UniFi Network 2026 — Complete Setup Guide, Start to Finish

Initial Setup & Adopting Your Gateway

Bluetooth-based setup — be within a few metres of the console

Start by factory resetting the console to begin clean. There are two ways to complete initial setup: via a browser (type unifi.ui.com or the device's local IP) or via the UniFi mobile app, which connects over Bluetooth. The app route is generally the easiest.

During setup you can restore from a backup immediately — useful if you are rebuilding an existing site. The setup wizard also checks your internet connection and shows latency and IP information per WAN port.

InsideWire tip: Always set dark mode as the first thing you do after logging in — Settings → Appearance. It makes everything easier to read and is how most UniFi documentation and YouTube content looks.

WAN Settings — IPv4, IPv6, DNS

Settings → Internet → select your WAN interface

Go to Settings → Internet to configure your WAN connections. If your ISP provides a static IP, select Manual and enter the IP, subnet, gateway, and VLAN ID if required (some ISPs like FTTP providers use a specific VLAN tag on the WAN port).

DNS servers: Set your preferred DNS in the WAN settings. Good defaults are 1.1.1.1 (Cloudflare) as primary and 8.8.8.8 (Google) as secondary. These apply to both IPv4 and IPv6.

Multiple WANs: The UDM Pro Max supports multiple WAN connections. You can configure failover (primary + backup) or load balancing with percentage weighting. Use the drag-and-drop interface to set priority order.

WAN SLA monitoring: Create custom SLA profiles to define exactly when a WAN link is considered failed — using packet loss, latency, and jitter thresholds with multiple verification servers. This prevents false failovers.

InsideWire tip: Set automatic speed tests to run at 1am daily so you have a historical record of whether you are getting the speeds your ISP is contracted to deliver.

UniFi OS System Settings

Go to Settings → System for the UniFi OS level settings. Key areas:

• →Updates: Disable auto-updates and control them manually. Set your release channel — Official for production, Release Candidate if you want early access to new features.
• →Backups: Weekly automatic backups are the default. Download a manual backup before making major changes. You can restore individual applications independently.
• →SSH: Configure SSH access with a username, password, and optional SSH keys. Required for advanced troubleshooting.
• →Push notifications: Configure email or push alerts for console events — updates, admin activity, backups.

Important: Device auto-updates default to on. Turn this off and schedule them manually for production environments — especially for switches and access points during business hours.

Changing Your Default Network

The default network ships as 192.168.1.0/24. This is optional to change, but using a 10.x.x.x scheme makes it much easier to manage multiple VLANs later — you can use a consistent naming convention like 10.10.10.x for management, 10.10.20.x for main, 10.10.40.x for IoT, and so on.

After changing the subnet, all connected devices will need to renew their DHCP lease. On Windows, run ipconfig /renew in Command Prompt to pick up the new address immediately.

InsideWire tip: Always untick 'Autoscale network size' on every VLAN. This setting automatically expands your subnet when addresses run out, which can cause unexpected behaviour and makes IP planning unpredictable.

Adopting Devices & Setting STP Priority

Devices page or Topology view

With devices powered on and connected, they will appear in the Devices page as pending adoption. Click Adopt on each one. Work from the bottom of your network up — adopt access points and end devices first, then edge switches, then aggregation switches, then the gateway last.

Once adopted, the topology view shows your full network hierarchy visually. If you see a warning about STP priority, address it:

STP Priority values by layer:

InsideWire tip: Always adopt in order and set STP priorities before connecting clients. Getting STP wrong on a busy network can cause broadcast storms that take everything down.

DHCP Reservations & Static IPs

Before assigning static IPs to infrastructure devices, shrink your DHCP range to leave a block of addresses at the bottom for manual assignment. Set the DHCP start address to .50 rather than .1 — this gives you .2 through .49 for static assignments without risking conflicts.

Assign static IPs to all network infrastructure (switches, APs, cameras) through the device settings page. Use a consistent scheme — e.g. .2 = aggregation switch, .3 = switch 1, .4 = switch 2, and so on. This makes management and troubleshooting significantly faster.

Planning Your Networks & VLANs

Settings → Networks

Separating traffic into VLANs is one of the most important things you can do for both security and network performance. The new Default Security Posture in UniFi Network automatically blocks traffic between VLANs when set to Block All — meaning you create the VLANs first, then explicitly allow only what needs to communicate.

A sensible starting VLAN structure for home or small business:

Network	VLAN	Subnet	Zone
Management	1 (default)	10.10.1.0/24	Internal (trusted)
Main / Home	10	10.10.10.0/24	Internal
IoT	40	10.10.40.0/24	Internal (untrusted)
CCTV	30	10.10.30.0/24	Internal (untrusted)
Kids	50	10.10.50.0/24	Internal
Guest	20	10.10.20.0/24	Hotspot

Important: Enable 'Block All' in the Default Security Posture at the start, before creating VLANs. If you add it after, existing VLANs are not automatically isolated — you would need to recreate them.

