A clear path
through UniFi.

01 / Before configuration

Gather the details and protect management access.

Obtain the service handoff location, Ethernet speed, port and connector, cable and optics requirements, and any provider-assigned VLAN or MTU. Confirm whether IPv4 uses DHCP or a static address; for static service, obtain the address, prefix or subnet mask, and gateway. Ask separately about IPv6 and any routed address block.

Before changing a working network, schedule an agreed maintenance window, record the current configuration and settings, and prepare a tested rollback. Ensure an authorized local management path remains available if the WAN or remote access goes down. Changes can affect network users, including ongoing classes and services.

UniFi’s local and remote management options vary with the device and deployment. A separate gateway or firewall may be responsible for the Internet connection; do not assume changing an access point’s settings changes the gateway.

02 / The handoff

Check the physical path.

Identify the port intended for the provider’s handoff, the cable type, and any intermediate switch or media converter. Confirm that the port, transceiver and cable support the agreed interface and speed. An SFP form factor alone does not establish compatibility; confirm the optical standard, fiber type, connector, and equipment support.

In UniFi Network, review the gateway and port status using the views available on your release. Compare the observed link state and speed with the provider’s handoff and any devices between them. A lit or active port does not prove addressing or Internet service is working. Handle optics according to the manufacturer’s safety instructions; do not look into a fiber end or port.

03 / Internet settings

Match the WAN to your service.

For a supported UniFi gateway, open UniFi Network → Settings → Internet and select the WAN connection or port associated with the handoff. The labels and available fields can differ between UniFi Network versions and models. Some setups use a separately managed router and need different steps.

1. 01

   Choose the assigned method

   For DHCP service, select the applicable automatic IPv4 method and confirm an address and gateway are obtained. For static service, select the static IPv4 method and enter the provider’s assigned address, prefix or mask, and gateway. An automatically obtained address can also remain stable if the provider assigns it consistently; confirm the addressing method separately from whether the address changes.

2. 02

   Check the provider’s requirements

   Set a WAN VLAN tag only if the service requires one. A provider’s WAN tag is separate from the VLANs used for local networks. Confirm any MTU or negotiation settings; do not invent values to make a link work.

3. 03

   Review before applying

   Confirm the correct physical port, addressing, DNS requirements, management and rollback path with your IT team. Apply changes in the agreed window, then verify service with the provider. An incorrect WAN change can interrupt connectivity.

For IPv6, confirm the provider’s handoff method, the WAN assignment, and how any prefix is routed or delegated to local networks. IPv6 firewall policy should follow the organization’s security design. Do not assume that every service uses DHCPv6 prefix delegation.

04 / Names & local networks

Keep DNS and VLAN responsibilities clear.

The DNS settings used by the gateway or its management system can differ from DNS servers supplied to local clients by DHCP. A school or business may rely on internal DNS for domain services, device management, or filtering. Check the approved resolvers and forwarding design before changing either setting.

To investigate a name-resolution problem, compare a lookup against the authorized resolver with other observations from an affected device. A successful lookup does not prove that the application or Internet path works. UniFi’s vendor guidance describes where gateway and client-network DNS settings may be found; labels can change by version. See our business DNS guide for a fuller explanation.

Local VLANs can separate networks such as staff, guests, and building systems, but an approved gateway policy and correctly configured switches and access points are also needed. Do not change a school’s filtering, segmentation, or DHCP settings as a shortcut to test the WAN.

05 / Confirm service

Test in layers.

1. 01

   Link and WAN

   Record the relevant port’s state and speed, the assigned WAN address, and the configured gateway or next hop. Check the actual port used; some models allow WAN ports to be reassigned.

2. 02

   Routes and DNS

   Review the active route, multi-WAN role, and applicable policy routes using the views available on your release. Check name resolution using approved DNS servers. A successful link does not prove the right route or resolver is in use.

3. 03

   Applications

   From a representative wired device, verify the services users need. Compare Wi-Fi separately if needed. Record the source, destination, time and time zone, address family, and whether a VPN or backup connection is in use.

Where available, UniFi’s built-in Debug Console can help authorized administrators investigate a device. Ubiquiti recommends it over SSH for direct troubleshooting. Availability and privileges vary; consult its current documentation and the organization’s procedures.

06 / Read the evidence

One way to narrow a problem.

Provider handoff port:  link up
Gateway WAN port:       link up, 1 Gbps
IPv4 assignment:        static configuration present
Client observation:     an approved hostname does not resolve

Record interface errors and drops, where the gateway exposes them, and compare a second reading after a known interval. Include relevant interfaces along the path to the handoff. An old counter alone does not establish a current fault, and available counters vary by model and software.

Optional read-only command examples

On a gateway whose debug environment provides the Linux ip tool, an authorized administrator can inspect interfaces and routes with the commands below. Ubiquiti recommends the built-in Debug Console for direct device troubleshooting. Command availability and output depend on the device and software; these commands do not change settings.

ip -s link show

ip -4 route show

07 / Performance

Separate the circuit from the rest of the network.

Test from a suitable wired client and check the gateway’s supported throughput with the actual features in use, such as inspection, VPNs, and traffic shaping. Port speed alone does not guarantee the same application throughput. Compare readings at busy and quiet times without running an uncoordinated test that could consume production capacity.

For wireless-only problems, review the affected clients, access points, signal and interference. A dense New York City environment can have competing wireless transmissions; the wired circuit and Wi-Fi each need their own investigation. See our slow connection guide and latency, jitter and packet loss guide.

Multi-WAN health monitors test particular targets and conditions; they cannot establish that every application is working. Coordinate any changes to failover, policy-based routes, or verification targets with the network owner and test the result during an approved window.

08 / Escalation

What to share with support.

• Service address, circuit identifier, handoff, gateway model, and software version.
• Time and time zone, affected users or applications, and what is still working.
• Link state and speed on the gateway and, if available, the devices through the handoff.
• Relevant addressing, route and counter observations; indicate if a VPN or backup WAN is active.
• The tests run, their source and destination, and any approved recent change.

Review screenshots and logs before sharing; remove passwords, private keys, tokens and sensitive student or network information. For Stealth service, call +1 212 232 2020 or email support@stealth.net. The organization’s UniFi administrator and Ubiquiti support can help with gateway-specific settings.