--- description: Ubiquiti has released the Early Access update for UniFi Network 9.0.92, featuring the Zone-Based Firewall (ZBF), simplifying administrator network... title: "UniFi Network 9.0.92 Early Access: Zone-Based Firewall in Action" image: https://www.storagereview.com/wp-content/uploads/2024/12/createpolicy.png --- [![Storage Review]()](https://storagereview.com/) --- [Facebook](https://www.facebook.com/@storagereview) [X (Twitter)](https://twitter.twitter.com/storagereview) [Instagram](https://www.instagram.com/storagereview/) [LinkedIn](https://www.linkedin.com/company/storagereview-com) [YouTube](https://www.youtube.com/user/storagereview?sub_confirmation=1) [Email](mailto:info@storagereview.com) [Spotify](https://open.spotify.com/show/1y6VnznABhHeOSMOmbDTz0) [Reddit](https://www.reddit.com/r/StorageReview/) [Discord](https://discord.gg/TwMHb4azdC) [RSS Feed](https://www.storagereview.com/rss.xml) [TikTok](https://www.tiktok.com/@storagereview) [Facebook](https://www.facebook.com/@storagereview) [X (Twitter)](https://twitter.com/storagereview) [Instagram](https://www.instagram.com/storagereview/) [LinkedIn](https://www.linkedin.com/company/storagereview-com) [YouTube](https://www.youtube.com/user/storagereview?sub_confirmation=1) [Email](mailto:info@storagereview.com) [Spotify](https://open.spotify.com/show/1y6VnznABhHeOSMOmbDTz0) [Reddit](https://www.reddit.com/r/StorageReview/) [Discord](https://discord.gg/TwMHb4azdC) [RSS Feed](https://www.storagereview.com/rss.xml) [TikTok](https://www.tiktok.com/@storagereview) [![StorageReview.com](https://www.storagereview.com/wp-content/uploads/2026/07/Storage-Review-2x.png)](https://www.storagereview.com) ≡ Menu - [Home](https://www.storagereview.com/) - [Storage Reviews](https://www.storagereview.com/review) - [Consumer Reviews](https://www.storagereview.com/consumer) - [Enterprise Reviews](https://www.storagereview.com/enterprise) - [Ubiquiti Reviews](https://www.storagereview.com/best/ubiquiti-reviews) - [SR Merch](https://store.storagereview.com) - [Leaderboards](https://www.storagereview.com/best) - [Best Storage Arrays](https://www.storagereview.com/best/storage-arrays) - [Best Enterprise SSDs](https://www.storagereview.com/best/enterprise-ssds) - [Best Servers](https://www.storagereview.com/best/servers) - [Best Desktops for Local AI](https://www.storagereview.com/best/desktops-local-ai) - [Best Laptops for Local AI](https://www.storagereview.com/best/laptops-local-ai) - [Best Local LLM Tools](https://www.storagereview.com/best/local-llm-tools) - [Agentic AI Hardware](https://www.storagereview.com/best/agentic-ai-hardware) - [Best SSDs & Hard Drives](https://www.storagereview.com/best_drives) - [Best Portable SSDs](https://www.storagereview.com/best/portable-ssds) - [Best Business Laptops](https://www.storagereview.com/best/business-laptops) - [Best Mobile Workstations](https://www.storagereview.com/best/mobile-workstations) - [Best Desktop Workstations](https://www.storagereview.com/best/desktop-workstations) - [Best Laptop Battery Life](https://www.storagereview.com/best/laptop-battery-life) - [Storage Reference Guide](https://www.storagereview.com/storage-reference-guide) - [About SR](https://www.storagereview.com/about-storagereview) - [StorageReview.com Sweepstakes Rules and Regulations](https://www.storagereview.com/storagereview-com-sweepstakes-rules-and-regulations) Search [Home](https://www.storagereview.com/) » [Review](https://www.storagereview.com/review) » UniFi Network 9.0.92 Early Access: Zone-Based Firewall in Action # UniFi Network 9.0.92 Early Access: Zone-Based Firewall in Action by Dylan Dougherty on December 6, 2024 [Enterprise](https://www.storagereview.com/enterprise)  ◇  [Networking](https://www.storagereview.com/enterprise/networking) Ubiquiti has launched their UniFi Network 9.0.92 Early Access update, introducing the **Zone-Based Firewall (ZBF).