UniFi integration

UniFi blocklist with Q-Feeds threat intelligence

UniFi Network 11 can import IP and domain lists from a URL. Point two Dynamic Network Lists at Q-Feeds and your gateway blocks known malicious hosts, with the lists refreshed automatically.

Start free UniFi setup guide
  • 2,500+Intelligence sources
  • 0Scripts to maintain
  • 5 minTo full integration
  • 100%Made in Europe
What it is

What is the Q-Feeds and UniFi integration?

UniFi Network 11 can import an IP or domain list straight from a URL and refresh it on a schedule. Q-Feeds publishes its threat intelligence as plain-text lists behind your personal API token, so the gateway fetches them itself, with no script, package or server in between.

You create one Network List for malicious IP addresses and one for malicious domains, then use them in your firewall policies. UniFi downloads each list again every 24, 48 or 72 hours and alerts you when an update fails. It works with every Q-Feeds license, including the free Community edition.

How it runs

Two Network Lists, one API token

IP list

A Dynamic Network List of type IP pulls the Q-Feeds malware IP feed. Use it in zone-based firewall policies to block traffic to and from those addresses, in both directions.

Domain list

A second list of type Domain pulls the malware domain feed. A firewall policy that matches on it stops clients from reaching phishing, malware and command-and-control domains.

Benefits

Why add Q-Feeds to your firewall

  • Enhanced threat detection

    Cross-reference threat information to reduce false positives and identify genuine threats more effectively.

  • Built into UniFi

    No scripts, packages or cron jobs. The gateway fetches the lists itself.

  • Increased resilience

    Rely on multiple sources for continuous protection and reduce the risk of blind spots in your security.

  • Improved incident response

    Faster, more precise response right on the edge of your network, saving time on internal investigations.

Setup

Integrate Q-Feeds with UniFi in 4 steps

  1. Create your free account

    Sign up on the Q-Feeds Threat Intelligence Portal and copy your personal API token.

  2. Update UniFi Network

    Make sure your gateway runs UniFi Network 11.0.83 or later on UniFi OS 6.0.10 or later.

  3. Add two Network Lists

    Under Networks, Network Lists, create an IP list and a Domain list with source Dynamic, paste the Q-Feeds URLs and choose a 24-hour refresh.

  4. Block the traffic

    Add zone-based firewall policies that block traffic to and from the lists, and the gateway drops known bad hosts.

UniFi setup guide Get your feed URLs
More integrations

Threat intelligence feeds

Curated IP, URL and domain feeds for your whole stack.

pfSense

Block malicious IPs and domains on pfSense with pfBlockerNG.

MikroTik

Load malicious IPs into a RouterOS address-list with our open source scripts.

Other firewalls

Bring Q-Feeds intelligence to virtually any firewall.
FAQ

Frequently asked questions about the UniFi integration

How do I add a blocklist to UniFi?

In UniFi Network 11, go to Networks, Network Lists and create a list with source Dynamic. Paste the Q-Feeds feed URL with your API token, choose how often UniFi refreshes it, and use the list in a firewall policy that blocks the traffic.

Which UniFi version do I need?

UniFi Network 11.0.83 or later, running on UniFi OS 6.0.10 or later. The gateway also needs outbound HTTPS access to api.qfeeds.com.

How often does UniFi refresh the lists?

You choose every 24, 48 or 72 hours, so UniFi pulls each list at most once a day. Every pull gets the current version of the feed your license covers, and Plus and Premium include more indicators than the free Community edition.

What if a list is too large for my gateway?

Add &limit= with a number to the feed URL, for example &limit=50000. The API then returns only the most recent indicators, so the list gets smaller while the newest threats stay blocked.

Why does domain blocking miss some devices?

Domain matching depends on DNS. Devices with their own DNS server or DNS over HTTPS can bypass the gateway, so let your clients resolve through the gateway and block outside DNS where you can.

Is there a free version?

Yes. The Q-Feeds Community edition is free and works with UniFi Network Lists, so you can test the integration before upgrading to Plus or Premium.

Evaluate our intelligence today!

Simplify your security operations, start your free Q-Feeds trial and experience the difference.

Start free