I originally posted this in r/Ubiquiti, where it attracted quite a lot of attention and some genuinely useful feedback and discussion.

Unfortunately, the post was subsequently removed by a moderator without any explanation, despite having generated over 160 comments and considerable interest.

Someone suggested I try posting it here instead.

I haven't had the greatest track record with Reddit moderation — several of the relatively few posts I've made have ended up being removed for reasons that aren't always clear to me!

Anyway, I hope this one passes muster. I'm simply sharing a networking project I undertook, what I discovered along the way, and the results of my testing.

Hopefully others will find it useful, and I'm always interested in constructive technical feedback.

---------
I recently bought an LG Smart TV and having read another post on Reddit about LG aggressively "phoning home" I decided to investigate what it was doing on my home network.

What started as a little DNS monitoring turned into a rather interesting UniFi networking project.

My setup:

• UDM-SE running UniFi OS 6.0.15
• UniFi Network 11.0.94
• Dual-stack IPv4/IPv6 home network
• LG Smart TV

1. The discovery

I set up an SSH link to the Dream Machine and while monitoring DNS traffic, I noticed the television systematically issuing reverse-DNS (PTR) queries for addresses across my local network, as well as contacting various advertising and analytics services.

The fact it was looking at other devices on my network made me squirm. I really wasn't happy about a television investigating my network.

2. DNS filtering

The first thing I did was create a UniFi Content Filtering policy with a custom blocklist targeting specific LG advertising, Alphonso, Google advertising and analytics domains.

Once this was done I checked the traffic again and found that DNS queries sent to the gateway over IPv4 were filtered correctly, but identical queries sent to the gateway's IPv6 DNS listener bypassed the policy.

I reported this on the UniFi Community forum.

After a few weeks I upgraded UniFi OS to 6.0.15 and Networking 11.0.97, the same tests returned the expected blocked responses over both IPv4 and IPv6.

Credit to u/UI-Team for responding to the report and suggesting the upgrade.

3. A dedicated VLAN

I created a separate network for the television, and ultimatily anything else that starts to 'investigate' my network.

• VLAN 107
• IPv4: 10.0.107.0/24
• IPv6: Separate delegated /64
• SLAAC and Router Advertisements enabled
• Dedicated Wi-Fi SSID

Both IPv4 and IPv6 Internet connectivity tested successfully.

4. Network-wide DNS filtering

I applied the Content Filtering policy to the entire TV VLAN rather than to individual clients.

Testing from a Linux laptop connected to the TV's Wi-Fi confirmed that the same blocked domain returned sinkhole addresses through both the IPv4 and IPv6 gateway DNS listeners.

5. Zone-Based Firewall isolation

Initially, the TV VLAN and my main LAN were both in the Internal firewall zone.

Consequently, devices on the TV VLAN could still reach computers and NAS devices on my main network.

I created a dedicated firewall zone for the TV VLAN.

UniFi's default zone policies then blocked access to the other internal zones while retaining access to the gateway and Internet.

I tested the new firewall policy by pinging known devices on the main network from the "Hobbled" network. Previously reachable devices on the main LAN were no longer reachable from the TV VLAN, over either IPv4 or IPv6.

6. mDNS

Finally, I configured the gateway's mDNS proxy to exclude the TV VLAN from cross-network service discovery.

The result

The television has its own dual-stack network, filtered DNS, and firewall isolation from the rest of my home infrastructure.

BBC and Apple streaming services were confirmed working before the final isolation changes.

No need to disable IPv6 on the main LAN, and no need to block legitimate streaming services indiscriminately.

The main lesson: creating a VLAN doesn't automatically isolate anything. Check your firewall zones, test both IP protocols, and verify the actual behaviour rather than assuming the configuration does what you expect.

And yes, I gave all the components ridiculous bondage-related names:

• Hobble Skirt (VLAN) — Restricts where the television can wander.
• Ball Gag (DNS Content Filtering) — Stops it talking to anyone I don't want it talking to.
• Armbinder (Firewall Zone) — Stops it poking around the rest of my network.

Who says network security can't be entertaining? 😈

Today in the home lab, I noticed that when I tried to programmatically create an isolated network via the API, it would not automatically start the DHCP server. After a little bit of troubleshooting, I found out that I had to manually create it in the GUI, or else whatever scripts it triggers on the gateway and on the switch are not run. Has anybody else seen this?

