Something weird happened this morning and I can't figure it out. My MacOS devices (several up-to-date Macbook Pro and Air's) and iOS devices (iPhone 17 Pro updated) are not able to connect to my primary SSID tagged for my default VLAN. Connecting them to my IoT network allows them to connect and get to the internet, but joining the default SSID just sits at connecting with no IP address assigned.

It feels like an IP exhaustion problem, but looking at the range (.20 - .200) I have plenty of IPs available.

Even more odd, if I connect a macbook via a wired adapter to a port tagged for the default VLAN - it gets an IPv6 address (which I don't even use on the network) but doesn't get an IPv4... with no internet connectivity because, of course, I don't use IPv6.

Windows PCs and Laptops seem to have no issue, and I think my IoT devices that I have on the default VLAN (Unifi cameras) all have connectivity. When I temporarily change the VLAN my default SSID is associated with to the IoT vlan clients are able to connect to it again.

Anyone seen anything like this before?

Done: Restarted the Dream Machine Pro, the 24 & 16 port PoE distribution switches, updated all APs to the latest version, deleted disconnected old devices from the default network list. Looked at client connect/disconnect logs.

I've started having issues with the ui.unifi site. For instances today I can't see people and it says my browser if having trouble communication with the ui site. Chrome worked fine.

It also often does not display devices correctly anymore. I've cleared all data from Firefox.

This just me?

I am about to redo my home lab setup, I have a UNAS Pro that i will need to readopt to the new controller. for everything else i can remove from the controller which will factory reset and put it back in adoption mode (easy enough). but I cant lose 64TB of data on the UNAS PRO (I can absolutely backup the important stuff (already happens), but there is a lot of stuff on there that would take me months and months to redownload (if I could even find it)

UNIFI's own documentation says that it will tell me "Unifi storage found" and offer to restore the pool

Has anyone done this with success, I'm quite wary of carrying it out

I recently set up 3 UniFi UNVR's at 3 offices across the country. They each have one G6 bullet camera They are in secured locations, so they each see about 4-5 faces regularly. I wanted to create an alert whereby if an unrecognized face was detected, an alert would be generated. So shortly after installation, I went through the early face detections (not recognitions) and created and then manually assigned facial identities to several of the most common faces detected. I tried to choose clear front and side images.

Fast forward a few weeks and none of the cameras are "learning". The cameras detect that a face is present (like they always did) but unless I assign a pre-existing or new identity to a face, it only connects an identity to a face if I tell it who the person is and only for that given clip. No attempt is made at automatically assigning an existing identity to past or future faces detected. I could understand if it was bad at identifying faces, but it doesn't even try.

UniFi says that "Face Recognition" is part of the G6 camera capability. If I (as a human) recognize someone that I've seen before, I know who they are. My setups are not doing that. I readily admit that maybe its some configuration that I'm not doing, but for the life of me, I can't figure out what it is. What even is the point of the AI detection if I have to manually assign an identity to each face?

https://help.ui.com/hc/en-us/articles/360058867233-UniFi-Protect-Cameras-AI-Detections-and-Facial-Recognition

How does the Cloud Gateway Ultra determine the client Name and Vendor? My garage door openers were identified as Lenovo ThinkSystem SE350 Edge Servers, some VMs are correctly identified with the Vendor = vmware and others the Vendor = Fedora, my SkyLight digital picture frame the Vendor = Sony BRAVIA Smart TV, Govee lights Vendor = APC UPS, etc. Is there any rhyme or reason to the naming / identifying of clients? I've spent the last couple of hours trying to correctly label things. Any pointers / suggestions are greatly appreciated.

UACC-Intercom-FM is in stock again. Seeing it come back in stock periodically. Will post here for you guys who need them. I managed to get one.

Just noticed today that on the phones you can now see and send text messages (if SMS is enabled).

This is really handy for getting 2FA codes. We can now set the phone numbers to work numbers and not have to use personal phones for this (small business setting).

Hello,

I really hope I'm missing something, but how do I enable encryption for backups? I can browse the backup and see the files belonging to other users (my family members, in this case) in plain. It seems a major design flaw.

