The only downside is this doesn’t work if you have IPv6 enabled as UniFi Network still allows those to bypass the VPN.

I ended up making a long list of firewall rules to block specific sites IPv6 ranges, which worked until I hit cloudflare backed sites.

I’m really hoping UniFi start supporting IPv6 WireGuard soon.