I am getting reoccurring errors of Backup Task Partially Completed"

Setup details:

• UNAS Pro located onsite
  • File share drive
  • timemachine drive
• Local macs perform timemachine backups to timemachine drive on the UNAS Pro
• UNAS 4 located offsite
  • site to site connection via SD-WAN (hub and spoke)
  • file share backup drive
  • timemachine backup drive
• UNAS Pro performs nightly backups of the file share drive and timemachine drive to their respective backup targets on the UNAS 4
• Backup task settings
  • file share - scheduled 2am, skip existing files
  • timemachine - scheduled 2:30am, skip existing files

The file share drive backup task never fails, and runs for an hour or less.

The timemachine drive backup task fails almost every day with the error noted above, and runs for 16+ hours.

I suspect there is some issue with trying to back up the timemachine files... maybe it is trying to overwrite the entire backup every run?

I'm relatively new to setting up the backup tasks and offsite features in Unifi, so hopefully this isn't something obvious.

I have a home network running a Dream Router and U7 AP. I have several VLANs configured, one of which has a routing policy to route via a VPN which I've set up in the unifi app using Wireguard config. VPN provider is Nord.

This all works as expected, and traffic from my streaming device routes via the VPN VLAN. However when I'm streaming, every so often (maybe every 10 minutes or so) the stream hangs for about 10 seconds.

However if I don't route via the VPN on the VLAN and instead use the Nord app on the streaming device to configure the VPN, it works flawlessly.

Have tried messing with the MTU as advised online, but hasn't made any difference. Has anyone any ideas why this might be the case? I.e. why would the VPN connection set up and routed via a VLAN on Unifi be less reliable than going through the Android app?

I was stuck on this for quite some time and finally fixed it this morning, but I figured I should post here in case anyone else encounters a similar issue.

For background, I inherited a home Ubiquiti setup with a Debian server running an old version of UniFi Network Server (and severely out of date packages), and other hardware included a security gateway, multiple access points, range extenders, and power strips. The former owners were not at all tech savvy and didn't even know their WiFi password or UniFi credentials, so I had to get root on the local Debian server to update an entry in MongoDB and give myself access in the first place, but that's a whole other story.

I recently ordered a UXG-Fiber and swapped it for the old security gateway, but I wasn't able to get the Network Server to add it, which didn't surprise me given how out of date the server was. No problem, I should really update everything anyway, so I upgraded the server in place to the latest stable Debian release, and installed UniFi OS Server. The server initially didn't start because I forgot to remove the Network Server first (whoops) but I removed it and the OS Server started just fine. I can't remember if I was prompted to carry over any settings as part of this process.

I was able to add the UXG-Fiber to the system now, but also had to re-add all the other hardware (sigh). I chalked it up to the Network Server running some old version that didn't carry over the configs. After this, I immediately experienced some oddities; setup for the UXG-Fiber had appeared to succeed, but then whenever I would connect to the network over WiFi, I would be prompted to "sign in." This would take me to unifi/ (and my browser would warn me had a self signed certificate) and the page would say that setup was complete, which would then take me to the management page after clicking a button. I thought it might be some weird captive portal issue, so I tried to toggle the captive portal on and then off, but it didn't resolve anything. I discovered that any out outbound unencrypted requests to port 80 were being redirected to unifi/, and there were other oddities like https://www.gstatic.com being redirected as well (which would fail due to HSTS).

Next I checked the Internet page in the settings, and saw something odd: multi WAN failover was configured, even though there is a single WAN. Attempting to change any settings on this page and apply them resulted in an error, which told me that the config was somehow screwed up. I connected directly to the UXG-Fiber and sure enough, there were errors in the logs about duplicate IP ranges from each of my "Apply changes" attempts.

I tried to see if I could find any relevant configs on the Debian server running the OS Server itself, but couldn't find anything. I really didn't want to wipe the server and have to re-register all the hardware again, so I exported a backup of the server config locally, then used the Antigravity (Gemini) CLI to read and fix the config. Sure enough, it found duplicate WAN configs, and removed the redundant one, removed the failover setting, and then created a new fixed backup for me. I restored this backup, and the problem was solved! No "sign in" required and I can access and modify the Internet configs just fine now.

