create_firewall_policy

create_firewall_policy

Create a Zone-Based Firewall policy (Integration API).

Side effects:

• Adds a policy from source_zone to destination_zone. Takes effect on the next packet. The console places it in its own evaluation order (index in the response).
• Mutates controller state. Use dry_run=True to preview the change without applying. A dry run still reads zones and networks, so it also reports a bad zone name or network id.
• Sites still on legacy rulesets get an error pointing at create_firewall_rule; nothing is written.

Written through /proxy/network/integration/v1 only, with no private-API fallback (ADR 0009). If the console refuses the body, the error carries its own message, which names the field it wanted. Returns the created v1 policy record, including its id, which is what update_firewall_policy and delete_firewall_policy take.

Each side matches by networks or by addresses, not both; leaving both empty matches the whole zone.

Example

create_firewall_policy(name="Allow IoT to Plex", action="allow", source_zone="Internal", destination_zone="Internal", protocol="tcp", source_network_ids=["6a1240..."], destination_addresses=["192.168.86.20"], destination_ports="32400")

Parameters

Parameter	Type	Required	Default	Description
name	string	yes	—	Display name for the policy.
action	string	yes	—	"allow", "block" or "reject".
source_zone	string	yes	—	Zone name ("Internal", "External", "Hotspot", "Vpn", "Dmz", "Gateway", or a custom zone) or its v1 id.
destination_zone	string	yes	—	Zone name or v1 id, as source_zone.
protocol	string	no	“all”	"all" (default), "tcp", "udp", "tcp_udp", "icmp" (IPv4) or "icmpv6" (IPv6). A port match needs tcp, udp or tcp_udp.
ip_version	string	no	“IPV4”	"IPV4" (default), "IPV6" or "IPV4_AND_IPV6".
source_network_ids	`array	null`	no	null
destination_network_ids	`array	null`	no	null
source_addresses	`array	null`	no	null
destination_addresses	`array	null`	no	null
destination_ports	string	no	“”	Destination port match: "443", "80,443" or "8000-8100". Empty = any.
allow_return_traffic	boolean	no	true	For allow only: also allow the reply traffic. Default True.
connection_states	`array	null`	no	null
logging	boolean	no	false	True logs every match.
enabled	boolean	no	true	False creates the policy disabled, for staging.
description	string	no	“”	Optional free-text description.
controller	string	no	“default”	Name of the UniFi controller to target. Defaults to "default".
dry_run	boolean	no	false	Preview the change without applying it. Returns the exact body that would be sent.