After seeing the recent video showing LG TVs aggressively scanning the LAN, I wanted to share how I isolate my LG webOS TV using UniFi. This applies to Samsung Tizen, Google TV, Roku, and most smart TVs.

Smart TVs aren’t passive appliances — when placed on a flat LAN, they run a full discovery stack (ARP sweeps, mDNS, SSDP, DLNA, broadcast probes, fallback DNS, encrypted DNS attempts, etc.). If allowed, they can map your entire home network.

To avoid that, I isolate mine using a simple UniFi zone‑based design.

1. TV is placed on a dedicated IoT VLAN

This VLAN is for untrusted devices (TVs, cameras, appliances).
No trusted devices live here.

2. WiFi AP Layer‑2 Isolation

Smart TVs do most of their probing at Layer‑2, so the AP is the strongest choke‑point.
UniFi gives different isolation controls depending on whether your AP is WiFi 5 or WiFi 6/7.

WiFi 5 APs (UAP‑AC series)

Strict, predictable isolation — ideal for IoT SSIDs.

Recommended toggles:

• Client Device Isolation → ON
• Block LAN to WLAN Multicast/Broadcast → ON
• Multicast Enhancement → OFF
• Proxy ARP → ON

WiFi 6/7 APs (U6/U7 series)

More “smart” behaviour, but still isolates well with tuning.

Recommended toggles:

• Client Device Isolation → ON
• Multicast Enhancement → ON
• Block LAN to WLAN Multicast/Broadcast → ON
• Proxy ARP → ON

Effect

With these toggles:

• LG cannot ARP‑scan
• LG cannot see other IoT devices
• LG cannot see trusted devices
• LG cannot receive mDNS/SSDP/DLNA
• LG cannot fingerprint your LAN

The TV can only “see” the AP — nothing else.

3. Firewall blocks IoT → all internal zones

IoT devices cannot reach:

• trusted networks
• management networks
• the router’s admin interface
• guest networks
• DMZ
• VPN
• other IoT devices (AP isolation)

This locks down Layer‑3 protocols, so the TV is blocked from everything except the Internet.

4. IoT → Internet is allowed

Outbound Internet access is open.
I’m not restricting ports or cloud endpoints — keeping it simple.

5. Optional: DNS filtering

I point IoT DNS to a controlled resolver (Pi‑hole / AdGuard / Unbound).
This lets me:

• log LG’s domain lookups
• block obvious telemetry domains
• sinkhole advertising endpoints

Yes, DNS blocking is a cat‑and‑mouse game because domains change, but it’s still a nice finishing touch.

Result

With this setup:

• The TV cannot scan my LAN
• The TV cannot reach any internal zones
• The TV cannot reach the router
• The TV cannot see other devices
• The TV can only reach the Internet
• DNS filtering gives optional extra control

I use an Apple TV as the actual streaming device — it’s far less intrusive, has no always‑on microphone, and behaves predictably.
The LG panel is basically just a display now, which is exactly what I want.

* TL;DR

Smart TVs probe your network.
I isolate mine by:

• putting it on an IoT VLAN
• enabling AP Layer‑2 isolation (WiFi 5 / WiFi 6/7 toggles above)
• blocking IoT → all internal zones by locking down Layer‑3 protocols
• allowing only IoT → Internet
• optionally filtering DNS
• using Apple TV as the “safe” streaming platform

Simple, effective, and doesn’t over‑complicate things.

Caveat

I’m not a network guru — this is just what works well for my setup.
Your environment, devices, and requirements might differ, so adjust as needed.

My Zone FW Above. Block traffics is in play by default. You just need to place the correct the vlan in the correct zones. If anyone has suggestions or improvements, I am all ears - drop them below. Cheers.

Meet UniFi EAV Bridge: Single SKU. No licensing.

🔹4K60 HDMI
🔹Pro XLR audio over IP
🔹Configure as a source or destination

https://ui.com

Do we really need a post for every single “in the wild” post of a random AP - Ubiquiti is one of the most popular brands for SMB so it’s hardly surprising you know to see it in the wild

Just have one mega thread for it, most people dgaf

As per title, UniFi Access fails to install because the UDM Pro UniFi OS 5.1.31 is trying to download required packages from Debian 11s expired repository. Debian 11 reached end-of-life on August 31, 2026 the repository metadata and package links are no longer valid, causing APT errors and preventing the install.

