UniFi Cloud Gateway Ultra Review: The Best $129 Gateway for Gigabit Networks (2026)

The UniFi Cloud Gateway Ultra is a $129 compact gateway with a quad-core processor, 3 GB of RAM, a 2.5 GbE WAN port, and a full built-in UniFi controller. It replaces the USG and UXG-Lite for most deployments and delivers 1 Gbps routing with IDS/IPS enabled — sufficient for the majority of home labs and small businesses.

The two constraints that matter: a hard 1 Gbps throughput ceiling and a scope restricted to UniFi Network only (no Protect, no cameras, no PoE). For multi-gig fiber or camera support, the Cloud Gateway Max ($199) is the better fit.

Key Specifications

Cloud Gateway Ultra vs. 2026 Compact Gateways

The UCG-Ultra ($129) is Ubiquiti's lowest-cost gateway with a built-in controller, sitting below the Cloud Gateway Max ($199) and Dream Router 7 ($279).

The Ultra is strictly a router and controller — no built-in WiFi, no camera storage, no PoE output. That focus keeps the price low but means additional hardware is required for a complete network. For rackmount comparisons (UDM-Pro, Pro Max), see our full gateway comparison guide.

Cloud Gateway Max IDS/IPS throughput of 2.3 Gbps requires UniFi OS 4.1+ (Network 9+) firmware. The original device spec was 1.5 Gbps.

UCG-Ultra vs. UXG-Lite

The UXG-Lite costs the same $129 but requires an external controller — a Cloud Key Gen2+ ($199) or self-hosted setup. The UCG-Ultra includes the controller, largely superseding the UXG-Lite for new deployments unless you already run a centralized multi-site management server.

Why Modular Beats All-in-One

The UCG-Ultra + separate AP approach often outperforms the Dream Router 7's all-in-one design for one reason: placement. The Dream Router 7 sits on a desk or shelf — wherever your ISP line terminates. A ceiling-mounted U7 Pro in the center of your space delivers measurably better coverage. See our network design guide for layout planning.

UCG-Ultra vs. UniFi Express 7

The UCG-Ultra is a wired router with four LAN ports. The Express 7 includes Wi-Fi 7 but has only one LAN port, requiring an external switch.

Both gateways share the same quad-core ARM Cortex-A53 processor and 3 GB of RAM, delivering identical routing performance. The Express 7 ($199) is designed for compact, single-device deployments such as small apartments. Adding wired desktop clients to an Express 7 network requires a separate PoE switch, bringing the true deployment cost to $230–$260. The UCG-Ultra trades the wireless radio for four built-in LAN ports, providing a more flexible foundation for multi-device networks at $70 less. For a deeper look, see our Express 7 vs Dream Router 7 comparison.

What Does a Complete UCG-Ultra Setup Cost?

A complete UCG-Ultra network costs approximately $427. This includes the $129 gateway, a $109 PoE switch, and a $189 wireless access point.

Because the gateway lacks integrated Wi-Fi and Power over Ethernet (PoE), a standard deployment requires external hardware. The most common topology pairs the UCG-Ultra with a USW-Lite-8-PoE switch and a ceiling-mounted U7 Pro access point.

Prices reflect Ubiquiti MSRP. Third-party retailers (CDW, Best Buy, Amazon) may charge 10–30% above MSRP depending on stock availability.

Swapping the AP for a U7 Lite ($99) reduces the total to roughly $337 while maintaining Wi-Fi 7 performance on the 2.4 and 5 GHz bands. For the differences, see our U7 Lite vs U7 Pro comparison.

For context: a Firewalla Gold Pro plus a separate AP runs higher. A Cisco Meraki Go stack exceeds $600. The UCG-Ultra setup delivers managed VLANs, IDS/IPS, multi-WAN, and centralized management for under $450.

What Are the Speed Limits of the UCG-Ultra?

The UCG-Ultra has a strict routing limit of 1 Gbps. Even with the 2.5 GbE WAN port, single-device traffic cannot exceed Gigabit speeds.