WiFi Setup — Channels, Channel AI, Spectrum Analyser

WiFi → Channel Plan

Channel AI scans the RF environment and selects the optimal channels and widths automatically. Run it when first setting up and after any major infrastructure changes.

Spectrum analyser (U7 Pro XGS and E7 only) gives a real-time view of RF activity on each band. Use it to identify interference sources before committing to channel selections.

Channel width guidance:

• 2.4 GHz:Stay at 20 MHz. This band is congested — wider channels make interference worse.
• 5 GHz:160 MHz if your environment is clean; drop to 80 MHz if you see instability. Avoid DFS channels near airports or radar.
• 6 GHz:320 MHz if available and clean. Start here and drop down if needed.

When creating SSIDs, use WPA2/WPA3 mixed mode for best compatibility. Pure WPA3 is preferable but some older IoT devices will not connect. For IoT SSIDs, enable the IoT optimisation mode — this restricts the network to 2.4 GHz only.

Zone-Based Firewall

Settings → Security → Firewall

UniFi's zone-based firewall organises traffic by zone pairs rather than individual rules. Understand the zones first:

• InternalYour trusted networks — main PC, NAS, servers
• Internal UntrustedIoT, CCTV — on your network but not trusted
• HotspotGuest network — isolated by default
• GatewayThe UDM itself — default gateway IPs live here
• ExternalThe internet
• VPNVPN client connections

Firewall rules are read top-down. The first matching rule wins. Keep allow rules for specific services above blanket block rules. Use the auto-allow return traffic option when creating policies — this handles the reply traffic automatically without needing a separate rule.

Important: When pinging across zones, remember: the default gateway IP sits in the Gateway zone, not the Internal zone. Devices can always reach the gateway unless you explicitly block it. Traffic between devices on different internal networks goes through the Internal ↔ Internal Untrusted zone pair.

IoT Network — Printing, AirPlay, Proxmox, Home Assistant

The IoT network is where most firewall work happens. The principle is: allow exactly what you need, block everything else. Start by allowing ICMP (ping) so you can test connectivity, then add specific service ports.

Common IoT firewall ports to add as lists:

AirPlay gotcha — PTP traffic: Even with all AirPlay ports open, streaming may stop intermittently. The fix is a rule allowing PTP ports (319, 320) from the IoT zone back to the internal zone. Without this, the HomePod cannot initiate the return connection it needs for synchronisation. This direction is Internal Untrusted → Internal, not the other way round.

Use packet capture on the access point (Devices → AP → Packet Capture) and analyse in Wireshark to diagnose any traffic that is still being blocked after your rules are in place.

InsideWire tip: Use the Ethernet port profiles feature to quickly apply consistent VLAN configurations to switch ports in bulk. Create an IoT profile, a management profile, and a trunk profile, then apply them across multiple ports at once.

Guest Network Setup

Guest networks sit in the Hotspot zone. By default, guests cannot reach any internal resources. To selectively allow guests to print or AirPlay, duplicate your existing IoT policies and change the source zone to Hotspot.

The Hotspot zone has a captive portal that generates pre-authorisation and post-authorisation restriction rules automatically. If you want guests to reach specific local IPs (e.g. a printer), add those IPs to the pre-authorisation allowances list in the Hotspot landing page settings — these take precedence over the firewall zone rules.

CCTV Network — Blocking Internet Access

CCTV cameras and NVRs generally should not have internet access — this prevents potential exfiltration and removes a common attack surface. Block internet access at the network level (Networks → [CCTV] → uncheck Allow Internet Access) or via a firewall policy from Internal Untrusted to External with action Block.

If specific devices need internet access for updates (such as a UniFi NVR), create an allow rule above the block rule with that specific device IP as the source. Firewall rules read top-down — the allow rule must sit above the block to take effect.

Kids Network — Scheduling, Content Filtering & Speed Limits

WiFi → [SSID] → WiFi Blackout Schedule

WiFi schedule: Go to WiFi → [Kids SSID] → scroll to WiFi Blackout Schedule. Set the hours when the SSID should be off. The network still exists but no device can connect during the blocked period.

Content filtering (Cyber Secure): Security → Cyber Secure → Content Filtering. Select the source network (Kids), enable Adult Content or Malicious filtering for free. Enhanced filtering with 100+ categories requires a Cyber Secure licence (£79/year/site). You can add custom allow and block lists, and set schedules for different rules on weekdays vs weekends.