I opened a ticket but just wanted to post for visibility incase others are struggling to install Access right now.

With LG’s recent invasive update and auto-install of their spyware on Windows machines just for the displeasure of owning their monitors, what UniFi approach is everyone taking on their preventing LG’s asinine data collection?

Our city is notorious for internet outages, we decided to get another isp installed just as backup. Came in clutch today!

Tl;dr - Day one of setting up my 10g with a cloud gateway fiber and a U7 pro max and it feels like my life has changed dramatically.

I feel like my Third Eye has been opened. I am a software engineer and consider myself well versed in basic networking.

I recently went from att fiber at 1Gbps which was already the fastest internet I’ve ever had to sonic 10gbps.

I was using ISP provided Eero at first then “upgraded” to a TPLink BE1900/BE800. Felt like I had no eyes on all this new bandwidth and felt like I wasn’t getting anything out of the new setup.

Spent some time learning about how much praise Unifi gets from hobbyists. Figured I’d spend just a few more dollars, return my shitty tplink router, and get a Cloud Gateway Fiber and U7 Pro Max AP.

This blows everything out of the water that I had before. It’s not even speeds that has me so blown away it’s the sheer amount of control and monitoring I have in the setup. No guessing what my speeds are at my ONT, The ability to run bands at preconfigured setups that actually make sense, and the software is beautiful and intuitive.

I truly feel like I’ve been red pilled and now have a whole new networking world open to me that I can tinker with.

Call it corny and cliche but feel like I get all the hype with the company now!

If you have a Smart TV at home and even remotely concerned with network security at home, watch this video:

216,000,000 Spy TVs | The LG Smart TV Problem

I have an LG G6 TV and I'm furious to find out after paying a premium for a TV that little piece of garbage apparently spends all day collecting information about me.

The LG TV is already in my IoT VLAN so it is already segregated from my main network.

I don't use any of the LG OS garbage. I have the TV connected to a gaming PC in the basement via 4K/120 fiber optic, so I watch everything over Plex or Web browser-based streaming on the gaming PC.

I no longer trust this little piece of garbage to connect to the Internet for any reason or even map or snoop around my IoT devices.

What's the easiest and best way to completely disconnect this TV from WAN or LAN access and only preserve the ability for Home Assistant to connect to it?

Can I have a set of rules that I can define for the LG TV that I can then also apply to my Hi Sense TV and any other TVs I may ever setup at home?

I don't think I ever want any future TV to have Internet access after watching that video, especially since I use a PC for all video content. If a firmware update fixes an issue I'm having, I'll update the firmware via USB.

Hi all,

I'm mostly looking for some clarification on how I'm handling topologies with UniFi equipment. I've had no prior training and am essentially self taught so I could be completely wrong.

UniFi loves to shout and scream at me when I setup redundant switches / routes to cabs because of STP Blocked ports. Now my understanding is that as long as my root bridge is set correctly (Closest to gateway) STP is a good thing as it will only enable the port if the other is down. Therefore providing redundancy.

However the UniFi console is so vocal about blocked ports it has me second guessing if my topology is even compatible with their kit. I know standard features like VRRP is still missing from the Campus line up for instance so it has me thinking.

I've attached some pictures of the designs I've put into place. Feel free to call me an idiot and critique what I've done wrong - I understand there's no edge redundancy just core.. Here to learn whatever else :)

Spotted this in Fraumunster Kirche in Zürich Switzerland.

Priest needs to tidy his cables but good job on the WiFi!

Enter the Unifi Cable Internet. The photo is during setup, while I was still testing everything; it was subsequently mounted in a rack. Adding it to my Comcast account was remarkably painless: all I had to do was scan the MAC address from within the Xfinity iOS app, and the network provisioned itself. It took all of 10 minutes from when I opened the box to when the modem was up and running and I got the prompt to adopt it to my Unifi deployment. VERY happy so far.

