So you would still need to run a wire from the switch to the area but it acts as a all in one? I have a few lots this would be great for cameras but getting a wire from the server room under concrete in a pain. So was hoping this would be the solution but not sure.

Am I missing something? My UDM Pro says that 5.1.33 is still the most current version of Unifi OS? I was under the impression that 6.0.11 had already been released.

Hi all,

I’m still very much getting used to the newer version of Unifi’s policy based routing system.

In a nutshell I have a very standard main lan / IOT VLAN situation

- Plex server (NAS) on the main LAN
- clients on the IOT VLAN I want to be able to access the server

Can you help me with the correct / most secure formatting of the policy rules to achieve that?

I have got it working but I suspect what I have isn’t the most secure. Essentially the rule allows all traffic, via the “internal” zone, for Plex servers(ip group) using Plex ports(port group).

Thanks

I'm not sure if I'm going crazy, but I'm 99% sure that you used to be able to see VPN usage on the iOS app; if a client was pulling via the VPN, you could see upload and download. I can't see the stats anymore, and I have to go into the more settings, web view version, not on the app.

A family friend is moving their business and I've become the go to guy on how they should restructure their network, camera system, and access control. I am aware this commits me to on call support for the foreseeable future! They were renting their previous property and are now moving to a space they own so I am thinking very long term on all of this. The business will have a primary office where the ISP will land, along with a few different outbuildings that will get added as time goes on.

Initial Gear list:

• UCG Fiber
  • From my research this is the way to go for cloud gateways. The business does not need the Beast and I will be adding an NVR for protect.
• Pro Max 48 POE
  • Initially there will only be around 6 cameras, 1 AP, and a few network drops in the office. But as time goes on there will likely be around 20 cameras so the 48 port is future proofing
• UNVR G2 Pro
  • Again this is mostly future proofing.
• WD Purple 8TB HDD's
  • What would be the minimum count of HDD's you would start with? I was thinking 4 but if I can start with less that would be great to save on cost at the beginning.
• UPS 2U Pro
  • I've seen a few mixed reviews on this so far but would rather stick with the Unifi ecosystem for a UPS if possible.

As the system expands the outbuildings will be linked to the network with single mode fiber buried in conduit. May end up doing Starlink as a failover ISP depending on network stability once everything is up and running. Cameras will be a mix of G6 Bullets and Bullets Pros, a few G6 turrets and likely two G6 PTZ's. There will likely be 2 or 3 Gate Hub's too.

• Is the UCG Fiber the way to go or should I be looking at one of the Dream Machines?
• Are the WD Purples the right choice? I know I am getting screwed on the pricing of those but not much I can do about that.
• Is the Unifi UPS the best way to go? I was also looking at some of the Eaton dual conversion UPS models.

Any other general thoughts or suggestions welcome! Looking forward to this build and will share pics when its done.

We are looking at potentially replacing a Switchvox system with Unifi Talk. However, one requirement we have is the ability to send audio directly to phones via standard multicasting. This is mostly for emergency alerts.

But I have not seen confirmation one way or another about whether I can assign multicast addresses to Unifi Talk phones.

When sending QR code guest access passes to our visitors, they regularly struggle to figure out where to scan that QR code. Most of them find the tiny QR symbol on the display, but nearly all then try to scan the code with the main camera or wiggle it around under the packet cam so it does not read.

It additionally does not help, that the official "how to"-link in the email invitation points to this page: [https://help.ui.com/hc/en-us/articles/29026995210775-Unlocking-Doors-with-QR-Code-in-UniFi-Access\](https://help.ui.com/hc/en-us/articles/29026995210775-Unlocking-Doors-with-QR-Code-in-UniFi-Access)

Which only shows the main camera unlock of the other access readers.

Is there:

* a) any ability to reconfigure the scanning camera to the main cam (i guess not)

* b) any official help center article how to use the product to be send to guests

I like the product very much, but this is just annoying and would basically take no time to fix on Unifi side to make the feature actually usable and great. Just another oversight, I guess...

I have a UDM Pro (two years old) running Unifi OS 5.1.33 and Network 10.6.109. I tried setting up a guest network a couple of months back and wanted to try again today, but I run into the same issue every time.

Whenever I setup a network (Settings > Network) as "Guest Network", clients in this network get a "this connection is not private" error when browsing the web (tested with iPhone). I tried to toggle all kinds of security settings, because I thought that this may have been the issue, but the only way to stop it is to disable the setting "Guest Network". I can enable "Isolate Network", which feels like it has a similar functionality, and on the Wifi setting also "Isolate Client Devices", but it's strange, that the "Guest Network" setting is causing this certificate error.