** This significant upgrade empowers administrators with a simplified yet powerful toolset for managing network security. This update concerns gateways and cloud gateways, which we’ve deployed on the Cloud Gateway Ultra through the [Dream Machine Pro Max](https://www.storagereview.com/review/ubiquiti-dream-machine-pro-max-review). ![](https://www.storagereview.com/wp-content/uploads/2024/10/StorageReview-Ubiquiti-UDM-Pro-Max-5-1024x422.jpg) This innovation focuses on grouping interfaces, such as VLANs, WANs, and VPNs, into logical zones, allowing for more intuitive policy creation, better segmentation, and heightened security. ![](https://www.storagereview.com/wp-content/uploads/2024/12/image-1024x719.png) ## **Key Features and Benefits** #### **Simplified Policy Management** Gone are the days of per-interface configurations that could become unwieldy in complex networks. The new **Zone Matrix** offers a clear visual representation of traffic flow between zones, enabling administrators to assess and modify security policies quickly. This intuitive approach makes policy management more accessible, even for less experienced network administrators. ![]() #### **Enhanced Network Segmentation** UniFi’s ZBF introduces predefined zones, including Internal, External, DMZ, VPN, and Hotspot, each tailored to common security needs. These zones ensure granular control over traffic flows, allowing administrators to apply specific rules to different network elements. This design helps isolate IoT devices, secure sensitive data servers, or manage guest traffic without risking the internal network. ![]() #### **Custom Policies for Flexibility** While predefined rules streamline setup, the custom policy feature allows administrators to tailor security settings to unique organizational requirements. Whether blocking a specific protocol, creating exceptions for trusted devices, or prioritizing traffic types, the flexibility of custom policies ensures that the ZBF can adapt to even the most complex network environments. #### **Visibility and Control** The ZBF includes built-in rules to safeguard critical flow, such as DHCP and DNS traffic to the gateway, ensuring that essential services are not accidentally disrupted. Enhanced logging capabilities through syslog provide detailed insights into traffic patterns and potential threats. Additionally, administrators can easily reorder rules to reflect changing priorities or requirements, improving oversight and adaptability. ## **Practical Applications of (ZBF)** The ZBF framework is designed to reduce complexity while strengthening security, making it a valuable addition for organizations of all sizes. #### **Securing IoT Networks** IoT devices often have limited built-in security, making them vulnerable to attacks. With ZBF, administrators can place all IoT devices in a dedicated zone and create policies that: - Block IoT devices from accessing sensitive internal networks. - Allow IoT devices to communicate only with specific external services or resources. #### **Isolating Guest Traffic** Guest users can be restricted to a dedicated zone that only permits internet access, preventing them from interacting with internal devices or sensitive data. #### **Balancing Internal and External Traffic** Predefined “Internal to External” policies offer a balanced approach, granting secure internet access to internal users while maintaining robust safeguards against potential threats. #### **Advanced Customizations** Organizations can create additional zones for specialized needs, such as segregating developer environments, testing labs, or remote VPN users, ensuring fine-grained control over inter-zone communication. #### **Considerations for Deployment** While ZBF simplifies firewall management, careful planning is essential to avoid unintended consequences. Administrators should: - **Understand Zone Behavior**: Moving networks between zones or blocking traffic to the gateway (critical for services like DHCP and DNS) can disrupt operations if not managed carefully. - **Audit Traffic Flows**: Before implementing ZBF, review current traffic patterns to ensure that essential communication paths are preserved. - **Test Rules**: Gradual testing of new rules helps prevent widespread disruptions, especially in larger environments with mixed trust levels. - **Leverage Logging**: Use logging features to monitor the impact of changes and identify areas for refinement. ## **ZBF** **Configuration** **Example** UniFi’s Zone-Based Firewall (ZBF) is a significant