r/Ubiquiti

We've operated for years with only 1 rule -- keep it relevant to Ubiquiti. In today's age, unfortunately we need to introduce another, super simple rule:

No AI/LLM generated slop.

If you don't know something for sure - that's okay! We're all here to listen and learn, but do not post AI summaries, answers, or other slop. Unless personally verified by you, such content is merely clutter and is subject to moderator removal at our discretion.

Please report content you see that breaks this rule so we can keep the subreddit clean, clear, and accurate.

My church is looking to install cameras indoor and outdoor and we asked our alarm company for a bid. In our state (Tennessee), you need to be a state licensed installer to deliver security cameras and alarm systems for commercial applications. But in the meeting today, the installer pushed back on doing Unifi claiming that they weren't UL certified for the stuff they typically install and explaining to me that's why you don't see them installed at banks or police stations. But we're not either of those properties and I wanted to ask people here about this kind of vendor pushback. Is it normal to have an installer not wanting to install what the customer is asking for, especially if our needs are different than what they pushed back on?

UniFi IPS/DPI kills livestreams and video calls every 5-10 minutes — root cause found and workaround

If you've ever had YouTube streams, Teams calls, or Zoom meetings drop every 5–10 minutes on a UniFi gateway with IPS or DPI enabled, I found the root cause and a workaround.

The problem:

UniFi gateways run Suricata for both IPS (Threat Management) and DPI (Traffic Identification). The Suricata config ships with stream.memcap: 16mb — a tiny buffer for tracking TCP streams. When this fills up, Suricata enters "emergency mode" and starts killing flows using a 100-second timeout. Your livestream or video call is the biggest flow, so it gets evicted first.

Key findings from my testing on a UXG-Lite:

• With IPS+DPI on: stream drops every 5–10 minutes like clockwork
• Disabling IPS alone doesn't help — Suricata stays running for DPI
• Disabling both IPS and DPI: zero drops for 45+ minutes
• The UI's "Allow List" for IPS only suppresses alerts — Suricata still tracks and evicts the flow
• The same 16 MB memcap is used on ALL UniFi gateways regardless of RAM, which is why the UDR7 (3 GB RAM) has the same issue

The fix:

Add a BPF filter to exclude your streaming/calling machine from Suricata's packet capture. Create this script on your gateway via SSH:

/data/fix-suricata.sh:

#!/bin/sh
IFACE_CFG="/run/ips/config/iface.yaml"
EXCLUDE_IP="10.99.0.140"  # change to your IP

[ ! -f "$IFACE_CFG" ] && exit 0
grep -q "$EXCLUDE_IP" "$IFACE_CFG" && exit 0

sed -i "s|not net 169.254.254.0/24|not net 169.254.254.0/24 and not host $EXCLUDE_IP|g" "$IFACE_CFG"
kill $(cat /run/suricata.pid 2>/dev/null) 2>/dev/null
logger "fix-suricata: excluded $EXCLUDE_IP from Suricata capture"

Then:

chmod +x /data/fix-suricata.sh
echo "* * * * * root /data/fix-suricata.sh" > /etc/cron.d/fix-suricata

The cron runs every minute and only patches if needed. IPS/DPI keeps working for every other device. The excluded host still has firewall and NAT protection, just not Suricata deep packet inspection.

To persist across reboots, also create /data/on_boot.d/fix-suricata-cron.sh:

#!/bin/sh
[ ! -f /etc/cron.d/fix-suricata ] && echo "* * * * * root /data/fix-suricata.sh" > /etc/cron.d/fix-suricata
/data/fix-suricata.sh

And chmod +x it.

The real fix Ubiquiti needs to make: scale the stream.memcap based on available RAM, increase the emergency-established timeout, or give us a proper UI option to exclude hosts from Suricata flow tracking (not just alert suppression).

Tested on UXG-Lite, UniFi OS 5.0.12. Should work on any UniFi gateway running Suricata (UDM, UDM Pro, UDR, UCG, UXG, etc).

UPDATE:

Further testing showed the BPF filter workaround reduces but does not eliminate drops on the UXG-Lite (1 GB RAM). With the BPF filter active, drops went from every 5 minutes to every 10–25 minutes. We confirmed the BPF filter works — Suricata only processed 120K packets in 33 minutes vs the ~1.2M the stream alone would produce — but Suricata's ~300 MB memory footprint on a 1 GB gateway causes periodic forwarding stalls during system housekeeping, regardless of whether it's inspecting the affected traffic.

What actually works:

• Disabling both IPS and Traffic Identification (DPI): zero drops confirmed over 45+ minutes
• BPF filter exclusion: reduces drop frequency but doesn't eliminate them on 1 GB gateways

The same issue is reported on the German UniFi forum: https://ubiquiti-networks-forum.de/board/thread/12795-problem-mit-intrusion-detection-and-prevention-ids-ips-bei-ms-teams/ — suggesting Ubiquiti ships the same undersized Suricata config across all gateways.

Conclusion: On the UXG-Lite, the only reliable fix is disabling IPS/DPI. Gateways with more RAM (8 GB like the UDM Pro Max) would likely handle it, but Ubiquiti should scale their Suricata stream.memcap and emergency-established timeout based on available hardware resources.

In case anyone else was considering using the UTR + Protect in a similar way: I'm currently on a trip and I was able to connect my camera to my Protect server back home through the UTR VPN. I had to reset the camera and connect to the new SSID but that was it. It just showed up in my Protect console. Features like geofencing don't work properly since Protect doesn't know the camera is not at home. Luckily the hotel wifi connection is decent so no issues with uploading the footage.

We are using the camera as a baby monitor at night and move it to the living room as a security camera for when we go out. The security camera use case is just a bonus, normally don't care about setting one up in a hotel room.

I have UniFi ecosystem since a couple of months (UCG-Fiber, UDB-switch, U7 Pro XG). I must say I have an addiction looking inside the logs, checking some settings, analyzing interference of a channel etc. EVERY DAY
Compared to my previous router, TP-Link, UniFi has a lot of firmware updates in a month. I was happy if I got an update/ new features in two months with TP-Link.

Hi all, trying to decide between UCG fiber and UXG fiber. I currently have a cloudkey gen 2 running as my controller (protect is on a UNVR).

From a hardware perspective, it looks like the cloudkey g2 has more memory (3GB RAM + 32 GB eMMC) than the ucg fiber (just 3GB RAM).

Will I see any difference in performance from a controller perspective for my home setup (with 9 APs, 2 POE switches, a UPS 2U and a USP PDU all on the controller) if I move from the CKG2 to the UCG fiber as my controller, given the fiber has inferior hardware? Am I better off just getting the UXG Fiber and sticking with the CKG2 as my controller? Or should I simplify and just go with the UCG Fiber and toss my CKG2?

Thank you!

Been waiting for one and got the notification they were in stock. If you have been waiting… run don’t walk.

Just randomly checked the site and they were back in stock after a month. Grabbed one while I could!