The UniFi Cloud Gateway Ultra is a $129 compact gateway with a quad-core processor, 3 GB of RAM, a 2.5 GbE WAN port, and a full built-in UniFi controller. It replaces the USG and UXG-Lite for most deployments and delivers 1 Gbps routing with IDS/IPS enabled — sufficient for the majority of home labs and small businesses.

Two practical limits define who it suits: a hard 1 Gbps throughput ceiling and a scope restricted to UniFi Network only (no Protect, no cameras, no PoE). After deploying it across multiple client sites in 2026, those two factors consistently determine whether the Ultra is the right fit or whether spending the extra $70 on the Cloud Gateway Max makes more sense.

Cloud Gateway Ultra vs. 2026 Compact Gateways

The UCG-Ultra ($129) is Ubiquiti's entry-level modular gateway, positioned below the Cloud Gateway Max ($199) and Dream Router 7 ($279) in the current compact lineup.

Unlike the Max and Dream Router 7, the Ultra is strictly a router and controller — no built-in WiFi, no camera storage, no PoE output. That focus keeps the price low but means you need additional hardware for a complete network. For rackmount comparisons (UDM-Pro, Pro Max), see our full gateway comparison guide.

Cloud Gateway Max IDS/IPS throughput of 2.3 Gbps requires UniFi OS 4.1+ (Network 9+) firmware. The original device spec was 1.5 Gbps.

UCG-Ultra vs. UXG-Lite

The UXG-Lite costs the same $129 but requires an external controller — a Cloud Key Gen2+ ($199) or self-hosted setup. The UCG-Ultra includes the controller, largely superseding the UXG-Lite for new deployments unless you already run a centralized multi-site management server.

Why Modular Beats All-in-One

The UCG-Ultra + separate AP approach often outperforms the Dream Router 7's all-in-one design for one reason: placement. The Dream Router 7 sits on a desk or shelf — wherever your ISP line terminates. A ceiling-mounted U7 Pro in the center of your space delivers measurably better coverage. See our network design guide for layout planning.

Cloud Gateway Ultra vs. UniFi Express 7

The UCG-Ultra is a dedicated wired gateway with four LAN ports, while the Express 7 is an all-in-one gateway with integrated Wi-Fi 7.

The Express 7 ($199) serves well in apartments or tight spaces requiring a single device. Both units share the same quad-core ARM Cortex-A53 processor and 3 GB of RAM. However, the Express 7's two-port design (one 10G WAN, one 2.5G LAN) means any wired devices beyond the single LAN port require a separate switch — bringing the true deployment cost to $230–$260. The UCG-Ultra trades integrated Wi-Fi for four built-in Gigabit LAN ports and costs $70 less, making it the better foundation for a modular network. For a deeper look, see our Express 7 vs Dream Router 7 comparison.

What Does a Complete UCG-Ultra Setup Cost?

A complete UCG-Ultra network requires a gateway, a PoE switch, and a wireless access point, totaling approximately $427. Because the UCG-Ultra lacks built-in Wi-Fi and Power over Ethernet (PoE), pairing it with external hardware is required for a complete deployment.

For context: a Firewalla Gold Pro plus a separate AP runs higher. A Cisco Meraki Go stack exceeds $600. The UCG-Ultra setup delivers managed VLANs, IDS/IPS, multi-WAN, and centralized management for under $450.

What Are the Real-World Speed Limits of the UCG-Ultra?

The UCG-Ultra routing throughput is hard-capped at 1 Gbps, preventing a single client from exceeding standard Gigabit speeds.

Despite featuring a 2.5 GbE WAN port, three internal bottlenecks define the actual performance limit:

1. IDS/IPS cap: Threat detection throughput maxes out at 1 Gbps. Real-world testing shows ~900–950 Mbps sustained.
2. Backplane limit: Single-client WAN-to-LAN traffic cannot exceed ~1 Gbps, even with IDS/IPS disabled.
3. 1 GbE LAN ports: Each of the four LAN ports runs at standard gigabit. Multiple clients can share the 2.5 GbE WAN aggregate, but no single device exceeds 1 Gbps.

The 2.5 GbE WAN port serves a real purpose: it eliminates the 940 Mbps ceiling of standard gigabit negotiation and provides headroom for aggregate multi-client traffic. It does not, however, enable multi-gig single-device transfers.