Has anyone noticed a similar behavior? What would be a good fix?

I have been beating my head against the same wall several others have been, but every question about how to activate the "Reorder" button for port forwarding rules has been locked. WTF? ¯_(ツ)_/¯

Anyway, I finally got an "ai" to answer:

AI Overview

You cannot directly reorder port forwarding rules in the Ubiquiti UniFi Network application because UniFi processes port forwards (Destination NAT / DNAT) simultaneously based on incoming packet matching rather than a strict sequential priority list. 

How to Control Traffic Priority Instead

If you need to change how traffic is handled, restricted, or prioritized, adjust your approach using these methods:

• Manage Firewall Rules Separately: When you create a port forward, UniFi automatically generates a corresponding allow rule in the firewall (WAN_IN or Zone-Based Firewall). If you want to block or filter traffic before or alongside a port forward, create a custom manual firewall rule and drag or position that rule above the auto-generated port forward rules in Settings > Security > Firewall (or Policy Engine).  Ubiquiti Community +2
• Use Specific Source Restrictions: Instead of relying on rule order to block unwanted IPs, edit your port forward rule and change the From field from Anywhere to Limited, then specify the exact IP address, subnet, or port group allowed to connect.  YouTube·Willie Howe +1
• Disable Unneeded Rules: If a rule is overriding or conflicting with another service, toggle the Enable switch off on the specific port forwarding entry rather than trying to shuffle its position in a list.  Beambox +1

Not very helpful, but it does lead me to believe that we lowly sysadmins and users are just NOT allowed to reorder rules, no matter what. I don't *think* that this is really a problem for me, personally, at this time, but it sure as hell triggers my OCD to have all my rules jumbled into a nasty messy heap with no relation among adjacent rules. :-/

Thanks everyone for steering me towards the UniFi ecosystem. I just renewed my contract with Community Fibre for another two years and managed to snag a great deal on the 2.5 Gbps package, so I'm finally planning to build out my home network around the following setup:
Gateway: UniFi Cloud Gateway Fiber (UCG-Fiber) connected to the Adtran multi-gig ONT via RJ45.
SFP+ Module: Ubiquiti UACC-CM-RJ45-MG to turn the 10G SFP+ LAN port into an RJ45 port for extra multi-gig wired expansion.
Workstation: MacBook Pro M3 connected via CalDigit TS3 Plus + Ubiquiti 5GbE USB-C to Ethernet adapter for dedicated 2.5G speeds.
Wi-Fi: A single UniFi U7 Pro powered directly by the UCG-Fiber’s 2.5G PoE+ port.
Note on coverage: My initial plan is to see if this single U7 Pro provides strong and consistent coverage throughout the entire flat. If there are any dead zones in the back room, I already have a Cat 7/8 wired run ready to add a second AP and a multi-gig switch later on.
A few questions for those running CF with UniFi:
Does Community Fibre assign IP directly via DHCP without VLAN tagging / PPPoE credentials once upgraded to the multi-gig ONT?
My connection is currently on CGNAT. One of my main reasons for moving to UniFi is enforcing Control D via DNS Shield (DoH) across the gateway/VLANs to bypass geo-restrictions on streaming gear (Apple TV, Smart TV). For those on CF with CGNAT, does this setup handle Control D and UniFi Teleport VPN smoothly, or did you find it necessary to pay for the static public IP add-on?
I'm also planning to add a NAS to this setup for local backups and media streaming. For those on CGNAT, how are you handling remote access to your NAS (Tailscale, Cloudflare Tunnels, QuickConnect, or static IP)? Any specific 2.5GbE NAS models you recommend pairing with UniFi?
If I do end up needing a secondary switch in the back room for a second AP and wired gear, what 2.5G + PoE+ switch would you recommend to keep native speeds? (I noticed the Flex Mini 2.5G doesn't do PoE Out and the USW-Ultra is 1G only).
Any feedback before I place the order is appreciated!

I manage several residential real estate properties and used a hodge podge of Hikvision and other cameras with Blue Iris.

After much research and hemming and hawing, I decided on a UniFi intercom on 2 doors and a pro reader on a third. I threw in a turret camera for kicks and picked up a used UDM pro.

I put off installing them because I assumed it would be a rabbit hole to set up and provision and involve a learning curve.

I prepared all the tenant fobs, sent Enpoint invites, and set the date for the doors to be locked and the reader to go in service. I held my breath for all sorts of hiccups. Zero. Not one.

I am by no means an IT expert. I’m just knowledgeable enough to be dangerous.

I cannot adequately say how absolutely delighted I am at how well everything just works.

