Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

A practical UniFi homelab starts with four essentials: a gateway/router that runs the UniFi control plane, one or more wired access points, Ethernet cabling, and a switch when you need additional ports or Power over Ethernet (PoE). Add VLAN-aware switching and firewall rules when you want separate trusted, guest, IoT, and lab networks.

The correct equipment count depends on your internet service, floor plan, construction, wired devices, rack or desktop space, and how much segmentation and expansion you expect. Build around those constraints rather than choosing a product because it is marketed as a “homelab” device.

The core architecture

A conventional UniFi home network has an internet handoff from your ISP, a gateway that performs routing and security, a UniFi management application, a switch for wired distribution, and access points for Wi-Fi. The gateway is the network’s default route and policy boundary; the switch carries wired traffic and, where supported, supplies power; access points bridge wireless clients onto the wired network.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Ubiquiti says that, in most cases, the best starting point is a Cloud Gateway. A Cloud Gateway combines UniFi Network management with routing and security, so the controller is not a separate computer that can be forgotten or powered off. A compact model such as the UCG-Ultra is listed as an entry-level option, but the right model still depends on WAN speed, applications, ports, form factor, and growth plans.

#1 Best Overall
UBIQUITI UCG-MAX Cloud Gateway MAX W/ 512GB SSD
  • UBIQUITI UCG-MAX CLOUD GATEWAY MAX W/ 512GB SSD

Equipment checklist

1. Gateway and UniFi control plane

Choose the device that will terminate your ISP connection, route between networks, provide firewall policy, and run UniFi Network management. Check the model’s stated routing throughput and supported UniFi applications against your service and intended features. Count the Ethernet ports you need for the switch uplink, an ISP handoff where applicable, and any directly connected devices.

A rack-mounted Dream Machine can fit a rack-based installation, while a compact Cloud Gateway is easier to place on a shelf or desk. Do not assume that a larger enclosure automatically provides better routing for your connection; compare the published capabilities with your actual WAN speed and desired services.

2. Wired wireless access points

Every access point needs a suitable wired path back to the network. Decide the number and locations from a floor plan, wall and ceiling construction, expected client density, and available cable runs. There is no universal “one AP per X square feet” rule supported by the available guidance.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Use the UniFi console to adopt and manage multiple APs centrally. Standalone AP mode can work for a small installation, but it does not provide seamless roaming across multiple APs and does not provide remote management. An AP is not a router: unless it is part of an integrated product, it needs a gateway or router elsewhere.

3. Ethernet switch

Add a switch when the gateway lacks enough ports, when several wired clients share a location, or when APs and other devices should receive PoE. Size its ports for the gateway uplink, each AP, desktop and server connections, cameras or other powered devices, and spare capacity for expansion.

Port count alone is not enough for a PoE model. The switch’s total available PoE budget must exceed the combined draw of the devices connected to it, with practical headroom for startup behavior and future additions. Confirm the switch’s supported PoE mode and each endpoint’s requirements in the model-specific documentation.

4. Ethernet cabling

Plan runs between the gateway, switch, AP mounting points, workstations, and any lab rack or cabinet. Label both ends and leave service slack where possible. A setup guide may recommend the manufacturer’s cables for compatibility, but the guidance does not establish proprietary cable as a requirement. Use correctly terminated, standards-compliant Ethernet and test each run before mounting an AP.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

5. Optional lab hardware

Servers, storage, hypervisors, test clients, and monitoring systems are additions rather than prerequisites. Put devices that must be isolated from household systems on a dedicated VLAN, and reserve switch ports and power for equipment you expect to add. UPS power, a small rack or shelf, and a patch panel improve serviceability but are not required to bring up the network.

Choose the control-plane design

Design What it combines or separates Best fit Important checks
Cloud Gateway Gateway, routing, security, and UniFi Network management in one appliance Most new single-site homes and compact labs WAN throughput, ports, supported applications, and desktop or rack placement
Independent gateway plus UniFi Console Routing remains on a separate gateway while a CloudKey or other UniFi Console runs management Installations that already have a suitable router or need physical separation Verify that the exact console and gateway support the applications and configuration you need
UniFi OS Server UniFi Network management is self-hosted on your own computer or server Administrators who accept responsibility for installation and ongoing operations Updates, firewall and discovery configuration, maintenance, uptime, and backup; an external UniFi OS Server cannot manage a Cloud Gateway because the gateway already includes the Network application
Official UniFi Hosting UniFi Network management is hosted by the vendor rather than on local hardware Readers who want the control plane separated from a physical controller Review current plans and terms before subscribing; pricing is not established here

Separating the gateway and controller can be useful, but it adds compatibility and failure modes: routing may continue while management is unavailable, and discovery or firewall rules may need extra work. An integrated Cloud Gateway reduces that assembly work for a first build.

