How to Disable UniFi Telemetry and Stop Unwanted Data Collection

In this article

1. Understanding UniFi Phone-Home Traffic: Telemetry vs. Operational Cloud Access
2. Step 1: Disabling Diagnostic and Analytics Data in UniFi OS Console Settings
3. Step 2: Auditing DNS Logs for Ubiquiti Device Queries
4. Step 3: Blocking Diagnostic Endpoints via DNS Sinkhole (Pi-hole / AdGuard Home)
5. Step 4: Creating Firewall Rules to Prevent Hardcoded DNS Fallbacks
6. Verification: Confirming Remote Access and Firmware Updates Remain Functional

Modern network hardware relies heavily on cloud connectivity, diagnostic reporting, and automated telemetry. While features like remote management and automated crash reports streamline maintenance for many environments, homelab enthusiasts and privacy-conscious network administrators often prefer a tighter leash on their infrastructure.

Ubiquiti’s UniFi ecosystem is no exception. Out of the box, UniFi OS consoles, gateways, switches, and access points generate various outbound requests for updates, telemetry, and device management. If you want to stop UniFi phoning home, disabling a single toggle in the graphical interface is rarely enough. A thorough approach requires navigating system settings, auditing local DNS logs, and establishing robust firewall or sinkhole rules.

Understanding UniFi Phone-Home Traffic: Telemetry vs. Operational Cloud Access

Before modifying settings or blocking endpoints, it is important to distinguish between administrative cloud access and diagnostic telemetry data collection. These functions use separate mechanisms:

• Operational Cloud Access: This encompasses WebRTC signaling, remote management via unifi.ui.com, push notifications, and UniFi Site Manager integration. If you rely on managing your network away from home without a VPN, breaking these services will cut off remote access.
• Diagnostics and Telemetry: This category covers crash reporting, device performance metrics, anonymous usage statistics, and error logs sent back to Ubiquiti servers. This data is distinct from your actual network traffic payload; device-level metadata and diagnostic logs are reported by default.
• Core Maintenance Services: Basic functions like NTP time synchronization, certificate validation, and checking for firmware updates are essential for network health. Blocking these entirely can cause issues with device clocks and security features.

When you aim to disable unifi telemetry, the objective is to halt diagnostic reporting and background data collection without unintentionally crippling firmware updates or remote accessibility.

Step 1: Disabling Diagnostic and Analytics Data in UniFi OS Console Settings

The first line of defense is disabling built-in opt-out toggles within your UniFi Console. Depending on your UniFi OS version, these settings are split between the high-level system settings and the individual application preferences (such as UniFi Network).

1. Log into your local UniFi Console or Cloud Key as an administrator.
2. Navigate to Settings (the gear icon) at the system level.
3. Look for sections labeled System, Administration, or Console Controls.
4. Locate options referencing diagnostic data sharing, crash reporting, or product improvement programs. Toggle these options off.
5. Next, open the UniFi Network Application, navigate to its internal settings menu, and check for application-specific telemetry or analytics toggles (often found under system or maintenance menus). Disable them as well.

While these interface toggles disable the console’s active reporting features, individual managed devices—such as access points and switches—may still attempt background reporting routines. To achieve complete control over unifi analytics settings, you must move beyond the GUI.

Step 2: Auditing DNS Logs for Ubiquiti Device Queries

To identify what your hardware is trying to reach, perform a network audit using a local DNS sinkhole or firewall logging tool. If you manage network security similarly to how you approach segmenting IoT devices for security, you can isolate your UniFi gear and inspect its DNS requests.

If you use Pi-hole, AdGuard Home, or an enterprise firewall with DNS inspection:

• Isolate one UniFi Access Point or place your console on a dedicated management VLAN to simplify log filtering.
• Clear your DNS query logs.
• Reboot the device and observe the immediate outbound DNS queries it generates during boot-up and steady-state operation.
• Filter for queries directed at domains associated with Ubiquiti analytics, crash reporting, and device provisioning.

This audit phase clarifies which specific domains your hardware attempts to resolve. Because infrastructure endpoints can change between major software releases, auditing your own logs is far more reliable than relying on static, outdated domain lists.

Step 3: Blocking Diagnostic Endpoints via DNS Sinkhole (Pi-hole / AdGuard Home)

Once you have identified the specific diagnostic domains from your audit logs, you can implement a DNS-level block. DNS sinkholing is safer and cleaner than layer-3 IP blocking because it prevents devices from resolving telemetry domain names without disrupting valid IP routing.

• Open your Pi-hole or AdGuard Home dashboard.
• Navigate to your local DNS blacklist or custom blocking rules.
• Add the identified telemetry and analytics domains to your blocked list. Configure the sinkhole to return a null IP address (0.0.0.0 or local loopback) rather than a redirection page.
• Ensure that your UniFi gateway or switches are explicitly configured to use your local DNS sinkhole rather than public resolvers like 1.1.1.1 or 8.8.8.8 for their primary name resolution.

This approach effectively stops unifi data collection queries at the local resolver level, returning empty responses whenever diagnostic modules attempt to check in.

Step 4: Creating Firewall Rules to Prevent Hardcoded DNS Fallbacks

Some connected devices feature hardcoded DNS fallback mechanisms. If a device cannot reach its preferred telemetry endpoint via local DNS, or if it ignores local DHCP-assigned DNS settings and queries public resolvers directly, it may bypass your sinkhole.

To prevent smart devices from evading local DNS restrictions, implement a destination NAT (DNAT) or firewall interception rule:

• Create a firewall rule on your gateway that intercepts outbound port 53 (DNS) traffic originating from your UniFi management network or individual hardware IPs, forcing those requests to route exclusively through your local DNS server.
• Alternatively, block direct outbound HTTPS (TCP 443) connections to known telemetry IP blocks if your audit reveals persistent hardcoded IP connections that bypass DNS entirely. Exercise caution here to avoid blocking essential cloud services like firmware update servers.

For administrators seeking deeper visibility into outbound traffic patterns, running periodic log reviews or structuring network policies follows a methodology similar to how advanced users audit server configurations in a secure homelab.

Verification: Confirming Remote Access and Firmware Updates Remain Functional

After applying DNS blocks and firewall rules, verify that your network management plane still functions correctly. Test the following core features:

• Firmware Updates: Trigger a manual check for updates on an access point or switch. The device should still successfully pull update binaries from official distribution channels. If update checks fail, your blocklist is likely too broad and is catching content delivery network (CDN) endpoints.
• Local vs. Remote Management: Confirm that you can still access your console locally via its IP address. If you utilize cloud management, test whether unifi.ui.com still establishes a stable WebRTC session.
• Console Stability: Monitor your UniFi event logs for excessive error spam, connection timeouts, or looping retry states. If a blocked module continuously hammers a dead-end domain, it can occasionally fill up local logging partitions or generate alert fatigue.

By systematically auditing DNS queries, turning off native console toggles, and utilizing a local DNS sinkhole, you can successfully restrict unwanted diagnostic reporting while maintaining full control over your UniFi hardware.