step in simplifying and enhancing network security. Shifting from traditional per-interface configurations to a zone-based approach enables administrators to focus on intentional security outcomes rather than wrestling with complex setups. Its intuitive design and robust customization options make it ideal for small-scale and enterprise deployments. To illustrate its practical implementation, the following is an example of how to set up a new **Guest/IoT Zone** using UniFi’s ZBF in the latest update. The goal was to isolate guest and IoT devices, ensuring they had controlled access to external resources without jeopardizing internal security. #### Update to the EA Release Follow the steps below to update to the EA Release Network 9.0.92. 1. 1. Go to **Settings > Control Plane > Updates** in UniFi Controller. 2. Click **Check for Updates or Update** and install the latest EA version. 3. Enable **Early Access** in the same menu if not already enabled. ![]() Next, enable Zone-Based Firewall (ZBF) by following the steps below. 1. Go to **Settings > Firewall & Security**. 2. Enable **Zone-Based Firewall**. 3. Configure zones and set traffic policies using the **Zone Matrix**. #### **Zone Configuration example** Start by creating a new zone. First, view the default zones, then click the **Create Zone** option. ![]() Clicking Create Zone will take you to the configuration screen to set up the new zone. For this example, we named it **Guest/IoT Zone**. It’s important to ensure a VLAN is created or is pre-existing before associating it with this new zone. In our example, we used **VLAN 30**. Any pre-existing rules tied to this VLAN or network might be paused or removed when creating the new zone. ![]() After setting up the zone, return to the main page by clicking the back button in the top-left corner. You’ll need three firewall rules to create an isolated Guest/IoT network that only allows internet access while blocking local device communication. First, click on Manage. Alternatively, you can filter to the Guest/IoT Zone row and select the first option in the Internal column. This will also display any related rules associated with this zone on the interface. ![]() **Rule1:** Block IoT/Guests from accessing the Internal zone. ![]() **Rule2:** Allow IoT/Guests to access the Internet via the External zone: ![]() **Rule3**: Allow IoT/Guest to communicate with the gateway for DHCP and DNS via the Gateway zone. ![]() #### **Testing Rules** Once the rules have been created, we can proceed with testing. For this test, we will use an Ubuntu server 24.04.1 VM connected to a VNET network tagged with VLAN 30. The VM will pick up DHCP from the UDM-SE to confirm that the network configuration and zone rules are functioning as expected. ![]() Starting with the command, **ip a** shows that the Ubuntu VM has successfully picked up a DHCP lease of (10.30.50.113) from the (10.30.0.0/18) network on VLAN 30. The first test verifies communication with the gateway, and we successfully ping the main UDM gateway (192.168.1.1). Next, we ensure we are blocked from reaching any devices on the internal network. The attempt to ping a domain controller at (192.168.1.32) fails, and the same holds true when we try to ping a managed switch at (192.168.1.202). We attempted an SSH connection to the managed switch, which also failed, as a further test. This confirms that the isolation rule works as expected for the Guest/IoT zone. Finally, test if the VM has external reachability by pinging Google, verifying that the Guest/IoT network can access the internet while remaining isolated from the internal network. ##### **Nmap test** In this next test, we installed Nmap using **sudo apt install nmap** followed by the command **sudo nmap -sP 192.168.1.0/24** to scan the default network range. Nmap is a network scanning tool that allows you to discover devices on a network and determine which ports are open on them. This test checks that the Guest/IoT network is properly isolated from the internal network by confirming that no devices in the 192.168.1.0/24 range are accessible from the isolated network. ![]() It only sees our gateway (192.168.1.1) and Honey Pot (192.168.1.2) with no visibility