Threat intelligence from Q-Feeds available on UniFi gateways. With UniFi Network 11, UniFi gateways can for the first time use threat intelligence from external parties, in addition to manufacturer Ubiquiti's paid security service. The Dutch company Q-Feeds is responding to this and is making available an integration for UniFi gateways with which administrators and IT service providers can block traffic to and from known malicious IP addresses, without scripts or additional hardware. Until now, anyone who wanted to block IP addresses of known attackers on a UniFi gateway had to rely on CyberSecure Enhanced, Ubiquiti's paid security subscription. Other sources could only be added using manually maintained lists or custom scripts on the gateway, which sometimes stopped working after an update. In the latest network software, a network list can be populated from an external URL. The gateway keeps that list up to date itself, so administrators can choose which threat intelligence they use. Blocking in two directions. A blocklist with threat information works in two directions, according to Q-Feeds. Incoming traffic from known scanners, brute-force sources and attack infrastructure is refused at the edge of the network, before it reaches an open port, VPN entry point or web service. Outgoing connections are blocked if an infected device, such as a laptop or camera, tries to contact a known command-and-control server. That is often the moment when an infection grows into a data breach or ransomware incident. The Q-Feeds list is compiled from more than 2,500 sources, including its own honeypots, and is linked to the MITRE ATT&CK framework. It can be used alongside CyberSecure Enhanced and also on gateways without that subscription. UniFi's IDS/IPS recognizes patterns in traffic, while the blocklist blocks based on the reputation of an IP address. According to Q-Feeds, a second, independent source reduces the chance of blind spots, because no single source sees all threats. Setup in five steps. Administrators first create an account on the Q-Feeds Threat Intelligence Portal and copy the feed URL with their personal API token there. They then update the gateway to the latest network software; the system requirements are in the manual. In the network settings, under Networks > Network Lists, they create a dynamic IP list, paste the URL and set a refresh every 24 hours. Next, they block traffic with two firewall rules: one for traffic from the list to their own network and one for traffic in the opposite direction. Finally, they check that it works. The gateway itself reports if retrieving the list fails, so Q-Feeds advises keeping an eye on the notifications after the first day. The company mentions a number of points to note. Many administrators block only incoming traffic, while the outgoing rule can expose infected devices on their own network. A very large list can also exceed the limits of entry-level models. In that case, the number of addresses in the feed URL can be limited, while retaining the most recent threats. Those managing multiple locations apply the same configuration per gateway: one list and two rules. Resellers and MSPs manage licenses per customer centrally in the Threat Intelligence Portal. 'No single layer sees everything' "UniFi is hugely popular among SMEs and IT service providers that manage dozens of customer locations," says Stefan Sprenkels, founder of Q-Feeds. "It is precisely those organizations that are increasingly being targeted, while professional threat intelligence was long too expensive or too complex for them. By opening the platform to external parties, Ubiquiti has opened the door. For an administrator, it is now about fifteen minutes of work to keep known attackers out and recognize infected devices. No single layer sees everything, so layering remains the key." The integration is available immediately and works with all Q-Feeds licenses, from Community to Plus and Premium. Those who want to try the integration first can do so in their own environment with the free Community edition or with a Premium trial period. The full manual is available here. About Wouter Hoeffnagel. Wouter Hoeffnagel is manager online content at Dutch IT Media. He is an expert in the field of ICT and has been writing about it for years in the form of news reports and insightful articles.