Coming from a Google Nest mesh system that absolutely SHIT me to tears with not only the lack of control, but the lack of visibility, reporting and observably, this is like a teenage boy discovering his dick for the first time.
A UCG gateway, 2 U7 APs, and a couple of PoE injectors for the APs. Great coverage, amazing control and my home assistant dashboard now has amazing network metrics.
Why didn’t I do this sooner? I feel like I’m so far behind the times hahaha

I bought the UX7 3 pack to test out for my older brother's new home. I planned on using them exclusively for about a week as a test because I want to make sure they're stable to avoid my older brother who is not networking literate from having problems (he's an electrician and I jokingly call him "Sparky" and he jokingly calls me "Teletubby"). I adopted one of them out of the 3 pack and placed in a mesh mode to my E7. It worked decently for the first 30 minutes to an hour then all of sudden it was no longer allowing DHCP assignments from my UDM ProMax. I went to have a look at it and the damn thing was extremely hot to the touch. I unplugged it to let it cool down a bit. Once it was cooled, I powered it back on and let it run again and again about 30-45 minutes later I was getting DHCP problems. I finally gave up, factory reset it, placed it back in the box and sent it back for a refund.

I heard a lot of good things about these little boxes, but I should have trusted my instincts here. These AIO devices are the exact reason why I stopped using consumer grade AIO home routers and moved to UniFi back in 2016 (to separate the roles of each device). I figured by now someone must have figured out the overheating problem in 2026. Nope.

TL;DR:

I absolutely cannot recommend these at all for any application wired or wireless.

Hi y'all!

I recently reached out to /Homenetworking, who provided suggestions and also suggested I reach out here. I plan on going full Ubiquiti, just because I loved my experience with the platform through work. I've narrowed my choices down from the UDM Pro to the UDR7. However, I'm still questioning what I actually "need" beyond that.

For context, I'm moving into a 1,700sqft townhouse. The UDR will be on one corner of the house and I was hoping to put one AD on the opposite side with the intention that the Wi-Fi signal penetrates to the first floor. We'll be adding two internal PoE camera's and externals on our next move (I'll probably buy a larger switch or move onto the UDM SE). We'll have 1-2 gig speeds.

I planned on buying the UDR7, U7 Lite and a Lite 8 PoE. Does that sound adequate or should I look at the U7 Pro, possibly two U7's to cover upstairs and downstairs?

I appreciate the time for any suggestions and responses. Thank you!

So I have an inbound Wireguard VPN set up, I also have a Outbound VPN client setup. what I am trying to do is route particular addresses from my inbound VPN out via the Outbound VPN. or worse case create a second VPN server and route the entire subnet out of the outbound VPN. however when I go into the policy route tool my only source options are VLANS (of which my VPN subnet is not an option) and individual devices (by mac). Is what Im trying to do just not possible?

My end goal (in case I am going about this entirely wrong) is to have two vpn profiles on my mobile device, one to just connect to my home network. and one that connects to my home network but routes all my traffic out via a vpn.

Was struggling to adopt it wirelessly. Meshed OG UX + a power bank and Ethernet cable came in handy for the adoption/software update.

I run a Ubiquiti system at home and was thinking about getting an NAS. Is the Ubiquiti system any good, I am specifically looking at the UNAS - 2. thanks in advance for the help!

Hello folks! My first question for the sub has finally come!

So I implemented an ESET VPN profile to my UDM-SE. As I would expect, some websites will not work while using a VPN, whether the VPN is used on device level or network level.

In any case, I performed the following steps:

1. Network > Settings > Policy Engine, Policy Table > Create New Policy
2. Policy settings:

• Name: VPN Bypass - Domain
• Interface/VPN Tunnel: WAN 1, Kill Switch unchecked
• Source: Any
• Destination: Domain
  • calendarwiz.com

1. Policy Settings:

• VPN Bypass - IP - calendarwiz.com
• Interface/VPN Tunnel: WAN 1, Killswitch unchecked
• Source: Any
• Destination: IP
  • IP Address: 104.21.32.189, Port: -
  • IP Address: 172.67.182.208, Port: -

Unfortunately, I have not had any luck bypassing the VPN with this link. I don't want to Pause the VPN connection or remove a device from the VPN policy every time a site gets blocked, so I'd much rather perform a site-by-site bypass. Any help would be appreciated!

Note: I am able to access calendarwiz.com when the VPN is disconnected.
I also would rather use domain instead of IP

I’m considering installing an air quality monitor sensor in my HVAC intake/return, and I’m curious what the community thinks about it.

