UniFi Network Rules is a custom integration for Home Assistant that integrates with your UniFi Dream Machine/Router to both provide and help you create useful interactions and automations for your Home Lab. The goal of this integration is to simplify policy and rule management for real world use cases. I built this because I wanted to unlock the power of my UniFi firewall. From simple things like screen time and game server access controls for my kids, to more advanced like getting notified when a critical rule is changed. And most importantly, make all of this easy to use and share with anyone in your home or home lab. I hope you find it useful!
- Firewall policies (zone-based firewall)
- Traffic/firewall rules (non-zone-based firewall)
- Port Forwarding rules
- Traffic Routes & Traffic Route Kill Switch
- QoS rules
- OpenVPN Client and Server configurations
- WireGuard Client and Server configurations
- UniFi Device LEDs
- WLAN SSIDs
Advanced automations powered by Custom Triggers and Custom Services
The included Triggers and Services provide a framework for building custom UDM automations to cover a wide range of use cases. For example, you can backup and restore all rules when a change is detected, ensure game server port forwarding rules get disabled at bedtime, create and maintain an audit log of all UDM configuration changes, and so much more. Get inspired by the many examples below.
Questions, ideas, help, or feedback? Discussions. Errors or bugs? Issues.
If you don't or can't use HACS, alternatively, copy the custom_components/unifi_network_rules
directory to your config/custom_components
directory.
I recommend installing the Studio Code Server addon to make it easier to copy in the custom component directly in the Home Assistant UI. Settings -> Add-ons -> Studio Code Server -> Install
. Then turn on Show in Sidebar
.
THEN
- Restart Home Assistant.
- In the Home Assistant configuration page, click on "Integrations".
- Click on the "+" button in the bottom right corner.
- Search for "UniFi Network Rule Manager" and select it.
- Enter credentials of a local admin user on your UDM and click on the "Submit" button.
- A UniFi device running network application 9.0.92 or later.
- A local account with Admin privileges to the network application. Must not be a UniFi Cloud account.
- Home Assistant 2025.2 or later with network access to the UniFi device.
Host: The IP address or hostname of your UniFi Device. ex. 192.168.1.1
or udm.mydomain.com
Username: The local admin account on the UDM. ex. admin
Password: The password for the UDM account. ex. password
Site: The UniFi site name to connect to (defaults to "default" if not specified).
Update Interval: The automatic refresh interval in minutes. Can be longer since updates real-time.
Verify SSL: Enable SSL certificate verification (defaults to disabled for self-signed certificates).
The integration provides several services focused on managing and automating existing UniFi Network rules:
Here are some examples of how to get started with services in Home Assistant:
- Go to Settings → Devices & Services → Helpers
- Add a Button helper (e.g., "Refresh UniFi Rules")
- Create an automation that triggers when the button is pressed
- Use the service in the automation's action
Example automation for refresh:
alias: Backup UniFi Network Rules
description: >-
Dumps all policy, rule, and route JSON state to a file in the ha config
directory
triggers:
- trigger: state
entity_id:
- input_button.backup_unr
conditions: []
actions:
- action: unifi_network_rules.backup_rules
metadata: {}
data:
filename: unr_daily_backup.json
mode: single
First, create a script in your Settings → Automations & Scenes → Scripts:
sequence:
- sequence:
- action: unifi_network_rules.backup_rules
metadata: {}
data:
filename: my_custom_unr_backup.json
alias: Backup my UniFi Rules
description: Custom script that will backup all rules and routes imported from your UDM
Then add a button card to your dashboard that references the script:
show_name: true
show_icon: true
type: button
tap_action:
action: perform-action
perform_action: script.backup_my_unifi_rules
target: {}
name: Backup my Network Rules
icon: mdi:cloud-upload
See below for more automation examples using Services with Triggers.
