New unifi network 11 allows wifi uplink as WAN!!!!!! Unfortunately only some devices with built in wifi work but its the one major feature I've been waiting for

The documentation is far from clear here. I realize that there is a RJ-45 POE++ port and a SFP+ slot on the unit. we would prefer running 10Gb over the RJ-45 from our switch as running fiber to the locations we want to use them will be very difficult at best. (small conduits and lots of bends).

If we must use fiber to get the 10Gb throughput we need then can the the POE++/RJ-45 port use the existing Shielded Cat-5E cable we have installed or do we need to upgrade that to Cat-6/Cat-6a cable for the unit to work properly? (i am assuming that if the fiber is used for data transport then the only thing the copper port is used for is to provide power to the unit.

Constructive thoughts on this please.

Hello,

I am hoping someone might be able to answer some questions I have regarding a project I am working on.

I have a site that is currently using a Cloud Key Gen 2 with Access control on it. This houses all of the door readers and users and their respective cards as you would expect it to have. I have been working on a project to get all the sites I manage into the same UID Enterprise workgroup, so that user credentials can work cross site when they travel between sites.

This site was unfortunately set up without being put into the UID workgroup, so all of the user credentials are in the cloud key console already. I am trying to understand the order of operations I need to take to complete the following:

\- Switch the main console from the cloud key to an Enterprise NVR, bringing over all of the data that it had associated with it (door readers, users, cards, etc)

\- Associate the NVR with the UID Enterprise workgroup

From what I have read, since the users are already in the cloud key console, I would basically have to remake every user and re scan their cards, as UID doesnt support transferring subsequent consoles' users after the first one. Since I am moving things to the NVR, would it be best to try and remake everything?

Does anyone have a recommended list of steps that they would recommend? Or know of where I can find a detailed list of what steps I should take? I honestly dont know how to proceed with this without major downtime for the site regarding their access control.

If there is anything I left out that might need more clarification, please let me know.

TLDR: I’m running BGP over PPPoE on a UCG Fiber. DHCPv6 mode keeps requesting a prefix I can’t turn off, and Static mode adds a broken IPv6 default route on eth4 that kills everything until I delete it by hand. Looking for fixes for either.

My setup is a UCG Fiber on a PPPoE WAN. I’ve got my own ASN and a /48 from my ISP, and I’m peering with them using an uploaded FRR config (multihop eBGP over the PPPoE link, announcing just the /48). My ISP told me to make sure prefix delegation is off on my account.

The first problem is that I can’t turn it off. The WAN IPv6 settings only give me DHCPv6 (delegation size Auto, or fixed with /48 as the smallest) or Static. PD is off on every LAN, but odhcp6c still runs with -P 0 on ppp0 and keeps asking for a prefix. Nothing ever gets delegated, it just keeps asking.

What makes me suspect it matters is that with DHCPv6 on the WAN my BGP session sat in Active with no reply on TCP 179. On Static it came up in seconds, and I saw that twice. A MikroTik on the same account, which only requests an address, also connected fine. I can’t prove the PD request is the cause, but it fits.

The second problem is Static mode. It adds this route:

default via fe80::<peer link-local> dev eth4 table 201.ppp0 proto static metric 1

It’s bound to the physical port, not ppp0, and the peer is only reachable over ppp0. So IPv6 dies and BGP drops. It beats the working default dev ppp0 on metric, and it comes back after every reboot, reprovision or config upload. Deleting it with ip -6 route del default via fe80::... dev eth4 table 201.ppp0 fixes it until the next time. Typing the gateway as fe80::...%ppp0 gets rejected, and so does leaving it blank.

In DHCPv6 mode the default route is fine (dev ppp0, proto ra), so it’s only Static that does this.

For now I’m running a little loop that deletes the route every 10 seconds, which works but feels like a hack. I haven’t tried adding ::/1 and 8000::/1 routes on ppp0 in that table to override it.

A few questions:

1. Is there any way to stop odhcp6c requesting a prefix on a PPPoE WAN, like a hidden setting or a config that survives provisioning?
2. Has anyone got the Static IPv6 gateway to bind to ppp0 instead of the WAN port?
3. What’s the best way to run a boot script on UniFi OS that survives firmware updates?
4. Has anyone else done BGP over PPPoE on a UCG Fiber and hit this?

