How to Set Up UniFi Dream Machine: Wizard to Firewall

If you just pulled a UniFi Dream Machine out of the box, the good news is the hardware setup takes under ten minutes. The part that trips people up is everything after the wizard closes — VLAN design, firewall rules, and making sure your IoT gear actually stays isolated. This guide covers how to set up UniFi Dream Machine end to end, from plugging in the WAN cable to writing traffic rules that hold up under real use.

Hardware and Port Assignments

The base UDM has four LAN ports (RJ45, 10/100/1000) and one WAN port. The WAN port is DHCP client by default — plug your modem or ONT into it. If you have the UDM Pro, the layout differs:

• Ports 1–8: Gigabit RJ45 LAN
• Port 9: Gigabit RJ45 WAN (your ISP uplink)
• Port 10: 10G SFP+ WAN (fiber failover or primary if your ISP hands you SFP)
• Port 11: 10G SFP+ LAN (uplink to a core switch like a USW-Pro-24-PoE or MikroTik CRS328)

Connect WAN first, then power. The LED cycles white while booting. Solid white means the device is waiting for initial configuration; solid blue means it has been claimed and is running.

Do not connect a downstream switch or any LAN devices until you have completed the setup wizard. Attaching gear before the wizard runs occasionally causes the UDM to import old DHCP leases or confuse its default gateway detection.

Running the Setup Wizard

Three paths exist: the UniFi Network mobile app over Bluetooth (stay within 3 meters of the device), Wi-Fi to the broadcast SSID named UDM Setup <LAST4MAC>, or a wired computer pointed at https://setup.ui.com. Chrome is the only browser Ubiquiti fully supports here; Safari and Firefox have known rendering issues on the wizard.

The wizard asks for:

1. Ubiquiti account credentials — you need one. SSO into unifi.ui.com is how remote management works, and there is no fully local-only option on current firmware.
2. Wi-Fi SSID and passphrase — use WPA3 if all your clients support it, otherwise WPA2/WPA3 mixed. Do not use WPA2-TKIP; it caps your effective throughput.
3. Admin password for the local console.
4. Update firmware — accept this. Running day-one firmware on a UDM is asking for bugs that were fixed months ago. After the initial catch-up, move to the staged approach in a sane firmware and update strategy rather than clicking update-all on every device.

After the wizard completes, land on the UniFi Network dashboard at https://<udm-ip> or via unifi.ui.com.

VLAN Design Before You Touch Settings

This is the step most guides skip. Before creating networks, decide your VLAN IDs and CIDRs:

VLAN	Name	CIDR	Purpose
1	Default	192.168.1.0/24	Trusted workstations, NAS
10	Trusted	10.10.10.0/24	Servers, lab gear
20	IoT	192.168.20.0/24	Smart home, cameras, printers
30	Guest	192.168.30.0/24	Visitor Wi-Fi

Pick non-overlapping CIDRs. Reusing 192.168.1.0/24 across two VLANs is a common mistake that causes silent routing loops. If you have not settled on a segment model yet, work through VLAN segmentation for IoT, guest, and trusted devices first — retrofitting segments onto a live network is far more work than planning them now.

Creating VLANs and Wireless Networks

In the UniFi Network controller, navigate to Settings > Networks > New Virtual Network. For each VLAN above:

• Set VLAN ID to your chosen ID (e.g., 20 for IoT).
• Set the Gateway IP / Subnet — for IoT: 192.168.20.1/24.
• Leave DHCP enabled unless you are running a separate DHCP server (Pi-hole with DHCP, for example).
• For IoT and Guest, check Client Isolation if the option is present in your firmware version — this blocks clients on the same SSID from reaching each other directly.

Per the Ubiquiti VLAN documentation, UniFi Network 9.x and higher uses a Zone-Based Firewall model rather than the legacy LAN In/LAN Out/LAN Local structure. If you are running 9.x, some of the rule locations described in older blog posts will not match what you see. Always check your firmware version at Settings > System > Firmware.

For wireless: create one SSID per VLAN in Settings > WiFi > New WiFi Network. Assign each SSID to its corresponding network. Do not put IoT devices on your trusted SSID to “make it easier” — that defeats the segmentation entirely.

Firewall Rules That Actually Isolate

By default, UniFi permits inter-VLAN traffic. If you create the networks above and do nothing else, your IoT gear can reach your NAS. Fix this with Traffic Rules (or Zone-Based rules on 9.x):

Rule 1 — Allow established/related (prerequisite):
Source: All Networks | Destination: All Networks | Action: Allow | Match: Established/Related state

Rule 2 — Drop invalid state (prerequisite):
Source: All | Destination: All | Action: Drop | Match: Invalid state

Rule 3 — Block IoT to all local networks:
Source: IoT network | Destination: All Local Networks | Action: Block | Direction: Both

Rule 4 — Block Guest to all local networks:
Source: Guest network | Destination: All Local Networks | Action: Block | Direction: Both

Rules are applied top-down. Put the allow-established rule first or your existing sessions will break the moment the block rule fires. This is the most common misconfiguration in home lab setups.

For the UDM Pro running IPS (Suricata), enable Settings > Security > Threat Management and set sensitivity to Medium. High sensitivity generates enough false positives to throttle NAS transfers; tune down if you see unexplained TCP resets on file copies. Deep packet inspection also costs throughput, which is why a gateway should be sized against its inspected throughput rather than its headline routing number.

Switch Port Configuration

If you have a managed switch downstream (USW-Pro-24-PoE, for example), configure port profiles:

• Trunk port to UDM: tagged all VLANs, native VLAN 1.
• Access port for a workstation: Native VLAN 1, no tagged VLANs.
• Access port for an IoT device: Native VLAN 20, Tagged VLAN Management set to Block All.

The “Block All” tagged management setting prevents a device from advertising its own VLAN tag and jumping segments — a real concern for some smart home hubs that run their own VLAN-aware stacks. Before you buy the downstream switch, check its total wattage against every powered device you plan to hang off it, as covered in AP and switch PoE planning.

Things to Test Before You Call It Done

Run these from a device on each VLAN:

# From IoT VLAN client — should FAIL
ping 192.168.1.1

# From IoT VLAN client — should SUCCEED (internet works)
ping 1.1.1.1

# From Trusted VLAN — should SUCCEED (inter-VLAN permitted for trusted)
ping 10.10.10.1

# Verify DHCP assigned the right scope
ip addr show | grep inet

Use iperf3 between a wired trusted client and the UDM’s LAN IP to confirm you are getting full wire speed before IPS: a UDM with IPS on at Medium sensitivity on a 1G link should pass 800–950 Mbps depending on firmware.

Related across the network

• MikroTik Router Setup: Securing a New RouterOS Box — mikrotikguide.com

Related on this site

• How to Set Up UniFi VPN Remote Access: WireGuard or Teleport
• UniFi Dream Router vs Dream Machine: Which Gateway to Buy
• UniFi VLAN Setup Guide: Segment Your Network the Right Way