Mentioned it before, but since a few days ago my unifi devices (2 wifi APs, a small switch, plus one Debian VM with the controller, all on it's on VLAN) are not allowed to do outbound traffic anymore, with the exception of NTP, DNS and one trusted apt mirror.
Looking at the firewall logs it seems the devices try to ping (ICMP type 8) a bunch of AWS IPs every few hours. The controller tries to connect 80/443 on different AWS IPs a lot more often, even without me navigating the web interface. Other than that, no ill effects. Device firmware update notifications are gone, just says "up to date" now.
Interestingly, I still see the ad for their "dream machine" on the dashboard, as it seems to be baked into the controller. It's also trying to load external resources from "net-fe-static-assets.network-controller.svc.ui.com" while navigating the new web interface. The "classic" interface still seems to be truly self-contained. Using the latest controller version as of today (6.1.71-15061-1).
Condensed firewall logs for reference below. Not that it matters much, but why not.
Unifi controller VM:
zgrep unifidrop /var/log/syslog\* | grep "SRC=$unificontroller" | awk '{print $12, $21}' | sort | uniq -c | sort -h
5 DST=13.224.246.17 DPT=443
5 DST=143.204.174.59 DPT=443
5 DST=143.204.174.83 DPT=443
5 DST=34.210.116.187 DPT=80
5 DST=34.211.38.191 DPT=80
5 DST=34.218.198.60 DPT=80
5 DST=99.84.5.14 DPT=80
5 DST=99.84.5.24 DPT=80
5 DST=99.84.5.51 DPT=80
5 DST=99.84.5.82 DPT=80
7 DST=13.224.246.67 DPT=443
7 DST=13.225.74.11 DPT=443
7 DST=13.227.220.19 DPT=443
7 DST=13.227.220.38 DPT=443
15 DST=54.201.165.155 DPT=443
25 DST=44.239.243.150 DPT=443
28 DST=44.238.226.202 DPT=443
28 DST=52.89.51.163 DPT=443
28 DST=54.218.175.125 DPT=443
Unifi devices (all ICMP 8):
zgrep unifidrop /var/log/syslog\* | grep -v "SRC=$unificontroller" | awk '{print $12}' | sort | uniq -c | sort -h
2 DST=13.224.230.94
2 DST=143.204.9.24
4 DST=99.84.6.169
6 DST=52.84.94.172
6 DST=54.230.54.165
24 DST=52.222.138.169
Looking at the firewall logs it seems the devices try to ping (ICMP type 8) a bunch of AWS IPs every few hours. The controller tries to connect 80/443 on different AWS IPs a lot more often, even without me navigating the web interface. Other than that, no ill effects. Device firmware update notifications are gone, just says "up to date" now.
Interestingly, I still see the ad for their "dream machine" on the dashboard, as it seems to be baked into the controller. It's also trying to load external resources from "net-fe-static-assets.network-controller.svc.ui.com" while navigating the new web interface. The "classic" interface still seems to be truly self-contained. Using the latest controller version as of today (6.1.71-15061-1).
Condensed firewall logs for reference below. Not that it matters much, but why not.
Unifi controller VM:
Unifi devices (all ICMP 8):