Self-updating blocklists with External Network Lists

Network 11's External Network Lists import IP addresses or domains from a URL and keep them up to date, so firewall and routing policies that use a list stay current without any editing. Use them to block known-bad addresses, or to send specific services through a VPN.

You'll need

• Network 11 (11.0.83 or later) on UniFi OS 6.0.10 or later.
• The URL of a list of IP addresses or domains from a provider you trust.

Choosing a list

Ubiquiti doesn't publish blocklists of its own. Choose a well-maintained list whose terms allow this use: lists of known-bad IP addresses suit firewall blocking, and per-service domain lists suit routing rules. Open the URL in a browser first to check it's a plain list of addresses or domains.

Step 1: Create the list

1. Find Network Lists in Settings and create a new list; Ubiquiti hasn't published the exact path.
2. Name it, for example Malware IPs.
3. Type: IP or Domain.
4. Source: External. Paste the URL.
5. If it offers a refresh interval, choose daily.
6. Save, then open the list and check that its entries appear.

Step 2a: Block a list with firewall policies

Create these at Settings › Policy Table › Create New Policy (on Network 10: Settings › Policy Engine › Policy Table).

1. Outbound: Action Block, source zone Internal, destination zone External, with your list as the destination and the IP version matching the list. Repeat for every other zone with internet access, such as Hotspot and your IoT zone (see our VLAN guide).
2. Inbound: Action Block, source zone External with your list as the source, destination zone Internal. Repeat with Gateway as the destination zone. This matters most if you have port forwards.
3. Order: move these above any allow policy that matches the same traffic, because the first match wins. Use Reorder.
4. Optionally turn on Flows Logging on each policy, so blocked connections show up in Insights.

Step 2b: Send a list through a VPN client

1. Set up the VPN client first, under Settings › VPN.
2. Create a route at Settings › Policy Table › Create New Policy › Route.
3. Interface: your VPN client. Source: the devices or networks to route.
4. Destination: your Network List. Ubiquiti says Network 11 lets lists drive routing policies, but hasn't documented the exact control, so look in the Destination options.
5. Kill Switch: on drops the traffic if the tunnel is down; off falls back to your normal internet connection.

Check it worked

• The list shows its entries.
• Live Flows shows which policy allowed each flow (see our Live Flows guide), and Flows Logging records what your block policies stop.
• From a device covered by a route policy, open a listed site, then confirm in Insights › Flows that its traffic left through the VPN.

Watch out for

• Check a list before you trust it. Open the raw URL in a browser first, and stick to well-maintained sources. A list updates itself, so one bad entry, such as a huge address range, could block much of the internet.
• Domain lists need the gateway as DNS. Matching only works when devices use the gateway as their DNS server; devices with hard-coded DNS bypass it.
• Domain blocks hit shared IPs. The firewall acts on the resolved addresses, so other sites on the same shared hosting or CDN can be blocked too.
• Big lists can overwhelm small gateways. Ubiquiti doesn't publish a size limit, so import only what you need.

Sources: Network 11 announcement · Network release notes · Zone-based firewalls · Policy-based routing · Traffic flows

Disclaimer: This guide reflects UniFi software and official documentation as of 22 October 2026. Menus, features, plans and policies change, so check each step on your own equipment and back up first. It's general information, not legal advice, and you use it at your own risk. UniFi is a trademark of Ubiquiti Inc., and other names belong to their owners.