Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The highest-impact UniFi changes are straightforward: protect the UI Account with multi-factor authentication, use an encryption mode your clients can actually support, place guests and IoT devices on separate networks, block unnecessary inter-network traffic, and keep the UniFi application and devices updated. Apply them in that order, testing after each change so an older camera, printer or smart-home device does not silently lose access.
UniFi menus and capabilities vary by Network application version, gateway, switch and access point. The paths below use current UniFi terminology, but confirm the labels and supported features on your own console before saving a change.
Start with a security baseline
Before changing settings, record which devices need to communicate. A typical home has a trusted network for computers and phones, an IoT network for cameras and appliances, and a guest network for visitors. Write down exceptions such as a phone that must reach a printer, a media player that needs a local controller, or an automation hub that talks to specific sensors. This list prevents an isolation rule from breaking a legitimate function.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches- Use a unique administrator password and enable MFA on every UI Account with administrative access.
- Use WPA2/WPA3 mixed mode for general compatibility unless your client inventory supports a stricter mode.
- Keep Protected Management Frames (PMF) enabled; choose Optional or Required according to client support.
- Put guests and IoT devices on separate networks or VLANs and enable Network Isolation where supported.
- Use gateway policies for traffic between networks, switch ACLs for supported same-VLAN controls, and AP Client Isolation for clients sharing an access point.
- Review Update Manager and select an update channel and schedule appropriate for your tolerance for change.
1. Protect the UniFi administrator account
An attacker who obtains the UI Account can change Wi-Fi credentials, create firewall exceptions, disable logging or lock you out. Secure the account before tuning wireless settings.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Enable multi-factor authentication
- Sign in to the UI Account that administers your UniFi console.
- Open the account security settings and enable multi-factor authentication.
- Choose an app-based one-time passcode or a hardware security token. Ubiquiti documents both options; it does not establish support for every token model or standard, so verify compatibility in the UI Account before purchasing a token.
- Save the recovery information in an offline, protected location and test a second administrator’s sign-in before removing any existing method.
MFA protects cloud account access and administrator sign-in, but it does not replace strong local network controls. If your console supports local-only administrators, keep an emergency account with a unique password and tightly limited use, and store its recovery details securely.
Apply least privilege
Use role-based permissions so day-to-day users receive only the sites and functions they need. A person who only manages Wi-Fi should not automatically receive unrestricted network, firewall and account-management rights. Review administrator and operator lists after staff or household changes, remove dormant accounts, and require MFA for every remaining administrator.
Review activity records
Keep administrator activity logs available and inspect them after major changes. Look for unfamiliar sign-ins, new administrators, altered firewall rules, disabled updates or unexpected SSID changes. Logging is useful only if someone reviews it, so add a monthly reminder or another routine that fits your household.
2. Choose Wi-Fi encryption and PMF deliberately
In UniFi Network, wireless configuration is under Settings > WiFi. Change one SSID at a time and test all important clients before applying the same policy to the rest of the house.
Rank #2
- Standard OATH compliant TOTP token (time based)
- 6-digit OTP code with countdown time bar
- Zero footprint: no need for the end user to install any software
- Secure, sturdy, and long-life hardware design
- Easy to use - Portable key chain design. These tokens will only work with Symantec VIP Access. These tokens will not work for any other Multi-Factor Authentication services, besides Symantec VIP Access.
| Security mode | Best fit | Compatibility consequence |
|---|---|---|
| WPA2/WPA3 mixed | Most mixed households with newer and older clients | Newer clients can use WPA3 while older supported clients continue with WPA2; unusual legacy devices may still fail. |
| WPA3-only | Networks whose clients are known to support WPA3 | Stronger modern requirements, but older phones, printers, cameras and IoT products may not connect. |
| WPA2-only | Legacy devices or deployments requiring WPA2, including some PPSK arrangements | Broad compatibility, but it does not provide WPA3 protection to capable clients. |
| OWE | Open guest access on compatible clients | Client and AP support is required; OWE is not the same as an unauthenticated, unprotected open SSID. |
| 6 GHz Wi-Fi | Compatible 6 GHz clients and access points | UniFi’s overview associates 6 GHz operation with OWE or WPA3, so WPA2-only legacy clients cannot use that band. |
Ubiquiti recommends WPA2/WPA3 mixed mode for many environments. Inventory the clients on an SSID before selecting WPA3-only. If one older device is the reason you cannot use a stricter mode, put that device on a separate, restricted SSID rather than weakening every client network.
