Website • Everything It Can Do • Quick Start • Deployment Guide • Releases
Genuinely, thank you so much to everybody for taking the time to use Network Optimizer and have it find a place on your network(s). It really means a lot to receive all of the bug reports, feature requests, feedback, support, and donations from everybody. Totally a whole new experience from writing code in a dayjob, and it greatly motivates me to keep on going!
Available on the latest release: the companion Traefik proxy repo is getting a custom wrapper around the Coraza Web Application Firewall (WAF) running the OWASP Core Rule Set, with a management plane implemented in Network Optimizer that pulls in free block lists (Spamhaus DROP by default, plus CINS Army, DShield, blocklist.de, IPsum, and more if you want them), IPS events, establishes an allow list based upon a matrix of your managed sites' public IPs, and more. WAF events land in Threat Intelligence and your alerts right alongside your IPS events, and you can clear a false positive straight from the event (no restart). It starts out in Detection Only, so you can let it run for a week before you flip it to blocking.
On the UniFi Network side, we are introducing automatically managed Network Lists based upon said lists of site public IPs, Cloudflare's IP set, and IPs of your own choosing. These lists can be used in UniFi Firewall and Port Forwarding rules so you don't have to keep managing them manually, and they follow your sites' WAN IPs as they change.
Your UniFi Gateway also gets optional auto-block functionality based upon both the public block lists (supplements CyberSecure / Suricata) and live WAF attack detections, so blocking for already-identified direct / non-Cloudflare traffic occurs right at the firewall level before it even hits Traefik. Cloudflare-proxied hosts can get the same blocks at Cloudflare's edge. Blocks are shared across your sites: an attacker caught at one site is blocked at all of them. With the On-Site Agent running on your gateway, blocks land in seconds through its own ipsets without reprovisioning the gateway, and the Network Lists in UniFi Network catch up overnight. The public block lists can block outbound too, so an infected device can't reach its botnet's command server, and any device on your network that reaches (or tries to reach) a listed address raises an alert.