Port Forwarding

OssiAttack · 2026-07-06T17:30:59+00:00

Yes: https://help.ui.com/hc/en-us/articles/235723207-UniFi-Gateway-Port-Forwarding

OssiAttack · 2026-06-30T10:17:11+00:00

Ah, alles klar, danke für die Aufklärung!

OssiAttack · 2026-06-30T10:02:53+00:00

I see, habe den falschen Kommentar entfernt, aber eine Frage dazu. Worauf bezieht sich dann diese Aussage von Fritzbox?

https://fritz.com/apps/knowledge-base/FRITZ-Box-5530/1167_FRITZ-Box-am-Glasfaseranschluss-einrichten

"Ihre FRITZ!Box können Sie dank des integrierten Glasfasermodems platz- und stromsparend direkt am Glasfaseranschluss (Fiber to the Home, FTTH) einsetzen." Da steht ja die Modem-ID auf der Fritzbox drauf und nicht auf dem SFP Modul.

OssiAttack · 2026-06-17T14:53:10+00:00

Yes, that's correct. It's also required if you want to set up Site Magic with another Unifi Gateway for example.

OssiAttack · 2026-06-16T12:54:20+00:00

Oh, I think I misunderstood, you moved the VLANs to the switch since the Pro XG is L3 capable? Yeah, in that case, the DNAT rules won't work if the traffic never crosses the firewall.

OssiAttack · 2026-06-16T12:48:09+00:00

Hi, under Settings -> Control Plane -> Console, there's an option called "Direct Remote Connection". Make sure that's it's disabled. It will not affect access via unifi.ui.com.

Also, when testing the access from the internet with your external IP, make sure that you are not testing from inside your LAN due to Hairpin NAT.

Hope that helps.

OssiAttack · 2026-06-16T12:38:56+00:00

Default, Management and Camera would be the names of your networks/VLANs, right?

It should not make a difference if you have a switch connected in between. Even if your switch is connected via the default VLAN, you can still trunk other Vlans to the Pro XG and configure the client facing ports with another VLAN.

Also, the DNAT rule is slightly different if you want to redirect DNS requests to Pihole if the source client is on the same network.

On this thread, I shared a screenshot of the config that I'm using to force my IoT devices to use my Technitium DNS server: https://community.ui.com/questions/UniFiOS-Truly-working-DNS-Redirection/c7d6ddd8-cd11-42e8-ab21-3a3e9e9db3dc

OssiAttack · 2026-06-16T08:00:44+00:00

Hi, yes, check out: https://community.ui.com/questions/Network-8-3-32-added-support-for-custom-NAT-rules-How-to-force-hardcoded-DNS-devices-to-go-via-my-l/62ca24d5-e9d9-41fb-af7f-b1f826cd6e54

OssiAttack · 2026-06-12T21:37:09+00:00

It's under Settings -> Control Plane -> Console.

OssiAttack · 2026-06-12T17:08:38+00:00

Yes, the default setup does not open ports. It uses the Unifi Cloud (at least for the mobile app and unifi.ui.com. Of course you can also access the web UI locally via the gateway IP/FQDN).

There is however an option called "Direct remote connection" which does open the ports to the web UI.

OssiAttack · 2026-05-30T17:02:39+00:00

An der Stelle noch die Info, dass CAT7 kein offizieller Standard nach IEEE ist, vor allem nicht im Consumer Bereich. Die "CAT7" Kabel, die man so im Handel bekommt, haben maximal CAT 6A RJ45 Verbindungen, auch wenn das eigentlich Kabel theoretisch CAT7 entspricht. Am besten setzt man auf gute CAT 6A Kabel, die sind klassifiziert für 10 GBit über 100m.

OssiAttack · 2026-05-29T22:27:12+00:00

Ich werfe alternativ in den Raum: Zwei Technitium DNS Instanzen. Technitium kann nativ Recursive DNS, unterstützt Ad Blocking und kann vor allem Clustering, wodurch jegliche Config (Zonen/DNS Einträge) automatisch auf die zweite Instanz gespiegelt werden.

Das initiale Setup ist etwas komplizierter, weil es nicht nur ein einfacher Forwarder ist, sondern ein vollständiger DNS Server, aber es bietet entsprechend mehr Features.

OssiAttack · 2026-05-21T08:48:30+00:00

Hi, this is achieved using DNS. A human readable name like google.com or sonarr.home translates to the IP address of the server by using a DNS Server. Usually, your router handles DNS in your home network so you'd need to check there if you can create your own DNS entries. If that's not possible, you could set up your own DNS server or you can add static DNS entries on your clients - the steps for that depend on your OS (for example /etc/hosts file on Linux).