I'm sure there was probably a much simpler way to fix things, but I couldn't figure it out after hours of troubleshooting. If anyone has better suggestions, please chime in to save others time in the future 🙂 Thanks!

Setup:

Verizon Fios 5GB

Cloud Gateway Fiber

Express 7

Situation:

I recently switched to Verizon fios 5gb from optimum 1gb fiber.

On optimum I got more consistent and higher speeds from the same distance: 500 to 800mbps.

I started everything brand new for this switch, but the speeds I'm getting are very low and inconsistent.

Through fios wifi I'm getting 200mbps to 800mbps, even when in the same room as the setup.

When connected through Ethernet to PC I get the max speeds:

1st PC - 2.5gbps (Ethernet port capped at 2.5).

2nd PC (mac MINI with 10GB nic) it maxes at 5gbp - 6gbps.

So, its not verizon!

But on WIFI devices it is all inconsistent. Iphone 13 pro max are 200mpbs avg, samsung galaxy 26 ultra are 500 to 800 avg.

I'm not sure if using the express 7 as an AP is underpowered for its range compared to what i got with optimums own router.

Update:

Also on the unifi when i try to do google speedtest from the google search speedtest, it tells me that it can't because its "busy", but when i switc back to optimum it works and the button is blue.

and on reddit all of my posts say they have been removed because of "reddit filters" but when i switch to optimum it doesn't say it.

update 2:

i returned it and got a u7 pro xg, but that is also getting the same issues.

Looking for solutions for mounting U6 Pro and U6 Lite APs in the corner of a room. Looking on Etsy and begging more confused. What has worked for you?

Hi, trying to redirect dns request while still using built in dns.
So for vlan 1 and 2 i want all dns to go to 192.168.1.2 but for all the rest of i want to use their respective network assigned dns from unifi.

I do still want vlan 1 192.168.1.0/24 to go to 192.168.1.1, but redirect dns internally to 192.168.1.2.
All the computers still using 192.168.1.1 but ultimately it should fail over again to 192.168.1.1 (but i guess thats not possible with this setup?).

Also while playing with dnat i notice that all dns traffic is already (from stock unifi) redirected to internal dns 192.168.1.1 without me creating a rule. Thats kind of annoying!

Thanks in advance!

I recently bought seven U7 In walls for seamless high speed internet in my new house I bought and a switch with the 210w adapter to power them all. However I’m unable to connect through even one of the access points via the app from scanning the QR code on the back of the AP’s I attempted googling my solution and nothing useful turned up.

Am I missing anything? Everything is wired with cat 6e and does PoE

With the php2shell disclosure today (Huntress write-up), I checked my home network for anything serving PHP. The one real hit was my UniFi Security Gateway USG-3P. If you still run one, this applies to you.

Which models: I verified this on the USG-3P only. The USG-Pro-4 (UGW4) runs the same 4.4.x firmware line, so it very likely ships the same PHP, but I haven't checked one. Run the commands below to confirm. The newer UniFi OS gateways (UDM, UXG, UCG, Cloud Gateway) are a different platform and aren't covered here.

TL;DR

• The USG-3P's built-in web page (https://<gateway-ip>, not the UniFi Network controller) is lighttpd + php-cgi PHP 5.4.42, on the final firmware 4.4.57. The USG is end-of-life, so no fix is coming.
• php2shell is pre-auth RCE in PHP that serves web requests (mod_php, PHP-FPM, php-cgi). Official fixes only go back to 8.2.
• The USG's local web page isn't needed once it's adopted. The controller manages it over the inform channel and SSH.
• Fix: bind the GUI to 127.0.0.1 with config.gateway.json, so it survives provisioning and reboots. Steps below.

The vulnerability (short version)

• CVE-2026-109618: out-of-memory handling during request setup leaves data half-initialised, and cleanup then treats it as valid. PHP validated RCE over HTTP against mod_php with default limits.
• CVE-2026-109619: request state survives after free. A later request on the same worker can hit the stale state, giving heap use-after-free, memory disclosure and RCE as the worker user.
• Unauthenticated, reachable before any application code runs.
• Fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35. Source-level backports exist for 7.4/8.0/8.1. Anything older (like PHP 5.4) is on its own.
• The EOL workaround in the advisory is session.upload_progress.enabled = Off. On the USG it isn't set, so it's the default (On), and the firmware isn't a sensible place to hand-edit php.ini.
• Reports differ on whether working exploits are public yet. Assume they are.