Three hardware constraints define this ceiling. First, threat detection (IDS/IPS) throughput physically maxes out at 1 Gbps — real-world testing shows ~900–950 Mbps sustained. Second, the internal backplane restricts single-client WAN-to-LAN traffic to 1 Gbps, even if security features are disabled. Finally, the four LAN ports operate at standard 1 GbE. The 2.5 GbE WAN port prevents the 940 Mbps overhead penalty common to standard Gigabit negotiation and provides aggregate headroom for multiple clients, but it does not enable multi-gig downloads for individual devices.

If your ISP plan exceeds 1 Gbps, the Cloud Gateway Max provides 2.3 Gbps routing throughput and 2.5 GbE LAN ports. For 2+ Gbps fiber, look at the Cloud Gateway Fiber (5 Gbps IDS/IPS) or Dream Machine Pro Max.

Local Network (NAS) Transfer Limits

The 1 Gbps ceiling also applies to LAN-to-LAN traffic routed through the gateway. Users with a 2.5 GbE or 10 GbE Network Attached Storage (NAS) device cannot achieve multi-gig local file transfers through the UCG-Ultra's built-in switch — each port is limited to 1 GbE. For multi-gig local transfers, connect NAS and client devices to a separate 2.5 GbE switch (such as the USW-Enterprise-8-PoE) and keep traffic on the same VLAN to avoid routing through the gateway.

Power Consumption and Thermals

The UCG-Ultra draws a maximum of 6.2 W via USB-C (5V/3A) — among the lowest in its class and a strong consideration for UPS runtime planning. The compact fanless chassis dissipates heat passively; the unit will feel warm during normal operation. Do not stack it directly on heat-generating equipment such as a cable modem or PoE switch, and ensure adequate airflow around the enclosure.

PPPoE Connection Overhead

PPPoE fiber users should expect throughput to land 5–15% below the 1 Gbps ceiling due to encapsulation overhead on ARM-based gateways. Community testing shows most gigabit PPPoE connections achieving 850–950 Mbps downstream, with some configurations dropping toward 800 Mbps.

Earlier UCG-Ultra firmware (pre-2024) had more severe PPPoE throughput problems — in some cases dropping below 700 Mbps. These encapsulation issues were resolved across the UniFi OS 4.x firmware cycle, and current firmware (UniFi OS 5.x, as of May 2026) sustains PPPoE speeds in the 900+ Mbps range under normal conditions. If your ISP (CenturyLink/Lumen, some AT&T fiber plans, many European providers) requires PPPoE and your plan is at or near 1 Gbps, the Cloud Gateway Max provides substantially more headroom at 2.3 Gbps IDS/IPS.

Multi-WAN Failover and Load Balancing

The UCG-Ultra supports multi-WAN by reassigning LAN Port 4 as a secondary WAN. Configure automatic failover or active load balancing across two ISP connections — a feature typically reserved for gateways costing $300+.

• Failover: Primary ISP drops, traffic shifts to backup (5G modem, Starlink, second cable line) within seconds.
• Load Balancing: Traffic distributes across both connections for improved aggregate throughput.

For work-from-home setups and small offices where connectivity interruptions are costly, multi-WAN failover is a practical feature at this price point. The UniFi 5G Backup ($99) pairs well with the Ultra — it connects to any PoE switch port and provides automatic cellular failover without using a WAN port. See our 5G failover setup guide for full configuration details, or our Starlink Business failover guide if satellite is the better fit for your location.

VPN Performance

The UCG-Ultra supports WireGuard, OpenVPN, IPsec, L2TP, and Teleport VPN. WireGuard — the fastest modern option — delivers approximately 300–600 Mbps in server mode based on community benchmarks, though throughput varies with IDS/IPS status and client configuration. The built-in Site-Magic SD-WAN provides zero-config site-to-site connectivity for multi-location deployments.