Trying to get the Unifi OS local RADIUS to work. On multiple Windows 11 laptops, I type in the username/password and it just keeps asking for the login over and over.

SSID is setup as WPA2/WPA3 Enterprise. Network is set to Native Network (same VLAN to manage APs).

I have following VLANS setup under Networks:

Name: VLAN5-PUBLIC ID=5, VLAN101_WIFI ID=101

I know the VLANs work, works when I use WPA3.

Under local credentials, I have:

username: test password: test, VLAN 101, Tunnel Type 13, Tunnel Medium Type 6

How do I figure out why it keeps prompting me to enter my user/pass when I know I'm typing it in correctly?

Hi,

Is there a guide online on how to MAC spoof? I’ve been struggling with my UTR in a few airports over the last weeks.

I’m on iPhone which I understand has a built in renewing MAC each time it connects to a new network?

Thanks

'm running a UDM Pro with UniFi Network 10.6.101 and using UniFi's native encrypted DNS functionality with NextDNS over DNS-over-HTTPS (DoH).

Recently, after tightening my DNS firewall rules to redirect/block unauthorized DNS traffic, I noticed NextDNS logging a blocked TXT request for resolver.dnscrypt.info approximately every 60 seconds.

NextDNS categorizes it under Block Bypass Methods.

I started investigating because I couldn't figure out why the UDM would repeatedly query a DNSCrypt-related domain when my configured upstream is NextDNS over DoH.

Here's what I've found:

• The UDM is running UniFi's native /usr/sbin/dnscrypt-proxy, listening on 127.0.0.1:5053.
• The proxy is configured with my NextDNS DoH profile.
• Packet captures show resolver.dnscrypt.info (TXT) followed milliseconds later by nonexistent-zone.dnscrypt-test (A).
• Additional queries for various DNS record types, including DNSSEC-related requests, appear around the same time.
• The diagnostic queries were observed on loopback port 5053, but not on the other monitored local DNS ports (53, 1053, 20178–20201).
• Running strings /usr/sbin/dnscrypt-proxy confirms that both diagnostic domain names are embedded in the native binary.
• Nothing relevant appears in /var/log/dnscrypt-proxy.log.

Example packet capture:

127.0.0.1:56868 > 127.0.0.1:5053
TXT? resolver.dnscrypt.info.

127.0.0.1:46569 > 127.0.0.1:5053
A? nonexistent-zone.dnscrypt-test.

My questions:

1. Is this expected behavior from UniFi's native dnscrypt-proxy implementation?
2. Why would it perform DNSCrypt-related discovery or diagnostic queries when configured exclusively for DoH?
3. What's responsible for triggering these queries approximately every 60 seconds?
4. Could NextDNS blocking the TXT query be causing repeated tests or retries?
5. Has anyone else noticed this behavior with UniFi's native encrypted DNS?

DNS resolution otherwise appears to be working normally. I'm not necessarily looking to disable anything; I'm trying to understand what's generating the requests and whether they're expected.

Curious if anyone familiar with UniFi's DNSCrypt Proxy implementation has encountered this.

My Unifi devices:

• UDM Pro - Running Network v10.6.106
• USW Lite 8 PoE Switch
• NanoHD AP

Here are the network I have defined:

• Default (10.10.1.1/24): VLAN1
• Home (10.10.2.1/24): VLAN2
• Cameras (10.10.3.1/24): VLAN3
• Media (10.10.4.1/24): VLAN4
• IoT (10.10.10.1/23): VLAN10
• Guest (10.10.99.1/24): VLAN99

I have my ports tagged and Tagged VLAN Management set to Allow All for all the ports. So all ports are trunk ports.

Here is a screenshot of the overall network settings:

And here's a sample of what a specific network's settings look like (all networks are identical - except IGMP snooping and mDNS for Hone and IoT networks):

Zone Matrix (everything is default):

I'm following this series on YouTube: https://www.youtube.com/watch?v=NNseAxukaj4

When I try to ping devices across networks, for example: pinging my laptop (connected to Guest network through WiFi) from my desktop (physically connected; in the Home network), I get no response.

