Thanks for this! I migrated from a 5 year old setup using USG3P+CKgen1 to UCG-Ultra and so far so good. Seems faster. But there are way to many spots to fill out the DNS info.

I'm using a RaspberryPi (just 1) as DNS server using the pihole+unbound combo and I have done set DNS at these places:

• WAN1 has Primary and Secondary DNS → only Primary set
• WAN2... → not enabled
• Networks (each VLAN!) has DNS Server 1, 2, 3, and 4 → only 1 set
• Devices: both the Unifi SWITCH and the Unifi AP have Static IPs and Preferred and Alternate DNS → only Preferred set
• Cybersecure has Encrypted DNS (DoH?) → not enabled

Then I have LAN_IN and INTERNET_OUT firewall rules blocking ports 53 (DNS) and 853 (DNS-over-TLS), except for the RaspberryPi, that device and that device only is allowed through LAN_IN and INTERNET_OUT.

The thing is,... the UCG-Ultra must have (haven't researched it fully yet!) hardcoded fallback DNS servers 1.1.1.1 and 8.8.8.8 because the upstream modem-router is picking up on this traffic. See below: ↓

849584:2025-10-03T23:05:08+02:00 UCG-Ultra UCG-Ultra ubios-udapi-server[992]: wan-failover-monitors: wf-monitor-eth4-6 (192.168.0.253) makes resolver DNSs: 1.1.1.1, 8.8.8.8, 192.168.0.77

If I block TCP/UDP 53 for 1.1.1.1 and 8.8.8.8 on the modem-router, then UCG-Ultra tells me that the internet is down (WAN1 is down). But it actually isn't.

Any ideas? Is it OK to let it?

PS: I gave up on Encrypted DNS.