Use when working on UniFi firewall rules, zones, or network segmentation: "my firewall rules are empty", "rest/firewallrule returns nothing", "isolate my IoT devices", "block cameras from the internet", "create a firewall zone", "VLAN isolation", "zone-based firewall", "my IoT devices lost DNS after I segmented them", or auditing what a zone actually permits. Covers the zone-based firewall model, where policies live, the block-by-default trap on new zones, and lockout safety. Assumes unifi-connect. Not for assigning devices to VLANs or switch ports (unifi-clients), Wi-Fi and SSID-to-network mapping (unifi-wifi).