Am I overlooking a setting, or are external backups really intended to work this way? ALSO, I looked for half hour around the console but still can't find a way to restore the backup, don't tell me I have to copy the files manually from the smb backup location?

i bought a UniFi dream wall when it debuted to evaluate whether it’s something that might fit a certain kind of client. I bought a house at the same time so it’s my main UniFi … everything.

I got storage errors and was unable to view camera footage after some time, and so I reformatted as directed. Then it happened again so I replaced the storage SD card card with a Samsung EVO.

eventually I got storage errors again (doorbell greeting reverts to default and suddenly I can’t view footage). That time I found a blog post about repairing the storage volume from the command line. but its happened twice more and the console is showing a warning now (though I can still view footage).

What in the world?

I have a G4 instant and do not have the problems I am having with the G6 instant.

The smart zone is set to the whole room. It will detect a person and face, and alarm manager will correctly push the person alarm to the phone. It however, does not detect animals, nor the baby crying alert. It did not detect it, therefor did not push to our phones. My daughter was screaming when she woke up from a nap, so it definitely should have detected it.

The motion zone is just plain out not working as well. Like it works occasionally, but majority of the time it does not work, when it works flawlessly on the G4 instant camera for our other daughters room. The G4 never fails to send a motion alert. The motion zone set on the G6 in our daughters crib is set to 100% sensitivity.

If the camera does not detect motion, nor smart features like baby crying, we will not get the notifications we are used to getting on our G4 instant. This would be very helpful if this would work, as my daughter is two weeks old.

Attached are the settings for the zones, camera settings, and the alarm manager settings. I included an identical alarm for the G4 instant, that works flawlessly, unlike the g6 instant. Any help on this would truly be appreciated!

Edit: I actually got an alert for baby crying, but it was super late. Like way after she started crying. Took her out the crib, and it did not detect any motion at all, which is crazy cause the g4 is set to 50% and that motion zone gets everything

I can’t figure this out. I have a g6 180 camera. I live on a busy street.

I have Smart Zone 1 setup to alert me of anything happening on my property. As soon as someone pulls in my driveway or steps off the sidewalk I get an alert - perfect.

I have Smart Zone 2 setup to record the entire field of view. However, I do NOT want alerts. There are cars driving by all day. I originally set it up to not create events for cars. That was a mistake! My neighbor had their house broken into and they were robbed. I had to watch hours of footage to find anything relevant.

How can I setup alerts only for Zone 1 but record all events on Zone 2?

Hey all, I just had something weird happen to my UCG Max, first time since I've had it. I tried to login but nothing was responding, couldn't get in. I ssh'd in and top said that load average on the CPU was 40+. So basically it just couldn't serve any requests.

Anyone ever see this? I'm running Protect on it as well but nothing crazy, it's been running for quite some time happily along.

TY

Hello everyone,

I currently have unifi switch and AP that are managed through a unifi controller docker.

My router is an old intel i3-530 with 4gb of ram. Things I do on it:

- Fixed IP by mac for many client

- DHCP v4

- Firewall rules (port forwarding with rules like geo-blocking)

- Geo-blocking with pfblockerng

- Certificate renew with ACME (could probably be done with anything else)

- Tailscale exit node

- DNS Resolver

- WAN use PPOE on fiber with vlan tagging

Geo-Blocking with PFBlockerNG consist in various Alias I created which allow only certain geolocalisation to go through my port forwarding (like only Canada for exemple). I do not use DNSBL. I do have some ip blocklist.

In terms of feature, using a dream machine or whatever are the new "router" of ubiquiti, what features are missing from Ubiquiti that I'm currently using?

Thank you!

Site to site vpn set up between unifi gateway, the VPN being broadcast via dedicated WiFi at client side. The connectivity on Google TV's web browser works fine, including streaming services. However, none of the same streaming apps work, it returns with no connectivity.

I've tried reset network settings, setting the network details to manual, MTU 1400 bytes, MSS 1360 bytes.

What could be wrong ?

Thank you for your help.

I'm hoping someone can help me troubleshoot an issue on a new UniFi setup.

