5 Things You Must Do to Secure Your UniFi Network

Image: Ubiquiti

UniFi gateways are great: they bring the power of enterprise-level networking to the home in a single box that does it all, like the Dream Router 7, which offers Wi-Fi 7, security camera support, and the ability to control how data moves around your network. These features would have made sysadmins from even just a few years ago cry with joy, but now they are available for anyone.

Connecting any device to the Internet, though, brings risks of losing control of your personal data, or becoming an unknowing host to bots, spyware, or other unpleasantness. A few simple tricks can make your gateway safer: here are the five things you should do to keep your UniFi network safe and secure.

1. Enable auto update

There is no point in putting a fancy lock on your door if someone can open it with a quick jiggle of the handle. New vulnerabilities pop up on a daily basis and UniFi comes up with fixes for them as quickly as they can. So, make sure that you are getting these fixes by enabling auto update. In the UniFi app, go to Settings > System > Updates and click on Automate Device Updates. When this is turned on, your router will automatically check once a day for new fixes, then install them. Some fixes may require the router to restart, which is why it is set to run at 3am by default.

2. Use secure passwords and two-factor authentication

When setting up your UniFi device, you created an admin account used to control everything. That's the crown jewels for hackers: with that, they can do anything they want. So, make sure that you keep this username and password safe, storing them only in a secure password app. Never use the same password for different accounts and make it difficult to guess: a long string of letters created by an app like 1Password or Apple Passwords is harder to guess than your kids' names.

All UniFi devices support Multi-Factor Authentication (MFA, aka 2FA), where you have to enter a changing code from another device to get in. The idea is that a hacker won't have access to the second device (such as your phone). It is a pain to use sometimes, but it is also your best defense, so use it. UniFi offers a free app for iOS and Android called UniFi Verify that makes it easy to set up and use these codes, or you can store them in most password apps. This is also more secure than having codes texted to your phone, which can sometimes be intercepted or redirected.

3. Isolate your Internet-of-Things devices

If you have appliances, coffee makers, or other smart home devices that connect to the Internet, they could be used as a way to gain access. Besides, why should my dishwasher be able to connect to my file server? Consider adding these devices to a VLAN, a virtual local area network that keeps them isolated. To do this, open the UniFi app and create a new VLAN by going to Settings > Networks and hit +. Call it IOT, and make sure that the Isolate Network and Allow Internet Access options are turned on. Next, go to the Client Devices list and find the device. In my example my dishwasher is called, well, LG_Smart_dishwasher. Scroll down the list of details until you see Virtual Network Override. Click on this, turn it on, and select the IOT network. That will allow the dishwasher to access the Internet for updates, but keeps it separate from your other devices. To read more on how VLANs work, see my recent article.

4. Block icky stuff

All recent UniFi devices have a built-in ability to block certain types of content, such as adult or malicious web sites. This can also be extended to block any site you want, or even set a schedule that blocks web sites at certain times. Yes, I am looking at you, kids who should be doing homework but are watching Fortnite streams. To set this up, open the UniFi app and go to Settings > CyberSecure > Protection and select Content Filter. Click on create new filter, give the filter a name, then click on source and pick the devices to be blocked. Then, go back and select Blocklist > Add New and enter the domain name (the last part of the web site name, such as Twitch.tv or YouTube.com), then click on Schedule and pick your schedule for preventing access.

This filtering is incredibly powerful: you can set it to block web sites for individual devices, for whole networks, or for everyone. It isn't foolproof, though: evildoers can still use apps that work more directly or use web proxies that use more stealthy methods. It's a great place to start, though.

5. Enable threat analysis

Your UniFi devices have incredibly powerful computers built in that can watch the traffic flowing in and out of your network and block attempts to break in. However, these features aren't enabled by default, because they can very occasionally block legitimate traffic. To enable these features, in the UniFi app, go to Settings > CyberSecure > Protection and make sure that Intrusion Detection is turned on. (One thing to note here: this feature is free, but if you are concerned about being hacked, consider subscribing to the full version of CyberSecure.)

If you're not sure what kind of network protection you need, or just want to get started with UniFi, drop by your local Micro Center, where our on-staff experts can walk you through all your networking needs.