I’ve switched all of my cameras to G6 turrets, and everything works just the way I want it to without any tweaking of motion sensitivity, IP address clashes, feeds dropping or anything.

The only thing I’m disappointed about is that the intercoms and readers don’t do motion alerts.

Have I just spent $5,000? Yes. Was it mandatory? No. Am I ecstatic? Yes.

I currently have 3 APs, one UX7 and two U7s (one pro XG one pro wall), all wired to the gateway. UX7 is not the gateway.

I need to add another AP to another room without wire, so I'm thinking meshing. Can I just buy another U7 to replace the currently wired UX7 and move the UX7 to the new room to get the MLO mesh, or do I need to buy another UX7 to mesh with the currently wired UX7? Their marketing stuff is all talking about how awesome the mesh is between UX7s, and has no mention about other APs.

Yesterday a UNVR G2 Pro landed on our doorstep for a customer. Surprisingly, it arrived earlier than I thought as it was on back order.

All seems to be well apart from a few setup niggles (it wouldn't find the internet initially) but after a few restarts it was OK.

The only thing I am struggling with so far is user permissions. The custom permission doesn't exist so setting up users to only access certain cameras, audio settings etc is not there. It's a major issue for this particular customer as they have some users which need to be restricted to some cameras etc.

Anyone else seen this issue and resolved?

Today in the home lab, I noticed that when I tried to programmatically create an isolated network via the API, it would not automatically start the DHCP server. After a little bit of troubleshooting, I found out that I had to manually create it in the GUI, or else whatever scripts it triggers on the gateway and on the switch are not run. Has anybody else seen this?

I am getting reoccurring errors of Backup Task Partially Completed"

Setup details:

• UNAS Pro located onsite
  • File share drive
  • timemachine drive
• Local macs perform timemachine backups to timemachine drive on the UNAS Pro
• UNAS 4 located offsite
  • site to site connection via SD-WAN (hub and spoke)
  • file share backup drive
  • timemachine backup drive
• UNAS Pro performs nightly backups of the file share drive and timemachine drive to their respective backup targets on the UNAS 4
• Backup task settings
  • file share - scheduled 2am, skip existing files
  • timemachine - scheduled 2:30am, skip existing files

The file share drive backup task never fails, and runs for an hour or less.

The timemachine drive backup task fails almost every day with the error noted above, and runs for 16+ hours.

I suspect there is some issue with trying to back up the timemachine files... maybe it is trying to overwrite the entire backup every run?

I'm relatively new to setting up the backup tasks and offsite features in Unifi, so hopefully this isn't something obvious.

I have a home network running a Dream Router and U7 AP. I have several VLANs configured, one of which has a routing policy to route via a VPN which I've set up in the unifi app using Wireguard config. VPN provider is Nord.

This all works as expected, and traffic from my streaming device routes via the VPN VLAN. However when I'm streaming, every so often (maybe every 10 minutes or so) the stream hangs for about 10 seconds.

However if I don't route via the VPN on the VLAN and instead use the Nord app on the streaming device to configure the VPN, it works flawlessly.

Have tried messing with the MTU as advised online, but hasn't made any difference. Has anyone any ideas why this might be the case? I.e. why would the VPN connection set up and routed via a VLAN on Unifi be less reliable than going through the Android app?

I was stuck on this for quite some time and finally fixed it this morning, but I figured I should post here in case anyone else encounters a similar issue.

For background, I inherited a home Ubiquiti setup with a Debian server running an old version of UniFi Network Server (and severely out of date packages), and other hardware included a security gateway, multiple access points, range extenders, and power strips. The former owners were not at all tech savvy and didn't even know their WiFi password or UniFi credentials, so I had to get root on the local Debian server to update an entry in MongoDB and give myself access in the first place, but that's a whole other story.

I recently ordered a UXG-Fiber and swapped it for the old security gateway, but I wasn't able to get the Network Server to add it, which didn't surprise me given how out of date the server was. No problem, I should really update everything anyway, so I upgraded the server in place to the latest stable Debian release, and installed UniFi OS Server. The server initially didn't start because I forgot to remove the Network Server first (whoops) but I removed it and the OS Server started just fine. I can't remember if I was prompted to carry over any settings as part of this process.

I was able to add the UXG-Fiber to the system now, but also had to re-add all the other hardware (sigh). I chalked it up to the Network Server running some old version that didn't carry over the configs. After this, I immediately experienced some oddities; setup for the UXG-Fiber had appeared to succeed, but then whenever I would connect to the network over WiFi, I would be prompted to "sign in." This would take me to unifi/ (and my browser would warn me had a self signed certificate) and the page would say that setup was complete, which would then take me to the management page after clicking a button. I thought it might be some weird captive portal issue, so I tried to toggle the captive portal on and then off, but it didn't resolve anything. I discovered that any out outbound unencrypted requests to port 80 were being redirected to unifi/, and there were other oddities like https://www.gstatic.com being redirected as well (which would fail due to HSTS).