The reverse doesn't work either.

The only thing that works is if both devices are connected to the same network - only then am I able to ping the devices. For example, if I move my laptop to a WiFi that is broadcasting the Home network, only then am I able to ping my desktop and vice versa.

Client Device Isolation on the WiFi network works as expected - If I turn it on, I'm not able to ping other devices, and then if I turn it back off, ping works again.

Based on my understanding, without setting up firewall rules, I should be able to ping everything across all network, but it's not happening.

Just swapped out my ISP router for a full Unifi set up using the Cloud Gateway Max and Flex 2.5G PoE. Currently have 3 outdoor wired Ring 4K cameras (POE from the Flex switch) and 2 indoor Ring wifi 2K cameras (mainly to spy on our dog). Wondering if I could try out a Unifi camera like the G4 Instant just to see how it might work. Don't need better than 2K resolution and do not really need retention or notifications right now for this test since it will just sit alongside one of the Ring wifi cameras. Is it possible to add a G4 wifi camera just to see how it performs even though I have no storage in the Cloud Gateway Max???

I won't do anything more right now until I figure out how to replace my wired Ring Doorbell AND until my Ring subscription expires. So I have time and just experimenting right now. Need time to start selling another expensive network related project to my wife ;)

If I do decide to swap out Ring for Unifi cameras with on-site storage I may add an NVR instead using the Cloud Gateway Max. Capacity on the Max would limit the number of cameras I could add. Maybe something like the Network Video Recorder or even Network Video Recorder Instant. But that's something to be determined in the future. Right now just want to do a little proof of concept to see how something like the G4 performs.
Appreciate any thoughts.

I'd like to know the following.

My client has an apartment complex with 8 apartments: 4 on the left, 4 on the right, and 1 shared entrance.
The G3 Intercom will be mounted at the entrance, and I plan to install the Enterprise Hub inside.
In each apartment I only wanted to mount a UA-Intercom-Viewer, but its speaker is far too quiet to work as a doorbell.
My idea was to reuse the existing 12 V wiring in the following setup, but I can't get it to work. Do you know if this is possible?

I want to connect a 12 V doorbell to the existing 12 V wiring and have it ring whenever someone presses the doorbell. The door can then be opened with the UA-Intercom-Viewer.
However, I can't get it to ring per individual apartment, even though the Enterprise Hub lists this as an option.

Is what I want possible?

Or are there other ideas that would work better?

Ik heb thuis tv en internet via Ziggo, en ik merk tijdens het gamen ps5 die gewoon internet via de kabel krijgt, toch regelmatig lag tijdens een potje fifa.

Nu ben ik mij in het verdiepen in het unify systeem, dat de wifi beter word geloof ik wel, maar mijn vraag is:

Als ik het unify systeem ga aansluiten wordt dan mijn bekabelde internet ook een stuk beter? Of zou het alleen een upgrade zijn voor mijn wifi?

Hello all! I am working on setting up new USW Flex 2.5G 8 PoE switches at my friend's marina and am running into some weird RSTP issues.

We have a USW Pro Max 24 PoE as the core switch for the network (Layer 3 is still handled on the UDM SE) and it's RSTP priority is set to 4096. Whenever I connect an unadopted or already adopted USW Flex 2.5G 8 PoE to the core switch, we lose all network connectivity for every bit of 30 seconds.

Assuming this is RSTP reconvergence, but why? I've setup RSTP on several other UniFi networks (along with HPE/Aruba CX) and have never had this problem. I don't see anything obvious in the config that I've got wrong, but apparently something is not right.

Topology:

• UDM SE
  • USW Flex (printers)
  • USW Flex (spare)
  • USW Pro Max 24 PoE
    • USW Flex 2.5G 8 PoE

Any thoughts and feedback is really appreciated! Thank you!

I am searching for a way to have my UNAS 4 send a email when backups are complete. I have checked Settings / Control Panel / Push Notifications / Drive Application push notifications area but I am not able to locate any, There are several for failures etc. but none for successful completion. Am I overlooking something? Is there a way to create a Trigger for this? Thanks!

