Ubiquiti collects “information relating to your system, network, devices or devices of third parties on your system or network” (1a) such as MAC addresses, models, operating systems, and the manufacturer of connected devices, as well as the topology of your network. They share this information with “your Internet service provider who may access and use this information for their purposes” (2c) including dynamic bandwidth allocation, rate-limiting, and service prioritisation. They also share “aggregate or de-identified information about users with third-parties for marketing, research, or similar purposes” (3b) such as “[targeting] advertisements by displaying ads for products and services in which you might be interested” (5d). This privacy policy is very vague, and doesn’t talk too much about what exactly they collect. They do give you the ability to easily request the deletion of your data, but the same section also says they can remotely disable your access if do this.
The Unified Interface (UniFi) give you a few options to limit tracking. These options require you to trust that Ubiquiti hardware will follow their own rules and honour the choice. Disabling the teleport VPN and turning off remote access will prevent Ubiquiti or anyone from accessing your UniFi gateway. If you still need remote access, you can setup a WireGuard or OpenVPN server that you control, but you will need the ability to port forward, and have a static IP or dynamic DNS domain. To block most of the tracking, there is an option to set “Analytics & Improvement” to off. If Ubiquiti is trusted to follow these options, this will disable all phoning home with your personal information. This should be enough for most people who don’t want to tinker around with DNS masking and IP rules. For those who can, there’s still more you to do.
Having a device outside the control of Ubiquiti place between the gateway and your modem will give you the option to use dnsmasq and iptables. I have a GliNet OpenWRT router that redirects all DNS traffic through dnsmasq, blocks DoT/DoH, and filters suspicious domains. The dnsmasq and iptables rules I use are below:
# /etc/dnsmasq.conf
address=/uid.alpha.ui.com/0.0.0.0
address=/static.ui.com/0.0.0.0
address=/sp-dir.uwn.com/0.0.0.0
address=/config-public.identity.ui.com/0.0.0.0
address=/trace.svc.ui.com/0.0.0.0
address=/geo.svc.ui.com/0.0.0.0
address=/ping.ui.com/0.0.0.0
address=/sentry.io/0.0.0.0
address=/ping.ubnt.com/0.0.0.0
# LuCi Firewall – Custom Rules
iptables -t nat -A PREROUTING -i br-lan -p udp --dport 53 -j REDIRECT --to-ports 53
iptables -t nat -A PREROUTING -i br-lan -p tcp --dport 53 -j REDIRECT --to-ports 53
iptables -t nat -A PREROUTING -i br-lan -p tcp --dport 853 -j REJECT
iptables -t nat -A PREROUTING -i br-lan -p udp --dport 853 -j REJECT
ip6tables -t nat -A PREROUTING -i br-lan -p udp --dport 53 -j REDIRECT --to-ports 53
ip6tables -t nat -A PREROUTING -i br-lan -p tcp --dport 53 -j REDIRECT --to-ports 53
ip6tables -t nat -A PREROUTING -i br-lan -p tcp --dport 853 -j REJECT
ip6tables -t nat -A PREROUTING -i br-lan -p udp --dport 853 -j REJECT
I believe these rules, in combination with the UniFi settings, are enough to prevent the phoning home of telemetry by your Ubiquiti devices. I’m gonna wait a little longer, then do a DPF collection request and review the data the collected about me. For now, I will continue to use Ubiquiti, and I will keep expanding my network. If you really like the Ubiquiti hardware, interface, and/or feature set, they can be made privacy-friendly enough for normal use. I will continue to search for alternatives, but I am currently very happy with my setup.