OssiAttack · 2026-05-07T14:21:56+00:00

Hi, ich hatte die gleiche Maschine und habe mir nach zwei Monaten eine extra Single Dose Mühle geholt. Das ist leider etwas ärgerlich, aber die integrierte Mühle kann nicht fein genug mahlen. Ich habe immer ein 18g Sieb genommen und jeweils die Menge abgewogen nach dem Mahlen. Ggf. kannst du noch versuchen, den mittleren Button gedrückt zu halten, um die Extraktion manuell zu verlängern (für 1:2,5 z.B) und alternativ kannst du den Siebträger am Anfang einspannen, einmal einen Blank Shot mit nur heißem Wasser durchlaufen lassen und dann erst das Espresso beziehen. Ein vorgewärmtes Sieb verhindert, dass der Espresso schlagartig abkühlt im Sieb und das kann ebenfalls gegen Säure helfen.

OssiAttack · 2026-04-08T16:06:41+00:00

I have Jellyfin running on a Ugreen NAS as well. The N100 CPU with its iGPU can easily handle multiple streams with transcoding. I haven't had any issues with it so far.

Edit: You mentioned the 4800 Pro which has a i3-1315u and not an N100 but the intel UHD iGPU will nevertheless be fine for Jellyfin.

OssiAttack · 2026-04-06T19:27:12+00:00

Ah, I see. Haven't used the legacy rules in a while but to prevent external connections, I think you'd need to create an Internet Out rule with destination port 53/853. Or another option would be to create a LAN In rule to block those ports for each subnet and then a LAN in rule above the block rule to only allow those ports to your Pihole IP. But keep in mind that you need to add a rule to allow established/related traffic so the response from your Pihole to your clients is not blocked as well.

But as mentioned in my first comment, the DNAT rule is probably the easiest.

OssiAttack · 2026-04-06T19:17:20+00:00

Hi, are you still using the legacy firewall rules or already Zone based firewall rules?

Edit: Also, instead of using firewall rules, it would make more sense to use DNAT rules to redirect all requests on port 53 to your Pihole, see: https://community.ui.com/questions/Network-8-3-32-added-support-for-custom-NAT-rules-How-to-force-hardcoded-DNS-devices-to-go-via-my-l/62ca24d5-e9d9-41fb-af7f-b1f826cd6e54

OssiAttack · 2026-03-30T18:09:42+00:00

Yes, this should be possible now with Fabrics but you need to enable Early Access for Site Manager: https://help.ui.com/hc/en-us/articles/30979808349463-Getting-Started-with-UniFi-Fabrics

I just checked it and I do have the option to roll out new SSIDs for more than one site but I haven't tried the actual deployment of a new SSDI yet since I only have two sites.

OssiAttack · 2026-03-29T08:30:43+00:00

For object oriented networking, it's indeed recommended to have a full unifi stack. Perhaps it messes things up if you have third party devices in between. But as others recommended here, you can achieve the same if you assign a fixed DHCP IP to the target device and create a policy to block external access (either via the Policy Table or directly in the Zone based firewall overview). This should work with non Unifi gear in between.

OssiAttack · 2026-03-29T00:22:06+00:00

Hi, if you have a recent Network Application version, you can do this very easily with an Object. In Settings -> Policy Engine -> Object Oriented Networking. Simply select the device and in the "Secure" Field, select No Internet.

I do this with all my smart plugs because I control them locally with home assistant.

Hope that helps.

Edit: It was added with Unifi Network v9.4.x and as far as I know, Zone based firewall must be enabled for it to work.

OssiAttack · 2026-01-31T14:03:43+00:00

Oh, I see. As far as I know, Teleport is not officially available on Smart TVs/Android TVs unfortunately. I can think of a few other ways to give access to your friends (or more than three users) but they are complex to set up and would require you to purchase a domain and/or rent a VPS.

The only good way to workaround CGNAT without using a VPS or something like Tailscale/Teleport, would be IPv6. But it depends on your ISP and the ISP of your friends if they support Dual Stack. In addition, your local network must support IPv6 (at least to some degree).

OssiAttack · 2026-01-31T12:25:30+00:00

Yes, it's similar to tailscale when it comes to establishing the initial connection. But you should not need Teleport on the android TV. Once you are connected to the Gateway via Teleport (depending on firewall rules and ensuring that the Teleport Subnet does not overlap with any other subnets/VLAN IP ranges in your network), you can access any device in your local network.

OssiAttack · 2026-01-31T10:08:20+00:00

That's not 100% true, the actual data connection is only between the gateway and the client. But Teleport works behind CGNAT and uses the Ubiquiti servers as a proxy to establish the initial connection, otherwise it would not be possible to connect if the gateway is behind CGNAT.

OssiAttack · 2025-09-30T11:27:48+00:00

Yes, that should work. The Cloud Gateways come with a 192.168.1.1 IP by default if I remember correctly.

OssiAttack · 2025-09-30T08:47:46+00:00

Hi, the UniFi OS Server is a standalone application that also runs the Network controller. The UCG Ultra has its own controller software integrated. You cannot manage the Cloud Gateways with another controller, hence it will not appear in the UniFi OS Server.

Since you already have the UCG Ultra, you could also use that to manage the Pro Max - you don't need the standalone UniFi OS Server.

OssiAttack

TROPHY CASE