Service | Description | Parameters |
---|---|---|
unifi_network_rules.refresh_rules |
Manually refresh all network rules from the UniFi controller | None |
unifi_network_rules.backup_rules |
Create a backup of all firewall policies and traffic routes | filename : Name of the backup file to create |
unifi_network_rules.restore_rules |
Restore rules from a backup file | filename : Backup file to restore fromname_filter : (Optional) Only restore rules containing this stringrule_ids : (Optional) List of specific rule IDs to restorerule_types : (Optional) List of rule types to restore (policy, port_forward, route, qos_rule) |
unifi_network_rules.bulk_update_rules |
Enable or disable multiple rules by name pattern | state : true (enable) or false (disable)name_filter : String to match in rule names |
unifi_network_rules.delete_rule |
Delete an existing firewall policy by ID | rule_id : ID of the rule to delete |
unifi_network_rules.refresh_data |
Refresh data for a specific integration instance or all | entry_id : (Optional) Specific integration instance ID |
unifi_network_rules.websocket_diagnostics |
Run diagnostics on WebSocket connections and try to repair if needed | None |
unifi_network_rules.force_cleanup |
Force cleanup of all entities in the integration | None |
unifi_network_rules.force_remove_stale |
Force removal of stale or broken entities | remove_all : (Optional) Remove all entities instead of just stale ones |
unifi_network_rules.apply_template |
Apply a predefined rule template | template_id : ID of the template to applyvariables : (Optional) Variables to use in the template |
unifi_network_rules.save_template |
Save a rule as a template for reuse | rule_id : ID of the rule to savetemplate_id : ID to save the template asrule_type : (Optional) Type of rule |
unifi_network_rules.toggle_rule |
Toggle a specific rule on or off | rule_id : ID of the rule to togglerule_type : Type of the rule |
Note: For
rule_types
parameter, you can specify one or more of:policy
(zone-based firewall rules),port_forward
(port forwarding rules),route
(traffic routes), orqos_rule
(quality of service rules). See the "Understanding Rule Types" section for more details.
UniFi Network Rules provides a sophisticated trigger system that gives you real-time notifications when network rules change, regardless of whether the changes originate from Home Assistant or directly from the UniFi console. This bi-directional monitoring enables powerful automations and monitoring scenarios.
- 🔄 Bi-Directional Monitoring: Triggers fire for changes made both from Home Assistant and directly from the UniFi console
- ⚡ Real-Time Updates: Uses UniFi OS websocket connections for instant notifications
- 🎯 Granular Filtering: Filter triggers by rule type, specific rule IDs, or rule name patterns
- 📊 Rich Data: Each trigger includes rule names, old/new states, and change details
- 🛡️ Reliable Detection: Smart state-diff approach ensures accurate change detection
Trigger Type | Description | When It Fires |
---|---|---|
rule_enabled |
Rule is enabled/activated | When a rule's enabled state changes from false to true |
rule_disabled |
Rule is disabled/deactivated | When a rule's enabled state changes from true to false |
rule_changed |
Rule configuration is modified | When any rule settings change (ports, IPs, names, etc.) |
rule_deleted |
Rule is completely removed | When a rule is deleted from UniFi |
- Firewall Policies (
firewall_policies
): Zone-based firewall rules - Port Forwards (
port_forwards
): Port forwarding rules - Traffic Routes (
traffic_routes
): Network routing rules - QoS Rules (
qos_rules
): Quality of Service rules - VPN Clients (
vpn_clients
): VPN client configurations - VPN Servers (
vpn_servers
): VPN server configurations - WLANs (
wlans
): Wireless network configurations
Note: The VS Code editor validation and UI trigger selectors may show errors since Home Assistant's automation validator hasn't been updated to recognize custom trigger platforms in HA 2025.7.0. However, the triggers work correctly when configured in YAML format as shown below.
