UniFi Zone-Based Firewall: Return Traffic, the Gateway Zone and Intra-Zone Traffic

Reviewed: 25 September 2026. A zone matrix is a planning view of traffic directions. It is not proof that every permitted connection works or that every unwanted path is blocked. A useful review follows a concrete connection from its source to the service, then checks the reply and the rules that actually match.

Minimum versions and the right gateway

Ubiquiti lists a UniFi Gateway or Cloud Gateway, Network 9.0+ and gateway software 4.1+. ZBF appeared in the 9.0.108 official release. Updating a controller alone is insufficient. [1]

An inventory should record the gateway model, its software and the Network application separately. A version number without its product name is ambiguous. Before migration, a saved configuration and a tested administrative access path make recovery practical. A version requirement also says nothing about whether an existing policy design is appropriate.

Return traffic needs an effective allowance

Auto Allow Return Traffic creates an additional policy; an existing matching policy can already provide it. State tracking does not mean all replies bypass rules. [1]

For example, a management computer may initiate a connection to an IoT device. The reply to that connection is different from a new connection initiated by the IoT device. A broad IoT-to-LAN allowance would permit more than the original requirement. The useful test records both attempts: the permitted request with its response, and an independently initiated reverse connection that should fail.

A sensor publishing to an MQTT broker is a different requirement: the sensor starts the connection. Its destination address and configured service port belong in the plan. Calling that message a “response” in everyday language does not make it return traffic for an unrelated network connection.

The gateway is a destination, not a list of guaranteed services

The gateway row needs an inventory of services actually provided there. A client may use the gateway for DNS, but a separately hosted resolver changes the destination. Likewise, allowing UDP port 123 to a gateway does not create an NTP service. The configured time server must exist and answer.

A practical service list records source network, destination host, protocol, destination port and expected function. Testing address assignment, name resolution and time synchronisation separately helps locate failures. A successful ping alone does not validate these services.

Same zone is not the same as same network

UniFi supports intra-zone policies, including Internal-to-Internal. Separate routed networks can therefore be filtered even when assigned to the same zone. [1]

Devices communicating directly within one VLAN present a different path. Gateway policy is not a substitute for controls at the switch or access point. Ubiquiti distinguishes gateway segmentation, switch ACLs and AP client isolation. The relevant control depends on where traffic passes and the hardware’s capabilities. [2]

Four test cases make the distinction concrete: devices in different zones; different VLANs in one zone; wired devices within one VLAN; and wireless clients on an access point. One successful isolation test does not establish the other three.

A review that produces evidence

1. Write down each intended connection with a specific source and destination.
2. Check both initiation directions and the policy responsible for replies.
3. Check the actual path: gateway, switch or access point.
4. Test required services and a small set of explicitly forbidden connections.
5. Record versions, relevant rule order, observed results and a rollback plan.

The UniFi Zone Matrix Planner helps document intentions. It does not inspect deployed rules, verify gateway capabilities or prove isolation. The useful output is a plan paired with observations from the actual network.