create_firewall_policy
Create a zone-based firewall policy to allow, block, or reject traffic between source and destination zones, applied immediately and persisted on the UniFi console.
Instructions
Create a zone-based firewall policy (UniFi Network 9+).
Mutating operation: applied immediately and persisted on the UniFi console. Action is ALLOW, BLOCK, or REJECT across the src_zone_id to dst_zone_id pair. Lower index evaluates earlier. A controller-generated "(Return)" companion rule is typically added. Requires zone ids from get_firewall_policies; review there first.
Args: name: Policy name (used for display and zone inference). action: Packet decision — "ALLOW", "BLOCK", or "REJECT". src_zone_id: Source zone id (from get_firewall_policies). dst_zone_id: Destination zone id (from get_firewall_policies). protocol: Protocol selector — "all", "tcp", "udp", "tcp_udp", "icmp", "igmp", or "icmpv6". description: Optional human-readable description. client_macs: Restrict the source to these client MAC addresses. index: Rule order index; lower values evaluate earlier. Omit for auto-order. enabled: Create the policy enabled. Defaults to True. site: Site to operate on. Defaults to "default". device: Optional console name to target a specific UniFi device; omit for default.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Policy name (used for display and zone inference). | |
| site | No | Site to operate on. Defaults to "default". | default |
| index | No | Rule order index; lower values evaluate earlier. Omit for auto-order. | |
| action | Yes | Packet decision — "ALLOW", "BLOCK", or "REJECT". | |
| device | No | Optional console name to target a specific UniFi device; omit for default. | |
| enabled | No | Create the policy enabled. Defaults to True. | |
| protocol | No | Protocol selector — "all", "tcp", "udp", "tcp_udp", "icmp", "igmp", or "icmpv6". | all |
| client_macs | No | Restrict the source to these client MAC addresses. | |
| description | No | Optional human-readable description. | |
| dst_zone_id | Yes | Destination zone id (from get_firewall_policies). | |
| src_zone_id | Yes | Source zone id (from get_firewall_policies). |