- Go to Settings → Automations & Scenes → Create Automation
- Choose "When" → Manual trigger
- Click "Edit in YAML" and use the YAML format shown below
- Configure your automation actions in the UI or YAML
triggers:
- trigger: unifi_network_rules
type: rule_enabled
rule_type: port_forwards # Optional: filter by rule type
name_filter: "Minecraft" # Optional: filter by rule name
Each trigger provides rich data you can use in conditions and actions:
# Available in automations as trigger.*
rule_id: "64f1a2b3c4d5e6f7g8h9i0j1" # Unique rule identifier (trigger.rule_id)
rule_name: "Minecraft Server Access" # Human-readable rule name (trigger.rule_name)
rule_type: "port_forwards" # Type of rule that changed (trigger.rule_type)
type: "rule_enabled" # Which trigger fired (trigger.type)
# Also available as trigger.event.* for some data:
old_state: { ... } # Previous rule configuration (trigger.event.old_state)
new_state: { ... } # New rule configuration (trigger.event.new_state)
trigger_type: "rule_enabled" # Which trigger fired (trigger.event.trigger_type)
Create rich notifications when firewall policies are modified:
alias: Security Alert - Firewall Changes
description: Alert when firewall rules are modified outside of HA
triggers:
- trigger: unifi_network_rules
type: rule_changed
rule_type: firewall_policies
- trigger: unifi_network_rules
type: rule_deleted
rule_type: firewall_policies
conditions: []
actions:
- action: notify.mobile_app_admin_phone
data:
title: "🚨 Network Security Alert"
message: >
Firewall rule "{{ trigger.event.rule_name }}" was {{ trigger.event.rule_type.replace('rule_', '') }}
Rule ID: {{ trigger.event.rule_id }}
data:
priority: high
category: security
mode: single
Use the new_state
and old_state
to get the full details of the rule change. (check your backup file to see what is available for each rule type)
alias: UniFi Policy Changed
description: UniFi Rule Changed Trigger
triggers:
- trigger: unifi_network_rules
type: rule_changed
rule_type: firewall_policies
conditions: []
actions:
- data:
title: >-
Firewall Policy {{ trigger.event.rule_name }} was {{
trigger.event.trigger_type.replace('rule_', '').upper() }}
message: |-
{% if trigger.event.new_state %}
The {{ trigger.event.new_state.action }} policy '{{ trigger.event.rule_name }}' was updated. It is now {{ 'enabled' if trigger.event.new_state.enabled else 'disabled' }}.
{% else %}
The policy '{{ trigger.event.rule_name }}' was deleted.
{% endif %}
action: persistent_notification.create
mode: single
Automatically disable game server access when enabled outside of allowed hours:
alias: Game Server Auto-Disable
description: Disable Minecraft server if enabled during school hours
triggers:
- trigger: unifi_network_rules
type: rule_enabled
name_filter: "Minecraft"
conditions:
- condition: time
after: "08:00:00"
before: "15:30:00"
- condition: time
weekday:
- mon
- tue
- wed
- thu
- fri
actions:
- delay:
minutes: 5 # Give a 5-minute grace period
- action: switch.turn_off
target:
entity_id: >
{% set rule_id = trigger.event.rule_id %}
{% set entities = states.switch | selectattr('attributes.rule_id', 'eq', rule_id) | map(attribute='entity_id') | list %}
{{ entities[0] if entities else none }}
- action: notify.family_devices
data:
title: "🎮 Game Server Disabled"
message: "Minecraft server was automatically disabled during school hours"
mode: single
Automatically backup network rules when critical changes are made by combining triggers and services:
alias: Auto-Backup on Critical Changes
description: Backup rules when important firewall or VPN changes occur
triggers:
- trigger: unifi_network_rules
type: rule_changed
rule_type: firewall_policies
- trigger: unifi_network_rules
type: rule_deleted
rule_type: firewall_policies
- trigger: unifi_network_rules
type: rule_changed
rule_type: vpn_servers
conditions:
# Only backup if it's been more than 1 hour since last backup
- condition: template
value_template: >
{% set last = state_attr('automation.auto_backup_on_critical_changes','last_triggered') %}
{% set last_ts = last.timestamp() if last else 0 %}
{{ (now().timestamp() - last_ts) > 3600 }}
actions:
- action: unifi_network_rules.backup_rules
data:
