From unifi-network
Manages UniFi firewall policies using natural language to create, modify, review rules, content filters, and traffic policies. Applies templates for IoT isolation, guest lockdown, and time-based controls.
npx claudepluginhub sirkirby/unifi-mcp --plugin unifi-networkThis skill uses the workspace's default tool permissions.
You are managing firewall policies on a UniFi network. Your goal is to translate natural-language requests into the correct firewall tool calls, always previewing before executing. Use the scripts and reference documents in this skill directory to work safely and efficiently.
Manages Ubiquiti UniFi networks via unifly Rust CLI: VLANs, SSIDs, firewalls, NAT, DHCP, devices, clients, events, stats, DPI, backups.
Audits UniFi firewall policies for conflicts, redundancies, security gaps, and best practices. Runs Python script for scored JSON/human reports with MCP fix recommendations. Use for rule reviews or network policy optimization.
Configures pfSense firewall rules, NAT policies, VPN tunnels, and traffic shaping to enforce network segmentation, control traffic, and secure zones in enterprise/SMB networks.
Share bugs, ideas, or general feedback.
You are managing firewall policies on a UniFi network. Your goal is to translate natural-language requests into the correct firewall tool calls, always previewing before executing. Use the scripts and reference documents in this skill directory to work safely and efficiently.
This skill requires the unifi-network MCP server. Use unifi_tool_index to verify available tools, then unifi_execute to call them.
Before doing anything else, confirm the environment is ready:
UNIFI_NETWORK_HOST (or UNIFI_HOST) is set. If not, tell the user:
"UNIFI_NETWORK_HOST is not configured. Please run the setup flow at
/setupbefore using this skill."
unifi_tool_index.Always export a snapshot before any mutation. This gives you a before-state to diff against and a rollback reference.
python scripts/export-policies.py
Options:
--mcp-url URL — override MCP server URL if not using the default--state-dir DIR — override the directory where snapshots are savedThe script saves a timestamped JSON snapshot (e.g., firewall-snapshots/firewall_20260318_143200Z.json) containing all policies, zones, and IP groups. Run this before every mutating operation in the session.
For common security scenarios, use pre-built templates rather than constructing rules from scratch.
List available templates:
python scripts/apply-template.py --list
Apply a template:
python scripts/apply-template.py --template <template-name> --param key=value --param key2=value2
The script reads references/policy-templates.yaml, substitutes parameters, and outputs the MCP tool call payload. It does not execute — you review the output, then confirm with the user before calling the tool.
Example — IoT isolation:
python scripts/apply-template.py --template iot-isolation \
--param iot_network=IoT \
--param private_network=Main
Available templates (see references/policy-templates.md for full details):
| Template | Description |
|---|---|
iot-isolation | Block IoT VLAN from reaching the main LAN |
guest-lockdown | Restrict guest network to internet-only |
kids-content-filter | Time-based social media and gaming block by DPI category |
block-bittorrent | Block P2P/BitTorrent traffic via DPI |
work-vpn-split-tunnel | Allow corporate VPN while keeping local LAN accessible |
camera-isolation | Lock IP cameras to NVR-only communication |
For parameter details, required tool calls, and expected outcomes for each template, see references/policy-templates.md.
When no template fits, create rules manually. Consult the references before writing any policy payload.
references/firewall-schema.md — complete schema reference: rulesets (LAN_IN, WAN_IN, GUEST_IN, etc.), actions (accept/drop/reject), source/destination matching types, port matching, protocols, connection states, and schedule format.references/dpi-categories.md — application-aware blocking. When users mention app names (TikTok, YouTube, Steam, BitTorrent), find the right DPI category here. Always call unifi_get_dpi_stats to confirm the exact category IDs on the user's controller before building DPI rules.Tool selection:
unifi_create_simple_firewall_policy — use for most requests. Accepts friendly network names; resolves IDs automatically. See references/firewall-schema.md for the simple policy input format.unifi_create_firewall_policy — full schema with raw IDs. Use when the simple tool cannot express the required matching logic (IP groups, geographic regions, complex port/protocol/DPI combinations).After every mutation, run the diff script to confirm the change matches intent:
python scripts/diff-policies.py
The script auto-loads the two most recent snapshots in the state directory and shows added, removed, and modified policies. If the diff looks wrong, report it to the user and do not proceed with further changes.
