If you just pulled a UniFi Dream Machine out of the box, the good news is the hardware setup takes under ten minutes. The part that trips people up is everything after the wizard closes — VLAN design, firewall rules, and making sure your IoT gear actually stays isolated. This guide covers how to set up UniFi Dream Machine end to end, from plugging in the WAN cable to writing traffic rules that hold up under real use.
Hardware and Port Assignments
The base UDM has four LAN ports (RJ45, 10/100/1000) and one WAN port. The WAN port is DHCP client by default — plug your modem or ONT into it. If you have the UDM Pro, the layout differs:
- Ports 1–8: Gigabit RJ45 LAN
- Port 9: Gigabit RJ45 WAN (your ISP uplink)
- Port 10: 10G SFP+ WAN (fiber failover or primary if your ISP hands you SFP)
- Port 11: 10G SFP+ LAN (uplink to a core switch like a USW-Pro-24-PoE or MikroTik CRS328)
Connect WAN first, then power. The LED cycles white while booting. Solid white means the device is waiting for initial configuration; solid blue means it has been claimed and is running.
Do not connect a downstream switch or any LAN devices until you have completed the setup wizard. Attaching gear before the wizard runs occasionally causes the UDM to import old DHCP leases or confuse its default gateway detection.
Running the Setup Wizard
Three paths exist: the UniFi Network mobile app over Bluetooth (stay within 3 meters of the device), Wi-Fi to the broadcast SSID named UDM Setup <LAST4MAC>, or a wired computer pointed at https://setup.ui.com. Chrome is the only browser Ubiquiti fully supports here; Safari and Firefox have known rendering issues on the wizard.
The wizard asks for:
- Ubiquiti account credentials, or a local-only setup. Signing in with a UI account is what enables remote access through unifi.ui.com and cloud backups. You can instead choose an offline, local-only setup with a local admin account; Ubiquiti’s UniFi Local Management article covers that path.
- Wi-Fi SSID and passphrase — use WPA3 if all your clients support it, otherwise WPA2/WPA3 mixed. Do not use WPA2-TKIP; it caps your effective throughput.
- Admin password for the local console.
- Update firmware — accept this. Running day-one firmware on a UDM is asking for bugs that were fixed months ago. After the initial catch-up, move to the staged approach in a sane firmware and update strategy rather than clicking update-all on every device.
After the wizard completes, land on the UniFi Network dashboard at https://<udm-ip>, or via unifi.ui.com if you signed in with a UI account.
VLAN Design Before You Touch Settings
This is the step most guides skip. Before creating networks, decide your VLAN IDs and CIDRs:
| VLAN | Name | CIDR | Purpose |
|---|---|---|---|
| 1 | Default | 192.168.1.0/24 | Trusted workstations, NAS |
| 10 | Trusted | 10.10.10.0/24 | Servers, lab gear |
| 20 | IoT | 192.168.20.0/24 | Smart home, cameras, printers |
| 30 | Guest | 192.168.30.0/24 | Visitor Wi-Fi |
Pick non-overlapping CIDRs. Reusing 192.168.1.0/24 across two VLANs is a common mistake that causes silent routing loops. If you have not settled on a segment model yet, work through VLAN segmentation for IoT, guest, and trusted devices first — retrofitting segments onto a live network is far more work than planning them now.
Creating VLANs and Wireless Networks
In the UniFi Network controller, navigate to Settings > Networks > New Virtual Network. For each VLAN above:
- Set VLAN ID to your chosen ID (e.g., 20 for IoT).
- Set the Gateway IP / Subnet — for IoT:
192.168.20.1/24. - Leave DHCP enabled unless you are running a separate DHCP server (Pi-hole with DHCP, for example).
- For IoT and Guest, check Client Isolation if the option is present in your firmware version — this blocks clients on the same SSID from reaching each other directly.
Per the Ubiquiti VLAN documentation, UniFi Network 9.x and higher uses a Zone-Based Firewall model rather than the legacy LAN In/LAN Out/LAN Local structure. If you are running 9.x, some of the rule locations described in older blog posts will not match what you see. Always check your firmware version at Settings > System > Firmware.
For wireless: create one SSID per VLAN in Settings > WiFi > New WiFi Network. Assign each SSID to its corresponding network. Do not put IoT devices on your trusted SSID to “make it easier” — that defeats the segmentation entirely.
Firewall Rules That Actually Isolate
By default, UniFi permits inter-VLAN traffic. If you create the networks above and do nothing else, your IoT gear can reach your NAS. Fix this with Traffic Rules (or Zone-Based rules on 9.x):
Rule 1 — Allow established/related (prerequisite):
Source: All Networks | Destination: All Networks | Action: Allow | Match: Established/Related state
Rule 2 — Drop invalid state (prerequisite):
Source: All | Destination: All | Action: Drop | Match: Invalid state
Rule 3 — Block IoT to all local networks:
Source: IoT network | Destination: All Local Networks | Action: Block | Direction: Both
Rule 4 — Block Guest to all local networks:
Source: Guest network | Destination: All Local Networks | Action: Block | Direction: Both
Rules are applied top-down. Put the allow-established rule first or your existing sessions will break the moment the block rule fires. This is the most common misconfiguration in home lab setups.
For the UDM Pro running IPS (Suricata), enable Settings > Security > Threat Management and set sensitivity to Medium. High sensitivity generates enough false positives to throttle NAS transfers; tune down if you see unexplained TCP resets on file copies. Deep packet inspection also costs throughput, which is why a gateway should be sized against its inspected throughput rather than its headline routing number.
Switch Port Configuration
If you have a managed switch downstream (USW-Pro-24-PoE, for example), configure port profiles:
- Trunk port to UDM: tagged all VLANs, native VLAN 1.
- Access port for a workstation: Native VLAN 1, no tagged VLANs.
- Access port for an IoT device: Native VLAN 20, Tagged VLAN Management set to Block All.
The “Block All” tagged management setting prevents a device from advertising its own VLAN tag and jumping segments — a real concern for some smart home hubs that run their own VLAN-aware stacks. Before you buy the downstream switch, check its total wattage against every powered device you plan to hang off it, as covered in AP and switch PoE planning.
Things to Test Before You Call It Done
Run these from a device on each VLAN:
# From IoT VLAN client: should FAIL (a host on VLAN 1, such as the NAS; use its real address)
ping 192.168.1.10
# From IoT VLAN client: should SUCCEED (internet works)
ping 1.1.1.1
# From a VLAN 1 client: should SUCCEED (a host on the Trusted VLAN 10)
ping 10.10.10.20
# Verify DHCP assigned the right scope
ip addr show | grep inetTest against hosts, not the gateway. Rules 3 and 4 cover traffic routed between VLANs; traffic addressed to the gateway itself needs its own policy, so the UDM’s addresses (192.168.1.1, 192.168.20.1) can still answer from the IoT VLAN. If you add an IoT-to-Gateway policy that allows only DHCP and DNS, check from an IoT client that the gateway’s web interface no longer loads, and that the client still gets an address and resolves names.
To measure routed throughput with IPS on, run iperf3 -s on a wired host in one VLAN and iperf3 -c <that-host> from a wired host in another, for example a NAS on VLAN 1 and a server on VLAN 10. An iperf3 run against the UDM’s own LAN IP only measures the link to the gateway; that traffic is never routed between VLANs or inspected.
Related across the network
- MikroTik Router Setup: Securing a New RouterOS Box — mikrotikguide.com
- OPNsense VLAN Setup: Trusted, IoT, Guest, and Management — opnsenselab.com
- OPNsense Port Forwarding: NAT Rules That Actually Work — opnsenselab.com