Set PMF without causing avoidable outages
Protected Management Frames defend management traffic from attacks such as forged deauthentication frames. PMF Optional enables protection for clients that support it while retaining compatibility with clients that do not. PMF Required enforces the feature for every connected client and is therefore stronger, but older clients can be excluded. WPA3-only and OWE require PMF.
Ubiquiti states: “PMF is essential for securing modern networks, but disabling it should only be considered in cases where specific clients can’t connect otherwise.” If a device fails after enabling PMF, first try Optional on that SSID or move the device to a compatibility SSID; disable PMF only as a last-resort exception and document the reason.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Leave group rekey at its default unless you have a reason
Group rekey controls how often a broadcast or multicast encryption key changes. More frequent changes are not automatically safer for a home and can expose bugs in poorly implemented clients. Keep the UniFi default unless troubleshooting or a documented requirement gives you a specific value.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Do not treat a MAC allowlist as segmentation
MAC allowlists can provide simple admission control, but they are weak when devices rotate or randomize MAC addresses and they do not stop an admitted device from reaching others. Ubiquiti describes them as best suited to simple control in environments where addresses do not change. For flexible assignment and policy, use a properly designed network or PPSK deployment where your hardware and software support it.
3. Separate guests and IoT devices at the network layer
A different SSID alone does not guarantee isolation. Create separate networks or VLANs for untrusted device classes when your gateway and setup support them, map the corresponding SSIDs to those networks, and then enable Network Isolation for the guest and IoT networks. UniFi describes Network Isolation as automatically creating firewall rules that block traffic between isolated networks.
Create a guest network
- Open the network configuration area and create a dedicated guest network or VLAN with its own subnet.
- Enable Network Isolation for that network.
- Assign the guest SSID to the guest network under Settings > WiFi.
- Test internet access from a guest device and verify that it cannot open the management interface or reach a trusted computer.
Ubiquiti’s guest Wi-Fi guidance also recommends Network Isolation for a guest VLAN. Do not assume that isolation blocks every form of local discovery; test the services your household intentionally exposes.
Create an IoT network
- Create a separate IoT network or VLAN and enable Network Isolation where supported.
- Assign cameras, plugs, televisions, speakers and other less-trusted devices to an IoT SSID.
- Keep phones and computers on the trusted network, then add only the specific controller or service exceptions required by the devices.
- Retest onboarding, firmware updates and local control after applying the policy.
Some IoT products use multicast discovery or require a controller to initiate connections across subnets. If a device stops working, do not immediately merge the networks; identify the required protocol and permit only the narrow traffic needed.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Understand the three isolation layers
| Control | What it governs | Important limitation |
|---|---|---|
| Gateway firewall or zone policy | Traffic routed between different networks or VLANs | It does not automatically stop two devices that remain on the same VLAN. |
| Switch ACL | Same-VLAN or switch-level traffic on supported switch models | Availability, syntax and exceptions vary by switch; check the model-specific ACL documentation. |
| AP Client Isolation | Communication between wireless clients associated with the same access point | It is access-point scoped and is not a substitute for gateway rules between networks. |
Use the least complicated layer that matches the threat you are addressing. Network Isolation handles the common guest-to-trusted and IoT-to-trusted case. Add AP Client Isolation for a wireless client-to-client requirement, and investigate switch ACLs when same-VLAN wired devices must be separated and your switch supports that feature.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.4. Review firewall and application policy
Use Network Isolation for a simple inter-network block
For a household that wants guest and IoT networks blocked from trusted networks, Network Isolation is the lower-complexity control described by Ubiquiti. It avoids building a large collection of manual rules and reduces the chance of an accidental allow rule.