Size the gateway, ports, and PoE budget

WAN and application requirements

Start with the ISP service you actually pay for, then account for VPN use, traffic inspection, inter-VLAN routing, and any other gateway applications you plan to enable. Compare those requirements with the selected model’s published capabilities. If your service may be upgraded, leave capacity rather than sizing exactly to today’s plan.

Rank #2
UBIQUITI UNIFI Gateway LITE
  • UBIQUITI UNIFI GATEWAY LITE

Port-count worksheet

List every connection before buying a switch:

  • One port for the gateway-to-switch uplink.
  • One port per access point.
  • One port per desktop, server, storage device, printer, or wired entertainment device.
  • Ports for lab hosts, test machines, or management equipment.
  • Spare ports for devices you expect to add.

Use the total to select a switch size. Remember that a switch uplink consumes a port, and a multi-gigabit AP may benefit from a matching uplink and switch port if its requirements call for it.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

PoE calculation

Add the maximum or documented draw for every powered endpoint and compare the sum with the switch’s total PoE availability. Ubiquiti’s PoE Availability and Modes guidance lists 21 W for a U7 Pro and 9 W for a U6+; these are device power figures, not network-performance ratings. For example, two U7 Pro units and two U6+ units would represent 60 W of listed device demand before allowing any margin. Confirm the exact switch budget and PoE mode for the model you intend to use.

Example endpoint Listed draw in Ubiquiti guidance How to use the figure
U7 Pro 21 W Multiply by the number of planned units and include the result in the switch budget
U6+ 9 W Multiply by the number of planned units and include the result in the switch budget

If the switch cannot supply the required power, the remedies are a higher-budget PoE switch, an appropriate injector, fewer powered devices, or a different access-point plan. Never infer PoE capacity from the number of Ethernet ports.

Design VLANs before you connect the lab

A simple home can use one LAN, but a homelab usually benefits from separate networks. Common groups are trusted clients, guest Wi-Fi, IoT devices, and lab servers or test systems. Separation limits accidental access and lets you apply different firewall policies.

Write down a VLAN ID, subnet, DHCP scope, and purpose for each network before creating SSIDs. Then trace the complete path: gateway, switch, AP, and the client’s SSID. The gateway and switch must understand the intended VLANs, and every intervening port must carry the relevant VLAN IDs. If a trunk or AP uplink omits an ID, clients on the corresponding SSID may fail to join or may receive no usable address.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Firewall policy versus switch ACLs

Use gateway firewall rules as the normal control point for traffic between VLANs and for traffic to or from the internet. Switch ACL features vary by model, so do not promise a particular inter-VLAN behavior from a switch without checking its documentation. A useful baseline is to allow established return traffic, permit only the services a lab needs, and block unsolicited access from guest or IoT networks to trusted devices.

Physical layout that works

Place the gateway and main switch where the ISP handoff and cable runs converge. A central, elevated AP location generally gives more even coverage than hiding an AP beside a metal cabinet or at the edge of the house. For a larger home, run cable to multiple planned AP positions instead of relying on wireless mesh as the default.

Keep the gateway, switch, controller, and any lab server where they can receive ventilation and stable power. Label patch-panel ports and switch ports with the room and device name. Document which switch ports are access ports, which are trunks, and which VLANs each trunk carries; this turns later troubleshooting into a lookup rather than guesswork.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Step-by-step initial setup