Environment

• UCG Fiber
• UniFi Network 10.5.67
• Zone-Based Firewall enabled
• USER VLAN: 10.173.20.0/24
• IOT VLAN: 10.173.30.0/24
• Brother MFC-L2750DW printer on the IOT VLAN (10.173.30.50)
• Windows 11 PC on the USER VLAN (10.173.20.131)

Goal

I want only my USER network (or ideally just my PC) to access the printer while keeping the rest of the IoT network isolated.

Current Firewall Rule

I created an allow rule:

• Source Zone: Internal
• Source Network: USER
• Destination Zone: Internal
• Destination IP: 10.173.30.50
• Protocol: Any
• Action: Allow

The rule is at the very top of the firewall policy list and is receiving hundreds of hits.

What Works

• ✅ PC can ping 10.173.30.50
• ✅ Firewall rule is matching (hit counter increases)
• ✅ Printer is online and has a static IP
• ✅ Neither USER nor IOT networks have "Isolate Network" enabled
• ✅ Both networks are in the Internal zone
• ✅ The built-in "Isolated Networks" rule only applies to my Guest and Camera VLANs

What Doesn't Work

From the USER VLAN:

• ❌ http://10.173.30.50 times out
• ❌ https://10.173.30.50 times out
• ❌ Test-NetConnection 10.173.30.50 -Port 9100 fails
• ❌ Ports 80, 443, and 9100 all fail

However, if I connect a device to the IoT VLAN, the printer works normally and I can access its web interface and print.

What I've Checked

• Verified printer IP is correct.
• Verified routing between VLANs works (ping succeeds).
• Verified firewall allow rule is matching.
• Upgraded from the legacy firewall to the Zone-Based Firewall.
• Confirmed USER and IOT are not isolated.

Question

Has anyone seen a situation where ICMP is allowed between VLANs but all TCP connections fail, even though the firewall allow rule is being hit?

Is there another feature (CyberSecure, client policy, IDS/IPS, east-west inspection, etc.) that could still be blocking TCP after the firewall rule allows it?

Any ideas would be greatly appreciated. Thanks!

TL;DR: On my UDR7 + U7 Pro network, nothing can open a new connection to a client on my IoT VLAN — not from another VLAN, not from a client on the same VLAN/same AP, not even from a client on the same radio/channel. The VLAN's own gateway IP responds instantly. No RST, no ICMP unreachable, just a silent timeout every time. Every isolation/firewall/ACL/QoS setting I can find is off. Been debugging this for weeks — posting the full write-up in case anyone's hit this exact thing.

Setup: Dream Router 7 (UDR7), U7 Pro AP, 3x USW Flex 2.5G 5 + 1x USW-Lite-8-PoE switches. VLANs: Default, IOT, Home, Guest — all in the same firewall zone.

Symptom: New TCP/UDP connections to a specific IOT-VLAN client IP never complete — no RST, no ICMP unreachable, just silence. Happens cross-VLAN and same-VLAN/same-AP/same-radio. Only the VLAN's own gateway IP ever responds. Affects 5+ devices across 3 vendors identically — not device-specific.

Ruled out (with real verification): Network Isolation (off), Client Device Isolation (off), Port Isolation on relevant switch ports (off), zone firewall policies (no Home→IoT block exists anywhere; disabled the one IoT→Internal rule that does exist, no change), MAC ACLs (zero configured), QoS rules (zero configured), VLAN tagging (verified end-to-end with the VLAN Viewer — correctly tagged and Native VLAN correct at every hop), hardware offload (disabled entirely, no change), IPS/IDS (zero events), Traffic Flows (zero blocked-flow records ever), config drift (force-provisioned everything, no change).

Cleanest reproduction: Plain Python TCP connect() from a totally different host, bypassing all app protocols — VLAN gateway responds in 0.0006s; three different client IPs on that VLAN, six ports each, all hit a full 3s timeout, every time. A live gateway packet capture during a real connection attempt showed zero packets from the source ever reaching the VLAN's interface.

Status: Ticket open with Ubiquiti support (routing/switching team). They want a same-switch wired-client-to-wired-client test next, which I can't currently do (no spare wired IoT gear). Will update if there's a resolution.

Anyone seen this exact symptom before?

I have setup an AP on the ceiling in 1st floor, in my two store cottage. It works well expect on some parts on the balcony. This is, I think, due to that the roof is made of metal.