into the other 28 devices present in the defualt network. ## Conclusion UniFi’s new Zone-Based Firewall offers an intuitive and efficient approach to network security and segmentation. It’s a valuable asset for networks of all sizes, including labs like StorageReview, where professionals can leverage its capabilities. By simplifying the creation of isolated zones and enabling robust traffic control and secure VPN policies without the traditional complexities, this tool empowers administrators to design scalable, secure environments that support advanced testing, development, and daily operations. [Ubiquiti](https://store.ui.com/us/en?a_aid=StorageReview) (affiliate link) **Engage with StorageReview** [Newsletter](https://www.storagereview.com/storage_newsletter) |  [YouTube](https://www.youtube.com/user/StorageReview "Opens in a new window") | Podcast  [iTunes](https://podcasts.apple.com/gb/podcast/storagereview-com-storage-reviews/id1060681115 "Opens in a new window")/ [Spotify](https://open.spotify.com/show/1y6VnznABhHeOSMOmbDTz0 "Opens in a new window") |  [Instagram](https://www.instagram.com/storagereview/ "Opens in a new window") |  [Twitter](https://twitter.com/storagereview "Opens in a new window") |  [TikTok](https://www.tiktok.com/@storagereview? "Opens in a new window") |  [RSS Feed](https://www.storagereview.com/rss.xml) ![]() ### Dylan Dougherty IT professional specializing in network administration and writer for StorageReview. Previous post: [NVIDIA RTX 4090 vs. RTX 6000 Ada: Can a Gaming GPU Compete with a Workstation Powerhouse?](https://www.storagereview.com/review/nvidia-rtx-4090-vs-rtx-6000-ada-can-a-gaming-gpu-compete-with-a-workstation-powerhouse) Next post: [HPE Alletra Storage MP B10000: Multi-Protocol Storage for Modern Workloads](https://www.storagereview.com/review/hpe-alletra-storage-mp-b10000-multi-protocol-storage-for-modern-workloads) Trusted Vendors Products and solutions from our affiliate partners: - [ ![Ubiquiti Logo](https://www.storagereview.com/wp-content/uploads/2024/11/2-1.webp) Ubiquiti](https://store.ui.com/us/en?a_aid=StorageReview "Opens in a new window") - [ ![Newegg Logo](https://www.storagereview.com/wp-content/uploads/2025/11/newegg.webp) Newegg](https://click.linksynergy.com/fs-bin/click?id=g5terNMDhz0&offerid=1207190.18&subid=0&type=4 "Opens in a new window") - [ ![Amazon Logo](https://www.storagereview.com/wp-content/uploads/2025/11/amazon.webp) Amazon](https://amzn.to/4fLJUEW "Opens in a new window") Newsletter Subscribe to the StorageReview newsletter to stay up to date on the latest news and reviews. We promise no spam! 1 Leave this field empty if you’re human: ## Advertisement Content Categories [Facebook](https://www.facebook.com/@storagereview) [X](https://twitter.com/storagereview) [Instagram](https://www.instagram.com/storagereview/) [LinkedIn](https://www.linkedin.com/company/storagereview-com) [YouTube](https://www.youtube.com/user/storagereview?sub_confirmation=1) [Email](mailto:info@storagereview.com) [Spotify](https://open.spotify.com/show/1y6VnznABhHeOSMOmbDTz0) [Reddit](https://www.reddit.com/r/StorageReview/) [Discord](https://discord.gg/TwMHb4azdC) [RSS](https://www.storagereview.com/rss.xml) [TikTok](https://www.tiktok.com/@storagereview) Copyright © 1998-2025 Flying Pig Ventures, LLC Cincinnati, Ohio. All rights reserved. Manage your privacy To provide the best experiences, we and our partners use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us and our partners to process personal data such as browsing behavior or unique IDs on this site and show (non-) personalized ads. Not consenting or withdrawing consent, may adversely affect certain features and functions. Click below to consent to the above or make granular choices. Your choices will be applied to this site only. You can change your settings at any time, including withdrawing your consent, by using the toggles on the Cookie Policy, or by clicking on the manage consent button at the bottom of the screen. Functional Functional Always active The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network. Preferences Preferences The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user. Statistics Statistics