What does the UniFi firewall block by default?

What does the Ubiquiti UniFi firewall block by default? More than you think. Unsolicited packets won't get in. By default it will only allow responses in from machines on the LAN. A LOT of other brands of firewall operate this way too - TP Link, Grandstream, Synology, etc.

Amazon Afflilate Links for Ubiquiti Gear:

Affiliate Links (I earn a small percentage of the sale if you use these links):

Contact us for network consulting and best practices deployment today! We support all Grandstream, Synology, DrayTek, Obihai, Poly, Ubiquiti, MikroTik, Extreme, Palo Alto, and more!

Come back for the next video!
Twitter - @WillieHowe
TikTok - @whowe82

SUBSCRIBE! THUMBS-UP! Comment and Share!

[davidanderson]

Thanks Willi ! Very helpful - yes like to see more on creating rules and maybe some good to block things!😮

[MountVernonTowers]

It'd be nice for you to create a video that illustrates a "starter" position of how the firewall needs to be setup if the defaults are not good enough for security. Thanks for your content sir.

[Richard_GIS]

I must say just watched '2023 Firewall Features Compared' from lawrence systems and it raised exactly that question you now answer in this video, THY

[MitchellEarl]

Good video. The built in app blocking traffic control is pretty slick and they added a bunch of new ones with the 3.x updates.

[redheelerdog]

Thanks Willie for a great explanation, I would like to see more videos on the new UniFi OS and firewalls. Keep up the good work!

[PEDoers]

Excellent video and topic Willie. Thanks you 😊

[ryoohk]

Awesome video sir.

Only time we block out bound traffic is on our Point of Sale side but we are starting to get out of being that tight because it can become a huge hassle.

[mattq]

Any rules that would help access to the cloudkey for CCTV? great vid

[czummo]

What I'd like to see is a segment on LAN IN vs LAN OUT firewall rules explaining why you would or wouldn't set a FW rule on the LAN OUT as opposed to setting it on the LAN IN in the firewall - All my rules are set on the LAN IN as that was the way I learned and i don't know the purpose or use case where you'd set a FW rule on the LAN OUT - Thanks

[The_Tech_Ninja]

It would be great if you can make a video about fw rules, for example: You have a UDM Pro, NAS, Plex app... so to allow Plex running on a NAS and get access from the outside.

[joex]

can only hear by default mentioned 2million times - 6 min just to be told if u want to block out bond traffic you must creat rule - okay cool thanks

[stephanedelaval]

Basics to remember, thanks. This is for TCP. For UDP, is the internet incoming traffic blocs unless it is a response from an internal request ?

[Der_Ingenieur]

You mentioned you are not using IPv6. Is there anything special you have to do to prevent IPv6 traffic from making it on or out of your network?

[lcgn]

Very helpful, thanks a lot! I was told the exact opposite: oh no you can’t start UniFi, you need to set your rules before, otherwise your a** will be wide open in the internet. Good to see that someone could proof them wrong!

[kristopherleslie]

Does unifi offer a way to do firewall management by cli

[Luc]

Thanks Willie for the video. Any thoughs on the best routeur to setup a Voip, cameras, and computer network?

[FEPLabsRadio]

Willie - I've had a UDM Pro for a couple of years. I cannot for the life of me figure out how to disable port 80 from outside. THe admin interface of the UDM is wide open from the internet. On most firewalls I've ever worked on, you can enable/disable WAN access to the admin interface. It's driving me nuts. I can hit my UDM from work, from a phone, wherever. Obvi, I'm testing from outside. The cable modem is in WAN1. I do have several port forwards enabled that go to internal resources on 80, but the external side of all those is 8080, 8081, etc. It seems crazy that a security oriented device like the UDM would disable this by default. When I got the UDM, I disabled the remote access completely. What am I missing here? Thanks, and great channel!

[stevenmishos]

InterVLAN traffic for Guest networks is blocked by default when they're used (default restrictions block RFC1918 addresses and are controlled by Authorization Access in Hotspot Manager).
... and the restrictions are enforced by both the firewall and AP when wireless is used (which is where people struggle... they change the firewall rule and wonder why the traffic isn't passing).