ACL and traffic matching tools reference

Access Control Lists (ACLs) give you fine-grained control over which traffic is allowed or denied between sources and destinations on your network. Traffic matching lists let you define reusable groups of IP addresses, IPv6 addresses, or ports that you can reference in rules and policies. Together, these tools let your AI assistant build and maintain a complete traffic policy without you opening the UniFi console.

ACL rules

`list_acl_rules`

Returns all ACL rules configured for a site. Supports pagination and optional filtering.

string

required

The site identifier.

integer

Maximum number of rules to return.

integer

Number of rules to skip (for pagination).

string

A filter expression to narrow results.

`get_acl_rule`

Returns the details of a single ACL rule by its ID.

string

required

The site identifier.

string

required

The rule identifier.

`create_acl_rule`

Creates a new ACL rule. All write operations require explicit confirmation. Use dry_run=true first to preview the rule that would be created.

string

required

The site identifier.

string

required

A descriptive name for the rule.

string

required

The action to take when traffic matches. Accepted values: allow, deny.

boolean

Whether the rule is active immediately. Defaults to true.

string

The source type. Accepted values: network, device, ip, any.

string

The ID of the source resource (used when source_type is network or device).

string

A source network CIDR (e.g., 192.168.10.0/24). Used when source_type is ip.

string

The destination type. Accepted values: network, device, ip, any.

string

The ID of the destination resource.

string

A destination network CIDR.

string

Protocol to match. Accepted values: tcp, udp, icmp, all.

integer

Source port number (1–65535).

integer

Destination port number (1–65535).

integer

Rule priority. Lower numbers are evaluated first. Defaults to 100.

string

Optional free-text description.

boolean

required

Must be true to create the rule.

boolean

When true, returns the payload without applying changes.

{
  "site_id": "default",
  "name": "Block IoT to Corporate",
  "action": "deny",
  "source_type": "network",
  "source_id": "net-iot-vlan30",
  "destination_type": "network",
  "destination_id": "net-corp-vlan10",
  "protocol": "all",
  "priority": 50,
  "confirm": true,
  "dry_run": true
}

{
  "site_id": "default",
  "name": "Block IoT to Corporate",
  "action": "deny",
  "source_type": "network",
  "source_id": "net-iot-vlan30",
  "destination_type": "network",
  "destination_id": "net-corp-vlan10",
  "protocol": "all",
  "priority": 50,
  "confirm": true
}

`update_acl_rule`

Updates an existing ACL rule. Only the fields you supply are changed.

string

required

The site identifier.

string

required

The ID of the rule to update.

string

New rule name.

string

New action (allow or deny).

boolean

Enable or disable the rule.

string

Updated source type.

string

Updated source resource ID.

string

Updated source network CIDR.

string

Updated destination type.

string

Updated destination resource ID.

string

Updated destination network CIDR.

string

Updated protocol.

integer

Updated source port.

integer

Updated destination port.

integer

Updated rule priority.

string

Updated description.

boolean

required

Must be true to apply the update.

boolean

Preview the update without applying it.

`delete_acl_rule`

Permanently deletes an ACL rule.

string

required

The site identifier.

string

required

The ID of the rule to delete.

boolean

required

Must be true to delete the rule.

boolean

Preview the deletion without applying it.

Traffic matching lists

Traffic matching lists are reusable named groups of IP addresses or ports that you can reference across multiple rules without repeating values. Supported list types are IPV4_ADDRESSES, IPV6_ADDRESSES, and PORTS.

`list_traffic_matching_lists`

Returns all traffic matching lists for a site.

string

required

The site identifier.

integer

Maximum number of lists to return.

integer

Number of lists to skip (for pagination).

`get_traffic_matching_list`

Returns the details of a single traffic matching list.

string

required

The site identifier.

string

required

The list identifier.

`create_traffic_matching_list`

Creates a new traffic matching list.

string

required

The site identifier.

string

required

The type of entries in this list. Accepted values: PORTS, IPV4_ADDRESSES, IPV6_ADDRESSES.

string

required

A display name for the list.

array

required

The list entries. For PORTS, use port numbers as strings (e.g., ["80", "443", "8080"]). For IP lists, use CIDR notation or individual addresses.

boolean

required

Must be true to create the list.

boolean

Preview creation without applying it.

Example: create a blocked-ports list

{
  "site_id": "default",
  "list_type": "PORTS",
  "name": "Restricted Ports",
  "items": ["23", "137", "138", "139", "445"],
  "confirm": true
}

`update_traffic_matching_list`

Updates an existing traffic matching list. Supply only the fields you want to change.

string

required

The site identifier.

string

required

The list identifier.

string

New list type (PORTS, IPV4_ADDRESSES, or IPV6_ADDRESSES).

string

New display name.

array

Replacement list of items. This overwrites the existing entries.

boolean

required

Must be true to apply the update.

boolean

Preview the update without applying it.

`delete_traffic_matching_list`

Permanently deletes a traffic matching list.

string

required

The site identifier.

string

required

The list identifier to delete.

boolean

required

Must be true to delete the list.

boolean

Preview the deletion without applying it.

Example: deny inter-VLAN access on specific ports

This example creates a port list for common SMB and NetBIOS ports, then uses an ACL rule to block traffic from the Guest VLAN from reaching those ports on the Corporate VLAN.

# Step 1: Create a named port list
create_traffic_matching_list(
    site_id="default",
    list_type="PORTS",
    name="SMB and NetBIOS Ports",
    items=["137", "138", "139", "445"],
    confirm=True
)

# Step 2: Create the deny rule
create_acl_rule(
    site_id="default",
    name="Block Guest SMB to Corporate",
    action="deny",
    source_type="network",
    source_id="net-guest-vlan100",
    destination_type="network",
    destination_id="net-corp-vlan10",
    protocol="tcp",
    dst_port=445,
    priority=10,
    description="Prevent guest devices from reaching corporate file shares",
    confirm=True
)

Lower priority numbers take precedence. Set your most specific deny rules at low numbers (e.g., 10–50) so they are evaluated before broader allow rules.

Overview

Read Operations

Write Operations

Security & Access

Operations

ACL and traffic matching tools reference

ACL rules

`list_acl_rules`

`get_acl_rule`

`create_acl_rule`

`update_acl_rule`

`delete_acl_rule`

Traffic matching lists

`list_traffic_matching_lists`

`get_traffic_matching_list`

`create_traffic_matching_list`

`update_traffic_matching_list`

`delete_traffic_matching_list`

Example: deny inter-VLAN access on specific ports

​ACL rules

​list_acl_rules

​get_acl_rule

​create_acl_rule

​update_acl_rule

​delete_acl_rule

​Traffic matching lists

​list_traffic_matching_lists

​get_traffic_matching_list

​create_traffic_matching_list

​update_traffic_matching_list

​delete_traffic_matching_list

​Example: deny inter-VLAN access on specific ports

ACL rules

`list_acl_rules`

`get_acl_rule`

`create_acl_rule`

`update_acl_rule`

`delete_acl_rule`

Traffic matching lists

`list_traffic_matching_lists`

`get_traffic_matching_list`

`create_traffic_matching_list`

`update_traffic_matching_list`

`delete_traffic_matching_list`

Example: deny inter-VLAN access on specific ports