UniFi integration guide.

Check versions and capacity

This page adapts the existing Data-Shield UniFi guide. Its documented baseline is UniFi OS 6.0.10 or later, Network 11.0.81 or later and zone-based firewall support. Confirm that Dynamic IPv4 Network Lists are available on your gateway and release channel before continuing.

Back up the configuration and retain trusted management access. Review Ubiquiti's zone-based firewall model before selecting source and destination zones.

Add a Dynamic IPv4 Network List

Standard

94,998 unique IPv4 addresses in this published snapshot.

https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_data-shield_ipv4_blocklist.txt

Critical

104,852 unique IPv4 addresses in this published snapshot.

https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_critical_data-shield_ipv4_blocklist.txt

Published 21 Oct 2026, 00:05 UTC. Check live counts and SHA-256.

1. Open Settings → Networks → Network Lists → Create New.
2. Name the list Data-Shield-Standard, choose IPv4 and set the source to Dynamic.
3. Paste the complete Standard URL above. For Critical, use its URL and name the list Data-Shield-Critical.
4. Choose 24 Hours, the shortest scheduled interval in the repository workflow. It also documents 48 and 72 hours. The source generation interval does not override this gateway setting.
5. Use Update Now, inspect the preview and loaded count, then select Add. Resolve any limit or fetch warning before attaching the list to a policy.

Menu names can change between Network releases. If these controls are absent, confirm feature availability rather than creating a static list that will not refresh.

Protect the right destination zone

Create a dedicated block policy whose source zone is External. Select IP → List and the Data-Shield list as the source. Use IPv4, all protocols, any source port and an always-active schedule. Enable logging during validation.

A Gateway-zone rule does not automatically cover servers behind a port forward. Review Ubiquiti's port forwarding guide and inspect the effective policy order for your destination zone.

Verify the list and traffic logs

1. Open the Network List and check the last successful retrieval, complete entry count and any truncation notice.
2. Use Update Now when validating a recent publication or a whitelist correction. Compare with the matching source snapshot.
3. Inspect the block policy and confirm it refers to the dynamic list, not a separate manually populated object.
4. Validate a new connection in a controlled environment using an address you own. Check the matching rule and destination zone in Traffic Flows and traffic logs.

This integration is managed through UniFi Network. The copy buttons provide the exact feed URLs; no gateway shell script is needed.

Operate and roll back cleanly

Monitor list growth as well as refresh failures. A successful import today does not guarantee that tomorrow's larger feed fits. A shared whitelist correction must be published and retrieved before it changes the policy's source set.

To roll back, disable the dedicated Data-Shield block policies and check connectivity. Remove the Network List only after removing all policy references. Keep unrelated firewall rules and network lists in place.