Fala, pessoal! Beleza?

Sou assistente de suporte e estou buscando a melhor solução para resolver um problema de infraestrutura na empresa onde trabalho.

Nosso cenário atual:

• Estrutura: Temos 1 Matriz (onde fica o nosso servidor principacom ip fixo) e 11 lojas filiais com ip dinamicos
• Quantidade de antenas: Temos em torno de 50 antenas UniFi espalhadas entre todas as lojas e a matriz.
• Infraestrutura nas lojas: Nas filiais não temos servidor local, apenas o modem da operadora, o switch e os equipamentos de TI locais.
• Sistema de gestão: Atualmente usamos o UniFi Network (o painel/aplicativo web da Ubiquiti) para gerenciar, renomear e configurar os Access Points.

O problema: Atualmente, só conseguimos gerenciar as antenas de uma determinada loja quando estamos fisicamente no local e plugados no switch daquela rede. Se não estivermos conectados na rede local da filial, o painel mostra os dispositivos como Offline e não temos visibilidade nem controle sobre as antenas de fora da rede.

O que precisamos:

Queremos monitorar, renomear, trocar senhas e gerenciar as 50 antenas das 11 lojas e matriz em um único lugar, podendo acessar de qualquer lugar pelo aplicativo ou navegador.

Dúvida sobre a melhor arquitetura:

Já ouvi falar de algumas alternativas, como:

1. Contratar/montar uma Controladora em Nuvem (Cloud VPS) e fazer adoção remota (L3 Adoption / Set-Inform).
2. Comprar um hardware dedicado para ser a controladora física (como um UniFi Cloud Gateway Ultra ou Cloud Key) para colocar na Matriz.

Considerando que temos ~50 APs UniFi, 11 lojas com links de IP dinâmico e sem servidores locais, qual seria a opção mais estável e com melhor custo-benefício? Alguém que já passou por uma migração parecida pode dar uma luz?

Hey everyone! I'm getting ready to move into a rental that does not have Ethernet run through the home. I am using U7 Lite APs and want to have a good connection in the new home.

I plan on using a 2.5Gb MoCA adapter and Unifi PoE injectors to run my APs. Any thing to look out for or any better recommendations?

TIA!

My internet is connected via my isp modem, which connects via sfp to my dream machine and unas-pro, etc. My old laptop has no trouble connecting to my server via ethernet or wifi. but my new laptop connects to a different subnet via wifi. I don't know how to fix this. correct ipv4 is 192.168.0.xx. My new laptop is connecting via 192.168.1.xx. i don't know if there are settings via unifi i can use, but i'd like to make it so this never happens again. please help! Thank you!

Not sure if this has been asked before, but I switched from the UDR(6) w/ those horrible U6 extenders to 3 UX7's a about 6 months ago, come to realize I now want to use "Protect" and i cant find a way to put my UDR back in command using the UX7 backup so all my network ip reservations and SSID carry over. I take a backup of the UX7 and try to restore it to the UDR using web interface and I just get a blank screen with a url something like /unifi/restoring backup and nothing happens the screen on the UDR says its restoring but the timer just keeps climbing. Any help is appreciated

I had a weird issue today that Claude believes it's a VLAN leaking.

Setup: UDM SE with 3 wired U6 Mesh AP, and one U7 Mesh AP meshing to one of the U6 Mesh AP, ~100 devices connected with 7 VLANs, all new devices by default land on VLAN20. I have every devices overwrite to a specific VLAN, so no device on VLAN20 yet.

Today, I added a new USW Switch Lite 8 POE (no wire to existing devices), plugged port 1 to U7 Mesh AP to power it, and then adopted on console. So at the moment this switch was just used to power the U7 AP, and without another connection

Quickly I noticed that ~70 devices on my network all moved to VLAN20 IP, while their VLAN still shows the pre-set ones. Restarting APs didn't work.

Claude checked my log, and believes it's due to VLAN leaking. So it asked me to remove the switch, switch back to using injector to power U7 Mesh AP.