Use zone-based policies when an exception is necessary
Choose a zone-based firewall policy when one network must reach a carefully selected service on another network, or when you need more granular source, destination and application criteria. Ubiquiti lists UniFi Network 9.0 or newer and supported gateway versions, including Gateway 4.1 or newer in the cited requirements, for this feature. The cited documentation identifies Zone-Based Firewall support in the UniFi Network 9.0.108 Official Release. Menu paths differ between releases, so do not assume a 9.3 path is identical to a 9.4 path.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Define the source zone, destination zone, protocol, ports and direction as narrowly as possible. Start with a deny-by-default relationship between untrusted and trusted zones, then add one documented exception at a time. After each rule, test both the intended connection and an unrelated connection that should remain blocked.
Best Value
- OTP token that provides secure remote access with strong authentication
- Easy to use and easy to carry
- Expected battery life is approximately 7 years
Consider application filtering as a targeted control
UniFi offers simple application blocking and more granular application filtering through zone-based firewall policies. Use it to address a specific service or category, not as a replacement for network separation. A device that is already on a trusted network remains trusted even if one application is blocked.
5. Keep the UniFi system current
Updates close vulnerabilities, fix protocol handling and improve compatibility, but an update can also change behavior. Use Update Manager to review available releases, choose a release channel and configure automatic updates where appropriate. Ubiquiti documents Official and Early Access channels; do not treat an Early Access build as equivalent to a broadly validated production release.
Choose an update strategy
| Strategy | Advantage | Trade-off |
|---|---|---|
| Automatic updates | Reduces the time devices remain exposed after a fix is published. | A change can occur during an inconvenient period; confirm reboot and outage behavior. |
| Scheduled updates | Balances timely patching with a planned maintenance window. | Requires an accurate schedule and someone to investigate failed updates. |
| Manual updates | Maximum control over timing and testing. | Easy to postpone indefinitely and miss important security fixes. |
Device update controls may appear in the associated application settings, and available options depend on your console and device setup. Before updating, export or record the configuration, confirm you can reach the console locally, and avoid changing firewall and Wi-Fi policies in the same maintenance window. Afterward, verify that the gateway, switches, access points, VPNs, VLANs and key clients are online.
6. Validate the finished configuration
Security settings are only useful if they produce the intended traffic boundaries without disabling necessary services. Test from representative devices, not only from the administrator’s laptop.
- From a trusted device, open the UniFi management interface and confirm normal access.
- From a guest device, verify internet access, then attempt to reach a trusted device, printer and management address; the unwanted attempts should fail.
- From an IoT device or its controller, test onboarding, local control, cloud access and firmware updates.
- From two wireless clients on the same access point, test whether AP Client Isolation matches your stated requirement.
- From wired devices on the same VLAN, test any switch ACL policy and verify that required exceptions still work.
- Review activity logs for the account and inspect firewall events for unexpected allows or denies.
Common symptoms and fixes
- A client cannot join after changing WPA mode: return the SSID temporarily to WPA2/WPA3 mixed or WPA2-only, update the client firmware, and move only the legacy device to a compatibility SSID.
- A client fails after enabling PMF Required: use PMF Optional for that SSID unless the SSID is WPA3-only or OWE, which require PMF; replace or update the incompatible client when practical.
- Guests can still reach an IoT device: confirm both networks use distinct VLANs and that Network Isolation is enabled; then inspect gateway rules and switch paths.
- Devices on one VLAN still communicate: this is expected from inter-VLAN isolation alone. Add AP Client Isolation or a supported switch ACL, recognizing the scope and model limitations of each.
- Smart-home discovery stopped: identify the multicast or controller traffic required and create a narrow zone-policy exception instead of removing segmentation entirely.
- An update changes a menu or option: use the current console’s Update Manager and device settings, check the release notes for that version, and record the working configuration before making another change.
7. A practical maintenance rhythm
Once the baseline is in place, review administrator accounts and activity logs monthly, confirm that guest and IoT VLANs still have the intended boundaries after adding devices, and check Update Manager regularly. Re-test after replacing a gateway, switch or access point because feature support, ACL behavior and menu paths can change with hardware and software versions. Keep a short record of every exception: the device, destination, port or protocol, reason, and date it should be reviewed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