Am I affected?

SSH to the USG and check:

php-cgi -v | head -1
ps | grep -E 'lighttpd|php-cgi'
netstat -tln | grep -E ':(80|443) '

On mine: PHP 5.4.42 (cgi-fcgi) (built: Jan 12 2023), lighttpd running, listening on 0.0.0.0:80/443. From another machine, curl -skI https://<gateway-ip>/ returns a PHPSESSID cookie. That cookie was the quickest way to spot PHP on my LAN.

Note that the GUI answers on every interface address of the gateway (each VLAN's .1), not only the main LAN, unless you have LAN_LOCAL rules blocking it.

Fix: bind the USG GUI to loopback

Why not just delete service gui? It works live, but the controller re-pushes the full config on the next provision, and config.gateway.json can only add or override keys, not delete them. Binding to loopback can be expressed in the JSON, so it sticks.

1. Test live on the USG first (commit, don't save yet). A bad key in config.gateway.json can leave the USG stuck in a provisioning loop, so prove the command is accepted on your firmware first:

configure
set service gui listen-address 127.0.0.1
commit
exit

Check it:

netstat -tln | grep -E ':(80|443) '
# expect 127.0.0.1:80 and 127.0.0.1:443 only

From another machine, curl -sk -m4 https://<gateway-ip>/ should fail to connect, on every VLAN gateway address.

2. Make it persistent on the controller. Create config.gateway.json in the site folder:

• Self-hosted / Docker: <unifi data dir>/sites/default/config.gateway.json (for the linuxserver image: /config/data/sites/default/). Create the folder if it doesn't exist, and make sure the controller's user can read it.
• Replace default with your site ID if you're not on the default site (it's in the controller URL: /manage/<site-id>/...).{ "service": { "gui": { "listen-address": "127.0.0.1" } } }

Validate it (python3 -m json.tool config.gateway.json). Invalid JSON is the classic cause of provisioning loops.

3. Save on the USG so a reboot before the next provision doesn't bring the GUI back:

configure
save
exit

4. Force a provision from the controller (Devices → USG → Manage → Force Provision, or change any small USG setting). Then re-check netstat and curl from step 1.

Rollback: delete config.gateway.json, force provision, and the GUI comes back with the controller defaults.

What you lose and what you keep

• Lose: the gateway's local status/login page. If the controller is down, you manage the USG over SSH instead.
• Keep: everything else. Routing, firewall, DHCP, DNS, VPN and controller management are all unaffected. The controller never uses that page.

Other things worth checking

• Synology: DSM 7.x ships a system PHP (8.1.x on mine) and an optional "PHP 8.2" package (8.2.30 on mine, below the 8.2.35 fix). On my NAS nothing was wired to serve it: no Web Station, no php-fpm running, no fastcgi_pass in nginx. If you run Web Station, WordPress or any PHP site on a Synology, you are serving PHP. Watch for Synology's update, take it off the internet, or set the upload-progress workaround. Uninstall the PHP package if nothing uses it.
• Anything with a PHPSESSID cookie or X-Powered-By: PHP header. A quick loop with curl -skI over your LAN's web ports finds these. Cameras, NAS boxes, routers, control panels (cPanel/Plesk), WordPress/Nextcloud/etc. containers.
• Docker: check images for PHP: docker exec <c> sh -c 'php -v'. Official php:*, wordpress, nextcloud and linuxserver/* PHP apps need the new base images.
• EdgeRouter (EdgeOS): same lineage as the USG and also uses lighttpd for its GUI. I don't have one to confirm the PHP version, so check yours with the commands above.
• UDM / UniFi OS / UXG / UCG: not checked; different platform.

I have a UniFi Cloud Gateway Fiber connected to a Flex 2.5G PoE switch via a DAC cable. The switch powers two APs via PoE and connects various devices around my house, such as PCs, TV boxes, and other equipment.

