UniFi Gateway - Threat Management

Threat Management is a feature found in the Firewall & Security section of your Network application that allows you to detect and block potentially harmful traffic to your network, as well as show notifications in the System Log section when the UniFi gateway encounters anything suspicious. This feature may also be referred to as Intrusion Detection System and Intrusion Prevention System or IDS/IPS.

Requirements

• A UniFi gateway or UniFi Gateway Console.

Available Options

Threat Management can be configured to:

• Only detect traffic and show a notification.
• Detect and block traffic and show a notification.
• Use different detection levels (Low, Medium, High) or Custom categories.

I Got a Threat Detection. What Should I Do?

Depending on your Threat Management settings, you may receive notifications regarding security detections discovered by UniFi. These notifications exist so that you can be sure your gateway is doing its job in protecting your network.

If you have been alerted to a threat, you probably don't have anything to worry about. Security detections are typically harmless, and a result of settings you have already enabled.

In the Threat Management configuration, you can choose to either only Detect, or Detect and Block threats. If you select the latter, the block will last for 5 minutes. This ensures that false detections do not result in permanently blocking all traffic from a client device or website that is otherwise not harmful. 

For permanent blocks or to allow a signature, use the options available in the System Log section for a threat entry:

• Block This Connection - Block traffic between the source and destination IP addresses.
• Block This IP - Completely block incoming and outgoing traffic from the source IP address.
• Allow This Threat Signature - Allow this signature so that security detections are no longer generated for it. Use this for false positives. 
• Allow This IP - Allow this source IP so that security detections are no longer generated for it. Use this for false positives. 

How Can I Get Less Notifications?

There are four Sensitivity levels that control what categories (types of traffic) are detected and blocked. If the sensitivity is set to High, more notifications will be shown.

If you are forwarding ports to a client device on the LAN, it can also lead to more notifications as the UniFi gateway is inspecting the traffic from devices on the internet that are trying to access the forwarded port. We recommend to only forward ports when necessary.  

curl -A "BlackSun" http://www.example.com