UniFi VLAN Firewall Rules: Complete IoT & Guest Isolation Guide

Updated 2026-11-07 • By Marcus Vance, CCNA (Senior Network Engineer)

By default, Ubiquiti UniFi gateways route all traffic between local VLANs automatically, allowing potentially compromised smart TVs, security cameras, and cheap IoT bulbs to scan and attack your personal laptops and NAS. To secure your network, you must configure three core LAN In firewall rules: Allow Established and Related sessions, block inter-VLAN traffic, and permit restricted DNS and mDNS discovery.

The UniFi Security Risk: Automatic Inter-VLAN Routing

When you create multiple Virtual Local Area Networks (VLANs) in the UniFi Network Application (such as VLAN 10 for Trusted Devices, VLAN 20 for IoT, and VLAN 30 for Security Cameras), the UniFi gateway automatically injects connected routes for each subnet into its kernel routing table.

Unlike enterprise firewalls that follow a default 'Deny All' posture between interfaces, UniFi implements an 'Allow All' inter-VLAN routing policy out of the box. An untrusted $15 smart plug on your IoT Wi-Fi can freely ping, port scan, and exploit your TrueNAS storage server, home automation controller, or work laptop unless you explicitly define stateful firewall rules in the LAN In chain.

Step 1: Creating Reusable RFC 1918 IP Groups

Rather than authoring dozens of repetitive firewall rules for each individual VLAN pair, seasoned network engineers use Firewall Profiles / IP Groups. This ensures that any new VLAN you create in the future is isolated automatically.

1. Log into your UniFi Network console and navigate to Settings > Security > Firewall Rules (or Profiles > IP Groups).
2. Click Create New IP Group.
3. Name the group: RFC1918_Private_Subnets.
4. Select Type: IPv4 Address/Subnet.
5. Add the three canonical private IPv4 blocks defined in RFC 1918:
   • 10.0.0.0/8
   • 172.16.0.0/12
   • 192.168.0.0/16
6. Click Apply Changes. This group now represents every possible internal private IP address on your network.

Step 2: The Core 3-Rule Stateful Firewall Architecture

Navigate to Settings > Security > Firewall Rules > LAN In. Rules in the LAN In table are evaluated sequentially from top to bottom on traffic entering the gateway from any local network interface. You must create the following three rules in exact numerical order:

Rule 2001: Allow Established & Related State (P0 Rule)

• Action: Accept
• Protocol: All
• Source: Any
• Destination: Any
• Advanced > State: Check Established and Related. Uncheck New and Invalid.
• Explanation: This stateful inspection rule ensures that when your laptop on VLAN 10 opens an HTTP session to configure a smart bulb on VLAN 20, the bulb's reply packets are permitted back through the firewall.

Rule 2002: Drop Invalid State Connections

• Action: Drop
• Protocol: All
• Source: Any
• Destination: Any
• Advanced > State: Check Invalid.
• Explanation: Discards malformed TCP packets, out-of-sequence flags, and scanning probes before they consume gateway CPU cycles.

Rule 2003: Block All Inter-VLAN Traffic

• Action: Drop
• Protocol: All
• Source: Port/IP Group > RFC1918_Private_Subnets
• Destination: Port/IP Group > RFC1918_Private_Subnets
• Explanation: Any new connection initiated from one private subnet trying to reach another private subnet is dropped immediately. Because Rule 2001 precedes this rule, your trusted devices can still talk outward to IoT devices, but IoT devices can never initiate a connection inward to your trusted LAN!