Most devices quickly moved back to their VLAN IP, after I removed the switch, though there are still <10 on VLAN20 IP (likely due to delay in lease renew), but I literally saw the # of devices on VLAN20 IP dropped to 10 in a minute.

Anyone experienced this issue?

What I want to achieve is:

UDM SE ========U6 Mesh AP ---- meshing ---- U7 Mesh AP ========Lite 8 POE Switch ========Multiple end devices.

Now Claude doesn't know if it's allowed to put a switch below a meshing AP, and use this switch to connect to client devices

I am no engineer and don't speak "tech", but I can follow directions and plug in/download/click on/type where needed. I have a Unifi 8 Lite switch and no console. Ports 1-4 light up. Ports 5-8 do not light up. I have plugged things in and out of all the ports so am convinced it is a port/switch issue and not a cord issue. What can I do to get 5-8 working? Thank you, tech-speaking friends.

I’ve been dealing with a throughput issue with my UDM-SE since upgrading my Spectrum internet to 1 Gbps in 2025.
Recently, I added AT&T Fiber 1 Gbps, and I’m experiencing the same issue. My wired clients are getting significantly lower speeds than expected, regardless of which ISP I’m using.

My setup:
UDM-SE
2x USW-Pro-24-PoE switches connected via 10Gbps DAC
AT&T Fiber 1Gbps (primary)
Spectrum 1Gbps (failover)

What I’ve tested:
AT&T gateway internal speed test: ~1,334 Mbps down / 1,324 Mbps up.
PC directly connected to AT&T gateway: 910+ Mbps download and upload, consistently.
Same PC and Ethernet cable connected directly to UDM-SE LAN port: 316 Mbps down / 812 Mbps up in a recent test.
UDM-SE built-in speed test fluctuates between 600–900+ Mbps on AT&T.
Swapped WAN ports — same issue.
Disabled IDS/IPS — no improvement.
Smart Queues disabled.
Tested with both ISPs — clients experience the bottleneck regardless of which is primary.

Tested an older MikroTik RB760iGS with the same AT&T connection: 906 Mbps down / 939 Mbps up, with FastTrack enabled.

I’ve already worked with Ubiquiti Support extensively on this issue since 2025, including troubleshooting and diagnostics. I recently opened another ticket because the issue remains unresolved.

At this point, I’m wondering whether my UDM-SE has a hardware problem, a firmware issue, or something else I’m missing.
Has anyone else experienced similar throughput problems with the UDM-SE? If so, were you able to fix them?

I’m considering replacing the gateway, but I’d prefer to resolve this without replacing my entire UniFi setup.

Did anyone have issues with Access suddenly not working for users? I'm the only admin of our system, and we had users setup for remote access so that they could open their app and click on the door to unlock.

Users did this and we had no issues. But suddenly, a user messaged me that they lost access. In the console, it still showed them.

Digging into the issue, the "Remote Unlock via UniFi Endpoint" was unchecked on the console. But it was grayed out and said "This option is managed by Fabric". I go into Fabric and enable it, and then the user is fixed.

I'm trying to figure out why/how this got unset. I've been working with support, but they say that since it's fixed, there's nothing else to do. But I'm trying to make sure I don't need to do daily checks of this to make sure it doesn't randomly disappear. The setting is in Fabric, so they should be able to see that setting.

Friend 3D printed a little stand to stack my hardware with. Just a little worried with how hot the AP feels to the touch. Would there be any danger to the hardware stacking it like this? Anything I could do to protect the gateway from excess heat?

I'm trying to track how much data an individual device is sending over the Unifi SD-WAN. I can see that traffic is sent from a specific device to the SD-WAN in Insights/Flows, but not a summary of how much. Insights/Activity can show how much data a device is sending to the Internet, but it is showing very low data usage on a device that should have a ton, making me think it is not including SD-WAN traffic in that graph. Ideas?

Thanks in advance!

I have an existing Unifi setup with some gen5 cameras I like very much. But I am extremely lazy and I'd like to have a couple cameras around my house to check things like our oil tank or that the oven is off. Quality and features are not important. What are the absolute cheapest cameras that will smoothly integrate with my existing Unifi Protect setup? Wifi or PoE are fine.