UniFi Network 11 adds live traffic flows, WiFi WAN and Matter. Ubiquiti has announced UniFi Network 11, a major controller release built around deeper visibility, smarter routing and a first pass at smart-home device awareness. The headline change is a rebuilt telemetry engine that Ubiquiti says delivers over 30% better scalability, which flows through to real-time traffic data and historical network insight. Alongside that, UniFi gateways pick up expanded VLAN capacity, new SD-WAN policy controls and WiFi WAN, which lets a supported model use an existing wireless network - including a phone hotspot - as a primary or backup uplink. There is also a genuinely new direction here: UniFi can now sit alongside your existing Matter controller and surface Matter and Thread devices inside the same topology view as your IP clients. Telemetry rebuilt for larger sites. The telemetry work is the foundation of the release. Better scalability is the stated benefit for growing networks, but the user-facing payoff is Live Traffic Flows for every client connected to a UniFi Gateway, rather than aggregated counters after the fact. Ubiquiti has also added Time Machine Topology, which lets you step back through how the network looked at earlier points in time. For anyone who has tried to work out when a device moved ports or when a rogue client appeared, that is a practical troubleshooting aid. * More than 30% improvement in scalability from the re-engineered telemetry engine * Per-device live traffic flows behind a UniFi Gateway * Historical topology playback to visualise network changes Routing, WAN flexibility and SD-WAN policies. Gateway capabilities get a solid lift. VLAN capacity has been expanded for more complex segmentation, and Routing Policies have been simplified through Network Lists, which can now pull from an external URL so firewall rules and VPN resources stay current without manual edits. WiFi WAN is the attention-grabber. On supported models, any available wireless network can be pressed into service as a WAN link, which is a neat option for temporary sites or as a stopgap when the fixed service drops. On the multi-site side, new SD-WAN policies allow custom failover behaviour and application-based routing, applied consistently across sites from one place. AI-assisted threat detail and Matter awareness. Cybersecure Enhanced continues to receive daily Proofpoint threat signature updates, and those detections now come with AI-assisted explanations covering scope, risk and impact, plus recommended actions. For small teams without a security analyst on staff, clearer triage information is worth more than another raw alert count. The Matter integration works by entering a pairing code so UniFi can observe the device alongside your existing Matter controller. From there you get battery level, firmware version, signal strength and a view of how each device is connected. * IP and Thread devices shown together in a single UniFi Topology view * Custom alerts available for critical devices on either network type * Custom device icons created from the mobile app camera or uploaded via browser BUZY's take. This is one of the more substantial UniFi Network releases BUZY has seen in a while, and the telemetry rework is the part that matters most. Visibility improvements are easy to undersell in a release note, but live per-client flow data and historical topology are the sorts of features that save real hours when something breaks. For prosumers running a home or small office setup, the standouts are WiFi WAN and the Matter work. Hotspot failover is a sensible safety net for anyone on a single fixed service, and the Matter observability finally gives UniFi something useful to say about the growing pile of smart devices sitting on your wireless coverage. Worth noting it complements rather than replaces your existing Matter controller. Integrators and SMB IT get the most from the SD-WAN policy controls and Network Lists with external URL support. Application-based routing and custom failover across multiple sites, managed consistently, removes a lot of per-site fiddling - and dynamically updating lists means fewer stale firewall rules. A note of realism: the Matter and Thread features are early, and custom device icons are a nice touch rather than a reason to upgrade. As always with a point-zero release, BUZY would let it settle on a non-critical site first, particularly if you are running larger stacks of switches and access points where a controller issue is disruptive. Ubiquiti has not detailed which gateway models support WiFi WAN beyond saying it applies to supported hardware, so check your own kit before planning around it. If you are already reviewing the wider UniFi ecosystem, this release strengthens the argument for consolidating management rather than running parallel tools. Read the full announcement at blog.ui.com. Frequently asked questions. What is new in UniFi Network 11? UniFi Network 11 introduces a re-engineered telemetry engine with more than 30% better scalability, Live Traffic Flows for every client behind a UniFi Gateway, and Time Machine Topology for viewing historical network changes. It also adds WiFi WAN, expanded VLAN capacity, advanced SD-WAN failover and application routing policies, AI-assisted threat explanations, and Matter device awareness. Custom device icons can now be created from the mobile app camera or uploaded through a browser. What does WiFi WAN do in UniFi Network 11? Does UniFi Network 11 replace my Matter controller? Can UniFi Network 11 show Thread devices? How much does UniFi Network 11 cost? What are the new SD-WAN features in UniFi Network 11? Is UniFi Network 11 available in Australia? BUZY Networks stocks the full Ubiquiti range with a 2-year Advanced Replacement Warranty.