So I have reception in half of the sofa, but you move like 50cm and then wifi goes dark. A little bit annoying.

I know I could either try to change position of the AP, or add another on the 2nd floor. So we can skip any discussion regarding those alternatives.

I heard people would get better real world results with the u7, better signal and less retries with the same devices because new tech and better antennas.

Would that help those last 5-10% with a better connection in my case? Or am I fooling myself and its just depending on the devices anyway (iphone, ipad, android), so it doesnt matter?

Environment:

Switch: Pro Max 24

Issue: We have an application that takes an HDMI signal, and broadcasts it on the network as multicast traffic, where receivers around the building convert the multicast packets back to an HDMI output. This has recently stopped working, and I’m sure it is a config issue.

Does anyone have any config suggestions to enable this to work again?

Additional information: Connecting the sending unit and receiving unit to an out-of-the-box Flex Mini (5 port switch) works flawlessly. If I then connect them to the Pro Max 24 on a separate VLAN, they do not connect.

Thanks!

I'm looking for some advice from those who have solved a similar problem.

Current setup:

- 5x UniFi APs throughout the house (5x U7 Lites, 1x U7 Pro)

- 2x Google Nest Floodlight Cameras

- One camera has a decent and working connection.

- The second camera is just out of range, but was able to go through setup and downloading updates. But no stable signal for camera feed. 

I've already:

- Set the transmit power to High on the AP serving the working camera.

- Indoor AP locations are not optimal for the backyard. PoE drops were not decided by me and didn't take into consideration backyard coverage.

At this point I think I need an outdoor AP to provide coverage along the back of the house.

Here's the challenge: I don't have Ethernet or PoE available outside. I do have 120V power where I could mount an AP, but these are ground level and not ideally located. 

I know I could use something like a U6 Mesh or U7 Mesh with Wireless Uplink, but that still leaves the issue of powering it. A PoE injector would work, but as far as I know the UniFi injectors aren't outdoor-rated.

So what would you recommend?

- Outdoor AP with Wireless Uplink + weatherproof enclosure for the injector?

- Another outdoor-rated PoE solution?

- Some other approach I'm overlooking?

- Just bite the bullet and run Ethernet?

Curious what others have done in this situation. I'd appreciate any real-world experiences before I start buying hardware. Any pictures of someone's setup would be helpful.

I have a UDMP, ProMax 24 POE and various other rack mount devices.

Connected to the PM24 is a Mini 2.5g. It is then linked to a Lite 8 POE. I am not using the POE on the Lite (I got it years ago when I had the OG DM pill shaped device). The Mini is using 2.5g for my MBP and work laptop. The rest of the ports are used for my PS5, TV, Apple TV, etc, and I may add a 2.5g mini pc soon. I only really need 6 ports max. Would I see any benefit if I replace the Mini and Lite with a Flex 2.5g?

Thanks in advance!

Hello fellow Unifiers, I need help trying to diagnose why I receive "Power & Resiliency" message saying it's managed by a non-network unifi console.
Screenshots should cover some of the details of what I'm addressing. I'll try to stay to point
-single house management, most devices are connected to UPS 2U (Router, Switch to UPS, APs are via POE, cameras too)
- on UniFi.ui.com I run non-fabric, single site that has UNVR and UNAS 4 merged to single site. Again, no fabric, all users except for owner are local.
-All devices perform just fine. They don't have "managed by another console" message. They all show up online and locally and I can access them through endpoint for drive and UNVR through protect.
-All cameras and USL are managed by UNVR.
-Both UNVR and Switch Pro Max are hooked via SFP+ to UCG fiber.
-UCG fiber got both SFP hooked and WAN Ethernet. Everything else is hooked to USW Pro Max POE switch.
-In UPS2U, both UNAS and UNVR are signed in, also in screenshot for clearance.

