Gbit Tech (818) 809-6743
C-7 #1050088  ·  Liability insured  ·  UniFi Certified PartnerNever the cheapest. Built to last.

UniFi Lab 07

ZBF Gateway block

IoT associates. Trunk is fine. Still No IP. Zone policy is blocking the Gateway path.

IntermediateAbout 8 minNetwork

Your job: allow IoT → Gateway for DHCP and DNS, keep External if needed, leave IoT → LAN denied.

Run: Gateway block · WAN allow · LAN block

IoT clientno_ip_gateway_blocked

No IP · Gateway blocked

no_ip_gateway_blockedNo IP · Gateway blocked

Goal: Lease ok, LAN denied

Controls Why

Path and policies

Trunk locked healthy
  1. GatewayZone Based FirewallOnline
  2. TrunkNative LAN · Tagged IoT
  3. Switch + APUplink trunk locked healthyOK
  4. IoT SSIDVLAN 30
  5. IoT clientSTOPPhone / sensor on IoTNo IP · Gateway blocked

Zone policies IoT source

DestinationPolicyNeed
GatewayBlockDHCP / DNS
ExternalAllowInternet
Internal / LANBlockStay denied

IoT client

VLAN 30
SSID / VLANIoT · 30
IPNo IP
DNSUnreachable
InternetNo internet
LAN reachDenied

Legend

  • Allow / healthy
  • Block / No IP
  • LAN exposed (blocks win)

Controls

Trunk and port profiles stay locked. ZBF only.

IoT zone membership
IoT → Gateway
IoT → External
IoT → Internal / LAN
Leftover block any
IoT DNS

Out of scope for this lab

Port profile / trunkmDNS castingContent filter courseFull ACL catalog

Why this fails

Gateway blocked

No IP

Blocking IoT → Gateway also blocks DHCP and DNS to the router. The phone can associate. The lease never completes. External allow alone is not enough.

Why Broken and Fixed
D07 ZBF zone pair, BrokenBroken. Zones Gateway, IoT, Internal (LAN), plus External. IoT to Gateway is Block. IoT client shows No IP. IoT to Internal (LAN) is Block.BrokenGatewayExternalBlockIoTClientNo IPBlockInternal (LAN)D07 ZBF zone pair, FixedFixed. IoT to Gateway is Allow DHCP, DNS. IoT client shows 192.168.30.x. IoT to Internal (LAN) stays Block.FixedGatewayExternalAllow DHCP, DNSIoTClient192.168.30.xBlockInternal (LAN)
Blocking the Gateway zone kills DHCP and DNS.

Console words

  • No IPShowing
  • DNS unreachableClear
  • Traffic blocked by firewallClear
  • Isolated from LANClear
  • LAN exposedClear
  • Lease ok, LAN deniedClear

Gear in this lab

  • 1 Cloud Gateway / UDM class
  • 1 Switch + AP (trunk ok)
  • 1 IoT client on VLAN 30
Change on win: none yet

Config only. Counts only, no prices.

A teaching lab, not a quote and not a design for your site. Settings are simplified from the UniFi Network app. No account, and nothing from this lab is saved.