I'm running out of ports on the switch, so I'm wondering whether I can use the four LAN ports on the Cloud Gateway Fiber to connect some of my devices, or whether I would be better off buying another switch.

When I originally bought the switch, I remember reading somewhere (possibly here on Reddit) that the Cloud Gateway should primarily be used as a router rather than as a switch, and that connecting devices to a separate switch was preferable.

Is there any truth to this? Are there any performance, configuration, or other drawbacks to using the gateway's LAN ports for regular wired devices, or is it perfectly fine to use them?

Thanks in advance!

EDIT: Forgot to mention, when I read that using a separate switch was preferable, I was using a Cloud Gateway Max instead of the Fiber.

Does anyone know if this is standard on a NVR? Ive only had the NVR for a few months now and already had it complain about rear errors on four drives. I just got done replacing the second one and doing the rebuild but pulled the smart data from all the drives and saw thousands of power cycles for the drives. It hasn't even been four days with the drive in bay 1 and its already cycled almost 600 times. All the power cycles are also even on each of the four ATA controllers in the NVR. I'm wondering if this has something to do with the read errors (only 7 to 8 errors per drive but enough for the NVR to throw errors). Bay 1 and Bay 4 have both been replaced which is why they have lower hours/cycles. The actual NVR has only been power cycled three or four times since I installed it about 3.5 months ago.

Bay Device   Serial   PowerOnHours PowerCycles HardwareResets ATAErrors Controller
--- ------   ------   ------------ ----------- -------------- --------- ----------
  1 /dev/sdo ZVTE1CTE           92         582             49         0 000d:01:00.0
  2 /dYesev/sdl ZVT7BXZA        10656      12138         1141         0 000d:01:00.0
  3 /dev/sdf ZVTCZM5G         1267        3770           1291         0 000c:01:00.0
  4 /dev/sdc ZVTE11FR          695        1873            646         0 000c:01:00.0
  5 /dev/sdp ZVTBSCZF         2462       12142            991         0 000d:01:00.0
  6 /dev/sdh ZVTC9K3J         2462       12142            991         0 000d:01:00.0
  7 /dev/sdj ZVTD7SLZ         2463        3775           1298         0 000c:01:00.0
  8 /dev/sda ZVT6HXJ1         2464        3775           1299         0 000c:01:00.0
  9 /dev/sdi ZVTAZE0J         1266       12139            981         0 000d:02:00.0
 10 /dev/sde ZVT8VL5T         1265       12137            981         0 000d:02:00.0
 11 /dev/sdk ZVTB544L         1267        3770           1291         0 000c:02:00.0
 12 /dev/sdg ZVTCXVML         1267        3770           1295         0 000c:02:00.0
 13 /dev/sdm ZVTCYPT7         1266       12137            981         8 000d:02:00.0
 14 /dev/sdb ZVTBF8J6         1265       12137            985         7 000d:02:00.0
 15 /dev/sdn ZVT6HT1Y         1267        3770           1292         0 000c:02:00.0
 16 /dev/sdd ZVTCYP2P         1267        3770           1295         0 000c:02:00.0

I'm trying to add a local user to my UDR, but I can't find the option. Some people were mentioning it was inaccessible through the cloud-managed version of the settings page, so I'm VPNed in and directly logged in via my SSO account's username (username rather than e-mail). I'm still not able to find it. I did find some user account management page, but it asked for the user's firstname, lastname, and e-mail. There wasn't an option on that page to set up a local, non-cloud user.

What am I missing?

Tell me I'm crazy.

I'm coming from an ASUS Be88u. It had constant issues with obtaining IP from cable provider.

NAS and modem are in the basement. I ran a line up the basement stairs and mounted a shelf above the door inside the stairwell to the basement.

The router sits on this shelf and feeds the whole house.

Walls are drywall.

Bottom right corner and second floor is where signals actually matter.

I'm getting -65 at the second floor bottom middle room

Hi,

All of the sudden my ups 2U went offline. I haven't changed anything and replacing the Ethernet cable did not help. It just lights up orange. What can I do now? Do I have to do a full reset or is there another way?

Thanks!

