# Ubiquiti (UniFi) CyberSecure - Suricata- reports false SyncThing Threat

**URL:** https://forum.syncthing.net/t/ubiquiti-unifi-cybersecure-suricata-reports-false-syncthing-threat/26952
**Category:** Support
**Created:** [July 25, 2026, 10:28pm UTC](https://forum.syncthing.net/t/ubiquiti-unifi-cybersecure-suricata-reports-false-syncthing-threat/26952 "2026-07-25T22:28:43Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![LikesToys](https://forum.syncthing.net/letter_avatar_proxy/v4/letter/l/b487fb/32.png) [@LikesToys](https://forum.syncthing.net/u/LikesToys)
#### Post date: [July 25, 2026, 10:28pm UTC](https://forum.syncthing.net/t/ubiquiti-unifi-cybersecure-suricata-reports-false-syncthing-threat/26952/1 "2026-07-25T22:28:43Z")

</div>

My UniFi Network Gateway runs Suricata and every hour or so I get a security alert which I believe is FALSE saying that one of my devices has traffic that is Blocked as it matches a known threat profile because a TOR exit group is used (at least that is what I think as all of this is a bit above my skill level). I can remove the alert based on IP address, but they seem to vary so I don’t think I can disable them on my end. Is there some way to turn this off in SyncThing. I am on the latest version of everthing. Running Mac OS Tahoe. I have turned off Enable NAT traversal, Global Discovery and Enble Relaying. Anyone actually solved this? See message below.

 ![image](https://forum-uploads.syncthingcdn.net/original/3X/3/b/3b7eb4934d76d3f495d61f17c1d3b387e8c75d2f.png)

---

<div class="post-metadata">

### Author: ![calmh](https://forum.syncthing.net/user_avatar/forum.syncthing.net/calmh/32/15311_2.png) [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [July 26, 2026, 6:08am UTC](https://forum.syncthing.net/t/ubiquiti-unifi-cybersecure-suricata-reports-false-syncthing-threat/26952/2 "2026-07-26T06:08:59Z")

</div>

That is a relay connection, so disabling relaying is the correct answer and should work.

---

<div class="post-metadata">

### Author: ![LikesToys](https://forum.syncthing.net/letter_avatar_proxy/v4/letter/l/b487fb/32.png) [@LikesToys](https://forum.syncthing.net/u/LikesToys)
#### Post date: [July 26, 2026, 11:48am UTC](https://forum.syncthing.net/t/ubiquiti-unifi-cybersecure-suricata-reports-false-syncthing-threat/26952/3 "2026-07-26T11:48:39Z")

</div>

is there any way to do this on mobius sync?

---

<div class="post-metadata">

### Author: ![calmh](https://forum.syncthing.net/user_avatar/forum.syncthing.net/calmh/32/15311_2.png) [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [July 26, 2026, 11:55am UTC](https://forum.syncthing.net/t/ubiquiti-unifi-cybersecure-suricata-reports-false-syncthing-threat/26952/4 "2026-07-26T11:55:58Z")

</div>

No idea, you’d have to ask them.

---

<div class="post-metadata">

### Author: ![bt90](https://forum.syncthing.net/user_avatar/forum.syncthing.net/bt90/32/18565_2.png) [@bt90](https://forum.syncthing.net/u/bt90)
#### Post date: [July 28, 2026, 6:46am UTC](https://forum.syncthing.net/t/ubiquiti-unifi-cybersecure-suricata-reports-false-syncthing-threat/26952/5 "2026-07-28T06:46:52Z")

</div>

A bit offtopic but is there still a reason to use Mobius Sync whit Synctrain being a thing now?

---

<div class="post-metadata">

### Author: ![system](https://forum-uploads.syncthingcdn.net/original/2X/0/0b50e0a202b22ae6a67190759e8c868805b8ed9f.png) [@system](https://forum.syncthing.net/u/system)
#### Post date: [August 28, 2026, 3:39pm UTC](https://forum.syncthing.net/t/ubiquiti-unifi-cybersecure-suricata-reports-false-syncthing-threat/26952/7 "2026-08-28T15:39:29Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.