Connect Q-Feeds to UniFi Network Lists

Prerequisites

• UniFi Network: 11.0.83 or later
• UniFi OS: 6.0.10 or later
• Firewall: zone-based firewall policies
• Feeds: malware IPs (feed_type=malware_ip) and malware domains (feed_type=malware_domains)
• Network: outbound HTTPS from the gateway to api.qfeeds.com

Step 1: Copy your API token

Log in to the Threat Intelligence Portal, open Manage API Keys and copy your token. Each Network List gets its own URL with that token in it.

Step 2: Create the IP list

1. In UniFi Network, go to Networks, Network Lists and select Create New.
2. Name the list, for example Q-Feeds malware IPs.
3. Set Type to IP and Source to Dynamic.
4. Paste this URL with your own token in place of YOUR_TOKEN:

https://api.qfeeds.com/api?feed_type=malware_ip&ipv6=0&api_token=YOUR_TOKEN

5. Set the refresh interval to 24 hours and save.

ipv6=0 keeps the list to IPv4 addresses and IPv4 ranges in CIDR notation. A second list with the IPv6 part of the same feed would count as another download of malware_ip within the same window and be refused, so this guide covers IPv4. Contact support if you need IPv6 on UniFi.

Step 3: Create the domain list

Repeat the steps with Type set to Domain, a name such as Q-Feeds malware domains, and this URL:

https://api.qfeeds.com/api?feed_type=malware_domains&api_token=YOUR_TOKEN

Choose 24 hours again. The IP list and the domain list are different feeds, so they do not count against each other.

Step 4: Block the traffic

The lists only hold the data. Create these firewall policies with the action Block:

• Outbound to malicious IPs: source zone Internal, destination zone External, destination the Q-Feeds malware IPs list.
• Inbound from malicious IPs: source zone External with the Q-Feeds malware IPs list as source, destination zone Internal. Add the same policy with destination zone Gateway to protect the gateway itself.
• Malicious domains: source zone Internal, destination zone External, and match the destination on the Q-Feeds malware domains list.

Make sure no policy higher in the list allows the same traffic first, because the first match wins.

How it works

• Refresh: UniFi downloads each list again every 24, 48 or 72 hours. Q-Feeds updates its indicators more often, so a 24-hour refresh gets you the newest data your license covers once a day.
• Full list: every download brings the complete feed for your license. There are no scripts or differential updates involved.
• Newest first: the API sorts indicators by age, newest first. If you cap a list with &limit=, you keep the most recent threats.
• Alerts: since 11.0.83, UniFi Network alerts you when a Dynamic Network List fails to update.
• One download per feed: the rate limit applies per API key and per feed. Do not point two lists at the same feed with the same key.

Verify

After saving, open both lists under Networks, Network Lists and check that they hold entries and show no update alert. Turn on logging for the block policies for a few days if you want to see what they catch.

Troubleshooting

• Update failed alert or HTTP 429: the feed was already downloaded with the same key within the update window, often by a browser test or a second list. In the portal, open the key under Manage API Keys and select Activate Override under Rate Limit Override. That lifts the limit for five minutes; refresh the list in UniFi within that time.
• The list stays empty: check the token in the URL, confirm your license is active and that the gateway can reach https://api.qfeeds.com.
• The list will not import or the gateway slows down: add a cap to the URL, for example &limit=50000, and lower it until the list imports. You keep the newest indicators.
• A policy seems to do nothing: a policy higher in the list matches the traffic first. Move the block policies up.
• Domain blocking misses devices: those clients bypass the DNS of the gateway. See the DNS tip in step 4.
• Support: support@qfeeds.com or the support page.

Get your feed URLs About the UniFi integration