filename: "auto_backup_{{ now().strftime('%Y%m%d_%H%M') }}.json"
- action: persistent_notification.create
data:
title: "📁 Network Rules Backed Up"
message: >
Automatic backup created due to {{ trigger.event.trigger_type.replace('rule_', '') }}
of {{ trigger.event.rule_type.replace('_', ' ').title() }}: "{{ trigger.event.rule_name }}"
mode: single
Monitor specificVPN client connections and reconnect them when they disconnect:
alias: Reconnect VPN Client
description: Monitor when a specific VPN client disconnects and reconnect
triggers:
- trigger: unifi_network_rules
type: rule_disabled
rule_type: vpn_clients
name_filter: "NordVPN-Chicago"
actions:
- action: unifi_network_rules.toggle_rule
data:
rule_id: "{{ trigger.event.rule_id }}"
enabled: true
- action: persistent_notification.create
data:
title: "🔒 Attempting to reconnect VPN"
message: >
VPN "{{ trigger.event.rule_name }}" was disconnected, attempting to reconnect
mode: parallel
alias: VPN Client connected
description: Notify when VPN clients connect
triggers:
- trigger: unifi_network_rules
type: rule_enabled
rule_type: vpn_clients
- action: persistent_notification.create
data:
title: "🔒 VPN Connected"
message: >
VPN "{{ trigger.event.rule_name }}" was connected
Monitor and log when parental control rules change:
alias: Parental Control Monitor
description: Track changes to kids' internet access rules
triggers:
- trigger: unifi_network_rules
type: rule_enabled
name_filter: "Kid"
- trigger: unifi_network_rules
type: rule_disabled
name_filter: "Kid"
- trigger: unifi_network_rules
type: rule_changed
name_filter: "Block"
actions:
- action: logbook.log
data:
name: "Parental Controls"
message: >
{{ trigger.event.rule_name }} was {{ trigger.event.trigger_type.replace('rule_', '') }}
{% if trigger.event.trigger_type == 'rule_enabled' %}
✅ Internet access restored
{% elif trigger.event.trigger_type == 'rule_disabled' %}
🚫 Internet access blocked
{% else %}
🔧 Settings modified
{% endif %}
entity_id: automation.parental_control_monitor
- action: notify.parents_devices
data:
title: "👨👩👧👦 Parental Control Update"
message: "{{ trigger.event.rule_name }} - {{ trigger.event.trigger_type.replace('rule_', '').title() }}"
mode: parallel
Create input helpers to track network rule changes on your dashboard:
alias: Update Network Stats
description: Update dashboard counters for network changes
triggers:
- trigger: unifi_network_rules
type: rule_enabled
- trigger: unifi_network_rules
type: rule_disabled
- trigger: unifi_network_rules
type: rule_changed
actions:
- action: counter.increment
target:
entity_id: counter.network_rule_changes
- action: input_text.set_value
target:
entity_id: input_text.last_network_change
data:
value: >
{{ now().strftime('%H:%M') }}: {{ trigger.event.rule_name }} ({{ trigger.event.trigger_type.replace('rule_', '') }})
- action: input_datetime.set_datetime
target:
entity_id: input_datetime.last_rule_change
data:
datetime: "{{ now() }}"
mode: parallel
triggers:
- trigger: unifi_network_rules
type: rule_changed
rule_type: port_forwards
- trigger: unifi_network_rules
type: rule_changed
rule_type: vpn_clients
triggers:
- trigger: unifi_network_rules
type: rule_enabled
name_filter: "Gaming" # Matches any rule containing "Gaming"
triggers:
- trigger: unifi_network_rules
type: rule_changed
rule_id: "64f1a2b3c4d5e6f7g8h9i0j1" # Monitor one specific rule
- Use Specific Filters: Filter triggers to avoid unnecessary automation runs
- Add Conditions: Use time, state, or template conditions to refine when automations run
- Set Appropriate Modes: Use
single
,parallel
, orqueued
based on your needs - Log Important Changes: Use logbook entries for audit trails
- Test Thoroughly: Test triggers with both HA-initiated and console-initiated changes
- Monitor Performance: Triggers are real-time, so ensure your automations are efficient
- VS Code Validation Errors: The automation validator in HA 2025.7.0 doesn't recognize custom trigger platforms yet, causing false validation errors. The triggers work correctly despite these warnings.
- UI Shows "Unknown": The automation UI doesn't display custom trigger options. Use YAML configuration as shown in the examples above.
