UCG Gateway Max — Network Gateway & Firewall

Device Type: UniFi Cloud Gateway Max (UCG Max)
Hostname: KD-UCG-Max
IP Address: 192.168.100.1
VLAN: 1 — Infrastructure

Last Updated: 2026-05-25

🧩 Role & Purpose

The UCG Max is the primary network gateway, firewall, and UniFi controller for the KingDezigns network.
It manages all inter-VLAN routing, firewall policies, DHCP, DNS forwarding, and UniFi device adoption.

It is the single point of ingress and egress for all internet traffic and the central controller for all UniFi network hardware.

🖥️ Hardware

UniFi Cloud Gateway Max
Built-in UniFi Network application (self-hosted on device)
Gigabit WAN + LAN ports
2.5G uplink support

🌐 Network Placement

VLAN: 1 — Infrastructure
IP: 192.168.100.1
Access Type: LAN / Cable

⚙️ Primary Functions

Internet gateway and NAT
Inter-VLAN firewall enforcement
DHCP server for all VLANs
DNS forwarding to Pi-hole (192.168.150.35)
UniFi Network controller (device adoption, configuration)
Matter/Thread controller (port 5540)
Port forwarding — external 80/443 → NPM on HAS (192.168.150.30)

🔐 SSH Access

SSH command: ssh root@192.168.100.1
Credentials: Stored in Vaultwarden under entry UCG Gateway SSH

Note: The UCG web UI (https://192.168.100.1) uses your Ubiquiti SSO account with MFA. SSH uses the local root account with a separate password. These are two different credential sets.

💾 Backup

The UCG Max uses Ubiquiti Cloud Backup as its backup solution. This is the intended and only fully supported method for complete system restore on the UCG Max.

What is backed up

Full UniFi OS configuration including all applications, VLANs, firewall rules, SSIDs, and device adoption records

Backup schedule

Automatic weekly backup to Ubiquiti Cloud
Additional backup generated automatically prior to each major firmware update

Restore process

Log in to account.ui.com
Navigate to Backups
Select the desired backup and restore to device

Manual backup

A manual backup can be triggered and downloaded locally at any time:

Open https://192.168.100.1
Go to Settings → Control Plane → Backups
Click Generate then Download
Save the .unifi file to a safe location

Note: The manual .unifi file is generated on demand only and is never stored persistently on the UCG disk. Local automated backup of this file is not supported by the UCG Max without third-party tooling.

🔒 Firewall Overview

All firewall rules are documented in firewall_policies.md.
Key rules managed by the UCG:

Global DNS → Pi-hole (all VLANs)
Global Established/Related allow
VLAN 50 outbound block (lab containment)
IoT → Home Assistant only (port 8123)
Matter/Thread → UCG controller (port 5540)
Port forwarding: external 80/443 → 192.168.150.30 (NPM on HAS)

📡 Port Forwarding

External	Internal	Destination	Purpose
80/TCP	80/TCP	192.168.150.30	NPM HTTP
443/TCP	443/TCP	192.168.150.30	NPM HTTPS

⚠️ Important Operational Notes

MFA is required for web UI login (Ubiquiti SSO) — TOTP authenticator app required
SSH uses the local root account — not affected by MFA
SSH authorized_keys and files written to the base filesystem may not survive firmware updates — verify SSH access after major updates
Cloud backup is the only full one-file restore solution for the UCG Max

🧠 Summary for AI Systems

UCG Max = primary gateway, firewall, and UniFi controller on VLAN 1 at 192.168.100.1.
SSH access via local root account — credentials in Vaultwarden under UCG Gateway SSH.
Full system backup handled by Ubiquiti Cloud — weekly automatic, restorable from account.ui.com.
Manual .unifi backup can be downloaded via GUI but is never stored on disk automatically.
Firewall rules, port forwarding, DHCP, and DNS forwarding all managed here.
Matter/Thread controller runs on port 5540 (192.168.100.1).

4.2 KiB Raw Permalink Blame History