A UniFi gateway such as the UDM, UDM-Pro or a Cloud Gateway (UCG) ships with a built-in threat-management engine that inspects traffic against known attack signatures and, if you want, actively blocks it. This guide explains how IDS and IPS differ, where to enable the feature, which categories and sensitivity levels make sense, how much throughput drops and how to deal with false positives.
IDS vs. IPS: the key difference
Both methods inspect passing network traffic against a database of known attack patterns (signatures). The difference is what happens next:
- IDS (Intrusion Detection System) only detects and reports. Suspicious traffic is logged and you get a notification, but the connection continues undisturbed. In UniFi this mode is called Detect Only, depending on the version.
- IPS (Intrusion Prevention System) detects and actively blocks. On a match, the source is typically blocked for 300 seconds. This mode is called Detect and Block.
For getting started, IDS is the safe choice: you can watch what happens on your network for weeks without accidentally blocking legitimate services. Once you can judge the alerts, switch to IPS.
Where to enable the feature
Everything is controlled in the UniFi Network application, in the area around Firewall & Security or Threat Management. Depending on the software version the section is named differently (formerly Internet Security, later Firewall & Security with a Threat Management item), which is why we deliberately avoid a rigid menu path here. Look in Settings for the security or threat-management section.
There you first choose the operating mode (Detect Only or Detect and Block) and then enable the desired signature categories. Detected events show up in the Traffic Inspector or the threat-management logs, where you can review them in detail.
Under the hood UniFi uses a Suricata-based engine that inspects traffic in real time against continuously updated signatures. For reliable detection, the signatures should be kept up to date automatically and the gateway’s clock should be correct, otherwise timestamps and log entries will not line up.
Choosing categories and sensitivity
UniFi groups the signatures into categories, each covering a list of known threats. Rather than enabling everything blindly, base your choice on your actual needs. Typical categories include:
- Malware, trojans and command-and-control traffic
- Exploits and attacks against server services
- Scans and reconnaissance
- Peer-to-peer and potentially unwanted protocols
Sensitivity determines how many signatures are active. A higher level detects more but also produces more false positives and costs more processing power. For most home networks, a medium setting focused on malware, exploits and C2 traffic is a good compromise between protection and quiet.
Impact on throughput
This is the most important point: deep packet inspection is compute-intensive, and with IDS/IPS active the gateway caps the maximum WAN throughput. How much depends on the model. Verified reference values for IDS/IPS throughput:
- UCG-Ultra: around 1 Gbps with IDS/IPS active
- UDM-Pro: around 3.5 Gbps
- UCG-Fiber: around 5 Gbps
In practice: if you have a 1 Gbps line and a UCG-Ultra, you will barely see full bandwidth under load once IPS is running. On a multi-gig line you should choose the gateway model deliberately by its IDS/IPS throughput, not by raw routing performance without inspection.
An important side effect: active IDS/IPS can bypass certain hardware-acceleration paths, because every packet has to pass through inspection. If you need maximum bandwidth but still want some protection, you can reduce the categories or apply IDS/IPS only to selected networks or times, balancing load against security.
Dealing with false positives
No signature-based system is perfect. Legitimate services, VPNs or gaming traffic occasionally trigger a signature. Work through it methodically:
- Start in Detect Only mode and watch the logs for at least one to two weeks.
- Review every recurring alert: is the source truly malicious or a known service?
- For confirmed harmless matches, create an exception (suppress the signature or whitelist it) instead of disabling the whole category.
- Only once the logs are clean should you switch to Detect and Block.
Recommendation for home networks
For a typical home the recommendation is: enable IDS/IPS, but with a sense of proportion. Start in Detect Only mode, enable the malware, exploit and C2 categories specifically rather than every signature, and check whether your line is even faster than your gateway’s IDS/IPS throughput. If it is, you have to weigh full bandwidth against active inspection. After an observation phase with clean logs, Detect and Block is the right permanent mode for most households.
Frequently Asked Questions
Does IDS/IPS really slow down my internet? Yes. Once inspection is running, the model-dependent IDS/IPS throughput is the ceiling, not raw routing performance. On a line below that ceiling you will barely notice it.
Should I start with IDS or IPS? With IDS (Detect Only). That way you learn your network without blocking legitimate services, then switch to IPS later.
How long is a source blocked with IPS? A detected threat source is typically blocked for around 300 seconds, after which inspection applies again.
What do I do about a false positive? Set the specific signature as an exception or whitelist the source, rather than disabling the entire category.
Do I even need IDS/IPS at home? It is a useful additional layer of protection, but it does not replace updates, strong passwords and clean network segmentation.
Sources: Ubiquiti Help Center, iFeeltech UniFi Gateway Comparison