The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you. Marketing Marketing The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes. Statistics Marketing Features Always active Always active - Manage options - Manage services - Manage {vendor\_count} vendors - [Read more about these purposes](https://cookiedatabase.org/tcf/purposes/) Accept Deny Manage options Save preferences Manage options - {title} - {title} - {title} Manage your privacy To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions. Functional Functional Always active The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network. Preferences Preferences The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user. Statistics Statistics The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you. Marketing Marketing The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes. Statistics Marketing Features Always active Always active - Manage options - Manage services - Manage {vendor\_count} vendors - [Read more about these purposes](https://cookiedatabase.org/tcf/purposes/) Accept Deny Manage options Save preferences Manage options - {title} - {title} - {title} Manage consent Manage consent ```json {"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.storagereview.com\/review\/unifi-network-9-0-92-early-access-zone-based-firewall-in-action","url":"https:\/\/www.storagereview.com\/review\/unifi-network-9-0-92-early-access-zone-based-firewall-in-action","name":"UniFi Network 9.0.92 Early Access: Zone-Based Firewall in Action - StorageReview.com","isPartOf":{"@id":"https:\/\/www.storagereview.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.storagereview.com\/review\/unifi-network-9-0-92-early-access-zone-based-firewall-in-action#primaryimage"},"image":{"@id":"https:\/\/www.storagereview.com\/review\/unifi-network-9-0-92-early-access-zone-based-firewall-in-action#primaryimage"},"thumbnailUrl":"https:\/\/www.storagereview.com\/wp-content\/uploads\/2024\/12\/createpolicy.png","datePublished":"2024-12-06T19:08:34+00:00","dateModified":"2026-08-16T00:08:15+00:00","breadcrumb":{"@id":"https:\/\/www.storagereview.com\/review\/unifi-network-9-0-92-early-access-zone-based-firewall-in-action#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.storagereview.com\/review\/unifi-network-9-0-92-early-access-zone-based-firewall-in-action"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.storagereview.com\/review\/unifi-network-9-0-92-early-access-zone-based-firewall-in-action#primaryimage","url":"https:\/\/www.storagereview.com\/wp-content\/uploads\/2024\/12\/createpolicy.png","contentUrl":"https:\/\/www.storagereview.com\/wp-content\/uploads\/2024\/12\/createpolicy.png","width":1320,"height":856},{"@type":"BreadcrumbList","@id":"https:\/\/www.storagereview.com\/review\/unifi-network-9-0-92-early-access-zone-based-firewall-in-action#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.storagereview.com\/"},{"@type":"ListItem","position":2,"name":"Review","item":"https:\/\/www.storagereview.com\/review"},{"@type":"ListItem","position":3,"name":"UniFi Network 9.0.92 Early Access: Zone-Based Firewall in Action"}]},{"@type":"WebSite","@id":"https:\/\/www.storagereview.com\/#website","url":"https:\/\/www.storagereview.com\/","name":"StorageReview.com","description":"StorageReview.com is a leading provider of news and reviews throughout the entire IT stack - from the datacenter to the edge, and all points in between.","publisher":{"@id":"https:\/\/www.storagereview.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.storagereview.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.storagereview.com\/#organization","name":"StorageReview.com","url":"https:\/\/www.storagereview.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.storagereview.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.storagereview.com\/wp-content\/uploads\/2020\/02\/Storage-Reviews-2-2.png","contentUrl":"https:\/\/www.storagereview.com\/wp-content\/uploads\/2020\/02\/Storage-Reviews-2-2.png","width":344,"height":61,"caption":"StorageReview.com"},"image":{"@id":"https:\/\/www.storagereview.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/storagereview","http:\/\/youtube.com\/user\/storagereview"]}]} ```