Does the UCG-Ultra Support UniFi Protect Cameras?

No, the UCG-Ultra does not support UniFi Protect or security cameras. It is a dedicated network router that only runs the UniFi Network application.

The chassis lacks the internal storage and application support required for video surveillance, UniFi Access (door controls), or UniFi Talk (VoIP). The UCG-Ultra supports:

• ✅ VLANs, firewall rules, traffic identification, ad blocking, content filtering
• ✅ WireGuard, OpenVPN, IPsec VPN
• ✅ Site-Magic SD-WAN
• ❌ UniFi Protect (camera recording)
• ❌ UniFi Access (door controllers)
• ❌ UniFi Talk (VoIP)

The quad-core processor handles multi-VLAN routing for typical SMB segmentation — IoT isolation, guest network, management VLAN — without CPU strain at normal traffic volumes. The 30+ device / 300+ client spec holds with VLAN segmentation active; the 1 Gbps aggregate ceiling remains the practical limit regardless of VLAN count.

Deployments requiring camera support should consider the Cloud Gateway Max ($199), which includes NVMe storage specifically for the UniFi Protect suite. The $70 difference avoids having to purchase a separate UNVR ($299+) later. For existing Protect users, see our Protect CCTV guide and storage planning guide.

How Does the UCG-Ultra Compare to Non-Ubiquiti Alternatives?

The UCG-Ultra's closest competitors at the $50–$150 price tier are the TP-Link Omada ER605 (approximately $60) and the MikroTik hEX RB750Gr3 (approximately $60). Both offer Gigabit routing at lower prices, but with notable trade-offs.

The TP-Link Omada ER605 provides multi-WAN load balancing, IPsec/OpenVPN VPN, and centralized management through the Omada SDN controller. However, it lacks IDS/IPS entirely, and its management interface — while improved with Omada Cloud — does not match the depth of the UniFi controller for VLAN segmentation, traffic identification, or device-level visibility.

The MikroTik hEX (dual-core 880 MHz, 256 MB RAM) runs the full RouterOS feature set and offers granular control well beyond what most consumer-grade gateways provide. Network engineers comfortable with CLI configuration may prefer its flexibility. The trade-off is complexity: RouterOS has a steep learning curve, no built-in IDS/IPS, and no integrated device management dashboard. For MSPs and IT teams managing multiple sites, the UCG-Ultra's built-in controller and zero-touch provisioning via Site-Magic simplify ongoing management.

The UCG-Ultra's main differentiator is the integrated UniFi controller, which eliminates the need for separate management hardware. Combined with IDS/IPS at wire speed and a unified ecosystem of APs, switches, and cameras, it offers a more turnkey experience than either alternative at the cost of less granular protocol-level configuration.

Who Should Buy the UCG-Ultra?

Buy It If:

• Your internet is 1 Gbps or slower. Full IDS/IPS threat detection without bottlenecking your connection.
• You want a modular network. Gateway in the closet, WiFi 7 APs on the ceiling, PoE switch in the rack.
• You are replacing a USG or Cloud Key. The UCG-Ultra consolidates both into one $129 device with improved performance and a current-generation controller.
• You manage remote sites. Site-Magic VPN connects locations without manual configuration. Deploy one at a client's site and manage it from your controller.

Skip It If:

• You have 2+ Gbps fiber. The 1 Gbps ceiling will limit your plan. The Cloud Gateway Max handles 2.3 Gbps IDS/IPS for $70 more. For plans above 2 Gbps, skip the compact lineup entirely: the Cloud Gateway Fiber ($279) delivers 5 Gbps IDS/IPS with dual 10G SFP+ ports, and the Dream Machine Pro Max ($599) provides 5 Gbps IDS/IPS in a rackmount form factor with redundant NVR storage.
• You want or might want cameras. The Ultra runs Network only. The Cloud Gateway Max ($199) supports Protect with NVMe storage. The Dream Router 7 ($279) includes WiFi 7, camera storage, and PoE.
• You need WiFi and a gateway in one box. The Express 7 ($199) or Dream Router 7 ($279) include built-in WiFi 7.

