UBIQUITI UDM-PRO-EU Unifi Dream Maschine PRO Security Gateway 8 mal LAN

Highlights at a Glance

• Integrated platform: runs Network, Protect, Access, Talk, and Connect applications on one device
• High-capacity management: supports 100+ UniFi devices, 1,000+ simultaneous users, and up to 150 access hubs
• Flexible WAN: up to 8 WAN ports with multi-WAN load balancing and LTE backup support
• Advanced security: 55,000+ IDS/IPS signatures with CyberSecure and a Layer 7 application-aware firewall
• Comprehensive VPN: site-to-site options including Site Magic, IPsec, and OpenVPN plus WireGuard and Teleport VPN servers
• Redundancy: Shadow Mode VRRP gateway failover with DC power backup support

Performance & Connectivity

The gateway is powered by a quad-core ARM Cortex-A57 processor running at 1.7 GHz, paired with 4 GB of system memory and 16 GB of on-board storage. It offers nine 1 GbE RJ45 ports configurable at 1G, 100M, or 10M, alongside two 10G SFP+ ports that operate at 10G or 1G. The default WAN configuration uses one 10G SFP+ port and one GbE RJ45 port, with a maximum WAN port count of eight. Intrusion detection and prevention throughput is rated at 3.5 Gbps, and the MAC address table accommodates 4,000 entries.

LACP port aggregation and multi-WAN load balancing are supported, enabling traffic distribution across available links. Policy-based WAN and VPN routing, advanced QoS, and customizable DHCP further extend traffic-management capabilities. The device also supports IPv6 ISP connectivity, IGMP proxy, and multicast DNS.

Security & Firewall

A stateful firewall with application-aware Layer 7 filtering provides zone-based traffic control by regions, domains, and applications. Deep packet inspection and traffic identification are integrated, along with content filtering and ad blocking. The intrusion prevention system draws on a signature database of 55,000+ entries through CyberSecure.

VLAN and subnet-based traffic segmentation allow granular network isolation. An integrated RADIUS server supports RADIUS over TLS (RadSec) for secure authentication. NAT capabilities include SNAT, DNAT, masquerade, NAT pooling, and 1-to-1 NAT.

VPN & SD-WAN

License-free SD-WAN is included, along with site-to-site VPN options spanning Site Magic, IPsec, and OpenVPN. The VPN server supports Identity Endpoint One-Click VPN, Teleport zero-configuration VPN, WireGuard, OpenVPN, and L2TP. As a VPN client, the gateway supports both OpenVPN and WireGuard connections.

Additional internet failover is available through UniFi LTE Backup, and internet quality and outage reporting provide visibility into WAN health. Dynamic routing is supported through both OSPF and BGP.

Management & Applications

The UniFi application suite runs directly on the device, covering Network, Protect, Access, Talk, and Connect. Management is accessible via Ethernet and Bluetooth, and a 1.3-inch touchscreen LCM display provides local status information. The platform manages 100+ UniFi devices, up to 150 access hubs, and 1,000+ simultaneously connected users.

For surveillance deployments, the gateway supports 24 HD cameras, 14 2K cameras, and 8 4K cameras through the integrated Protect application. A 3.5-inch NVR HDD bay is provided for on-site recording storage.

Design & Power

The enclosure is constructed from CNC aluminium and SGCC steel, with an SGCC steel mount, and the unit occupies a 1U rack-mount form factor measuring 442.4 x 43.7 x 285.6 mm. A 1.3-inch touchscreen on the front panel displays system information, and status LEDs are provided for Ethernet, SFP+, RPS, PSU, and HDD activity. A factory reset button is included for service operations.

Power is delivered through an internal 50W AC/DC supply accepting 100–240V AC at 50/60 Hz, with a maximum power consumption of 33W. A USP-RPS DC input provides redundant power backup capability. Heat dissipation is rated at 112 BTU/hr. ESD and EMP protection is specified at ±15kV for air discharge and ±8kV for contact discharge.

Redundancy & High Availability

Shadow Mode using VRRP enables gateway failover for high-availability deployments, and DC power backup adds a second layer of redundancy. Virtual network override and all-traffic-flows visibility provide additional operational control. The device is NDAA compliant and carries certifications from CE, FCC, IC, Anatel, and SRRC.