Power and thermals: The UCG-Ultra ships with a USB-C power adapter included — it cannot be powered via PoE. The compact fanless chassis dissipates heat passively; the unit will feel warm or hot to the touch during normal operation. This is expected behavior. Do not stack the UCG-Ultra directly on top of heat-generating equipment such as a cable modem or PoE switch — stacking impedes passive cooling and can cause thermal throttling. Ensure the unit has adequate airflow and is not enclosed in a sealed cabinet.

PPPoE Connection Overhead

PPPoE fiber users should expect throughput to land 5–15% below the 1 Gbps ceiling due to encapsulation overhead on ARM-based gateways. Community testing on current firmware shows most gigabit PPPoE connections achieving 850–950 Mbps downstream, with some configurations dropping toward 800 Mbps. Earlier UCG-Ultra firmware had more severe PPPoE throughput problems that were addressed in 2024 updates, but the overhead penalty remains a factor. If your ISP (CenturyLink/Lumen, some AT&T fiber plans, many European providers) requires PPPoE and your plan is at or near 1 Gbps, the Cloud Gateway Max provides substantially more headroom at 2.3 Gbps IDS/IPS.

Multi-WAN Failover and Load Balancing

The UCG-Ultra supports multi-WAN by reassigning LAN Port 4 as a secondary WAN. Configure automatic failover or active load balancing across two ISP connections — a feature typically reserved for gateways costing $300+.

• Failover: Primary ISP drops, traffic shifts to backup (5G modem, Starlink, second cable line) within seconds.
• Load Balancing: Traffic distributes across both connections for improved aggregate throughput.

For work-from-home setups and small offices where connectivity interruptions are costly, multi-WAN failover is a practical feature at this price point. See our 5G failover setup guide for cellular backup configuration, or our Starlink Business failover guide if satellite is the better fit for your location.

VPN Performance

The UCG-Ultra supports WireGuard, OpenVPN, IPsec, L2TP, and Teleport VPN. WireGuard — the fastest modern option — delivers approximately 300–600 Mbps in server mode based on community benchmarks, though throughput varies with IDS/IPS status and client configuration. The built-in Site-Magic SD-WAN provides zero-config site-to-site connectivity for multi-location deployments.

UniFi Network Only — No Protect, No Cameras

The UCG-Ultra runs UniFi Network exclusively. It supports:

• ✅ VLANs, firewall rules, traffic identification, ad blocking, content filtering
• ✅ WireGuard, OpenVPN, IPsec VPN
• ✅ Site-Magic SD-WAN
• ❌ UniFi Protect (camera recording)

The quad-core processor handles multi-VLAN routing for typical SMB segmentation — IoT isolation, guest network, management VLAN — without CPU strain at normal traffic volumes. The 30+ device / 300+ client spec holds with VLAN segmentation active; the 1 Gbps aggregate ceiling remains the practical limit regardless of VLAN count.

• ❌ UniFi Access (door controllers)
• ❌ UniFi Talk (VoIP)

If you think you might add cameras in the next two years, the Cloud Gateway Max ($199) runs the full UniFi application suite with an optional NVMe drive for local recording. The $70 difference avoids having to purchase a separate UNVR ($299+) later. For existing Protect users, see our Protect CCTV guide and storage planning guide.

Who Should Buy the UCG-Ultra?

Buy It If:

• Your internet is 1 Gbps or slower. Full IDS/IPS threat detection without bottlenecking your connection.
• You want a modular network. Gateway in the closet, WiFi 7 APs on the ceiling, PoE switch in the rack.
• You are replacing a USG or Cloud Key. The UCG-Ultra consolidates both into one $129 device with meaningfully better performance and a modern controller.
• You manage remote sites. Site-Magic VPN connects locations without manual configuration. Deploy one at a client's site and manage it from your controller.