- Enable Debug Logging: Set
LOG_TRIGGERS = True
inconst.py
for detailed trigger logs - Check WebSocket Connection: Triggers require active WebSocket connection to UniFi OS
- Verify Permissions: Ensure your UniFi user has admin access to receive all rule change events
- Test Both Sources: Verify triggers work for both HA-initiated and console-initiated changes
alias: Backup UniFi Network Rules
description: >-
Creates a daily backup of all policy, rule, and route JSON state to a file in
the Home Assistant config directory every day at 2:00 AM
triggers:
- trigger: time_pattern
hours: "2"
conditions: []
actions:
- action: unifi_network_rules.backup_rules
metadata: {}
data:
filename: unr_daily_backup.json
mode: single
Fully restore the state of all policies
alias: Restore all policies from last backup
description: Restores the backed-up state of all policies, including zones, devices, objects, etc.
triggers:
- trigger: state
entity_id:
- input_button.restore_unr
conditions: []
actions:
- action: unifi_network_rules.restore_rules
metadata: {}
data:
filename: unr_daily_backup.json
mode: single
Selectively restore rules based on name and type
alias: Restore Kid Downtime Policies
description: Restores the backed-up state of the policies that contain the name `Block Kid`
triggers:
- trigger: state
entity_id:
- input_button.restore_unr
conditions: []
actions:
- action: unifi_network_rules.restore_rules
metadata: {}
data:
filename: unr_daily_backup.json
name_filter: Block Kid
rule_types:
- policy
mode: single
Every night at 11PM, Policies or Rules that contain the name "Block Kid Internet" will enable
and send a notification to Chris's iPhone
alias: Daily Device Downtime
description: Block kid devices at bedtime daily
triggers:
- trigger: time_pattern
hours: "23"
conditions: []
actions:
- action: unifi_network_rules.bulk_update_rules
metadata: {}
data:
state: true
name_filter: Block Kid internet
- action: notify.mobile_app_chrisiphone
metadata: {}
data:
message: Kids Device Downtime Enabled
title: Daily Device Downtime
mode: single
alias: Turn Off Minecraft Server Port after 2 hours
description: >-
We don't want to leave this port open indefinitely, just leave open for a
normal gaming session, then automatically turn off.
triggers:
- trigger: state
entity_id:
- switch.port_forward_minecraft_10_1_1_75_4882
from: "off"
to: "on"
conditions: []
actions:
- delay:
hours: 2
minutes: 0
seconds: 0
milliseconds: 0
- action: switch.turn_off
metadata: {}
data: {}
target:
entity_id: switch.port_forward_minecraft_10_1_1_75_4882
mode: single
This automation uses a helper to toggle port forwarding access to a game server. When enabled, it automatically disables the port forwarding after 2 hours for security.
-
Backup Organization: Use descriptive filenames with timestamps:
filename: "UniFi_rules_{{now().strftime('%Y%m%d_%H%M')}}.json"
-
Selective Restore: When restoring rules, use filters to target specific rules:
action: unifi_network_rules.restore_rules data: filename: "backup.json" name_filter: "Guest" # Only restore guest-related rules rule_types: - policy # Only restore firewall policies
-
Bulk Updates: Use naming conventions in UniFi to make bulk updates easier:
- Name related rules with common prefixes (e.g., "Guest_", "IoT_")
- Use the bulk_update_rules service with name_filter to manage groups of rules
-
Integration with Other Services: Combine with other Home Assistant integrations:
- Use the Folder Watcher integration to monitor backup file changes
- Combine with the Google Drive Backup integration for offsite copies
- Set up notifications when rule states change
The UniFi Network Rules integration supports several types of rules:
-
Firewall Policies (policy): Zone-based firewall rules that control traffic between different security zones (WAN, LAN, Guest, etc.). These form the backbone of your network security.
-
Port Forwarding Rules (port_forward): Allow external traffic to reach specific internal devices and services by forwarding specific ports from your WAN to internal IP addresses.
-
Traffic Routes (route): Control how traffic is routed through your network, typically used for VPN routing or specific network destinations. Each traffic route has two components:
- The main switch that enables/disables the route
- A child "kill switch" that blocks all traffic if the route is down (prevents data leakage if your VPN disconnects)
-
QoS Rules (qos_rule): Quality of Service rules that prioritize certain types of traffic on your network. These rules can ensure critical applications (like video conferencing) get bandwidth priority over less time-sensitive applications.