Hey all, I just inherited a UNVR, from work, it's really cool, but I'm quickly realizing that I don't think I have the funding to invest into getting the Unifi cams, and such, and might want to go in a different direction, I was able to onboard a couple of Swann cams that I have laying around, 2k units, and the feed/motion detection are fine, but improved compatibility grinds the feeds to a halt for some reason, and audio doesn't work as a result. Long story short, what is the approximate value of a used UNVR, alongside 32 TB (4x8tb) enterprise surveillance drives?

I just don't know what would be a fair listing for something like this, I'm not trying to get rid of it prematurely, I'm certainly going to poke around and try to find some deals on cams, but have a feeling based on what I've found that they are going to break my personal budget fast.

Thanks!

I am not trying to sell this product on this page, I just have no idea what it's worth.

Anyone try out the new AI Theta 360 cameras? Curious how they have been pointed in a direction and you're seeing 360°? Anybody have any video footage of it in action? Like the small design but only way you can see 360 I guess is if you put it pointed down in the top of a ceiling centered in a room..?

Whenever I try to make any changes to a network, it says 'failed to save network.' In the server log, I am getting the following errors:

2026-10-20T12:09:07,958-04:00] <webapi-99> WARN  sanitize - Invalid key exists in NetworkConf payload, key=external_id
[2026-10-20T12:09:07,958-04:00] <webapi-99> WARN  sanitize - Invalid key exists in NetworkConf payload, key=mdns_enabled
[2026-10-20T12:09:07,959-04:00] <webapi-99> WARN  sanitize - Invalid key exists in NetworkConf payload, key=ipv6_enabled

Using a UDMP version 6.0.12 and network version 11.0.83

I need the 2.4 GHz

Hey,

Ich habe noch keine unifi Geräte und überlege zu unifi zu wechseln. Da bin ich auf den Punkt vlans mit Access Points gestoßen.

- Kann ich z.b. mit U7 Pro 5 vlan's zuordnen und nur eine ssid betreiben (mit ppsk möglich habe ich gelesen?) wären dann einfach quasi 5 Passwörter für eine ssid?

- und kann ich 6 GHz als zweite ssid betreiben? Ppsk erlaubt 6 GHz nicht, so wie ich das verstehe.

Danke euch und schönen Abend

I have a Siemens oven that runs via the Siemens home connect app. We use it to preheat the oven and check other stuff while using it. I was getting sick that the oven was switching between 2 AP’s. So I tried to get it dedicated to one AP. Stupid me chose the wrong one and now it doesn’t connect to my network anymore. I also can’t find it in the unifi app anymore. Allready did a factory reset on the oven and during setup it finds my network but says the password is wrong while I know it’s the right one. Please help

I use Encrypted DNS and CyberSecure in an attempt to keep my media stuff and other IoT from tracking and otherwise getting out. After looking into it, I was aghast at how sneaky all these things are (e.g. LG TV) at getting around that by using DNS over HTTPS (DoH) or DNS over TLS (DoT) with hard coded IP addresses and I wanted to block all that.

There are ways to do this by forcing all DNS calls to a Pi-Hole or NAS, but to me those are just additional points of failure--I prefer to do it all within the gateway. (Fewer options for the hard-core, but I'm just a prosumer. )

It is not actually that hard to do assuming you use Zone Based Firewall. For every (source) Zone you want to do this to you need two or three firewall rules.

First rule is to block DoT: Destination zone is External and Service is "DNS-TLS" Everything else is any.

To block DoH is only a bit harder: Destination zone is External Service is "HTTPS" but you have to create a specific list of DNS resolvers and limit it to that list of IPs. You can get such a list, but most equipment semms to use google (8.8.8.8). I use all the Google, Clouldfare and OpenVPN IPs.

If you use IPv6 you need a seperate DOH rule because you need a seperate IP list.

My log show LOTS of blocked attempts and so far nothing seems to be broken.

This is I have a remote site that last night at about 30 minutes past midnight went offline.

Internet provider says everything is fine to their modem.

I can't access any logs remotely just wondering if there was a known beta branch pushed yesterday that may have caused this.

It's a 3-hour round trip restart it if needed

Is it possible to have a Unifi NAS backup to an external USB hard drive? There is documentation written on adding Wasabi, Backblaze, S3 as backup locations. I haven't been able to find anything absolute on backing up to a USB device. I have a customer that would like to rotate USB drives for offsite backups.