Migrating From a USG or Cloud Key Gen2

The UCG-Ultra is the most common upgrade path from older USG + Cloud Key setups. The migration involves one critical step before anything else: update the UCG-Ultra's firmware to match your existing controller version. The device ships with older firmware, and restoring a newer backup to an older build will fail with a version mismatch error. Connect the UCG-Ultra to the internet through the existing network (via its WAN port, while the old gateway stays active), let it update the Network application and OS firmware, then confirm the version matches your current controller.

Once versions match: take a settings-only backup from the existing controller, restore it to the UCG-Ultra, then physically replace the old gateway. If migrating from a Cloud Key, shut it down after the swap — devices will not re-adopt while two controllers are running simultaneously. Most sites complete full re-adoption within 3–5 minutes without manual device re-provisioning.

Bottom Line

The UCG-Ultra consolidates a $328+ stack (USG + Cloud Key) into a $129 USB-C-powered device with IDS/IPS, VLANs, multi-WAN failover, VPN, and a full built-in controller.

The 1 Gbps throughput ceiling matters if you have multi-gig fiber or plan to add cameras. For those cases, the Cloud Gateway Max ($199) adds 2.3 Gbps IDS/IPS and Protect support. For WiFi 7 in a single device, the Dream Router 7 ($279) covers that.

For gigabit internet and modular network design, the UCG-Ultra is the lowest-cost UniFi gateway with a built-in controller in 2026.

---

Need help designing your UniFi network? Our team provides network assessments and professional installation throughout South Florida. Contact us for a recommendation tailored to your floor plan and device count.

For more UniFi guidance, see our gateway comparison guide, WiFi 7 AP guide, and network design guide.

Frequently Asked Questions

Does the UCG-Ultra support UniFi Protect cameras?

No. The Cloud Gateway Ultra runs UniFi Network only. It cannot host Protect, Talk, or Access. For camera recording on a compact gateway, the Cloud Gateway Max ($199) adds NVMe storage and Protect support for $70 more. For larger deployments, see our Protect CCTV guide.

Can the UCG-Ultra handle 2 Gbps fiber internet?

Not at full speed. The 2.5 GbE WAN port negotiates a 2.5 Gbps link, but IDS/IPS throughput caps at 1 Gbps and the internal backplane limits single-client downloads to roughly 1 Gbps even with security features disabled. For multi-gig internet, the Cloud Gateway Max handles 2.3 Gbps IDS/IPS, and the Cloud Gateway Fiber scales to 5 Gbps.

Is the UCG-Ultra better than the UniFi Express 7?

The UCG-Ultra and Express 7 share the same quad-core ARM Cortex-A53 processor and 3 GB of RAM. The UCG-Ultra wins on wired connectivity — four GbE LAN ports vs. the Express 7's single 2.5G LAN port — and costs $70 less. The Express 7 wins on simplicity with built-in WiFi 7 and mesh AP mode. The Express 7 is ideal for apartments and travel; the Ultra is for dedicated, modular networks.

Does the UCG-Ultra have PoE ports?

No. All four LAN ports are standard GbE without PoE output. You need a separate PoE switch — the USW-Lite-8-PoE ($109) is the most common pairing — to power access points and cameras.

What does a full UCG-Ultra network setup cost?

A complete setup runs approximately $427 at MSRP: UCG-Ultra ($129) + USW-Lite-8-PoE ($109) + U7 Pro ($189). Substituting a U7 Lite ($99) drops the total to approximately $337 while keeping WiFi 7 on 2.4/5 GHz bands. Third-party retail pricing may vary.

Can the UCG-Ultra do multi-WAN failover?

Yes. Reassign LAN Port 4 as a secondary WAN for automatic failover or load balancing across two ISP connections. For configuration steps, see our 5G failover setup guide.