Options:
--current FILE — path to the after-snapshot--previous FILE — path to the before-snapshot--state-dir DIR — directory to scan for the two most recent snapshots (default)confirm=true. Show the preview to the user before executing.confirm=true.UNIFI_POLICY_NETWORK_FIREWALL_POLICIES_CREATE=trueUNIFI_POLICY_NETWORK_FIREWALL_POLICIES_UPDATE=trueUNIFI_POLICY_NETWORK_FIREWALL_POLICIES_DELETE=true (disabled by default)unifi_list_firewall_policies before creating rules to check for conflicts or redundancy.scripts/export-policies.py before any create, update, or delete operation (see Section 2).scripts/diff-policies.py after applying changes to verify the result (see Section 5).scripts/export-policies.py to snapshot current state.references/dpi-categories.md for the app's DPI category, then call unifi_get_dpi_stats to confirm the category ID on this controller.scripts/apply-template.py --list — if a matching template exists (e.g., block-bittorrent), use it.unifi_list_networks and unifi_list_firewall_zones to gather IDs, then unifi_create_simple_firewall_policy with action=reject.confirm=true.scripts/diff-policies.py to verify.scripts/export-policies.py.kids-content-filter template applies, use it with block_days, block_start, and block_end parameters.references/firewall-schema.md for the schedule format, then use unifi_create_firewall_policy with the schedule object.unifi_list_firewall_policies — get all policies.unifi_list_firewall_policies — get all policies.scripts/export-policies.py.scripts/apply-template.py --list and select the matching template.scripts/apply-template.py --template <name> --param ... to generate the payload.confirm=false first (preview).See references/policy-templates.md for the full parameter list and expected outcome for each template.
unifi_list_firewall_policies — full audit.scripts/export-policies.py before making any changes.firewall-auditor skill.Use these direct tool calls when scripts are unavailable (e.g., no Python runtime, running in a sandboxed environment).
unifi_list_firewall_policies — all firewall policiesunifi_get_firewall_policy_details — full details for one policy by IDunifi_list_firewall_zones — available zones (Internal, External, DMZ, etc.)unifi_list_firewall_groups — Firewall groups (address/port) for use in rulesunifi_list_networks — networks/VLANs (needed for targeting specific segments)unifi_get_dpi_stats — DPI categories available on this controllerunifi_create_simple_firewall_policy — recommended for most requestsunifi_create_firewall_policy — full schema for advanced casesunifi_update_firewall_policy — update specific fields of an existing policyunifi_toggle_firewall_policy — enable/disable a policyUNIFI_POLICY_NETWORK_FIREWALL_POLICIES_DELETE=true (disabled by default)Response pattern for every mutation:
confirm=true.confirm=true.unifi_create_simple_firewall_policy handles most cases — try it before reaching for the full schema. See references/firewall-schema.md for both formats.reject (sends RST/ICMP unreachable) vs drop (silent discard). reject is usually better for internal networks; drop is better for external-facing rules. See references/firewall-schema.md for the action comparison table.references/dpi-categories.md first to identify the category group, then confirm the exact ID with unifi_get_dpi_stats on the live controller.references/dpi-categories.md for the VPN category group.camera-isolation and multi-rule templates — confirm ordering with unifi_list_firewall_policies after creation, and use scripts/diff-policies.py to verify the final state.scripts/export-policies.py serve as rollback references. If a change causes unexpected behavior, share the before-snapshot path with the user so they can restore manually.