Mastering the UniFi Zone Matrix: Visual Firewall for Smart Homes and Servers

Managing firewall rules using traditional LAN IN / LAN OUT lists can be a nightmare, especially when your network grows to include IoT devices, cameras, and private servers. Ubiquiti has revolutionized this process in their UniFi ecosystem with the Zone Matrix, a visual representation of your firewall policies.

As you can see in the referenced screenshot, the Zone Matrix provides a grid where the Y-axis represents the Source (where the traffic originates) and the X-axis represents the Destination (where the traffic is going).

Understanding the Policy States

The matrix uses color-coded blocks to define routing behavior:

• Allow All (Green): The Source can freely initiate connections to the Destination.
• Allow Return (Blue): The Source cannot initiate new connections to the Destination. It can only send data back if the Destination initiated the connection first (stateful inspection).
• Block All (Red): Absolute isolation. No traffic can pass from Source to Destination.

Scenario 1: Securing a Server Network

A common security best practice is allowing your internal trusted devices to access a local server (like a NAS or Home Assistant), while preventing that server from actively scanning or connecting to your private devices if it gets compromised.

Looking at the screenshot at the top of this post, you can achieve this perfectly:

1. Set the policy from Source: Internal to Destination: Server Network as Allow All (Green). This lets your laptop access the server.
2. Set the policy from Source: Server Network to Destination: Internal as Allow Return (Blue). This configuration ensures the server can reply to your laptop’s requests but is physically incapable of initiating a new connection to your internal network.

Scenario 2: Isolating CCTV and Smart Home (IoT)

Smart home devices and IP cameras are notoriously vulnerable to hacking. They should never have free access to your main trusted network. You can use the Zone Matrix to create a “bulletproof” IoT isolation:

1. Assign your cameras and smart home devices to a dedicated VLAN and map it to a specific Zone (for example, you could use the DMZ or Hotspot zone, or create a custom “IoT” zone).
2. Set Source: Internal to Destination: IoT Zone as Allow All. This allows your smartphone on the main Wi-Fi to view camera feeds or control smart lights locally.
3. Set Source: IoT Zone to Destination: Internal as Allow Return (or Block All if no local control is needed and everything goes through the cloud).
4. To prevent cameras from accessing the internet, set Source: IoT Zone to Destination: External as Block All.