UniFi Switches and Access Control Lists (ACLs)

UniFi switches have Access Control Lists (ACLs), useful for isolating device traffic on the same VLAN. Networks with high-performance requirements can also use them to manage inter-VLAN routing, rather than rely on a gateway or firewall.

Requirements

ACLs are standard on all UniFi switches except for: Flex & FlexMini; US-8; USW Industrial; and USW Ultra, Ultra-60W & Ultra-210W.

Note: ACLs are not available on the switch ports of UniFi Gateways or In-Wall Access Points.

Switch ACLs vs. Firewall Rules

Firewall rules are the standard method of controlling traffic between VLANs, or to and from the internet. Learn more here.

The two primary use cases for Switch ACLs include:

1. Device isolation within the same network/VLAN (MAC ACLs): Firewall Rules only apply to traffic routed between VLANs or to/from external networks. Switch ACLs are required to manage traffic within a single VLAN.
2. Performance-driven network design (IP ACLs): Although not required in most deployments, this may save several milliseconds of latency because inter-VLAN traffic restrictions can be applied at the switch, instead of traversing upstream through the gateway.

UniFi’s Simplified ACLs

We have created two settings to simplify common ACL implementations (found in Settings > Networks):

• L3 Network Isolation: Block all IPv4 traffic between devices in different networks.
• Client Device Isolation: Block all communication between devices in the same network.

For more comprehensive information on implementing network and device isolation, go here.

How do ACLs Work?

When creating ACLs, keep the following logic in mind:

1. ACL rules are processed top-to-bottom.
   • Place specific "allow" rules before more general "block all" rules.
   • Create allow rules first, especially when using a "block all" rule with source: Any and destination: Any.
2. MAC ACLs are applied before IP ACLs.
   • It is not possible to add MAC ACLs to networks used to manage UniFi devices.

Examples of ACLs