> ## Documentation Index > Fetch the complete documentation index at: https://docs.hashgrid.net/llms.txt > Use this file to discover all available pages before exploring further. # ACL and traffic matching tools reference > Create and manage ACL rules and reusable traffic matching lists to precisely control network traffic flow across your UniFi sites. Access Control Lists (ACLs) give you fine-grained control over which traffic is allowed or denied between sources and destinations on your network. Traffic matching lists let you define reusable groups of IP addresses, IPv6 addresses, or ports that you can reference in rules and policies. Together, these tools let your AI assistant build and maintain a complete traffic policy without you opening the UniFi console. ## ACL rules ### `list_acl_rules` Returns all ACL rules configured for a site. Supports pagination and optional filtering. The site identifier. Maximum number of rules to return. Number of rules to skip (for pagination). A filter expression to narrow results. *** ### `get_acl_rule` Returns the details of a single ACL rule by its ID. The site identifier. The rule identifier. *** ### `create_acl_rule` Creates a new ACL rule. All write operations require explicit confirmation. Use `dry_run=true` first to preview the rule that would be created. The site identifier. A descriptive name for the rule. The action to take when traffic matches. Accepted values: `allow`, `deny`. Whether the rule is active immediately. Defaults to `true`. The source type. Accepted values: `network`, `device`, `ip`, `any`. The ID of the source resource (used when `source_type` is `network` or `device`). A source network CIDR (e.g., `192.168.10.0/24`). Used when `source_type` is `ip`. The destination type. Accepted values: `network`, `device`, `ip`, `any`. The ID of the destination resource. A destination network CIDR. Protocol to match. Accepted values: `tcp`, `udp`, `icmp`, `all`. Source port number (1–65535). Destination port number (1–65535). Rule priority. Lower numbers are evaluated first. Defaults to `100`. Optional free-text description. Must be `true` to create the rule. When `true`, returns the payload without applying changes. ```json Dry run theme={null} { "site_id": "default", "name": "Block IoT to Corporate", "action": "deny", "source_type": "network", "source_id": "net-iot-vlan30", "destination_type": "network", "destination_id": "net-corp-vlan10", "protocol": "all", "priority": 50, "confirm": true, "dry_run": true } ``` ```json Create rule theme={null} { "site_id": "default", "name": "Block IoT to Corporate", "action": "deny", "source_type": "network", "source_id": "net-iot-vlan30", "destination_type": "network", "destination_id": "net-corp-vlan10", "protocol": "all", "priority": 50, "confirm": true } ``` *** ### `update_acl_rule` Updates an existing ACL rule. Only the fields you supply are changed. The site identifier. The ID of the rule to update. New rule name. New action (`allow` or `deny`). Enable or disable the rule. Updated source type. Updated source resource ID. Updated source network CIDR. Updated destination type. Updated destination resource ID. Updated destination network CIDR. Updated protocol. Updated source port. Updated destination port. Updated rule priority. Updated description. Must be `true` to apply the update. Preview the update without applying it. *** ### `delete_acl_rule` Permanently deletes an ACL rule. The site identifier. The ID of the rule to delete. Must be `true` to delete the rule. Preview the deletion without applying it. *** ## Traffic matching lists Traffic matching lists are reusable named groups of IP addresses or ports that you can reference across multiple rules without repeating values. Supported list types are `IPV4_ADDRESSES`, `IPV6_ADDRESSES`, and `PORTS`. ### `list_traffic_matching_lists` Returns all traffic matching lists for a site. The site identifier. Maximum number of lists to return. Number of lists to skip (for pagination). *** ### `get_traffic_matching_list` Returns the details of a single traffic matching list. The site identifier. The list identifier. *** ### `create_traffic_matching_list` Creates a new traffic matching list. The site identifier. The type of entries in this list. Accepted values: `PORTS`, `IPV4_ADDRESSES`, `IPV6_ADDRESSES`. A display name for the list. The list entries. For `PORTS`, use port numbers as strings (e.g., `["80", "443", "8080"]`). For IP lists, use CIDR notation or individual addresses. Must be `true` to create the list. Preview creation without applying it. ```json Example: create a blocked-ports list theme={null} { "site_id": "default", "list_type": "PORTS", "name": "Restricted Ports", "items": ["23", "137", "138", "139", "445"], "confirm": true } ``` *** ### `update_traffic_matching_list` Updates an existing traffic matching list. Supply only the fields you want to change. The site identifier. The list identifier. New list type (`PORTS`, `IPV4_ADDRESSES`, or `IPV6_ADDRESSES`). New display name. Replacement list of items. This overwrites the existing entries. Must be `true` to apply the update. Preview the update without applying it. *** ### `delete_traffic_matching_list` Permanently deletes a traffic matching list. The site identifier. The list identifier to delete. Must be `true` to delete the list. Preview the deletion without applying it. *** ## Example: deny inter-VLAN access on specific ports This example creates a port list for common SMB and NetBIOS ports, then uses an ACL rule to block traffic from the Guest VLAN from reaching those ports on the Corporate VLAN. ```python theme={null} # Step 1: Create a named port list create_traffic_matching_list( site_id="default", list_type="PORTS", name="SMB and NetBIOS Ports", items=["137", "138", "139", "445"], confirm=True ) # Step 2: Create the deny rule create_acl_rule( site_id="default", name="Block Guest SMB to Corporate", action="deny", source_type="network", source_id="net-guest-vlan100", destination_type="network", destination_id="net-corp-vlan10", protocol="tcp", dst_port=445, priority=10, description="Prevent guest devices from reaching corporate file shares", confirm=True ) ``` Lower priority numbers take precedence. Set your most specific deny rules at low numbers (e.g., 10–50) so they are evaluated before broader allow rules. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.