cmc/cleberg.net

 1#+date:        [2023-06-18 Sun 00:00:00]
 2#+title:       Blocking Malicious IPs on Unifi
 3#+description: Manually blocking malicious IPs via Unifi firewall rules.
 4#+slug:        unifi-ip-blocklist
 5#+filetags:    :linux:self-hosting:
 6
 7* Identifying Abusive IPs
 8
 9If you're like me and use Unifi network equipment at the edge of the
10network you manage, you may know that Unifi is only somewhat decent at
11identifying and blocking IPs that represent abusive or threat actors.
12
13While Unifi has a
14[[https://help.ui.com/hc/en-us/articles/360006893234-UniFi-Gateway-Threat-Management][threat
15management]] tool inside their Network application, it can be lacking in
16functionality and identification. For example, I have my UDM Pro set to
17identify and block almost all categories of threats available within the
18Unifi settings. However, I regularly identify abusive actors on my web
19server via the server logs.
20
21In addition, I have identified IP addresses and subnets directly within
22Unifi's logs that the UDM did not block for whatever reason.
23
24This guide is meant to be another step in the process to manually block
25abusive IP addresses or subnets that you have identified but are not
26being automatically blocked yet.
27
28* Create an IP Group Profile
29
30To start, login to the Unifi machine's web GUI and navigate to the
31Network app > Settings > Profiles.
32
33Within this page, choose the =IP Groups= tab and click =Create New=.
34
35Each IP Group profile can be used as one of three options:
36
371. Port Group
382. IPv4 Address/Subnet
393. IPv6 Address/Subnet
40
41In this example, I'm creating an IPv4 Address/Subnet group and adding a
42few different IP addresses and a subnet. Once you've added all IP
43addresses and subnets, click the =Apply= button that should appear at
44the bottom.
45
46At this point, the IPv4 Address/Subnet has been created but not yet
47used.
48
49* Drop IP Group Profile via the Unifi Firewall
50
51To instruct the Unifi machine to block the profile we just created, we
52need to navigate to the Network app > Settings > Firewall & Security.
53
54Within this screen, find the Firewall Rules table and click
55=Create Entry=. This entry should contain the following settings:
56
57- Type: =Internet In=
58- Description: =<Your Custom Rule>=
59- Rule Applied: =Before Predefined Rules=
60- Action: =Drop=
61- Source Type: =Port/IP Group=
62- IPv4 Address Group: =<Name of the Group Profile You Created Above>=
63
64Customize the remaining configurations to your liking, and then save and
65enable the firewall rule.
66
67Once enabled, the Unifi machine will be able to drop all incoming
68connections from the defined IP addresses and subnets within the created
69profile.
70
71#+begin_quote
72As a personal aside to this topic, I'm looking for a convenient way to
73update the firewall rules or profiles remotely (within the LAN) from the
74web server to accelerate this process. If you have an idea on how to
75automatically update Unifi IP groups or firewall rules, let me know!
76#+end_quote