-
Legacy Rules: For older UniFi OS versions, there are also legacy_firewall and legacy_traffic rule types, which are mapped to "policy" when using the service.
To run the tests, you need to install the dependencies in the requirements.txt
file.
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
Then run the tests:
pytest tests
We've created a Bruno collection to manually test the API requests. These are the same requests that the integration makes. This is a great way to verify your credentials are valid and to verify device connectivity and compatibility.
The integration includes targeted diagnostics and debugging capabilities to help troubleshoot issues while minimizing resource usage.
To enable debug logging for the entire integration, add the following to your configuration.yaml
:
logger:
logs:
custom_components.unifi_network_rules: debug
aiounifi: debug # Also log the underlying UniFi library
For more focused debugging of specific subsystems, you can enable only what you need by editing the constants in custom_components/unifi_network_rules/const.py
:
LOG_WEBSOCKET
: Enable detailed WebSocket connection and message logsLOG_API_CALLS
: Log API requests and responsesLOG_DATA_UPDATES
: Log data refresh and update cyclesLOG_ENTITY_CHANGES
: Log entity addition, removal, and state changesLOG_TRIGGERS
: Log trigger detection and firing
These targeted flags help reduce log noise when troubleshooting specific issues.
This integration supports Home Assistant's built-in diagnostics. To access:
- Go to Settings → Devices & Services → Integrations
- Find the UniFi Network Rules integration
- Click on Configure → Download Diagnostics
- Share the generated file when reporting issues
The diagnostics provide essential information about your system configuration without exposing sensitive data.
For advanced troubleshooting of connectivity issues, the integration includes a WebSocket health monitor that can help identify connection problems with the UniFi controller.
To temporarily enable API call tracing for a session:
- SSH into your Home Assistant instance
- Enter the
/config/custom_components/unifi_network_rules
directory - Edit the file:
const.py
- Change
LOG_API_CALLS = False
toLOG_API_CALLS = True
- Restart Home Assistant
Remember to revert this change after troubleshooting to prevent excessive logging.
If you are having trouble getting the integration to work, please check the following:
- Ensure the UDM is running the latest version of the network application.
- Ensure the UDM is connected to the same network as your Home Assistant instance.
- Ensure you are using the IP address of the UDM, not the hostname.
- Verify your local account has proper admin privileges.
Run this on a computer connected to the same network as your UDM or directly on your Home Assistant instance to verify connectivity to the UDM and that your credentials are valid.
curl -k -X POST https://[UDM-IP]/api/auth/login \
-H "Content-Type: application/json" \
-d '{"username":"[USERNAME]","password":"[PASSWORD]"}'
Possible responses:
- 200 OK: Credentials are valid. Returns a JSON object with the user's information.
- 401 Unauthorized: Credentials are invalid.
- 429 Too Many Requests: The user has made too many requests in a short period of time. Wait a few minutes and try again.
You can do this by logging into your UniFi device locally or via https://UniFi.ui.com, navigate to Settings -> Admins & Users, and checking the local user's permissions. It should be Admin or Super Admin for the network application.
If you are having trouble getting the integration to work, please open an Issue using the bug report template. Please enable debug logging and include the full log output in your report. Note that it may contain sensitive network information, so please review it before posting. The logs can be large, so i recommend attaching them as a file.
To get the debug log, navigate Devices and Services -> UniFi Network Rules -> Enable Debug Logging. Then reload the integration and try to reproduce the issue. Finally, disable debug logging and download the log file.
This integration uses the same core library that Home Assistant Unifi integration uses, so there can be version incompatibility issues at time. We may ship with a higher version causing conflicts if you use multiple UniFi integrations. Sometimes restarting Home Assistant can help.
This will not support all the features of the UniFi controller, for that, leverage the core integration. The focus of this integration will be home and home lab use cases to extend and differentiate from the core integration.
Contributions are welcome! Please read our Contributing Guidelines and feel free to submit a PR.