Step 3: Pinhole Rules for mDNS, Home Assistant & Printers

With inter-VLAN traffic blocked, smart speakers, network printers, and Home Assistant dashboards require specific pinholes to function across subnets:

• Enabling Multicast DNS (mDNS): Go to Settings > Networks, click your IoT and Trusted networks, and ensure Multicast DNS is toggled ON. This allows Apple Bonjour, AirPlay, and Google Cast discovery beacons (UDP port 5353) to cross VLAN boundaries.
• Permitting IoT Gateway DNS Queries: IoT devices must still resolve internet domain names. Add a rule above Rule 2003 titled 'Allow IoT to Gateway DNS': Action: Accept, Protocol: UDP/TCP, Source: IoT Network, Destination: IoT Gateway IP, Port: 53.
• Dedicated Home Assistant Pinhole: If your Home Assistant server resides on VLAN 10 (IP 192.168.10.50) and needs to monitor ESPHome/Zigbee bridges on VLAN 20, create an Accept rule placed above Rule 2003 permitting Source: 192.168.10.50 to Destination: IoT Network.

Recommended UniFi LAN In Firewall Rule Execution Order and Logic

UniFi VLAN Isolation Implementation Checklist

1. Navigate to Profiles > IP Groups and verify RFC1918_Private_Subnets contains 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
2. Create Rule 2001 on LAN In to Accept Established and Related traffic across all protocols.
3. Create Rule 2002 on LAN In to Drop all Invalid state connections.
4. Create Rule 2003 on LAN In to permit UDP Port 53 from IoT subnets to the local gateway IP.
5. Create Rule 2005 on LAN In to Drop traffic where Source and Destination match RFC1918_Private_Subnets.
6. Enable Multicast DNS (mDNS) reflector in Global Network Settings for AirPlay and Chromecast support.
7. Test isolation by opening a terminal on an IoT client and attempting to ping or SSH to your trusted PC IP.

Frequently Asked Questions

Why does UniFi route traffic between VLANs without firewall rules?

UniFi gateways are Layer-3 routers configured for ease of use. When you create networks in the UniFi controller, the gateway assigns itself an IP in each subnet and automatically bridges them in the routing table until you insert Drop rules in the LAN In firewall table.

What is the difference between LAN In, LAN Out, and LAN Local in UniFi?

LAN In filters traffic entering the gateway from a local network intended for another local network or the internet. LAN Out filters traffic exiting the gateway toward a local network. LAN Local filters traffic directed specifically at the UniFi gateway itself (such as port 22 SSH or port 443 web GUI).

Can I use UniFi 'Traffic Rules' instead of manual Firewall Rules?

UniFi Traffic Rules (introduced in Network 7.x/8.x) offer simple one-click inter-VLAN blocking, but they lack fine-grained stateful control (Established/Related inspection) and custom port pinholes. For robust security, manual LAN In firewall rules remain the industry best practice.

How can my phone on the trusted VLAN cast video to a Chromecast on the IoT VLAN?

Enable Multicast DNS (mDNS) in UniFi Network Settings. When mDNS is active, the UniFi gateway forwards UDP Port 5353 discovery packets between subnets. Because your phone initiates the connection to the Chromecast, Rule 2001 (Established/Related) permits the streaming data back automatically.

Related Home Network Security & Engineering Guides

• CrowdSec vs Fail2ban on OPNsense & pfSense: Intrusion Defense Guide — Protect your homelab and firewall from automated bots. Compare CrowdSec collaborative threat intelligence against traditional Fail2ban on OPNsense and Linux.
• VLAN Trunk vs. Access Ports: 802.1Q Switch Setup Guide — Configure IEEE 802.1Q VLAN trunk ports, access ports, PVID, and native VLANs cleanly on UniFi, TP-Link Omada, Netgear, MikroTik, and Cisco switches.
• How to Secure Home WiFi (12-Step Hardening Guide) — Harden your home WiFi network in 12 practical steps. Enable WPA3-SAE encryption, disable WPS and UPnP, isolate IoT VLANs, and lock down router admin access.
• Router Default Password Safety & Credential Hardening — Eliminate default router credentials before botnets hijack your gateway. Separate admin passwords from WiFi WPA3 keys and enforce LAN HTTPS management.