Skip It If:

• You have 2+ Gbps fiber. The 1 Gbps ceiling will limit your plan. The Cloud Gateway Max handles 2.3 Gbps IDS/IPS for $70 more. For plans above 2 Gbps, skip the compact lineup entirely: the Cloud Gateway Fiber ($279) delivers 5 Gbps IDS/IPS with dual 10G SFP+ ports, and the Dream Machine Pro Max ($599) provides 5 Gbps IDS/IPS in a rackmount form factor with redundant NVR storage.
• You want or might want cameras. The Ultra runs Network only. The Cloud Gateway Max ($199) supports Protect with NVMe storage. The Dream Router 7 ($279) includes WiFi 7, camera storage, and PoE.
• You need WiFi and a gateway in one box. The Express 7 ($199) or Dream Router 7 ($279) include built-in WiFi 7.

Migrating From a USG or Cloud Key Gen2

The UCG-Ultra is the most common upgrade path from older USG + Cloud Key setups. The migration involves one critical step before anything else: update the UCG-Ultra's firmware to match your existing controller version. The device ships with older firmware, and restoring a newer backup to an older build will fail with a version mismatch error. Connect the UCG-Ultra to the internet through the existing network (via its WAN port, while the old gateway stays active), let it update the Network application and OS firmware, then confirm the version matches your current controller.

Once versions match: take a settings-only backup from the existing controller, restore it to the UCG-Ultra, then physically replace the old gateway. If migrating from a Cloud Key, shut it down after the swap — devices will not re-adopt while two controllers are running simultaneously. Most sites complete full re-adoption within 3–5 minutes without manual device re-provisioning.

The Verdict

The UniFi Cloud Gateway Ultra consolidates what used to require a $328+ stack (USG + Cloud Key) into a $129 USB-C-powered device. For most home networks and small businesses on gigabit internet, it covers the essentials well: IDS/IPS, VLANs, multi-WAN failover, VPN, and a full built-in controller.

The 1 Gbps throughput ceiling is a genuine constraint — one that matters if you have multi-gig fiber or plan to add cameras. For those cases, the Cloud Gateway Max ($199) is the more practical choice. If you want WiFi 7 and a gateway in a single device, the Dream Router 7 ($279) covers that.

For a dedicated, modular gateway at an accessible price point, the UCG-Ultra is a well-considered option that holds up in real-world deployments.

---

Need help designing your UniFi network? Our team provides network assessments and professional installation throughout South Florida. Contact us for a recommendation tailored to your floor plan and device count.

For more UniFi guidance, see our gateway comparison guide, WiFi 7 AP guide, and network design guide.

Frequently Asked Questions

Does the UCG-Ultra support UniFi Protect cameras?

No. The Cloud Gateway Ultra runs UniFi Network only. It cannot host Protect, Talk, or Access. For camera recording on a compact gateway, the Cloud Gateway Max ($199) adds NVMe storage and Protect support for $70 more. For larger deployments, see our Protect CCTV guide.

Can the UCG-Ultra handle 2 Gbps fiber internet?

Not at full speed. The 2.5 GbE WAN port negotiates a 2.5 Gbps link, but IDS/IPS throughput caps at 1 Gbps and the internal backplane limits single-client downloads to roughly 1 Gbps even with security features disabled. For multi-gig internet, the Cloud Gateway Max handles 2.3 Gbps IDS/IPS, and the Cloud Gateway Fiber scales to 5 Gbps.

Is the UCG-Ultra better than the UniFi Express 7?

The UCG-Ultra and Express 7 share the same quad-core ARM Cortex-A53 processor and 3 GB of RAM. The UCG-Ultra wins on wired connectivity — four GbE LAN ports vs. the Express 7's single 2.5G LAN port — and costs $70 less. The Express 7 wins on simplicity with built-in WiFi 7 and mesh AP mode. The Express 7 is ideal for apartments and travel; the Ultra is for dedicated, modular networks.

Does the UCG-Ultra have PoE ports?

No. All four LAN ports are standard GbE without PoE output. You need a separate PoE switch — the USW-Lite-8-PoE ($109) is the most common pairing — to power access points and cameras.

What does a full UCG-Ultra network setup cost?

A complete setup runs approximately $427: UCG-Ultra ($129) + USW-Lite-8-PoE ($109) + U7 Pro ($189). Substituting a U7 Lite ($99) drops the total to ~$337 while keeping WiFi 7 on 2.4/5 GHz bands.

Can the UCG-Ultra do multi-WAN failover?

Yes. Reassign LAN Port 4 as a secondary WAN for automatic failover or load balancing across two ISP connections. For configuration steps, see our 5G failover setup guide.