  1. Inventory the site. Record the ISP handoff type, subscribed WAN speed, rooms needing coverage, wired equipment, possible AP mounting points, rack or desktop space, and expected lab devices.
  2. Choose the control plane. For a new single-site installation, evaluate a Cloud Gateway first. If routing must remain on existing hardware, verify the compatibility of a separate UniFi Console, self-hosted UniFi OS Server, or official hosting arrangement.
  3. Plan networks and ports. Assign LAN and VLAN IDs, subnets, DHCP ranges, SSIDs, firewall intent, switch port roles, and spare capacity before physical installation.
  4. Install cabling. Run and label Ethernet between the gateway, switch, AP locations, and fixed clients. Test continuity and negotiate the expected link speed.
  5. Power and connect the gateway. Follow the hardware’s startup instructions, connect the ISP handoff and initial LAN path, and wait for it to finish booting.
  6. Adopt the gateway. With a Cloud Gateway, connect the device to the same network as the setup phone or client, open the UniFi mobile app, and follow the adoption and setup prompts. This is why the controller is part of the equipment decision rather than an optional later add-on.
  7. Adopt the switch and APs. Connect each device to the planned wired path, confirm it receives an address, and adopt it in UniFi Network. Update firmware only after recording the current configuration and ensuring the device has stable power.
  8. Create networks and SSIDs. Build the LANs and VLANs, map each SSID to its intended network, and configure switch trunks and access ports to carry the required IDs.
  9. Apply firewall policy. Test the intended allows first, then add deny rules for guest, IoT, and lab boundaries. Permit only management or service flows that are genuinely required.
  10. Validate from real clients. Join every SSID, confirm DHCP and internet access, test allowed and blocked inter-VLAN traffic, walk through coverage areas, and verify that wired devices negotiate the expected speed.

Troubleshooting by symptom

The AP powers on but clients cannot join an SSID

  • Confirm the AP has a working wired uplink and an address from the expected management network.
  • Check that the SSID’s VLAN ID is allowed on every switch and gateway port between the AP and gateway.
  • Verify that the gateway has a DHCP scope for that VLAN and that firewall rules are not blocking essential DHCP or DNS traffic.

The AP never appears for adoption

  • Check physical link, PoE mode, and switch power budget.
  • Place the AP and controller on a reachable network and confirm discovery is not blocked by a firewall or isolated VLAN.
  • Reset and re-adopt only after recording the intended configuration; a reset erases the device’s current settings.

Some powered devices reboot or disappear

  • Compare the switch’s total available PoE with the sum of connected-device demand.
  • Check whether the endpoint requires a particular PoE mode supported by that switch port.
  • Move one endpoint temporarily to a known-good port to distinguish cabling, port, and budget problems.

Devices on different VLANs can reach each other unexpectedly

  • Review gateway firewall rules and rule order.
  • Confirm the switch is not being relied on for ACL behavior that its model does not provide.
  • Check for a second router, unmanaged switch, or accidental bridge that bypasses the intended policy boundary.

Common mistakes to avoid

  • Buying an AP as the entire network: an AP supplies wireless access, not routing or internet security.
  • Choosing PoE by port count: a full switch can still be unable to power all connected devices.
  • Creating VLANs without tracing trunks: the VLAN must be carried end to end from gateway to AP or wired client.
  • Assuming every console supports every application: confirm support for the exact UniFi applications and topology you want.
  • Running a self-hosted controller without an operations plan: updates, backups, discovery, firewall configuration, and uptime become your responsibility.
  • Ignoring physical expansion: a few spare ports, labeled cables, and a documented IP/VLAN plan cost less than a rebuild.

A sensible starting build

For a first installation, use a Cloud Gateway sized to the ISP service, a PoE switch with enough ports and wattage for the planned APs and wired clients, one or more wired UniFi APs placed from the floor plan, and tested Ethernet runs. Start with a trusted LAN and guest network, then add IoT and lab VLANs after the basic path is stable. This sequence keeps troubleshooting bounded while preserving the segmentation and expansion capabilities that make a homelab useful.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Model names, software features, performance claims, hosting terms, prices, and stock can change. Verify the current data sheet, PoE budget, supported applications, and availability for every selected device before purchase.

Quick Recap

Bestseller No. 1
UBIQUITI UCG-MAX Cloud Gateway MAX W/ 512GB SSD
UBIQUITI UCG-MAX Cloud Gateway MAX W/ 512GB SSD
UBIQUITI UCG-MAX CLOUD GATEWAY MAX W/ 512GB SSD
$329.00
Bestseller No. 2
UBIQUITI UNIFI Gateway LITE
UBIQUITI UNIFI Gateway LITE
UBIQUITI UNIFI GATEWAY LITE
$83.89

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.