi-firewall --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# UniFi Firewall Modern UniFi Network replaced the old LAN-IN / LAN-LOCAL / WAN-IN rule groups with a **zone-based firewall**. Every network belongs to a zone, and policies govern traffic between zone pairs rather than between interfaces. This is a better model and a worse migration, because the old API endpoint still exists and still answers. ## Why your firewall rules look empty ```bash udm raw GET /proxy/network/api/s/default/rest/firewallrule # [] ``` An empty array. The endpoint is alive, authenticated, and lying by omission: on a zone-based controller your rules are not there. They are here: ```bash udm policies # GET /proxy/network/v2/api/site/default/firewall-policies udm zones # GET /proxy/network/v2/api/site/default/firewall/zone ``` An agent that reads `rest/firewallrule`, sees `[]`, and concludes the network is unfirewalled will confidently propose rebuilding rules that already exist. If a gateway reports zero firewall rules and it is clearly not wide open, you are on the wrong endpoint. **The zone endpoint is singular.** `/firewall/zone` works, `/firewall/zones` 404s. There is no reason for this; just remember it. ## The trap: new zones default to BLOCK against Interna
- Why your firewall rules look empty
- The trap: new zones default to BLOCK against Internal
- A worked segmentation: IoT and cameras
- Writing policies
- Lockout safety
udm raw GET /proxy/network/api/s/default/rest/firewallrule
udm policies # GET /proxy/network/v2/api/site/default/firewall-policies
udm zones # GET /proxy/network/v2/api/site/default/firewall/zone
udm policies --json | python3 -c '
import json,sys
for p in json.load(sys.stdin):
Create
udm policies create '{...}'
udm policies update <POLICY_ID> '{...full object...}'
udm policies delete <POLICY_ID>What does the unifi-firewall skill do?
Use when working on UniFi firewall rules, zones, or network segmentation: "my firewall rules are empty", "rest/firewallrule returns nothing", "isolate my IoT devices", "block cameras from the internet", "create a firewall zone", "VLAN isolation", "zone-based firewall", "my IoT devices lost DNS after I segmented them", or auditing what a zone actually permits. Covers the zone-based firewall model, where policies live, the block-by-default trap on new zones, and lockout safety. Assumes unifi-connect. Not for assigning devices to VLANs or switch ports (unifi-clients), Wi-Fi and SSID-to-network ma
How do I install it?
Run `npx skills add t3chnaztea/unifi-skills --skill unifi-firewall --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From t3chnaztea/unifi-skills, a repository with 24 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.