FirewallZone

Package: @alchemy-unifi/network@0.1.2-nightly.20261027100339.gc70dd7b.0 · Source: FirewallZone.ts

A custom zone in the zone-based firewall. Zones group networks, and FirewallPolicy resources allow or block traffic between them. Existing custom zones are adopted by name with --adopt. Deleting a zone moves its networks to Internal.

Creating a zone

A zone with a network in it

import * as UnifiNetwork from "@alchemy-unifi/network";
import * as Alchemy from "alchemy";
import * as Effect from "effect/Effect";

export default Alchemy.Stack(
  "HomeNetwork",
  { providers: UnifiNetwork.providers(), state: UnifiNetwork.state() },
  Effect.gen(function* () {
    const cameras = yield* UnifiNetwork.FirewallZone("cameras", { name: "Cameras" });
    // Networks join zones from the network's side.
    yield* UnifiNetwork.Network("cctv", {
      management: "GATEWAY",
      name: "CCTV",
      vlanId: 30,
      enabled: true,
      cellularBackupEnabled: false,
      internetAccessEnabled: false,
      isolationEnabled: true,
      zone: cameras,
      ipv4Configuration: { autoScaleEnabled: false, hostIpAddress: "192.168.30.1", prefixLength: 24 },
    });
  }),
);

Note

Membership is set on the network (Network’s zone), not on the zone, so the two resources never disagree about it.

Built-in zones

The system zones aren’t resources and can’t be renamed or deleted. Use FirewallZone.INTERNAL, EXTERNAL, GATEWAY, VPN, HOTSPOT and DMZ wherever a zone goes.

A network in a built-in zone

import * as UnifiNetwork from "@alchemy-unifi/network";
import * as Effect from "effect/Effect";

export const guests = UnifiNetwork.Network("guests", {
  management: "GATEWAY",
  name: "Guests",
  vlanId: 40,
  enabled: true,
  cellularBackupEnabled: false,
  internetAccessEnabled: true,
  isolationEnabled: true,
  zone: UnifiNetwork.FirewallZone.HOTSPOT,
  ipv4Configuration: { autoScaleEnabled: false, hostIpAddress: "192.168.40.1", prefixLength: 24 },
}).pipe(Effect.asVoid);

Looking up a zone

FirewallZone.lookup({ name }) finds any zone, built-in or custom, that the stack uses but doesn’t manage.

A zone made in the UI

import * as UnifiNetwork from "@alchemy-unifi/network";
import * as Effect from "effect/Effect";

export const iot = Effect.gen(function* () {
  const zone = yield* UnifiNetwork.FirewallZone.lookup({ name: "IoT" });
  return zone.firewallZoneId;
});

Deleting a zone

UniFi moves a deleted zone’s networks to Internal. Alchemy updates the networks that referenced the zone before deleting it.