SDF and HK downloads failed or disabled with Unifi Network Region Blocking

[scorp508]

Just an FYI for any "future me" that needs to fix this. As of right now this is Unifi Network 9.5.21 with the upgraded zone based advanced firewall, so it may change in the future if Ubiquiti changes anything.

If you enable Region Blocking under the CyberSecure tab of Unifi Network and select Russian Federation as a region to block, then MakeMKV will be unable to perform its SDF/HK downloads.

The bottom of the CyberSecure page has a "Detection Exclusions" setting, and you'd think you can put your internal client IP into that setting to bypass the region blocking. You'd be wrong. Unifi confirmed for me the exclusion setting is only for the IDS/IPS features and does not bypass the region blocking feature.

I went this route to fix it.

1. Do a network capture and identify the IP MakeMKV is attempting to contact for downloads. For Windows I use Microsoft Network Monitor as it easily shows what process initiated the network traffic. It still works on Windows 11.
2. Create a firewall rule in the Internal -> External zone, allowing the internal client IP to use IPv4 TCP:443 to contact the external host IP.
3. Create a firewall rule in the Internal - > External zone for region blocking and enable the same regions you have in CyberSecure settings.
4. Confirm the Internal-> External region blocking rule is in the processing order after the client allow rule created before. Reorder the rule if needed. If you don't do this, then the block rule is applied before ever getting to the allow rule.
5. Create a firewall rule in the External - > Internal zone for region blocking and enable the same regions you have in CyberSecure settings.
6. Confirm the External -> Internal region blocking rule is in the processing order after the default "Allow Return Traffic" rule. Reorder the rule if needed. If you don't do this, then your client can send outbound, but the return traffic will fail, and you'll see the client sending retries.
7. Completely disable region blocking under the CyberSecure tab to allow the FW rules to take over this task.

With the above in place, I still have the blocking I want for my network, but one client has a pinhole to do the downloads as needed. Any traffic from the region is still blocked unless it is part of a TCP conversation initiated by the internal client. You can leave the allow rule disabled if you'd like, and only enable it when you see MakeMKV needs to do a download.