UniFi Chromecast to IoT Subnet (Updated)
Revised version for clarity and accuracy
Disclaimer: Always back up your settings before you make changes, so you can easily roll back if something doesn’t work. You’re following these directions at your own risk, and I can’t promise they’ll match every setup.
So you’ve put your smart devices on their own IoT network, but you still want to Chromecast or AirPlay from your phone or PC to a TV or speaker on that network, while blocking everything else. When I first wrote about this, UniFi used per-network “LAN In” firewall rules. Since UniFi Network 9.0, gateways use a zone-based firewall instead, and the setup is simpler. Here’s how I do it now.
How the zone-based firewall works
Every network belongs to exactly one zone, and policies control traffic between zones in both directions. There are two things to know before you start:
- The built-in Internal zone is open. Networks in Internal can reach each other freely. If your IoT network is still in Internal, it isn’t actually isolated from your main network.
- Custom zones are closed. A zone you create yourself blocks traffic to and from every other internal zone by default. Traffic out to the internet is still allowed.
So the plan is to keep your main network in Internal, move IoT into a custom zone, and then open exactly one door from main to IoT.
Step 1: Turn on Multicast DNS
Chromecast and AirPlay devices announce themselves with mDNS, which normally doesn’t cross between networks. In UniFi Network, go to Settings > Networks and find Multicast DNS under the global network settings. Turn it on, and make sure both your main network and your IoT network are selected. The exact location moves a little between versions, so use the settings search if you don’t see it.
Step 2: Put IoT in its own zone
Go to the firewall zones page (Settings > Zones in Network 9.4 and later, or Settings > Policy Engine > Zones in 9.3) and create a new zone called something like “IoT”. Assign your IoT network to it. A network can only be in one zone, so this moves it out of Internal.
As soon as you save, IoT devices can still reach the internet and the gateway (for DHCP and DNS), but they can no longer reach your main network, and your main network can no longer reach them either. That second part is what we fix next.
Step 3: Allow main to IoT, with return traffic only
Create a new firewall policy:
- Name: Internal to IoT
- Source zone: Internal
- Destination zone: IoT
- Action: Allow
- Auto Allow Return Traffic: on
That single policy replaces the two rules from my original post. Your phone or PC can start a connection to a Chromecast, and the Chromecast can answer, but nothing on the IoT network can start a new connection back into your main network. If you’d rather be stricter, set the destination to just your casting devices instead of the whole IoT zone.
If casting still doesn’t work
Some features, including AirPlay and screen mirroring, need the receiving device to open its own connection back to the sender. Return-only traffic isn’t enough for those. Open Flows in UniFi Network and look for blocked traffic from the TV or speaker. Then add a narrow allow policy from that one device in the IoT zone to the Internal zone, rather than opening the whole zone.
The zones page also shows hit counters for each policy, which is a quick way to confirm your new policy is actually matching traffic.
Optional: lock down the gateway
By default, a custom zone can still reach the gateway itself, including its management login. I add one more policy that blocks TCP ports 22, 80 and 443 from the IoT zone to the Gateway zone. Don’t block the gateway entirely, though, or your IoT devices will lose DHCP and DNS.
This is the setup I run on my own network: devices on IoT can’t start connections into my main network, while my main network can still reach them. Ubiquiti’s own write-up is here if you want more detail: Zone-Based Firewalls in UniFi.
This post updated with AI and reviewed by the author