Speed limits: WiFi → [Kids SSID] → WiFi Speed Limits. Note: the maximum you can set here is 100 Mbps. For higher limits or more granular per-device QoS, use the Object-Oriented Networking section instead.

Object-Oriented Networking & QoS

Object-oriented networking lets you apply routing, QoS, content blocking, and firewall rules directly to a device or network in one place — without going through the individual firewall policy pages. It requires a fully UniFi deployment (no third-party switches or APs).

Policy-based routing: Route specific domains or all traffic from a device through a specific WAN interface. Useful for routing certain devices through a VPN client, or for devices that only work through a specific ISP connection (e.g. set-top boxes tied to one ISP's network).

QoS: Prioritise time-sensitive apps like Teams, FaceTime, or WhatsApp calls. Limit bandwidth for high-consumption apps like YouTube or Netflix per device or network. These rules generate standard firewall entries visible in the firewall policy list.

InsideWire tip: For routing specific apps through a VPN client, use the domain-based routing option rather than IP-based — streaming services frequently change their IP ranges. Domain rules are more reliable.

Cyber Secure & Intrusion Prevention

Cyber Secure pulls together all security features in one place. Key settings worth enabling on any deployment:

• ✓Intrusion Prevention (IPS): Deep packet inspection with Proofpoint signature updates. Enable on all networks with notify and block. Signatures update automatically.
• ✓Encrypted DNS: DNS over HTTPS — prevents ISP and third parties from seeing your DNS queries. Use Cloudflare or Google's DoH endpoints.
• ✓Honeypot: Assigns an unused IP on your network. Any device attempting to contact it is flagged as potentially malicious. Set it outside your DHCP range.
• ✓Device & Traffic Inspection: Enables deep identification of devices and traffic types. Required for accurate QoS and content filtering.

The paid Cyber Secure licence (£79/year) adds enhanced content filtering with 100+ categories, 55,000+ threat signatures, and daily signature updates via Proofpoint. For business deployments this is worth the cost.

Reading Flows & System Logs

Insights → Flows → filter by Blocked

Flows (Insights → Flows) is your first stop when something is not working as expected. Filter by Blocked to see exactly what is being dropped and which firewall policy is blocking it. You can filter by source device, destination, zone, network, protocol, and policy name.

Always enable SysLog on firewall policies you are actively testing — this makes blocked traffic visible in the flows view immediately. Once rules are confirmed working, you can leave it on or disable it to reduce log volume.

InsideWire tip: When AirPlay or printing stops working, check flows immediately after the failure — the blocked connection will appear in the list within seconds, showing you exactly which zone pair and which rule is the problem.

Alarm Manager

Create alarms for the events you actually want to know about. Recommended for most deployments:

• →Internet disconnect or high packet loss
• →Threat detected (IPS block)
• →VPN user connected / disconnected
• →Admin access to the console
• →UPS battery in use / power failure
• →Honeypot triggered

Notifications can be delivered via push notification, email, or webhook. Webhooks are useful for feeding alerts into Slack, Teams, or automation platforms like Home Assistant.

VPNs — Teleport, WireGuard, OpenVPN, Site-to-Site

Teleport: The simplest option — one-click VPN access via the WiFiman app. Generate a guest invite link, share it, and the recipient pastes it into WiFiman. No configuration required on either end. Ideal for giving temporary access to someone.

WireGuard Server: Permanent VPN access for trusted devices. Create a server, add a client for each device (each needs its own config file or QR code), and distribute. The VPN zone in the firewall controls what VPN clients can reach.

By default VPN clients can reach internal networks. Lock this down by creating a block policy from VPN to Internal, then add specific allow rules for exactly what each VPN client needs — NAS access, Home Assistant, Proxmox, etc.

VPN Client (OpenVPN/WireGuard): Route specific devices or domains through an external VPN provider. Combine with object-oriented networking to route only specific apps through the tunnel, leaving everything else on your normal WAN.

IPv6 WireGuard: Now supported in UniFi OS 5.1+ — select an IPv6 address when creating the WireGuard server. Covered in detail in the UniFi Network 10.2 post.

IPv6 Setup

If your ISP provides a static IPv6 block, create a static route with your ISP-provided gateway address, then assign a unique /64 subnet from your prefix to each VLAN. Use sequential numbering — ::1 for management, ::2 for main, ::3 for IoT, and so on.

Set each network to DHCPv6 for client assignment. Enable SLAAC as well (the Allow SLAAC option) — Android devices in particular do not fully support DHCPv6 and require SLAAC to get an IPv6 address. Set the router advertisement interval to High so clients receive prefix information quickly.

Important: IPv6 firewall rules are separate from IPv4. If you block IoT internet access via IPv4 rules only, IoT devices with IPv6 addresses may still reach the internet directly. Always create matching IPv6 policies alongside your IPv4 ones.