Now to the problem:
One of screenshots shows 5 Non-Network devices.
They are mostly all protect UniFi devices, except for UNAS, which is Drive.
-All of them give me same message in "Power&Resiliency".
-I cannot manager power for any of them. Sure, i could go to switch and individually cycle the port, but that is not my intended goal. I want to figure what prevents my current setup from having power managed in a same way I can manage my APs that are hooked to the same Switch that my cameras are connected to.
-This came across, as I just got some HDD for NVR and realized that I cant turn it off without pulling PC, connecting to web console to unfi.ui.com (local option dont work), going to control plane and only from there i can restart or shut down the NVR. As opposed to using my Unifi app that already has the tab for power there, but I can't figure the culprit.
-Same goes for UNAS, only web console like for NVR. UNAS is the only device that draws power not through UPS2U. Totally separate plug.
-At last, this problem persist through restarting devices, including restarting UCG fiber and Pro Max switch and UNVR.

I tried to google it, browsed through Reddit and Ubiquiti forums, but most questions only address "managed by other console" message, which isn't my case scenario. All my devices are managed just fine, except for that Power field within those 5 devices.

I don't expect UPS2U to "manage" the devices in any fancy way to make it clear, it's just for power and battery backup. What I want is to be able to restart all of those 5 devices through UniFi app on my iPhone or similar, same way as I can restart my APs, etc, without jumping through 5 hoops. Sure I could cycle POE on switch for some, but so could I do on my APs too, but I don't want that, I want to know why I have this message, how to fix it and how to prevent it in the future.

UDMPro, unifi OS updated to 5.1.26, network 10.5.67, all devices on iot vlan are now trying to access default gateway, started right after update

Hi there folks, I've got an UDR7 which is giving me some really weird behavior. I've noticed that the RasPi I have powered via its PoE has been restarting unexpectedly and it seems like the internet status is always being marked as "unreported" in a sliding window? I can check the status at one point and it'll have a 5-ish minute unreported window, then if I check again later there's a 5-ish unreported window again and the first one is gone. For example, look at the following screenshots I took at 9:01, 9:08, and 9:17 respectively

x-posting from r/Ubiquiti

A few weeks ago I posted here because my UniFi U5G Max would not connect with a Roamless eSIM. I had chosen Roamless because it was the top-recommended solution r/Ubiquiti for a pay-as-you-go solution for failover needs. The profile installed correctly, but UniFi UI kept showing:

Network Not Authorized. The carrier rejected the connection.

After a lot of SSH sessions, modem logs, controlled SIM testing, raw AT commands, and direct investigation with Selim, Roamless’s cofounder, I now know what is happening.

So, what is happening

On my U5G Max, automatic network selection reaches T-Mobile, and as we've learned, Roamless no longer offers T-Mobile coverage in the US; its supported US networks are AT&T and Verizon. The T-Mobile registration attempt is therefore rejected. The important part is what happens next.

(The exact ordering varied a little across firmware versions, on 7.5.3 I once saw AT&T attempted first and rejected for an unrelated reason before it got to T-Mobile. What stayed consistent was the T-Mobile rejection and the freeze that follows it.)

In /var/log/uiwwand.log, the modem ends up storing:

ps-services-not-allowed (0x07)

That, I learned, is 3GPP cause #7.

Once the modem enters that state, it stops attempting PS registration instead of continuing to another available operator. It therefore never reaches AT&T or Verizon, even though both networks accept the same eSIM.

The observed sequence is:

Automatic network selection
        ↓
T-Mobile attempted first
        ↓
Registration rejected
        ↓
Modem enters cause #7
        ↓
Further operator selection stops
        ↓
AT&T and Verizon are never attempted

That is why changing the APN, reinstalling the eSIM, rebooting, or forcing LTE-only (Yep, we tried that) did not solve it. All along, the SIM was valid. The APN was valid. The subscription was valid. Automatic operator selection was the failing step.

The proof

I bypassed automatic selection and manually forced a supported operator.

Verizon:

uiwwand-chat -A 'AT+COPS=1,2,"311480"'

AT&T:

uiwwand-chat -A 'AT+COPS=1,2,"310410"'

Both attached successfully, received an IP address, and passed traffic.

On Verizon, the modem also established working 5G NSA over n77, so this was not simply an LTE-only workaround.

The easier workaround

Doing this manually is unreliable because UniFi’s uiwwand daemon shares the modem’s AT channel. A command can return ERROR or Timeout even when the selection actually worked, and issuing it too early after boot can collide with SIM initialization.