Next I checked the Internet page in the settings, and saw something odd: multi WAN failover was configured, even though there is a single WAN. Attempting to change any settings on this page and apply them resulted in an error, which told me that the config was somehow screwed up. I connected directly to the UXG-Fiber and sure enough, there were errors in the logs about duplicate IP ranges from each of my "Apply changes" attempts.

I tried to see if I could find any relevant configs on the Debian server running the OS Server itself, but couldn't find anything. I really didn't want to wipe the server and have to re-register all the hardware again, so I exported a backup of the server config locally, then used the Antigravity (Gemini) CLI to read and fix the config. Sure enough, it found duplicate WAN configs, and removed the redundant one, removed the failover setting, and then created a new fixed backup for me. I restored this backup, and the problem was solved! No "sign in" required and I can access and modify the Internet configs just fine now.

I'm sure there was probably a much simpler way to fix things, but I couldn't figure it out after hours of troubleshooting. If anyone has better suggestions, please chime in to save others time in the future 🙂 Thanks!

Setup:

Verizon Fios 5GB

Cloud Gateway Fiber

Express 7

Situation:

I recently switched to Verizon fios 5gb from optimum 1gb fiber.

On optimum I got more consistent and higher speeds from the same distance: 500 to 800mbps.

I started everything brand new for this switch, but the speeds I'm getting are very low and inconsistent.

Through fios wifi I'm getting 200mbps to 800mbps, even when in the same room as the setup.

When connected through Ethernet to PC I get the max speeds:

1st PC - 2.5gbps (Ethernet port capped at 2.5).

2nd PC (mac MINI with 10GB nic) it maxes at 5gbp - 6gbps.

So, its not verizon!

But on WIFI devices it is all inconsistent. Iphone 13 pro max are 200mpbs avg, samsung galaxy 26 ultra are 500 to 800 avg.

I'm not sure if using the express 7 as an AP is underpowered for its range compared to what i got with optimums own router.

Update:

Also on the unifi when i try to do google speedtest from the google search speedtest, it tells me that it can't because its "busy", but when i switc back to optimum it works and the button is blue.

and on reddit all of my posts say they have been removed because of "reddit filters" but when i switch to optimum it doesn't say it.

update 2:

i returned it and got a u7 pro xg, but that is also getting the same issues.

Looking for solutions for mounting U6 Pro and U6 Lite APs in the corner of a room. Looking on Etsy and begging more confused. What has worked for you?

I recently bought seven U7 In walls for seamless high speed internet in my new house I bought and a switch with the 210w adapter to power them all. However I’m unable to connect through even one of the access points via the app from scanning the QR code on the back of the AP’s I attempted googling my solution and nothing useful turned up.

Am I missing anything? Everything is wired with cat 6e and does PoE

Hi, trying to redirect dns request while still using built in dns.
So for vlan 1 and 2 i want all dns to go to 192.168.1.2 but for all the rest of i want to use their respective network assigned dns from unifi.

I do still want vlan 1 192.168.1.0/24 to go to 192.168.1.1, but redirect dns internally to 192.168.1.2.
All the computers still using 192.168.1.1 but ultimately it should fail over again to 192.168.1.1 (but i guess thats not possible with this setup?).

Also while playing with dnat i notice that all dns traffic is already (from stock unifi) redirected to internal dns 192.168.1.1 without me creating a rule. Thats kind of annoying!

Thanks in advance!

With the php2shell disclosure today (Huntress write-up), I checked my home network for anything serving PHP. The one real hit was my UniFi Security Gateway USG-3P. If you still run one, this applies to you.

Which models: I verified this on the USG-3P only. The USG-Pro-4 (UGW4) runs the same 4.4.x firmware line, so it very likely ships the same PHP, but I haven't checked one. Run the commands below to confirm. The newer UniFi OS gateways (UDM, UXG, UCG, Cloud Gateway) are a different platform and aren't covered here.

TL;DR

• The USG-3P's built-in web page (https://<gateway-ip>, not the UniFi Network controller) is lighttpd + php-cgi PHP 5.4.42, on the final firmware 4.4.57. The USG is end-of-life, so no fix is coming.
• php2shell is pre-auth RCE in PHP that serves web requests (mod_php, PHP-FPM, php-cgi). Official fixes only go back to 8.2.
• The USG's local web page isn't needed once it's adopted. The controller manages it over the inform channel and SSH.
• Fix: bind the GUI to 127.0.0.1 with config.gateway.json, so it survives provisioning and reboots. Steps below.