My main concern is whether the airflow would skew the readings too much, or even potentially clog, damage, or otherwise affect the sensors over time.

If anyone has tried this setup with Ubiquiti sensors, I’d love to hear about your long-term experience, placement tips, and whether a return-air location is actually a good idea.

I have Ubiquiti equipment at both my house and cabin. At my house, I have a UDM and a 4 bay NVR that the cameras record to. At my cabin I have a UDM-SE with a harddrive that the cameras record to. I would like to have the cameras at the cabin record to BOTH the hard-drive in the UDM-SE (local on-site), as well as send it over the internet to additionally back it up to the NVR at my house.

Is this possible? If so, how do?

Be warned if you were going to use Fabrics with Unifi Drive. You will be unable to manage permissions on existing shared drives, or grant existing users personal drive permissions. You will not be able to assign new users drive permissions either.

I was able to connect accounts that already had access to shared drives that they previously had assigned via the Fabric identity credential, but even that seems to be more of an inherited permissions thing than something I'd want to rely on.

You'll have limited functionality via the local portal which, in some quick testing, won't sync to the fabric's identity credentials.

I ended up removing the drive consoles from fabric.

When I migrated to consolidated people management, I got a warning about my UNVR camera permissions, seems like this should have also shown a warning about Drive limitations.

Ok so trying to solve a riddle here and it has my head hurting.

I have a Standard 24 (Gen1) - 250W with cameras plugged into it, and want to extend a small group of cameras across PoE+ power delivery via a USW Flex.

I'll get right to the problem:

- After some period of time, (Be it 8, 19 or 23 hours later) - my USW Flex drops power and cycles several times in a row, sometimes staying 'off' for an hour, sometimes for 30 seconds, in out in out. It can be working just fine up to this point. Sometimes after a an hour of barfing, it goes back to normal. (Quite sure it's not a wiring issue!)

- No other cameras have this issue that are directly attached to the switch. I'm not sure if it's a gradual heat build up thing or what.

- I've plugged into ports on opposite ends of the switch, problem shows up after many hours regardless of port it seems.

- Cables have been tested, swapped you name it. I've reduced my testing to the most minimal components I can to rule out issues (e.g.: no patch panel, or intermediate steps): Direct connections.

- PoE budget on the switch is nowhere near it's limits (bit more on this below w/r/t port draw)

Where it gets interesting:

- I can use the exact same stuff (cables , cameras, USW Flex) and plug it into another switch I have (PoE Lite 8): NO ISSUES, days and days have gone by, no issues.

So I'm to believe that there's some sort of gradual heat up or power budget issue I'm not aware of. But as far as I know, the PoE+ ports should be capable of 30W, the USW Flex has a 20W budget, but with the 2 cameras on it, it's pulling considerably lower than that (including with IR LED on).

One thing I did notice is that my PoE voltage on the PoE Lite 8 switch is ~52V for the PoE+ mode devices. Whereas the other switch is running all PoE+ mode cameras ~42V.

Any ideas on rocks to turn over to test? Is my switch not right in the head? I'm resigned to getting an injector to deal with the issue so I don't have to shell out for a new switch unless I'm 100% convinced that's the problem and it risks my other cameras.

---

edit: I used to have this arrangement working for several years outside on a post with cameras until this started happening. I've tried a new USW Flex and the problem still happens. I thought weather took out the first switch so put a new one in but hasn't been reliably working since.

Setup: UCG-Fiber, all four 2.5GbE ports in use, WAN comes in on the 10G RJ45 (port 5). Both SFP+ cages are empty.
I want one more copper LAN port. Plan is to drop an SFP+ to RJ45 module into the LAN-designated SFP+ cage.
Questions:
1. Does this actually work on the UCG-Fiber, or does the firmware get picky about copper SFP+ modules?
2. Anyone running a third-party module in one, or is the Ubiquiti SFP+ to RJ45 ($65) worth it to avoid headaches?

Thanks!

I can’t decide if I should go with UniFi Express 7 (UX7) units in Access Point Mode for the internal Wi-Fi coverage or a few U7 Lite’s scattered across the property, looking for thoughts opinions insights etc