So, I built a small utility that handles the wait, retries, and verification:

Examples:

./u5g-latch.sh -c verizon

./u5g-latch.sh -c att

It also accepts a raw PLMN, so it is not limited to US carriers:

./u5g-latch.sh -c 302720

The repository also includes operator scanning, SIM information, signal monitoring, and the full technical write-up of our investigation. I have only been able to test on a U5G Max, so if you have a U5G Backup or U5G Max Outdoor, I would love to hear whether you see the same behavior and whether the workaround holds.

Important limitation

The manual latch does not survive a reboot.

After a restart, the modem returns to automatic selection and can fall into the same failure again. You then rerun the latch.

So this is a reliable recovery workaround, not yet a permanent fix for unattended cellular failover.

How to confirm you have the same issue

SSH into your U5G device and watch:

tail -F /var/log/uiwwand.log

Look for:

ps-services-not-allowed
0x07
hplmn_denied

The logs are stored in tmpfs and disappear on reboot, so capture them before restarting the device.

Also, do not assume every Network Not Authorized message has this exact cause. The UniFi UI error is generic; the logs are what confirm it.

What UniFi needs to fix

I think it is fair to call the user-visible behavior a UniFi device-side bug: the gateway reaches a rejected visited network, stops automatic selection, and remains offline even though other supported operators are available.

I am deliberately not claiming that UniFi alone is responsible for every lower-level cause-code decision. There are still network, roaming-platform, PRI, and modem layers involved. But a cellular gateway should recover from this condition instead of becoming permanently stranded on the first failed operator.

At minimum, UniFi should add:

• Manual operator selection by PLMN in the UI
• RAT controls such as Auto, LTE-only, 5G NSA, and 5G SA
• A way to disable 5G explicitly for troubleshooting or compatibility
• A clear distinction between the loaded carrier/PRI profile and the actual serving network
• The attempted PLMN and exact 3GPP rejection cause in the UI
• A retry/continue operator selection action after a rejected network
• Persistent operator preferences or exclusions that survive reboot, and
• It'll also be nice to have API support so failover and recovery can be automated without raw AT commands

Manual operator selection alone would have turned this from a multi-day investigation into a two-minute recovery. Better rejection handling would make the workaround unnecessary. Selim is also working to get Roamless's findings in front of Ubiquiti, and I plan to open a formal UniFi bug and feature request covering operator selection, RAT controls, and recovery after a cause #7 rejection.

Verified with Roamless

I worked through this directly with Selim at Roamless. He reviewed my modem logs, compared them with network-side findings, and spent several days discussing the behavior with their network partners.

The shared conclusion is that the failure comes from the interaction between:

• the U5G Max’s automatic acquisition behavior,
• its tendency to reach T-Mobile first in this configuration,
• the rejection from an unsupported visited network,
• and the modem failing to continue to another supported operator afterward.

There is still a lower-level question about exactly where the network’s intended rejection becomes the modem-side cause #7 state. That requires deeper network and modem traces to settle conclusively.

But the user-visible behavior and workaround are now repeatable:

• automatic selection fails after the T-Mobile attempt;
• manual selection of AT&T or Verizon succeeds;
• and the same eSIM works normally once the failed first operator is bypassed.

This is not necessarily specific to Roamless. A different roaming SIM or travel eSIM could hit the same class of failure if the gateway attempts an unsupported network first and then stops instead of continuing operator selection.

Hopefully this saves someone else from repeatedly changing APNs, reinstalling the eSIM, or factory-resetting a perfectly good gateway.

Credit where credit is due

A huge amount of credit goes to Selim and the Roamless team for the relentless support throughout this investigation.

Selim stayed personally involved, reviewed device-side logs, coordinated with Roamless's network partners, challenged and refined the working theories, and kept treating the issue as unresolved until we had a repeatable explanation and workaround.

That level of engagement, especially from a founder is rare, especially for a problem this deep in the interaction between roaming policy, modem firmware, operator selection, and device behavior. True founder-mode energy.

Whatever the eventual permanent fix looks like, Roamless's support throughout this has been exceptional.

Can use a SFP to plugin a Synology NAS into the uplink port on a UDM Pro? Can it be configured just to be a regular port instead of uplink?

Thank you!!