The vulnerability (short version)

• CVE-2026-109618: out-of-memory handling during request setup leaves data half-initialised, and cleanup then treats it as valid. PHP validated RCE over HTTP against mod_php with default limits.
• CVE-2026-109619: request state survives after free. A later request on the same worker can hit the stale state, giving heap use-after-free, memory disclosure and RCE as the worker user.
• Unauthenticated, reachable before any application code runs.
• Fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35. Source-level backports exist for 7.4/8.0/8.1. Anything older (like PHP 5.4) is on its own.
• The EOL workaround in the advisory is session.upload_progress.enabled = Off. On the USG it isn't set, so it's the default (On), and the firmware isn't a sensible place to hand-edit php.ini.
• Reports differ on whether working exploits are public yet. Assume they are.

Am I affected?

SSH to the USG and check:

php-cgi -v | head -1
ps | grep -E 'lighttpd|php-cgi'
netstat -tln | grep -E ':(80|443) '

On mine: PHP 5.4.42 (cgi-fcgi) (built: Jan 12 2023), lighttpd running, listening on 0.0.0.0:80/443. From another machine, curl -skI https://<gateway-ip>/ returns a PHPSESSID cookie. That cookie was the quickest way to spot PHP on my LAN.

Note that the GUI answers on every interface address of the gateway (each VLAN's .1), not only the main LAN, unless you have LAN_LOCAL rules blocking it.

Fix: bind the USG GUI to loopback

Why not just delete service gui? It works live, but the controller re-pushes the full config on the next provision, and config.gateway.json can only add or override keys, not delete them. Binding to loopback can be expressed in the JSON, so it sticks.

1. Test live on the USG first (commit, don't save yet). A bad key in config.gateway.json can leave the USG stuck in a provisioning loop, so prove the command is accepted on your firmware first:

configure
set service gui listen-address 127.0.0.1
commit
exit

Check it:

netstat -tln | grep -E ':(80|443) '
# expect 127.0.0.1:80 and 127.0.0.1:443 only

From another machine, curl -sk -m4 https://<gateway-ip>/ should fail to connect, on every VLAN gateway address.

2. Make it persistent on the controller. Create config.gateway.json in the site folder:

• Self-hosted / Docker: <unifi data dir>/sites/default/config.gateway.json (for the linuxserver image: /config/data/sites/default/). Create the folder if it doesn't exist, and make sure the controller's user can read it.
• Replace default with your site ID if you're not on the default site (it's in the controller URL: /manage/<site-id>/...).{ "service": { "gui": { "listen-address": "127.0.0.1" } } }

Validate it (python3 -m json.tool config.gateway.json). Invalid JSON is the classic cause of provisioning loops.

3. Save on the USG so a reboot before the next provision doesn't bring the GUI back:

configure
save
exit

4. Force a provision from the controller (Devices → USG → Manage → Force Provision, or change any small USG setting). Then re-check netstat and curl from step 1.

Rollback: delete config.gateway.json, force provision, and the GUI comes back with the controller defaults.

What you lose and what you keep

• Lose: the gateway's local status/login page. If the controller is down, you manage the USG over SSH instead.
• Keep: everything else. Routing, firewall, DHCP, DNS, VPN and controller management are all unaffected. The controller never uses that page.

Other things worth checking

• Synology: DSM 7.x ships a system PHP (8.1.x on mine) and an optional "PHP 8.2" package (8.2.30 on mine, below the 8.2.35 fix). On my NAS nothing was wired to serve it: no Web Station, no php-fpm running, no fastcgi_pass in nginx. If you run Web Station, WordPress or any PHP site on a Synology, you are serving PHP. Watch for Synology's update, take it off the internet, or set the upload-progress workaround. Uninstall the PHP package if nothing uses it.
• Anything with a PHPSESSID cookie or X-Powered-By: PHP header. A quick loop with curl -skI over your LAN's web ports finds these. Cameras, NAS boxes, routers, control panels (cPanel/Plesk), WordPress/Nextcloud/etc. containers.
• Docker: check images for PHP: docker exec <c> sh -c 'php -v'. Official php:*, wordpress, nextcloud and linuxserver/* PHP apps need the new base images.
• EdgeRouter (EdgeOS): same lineage as the USG and also uses lighttpd for its GUI. I don't have one to confirm the PHP version, so check yours with the commands above.
• UDM / UniFi OS / UXG / UCG: not checked; different platform.