Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsA practical UniFi homelab starts with five things: a gateway that routes your internet connection, a UniFi control plane, wired access points, Ethernet cabling, and a switch when you need additional ports or Power over Ethernet (PoE). Add VLANs and firewall rules when you want to isolate trusted computers, guests, IoT devices, and lab systems.
For most first-time, single-site installations, Ubiquiti recommends beginning with a Cloud Gateway because it combines routing, security, and UniFi Network management. The correct equipment still depends on your ISP speed, floor plan, number of wired devices, PoE load, rack or desktop space, and how much segmentation you plan to operate.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
UBIQUITI UCG-MAX Cloud Gateway MAX W/ 512GB SSD | $329.00 | Buy on Amazon |
| 2 |
|
UBIQUITI UNIFI Gateway LITE | $83.89 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
Define the network before buying hardware
“Homelab” can mean anything from a few virtual machines on one server to a rack with multiple VLANs, cameras, and several wireless access points. Write down the requirements first; otherwise it is easy to buy an access point or switch that cannot support the rest of the design.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Record your internet and physical requirements
- ISP service: note the advertised download and upload rates, connection type, and whether the ISP supplies a modem or router that must remain in the path.
- Wired equipment: count desktop computers, servers, NAS units, televisions, printers, game consoles, cameras, and spare ports you want for future projects.
- Wireless areas: mark rooms that need coverage and identify where Ethernet can reach a ceiling, wall, or shelf-mounted access point.
- Installation location: decide whether equipment will live on a desk, in a cabinet, or in a rack. Heat, noise, power outlets, and cable paths matter as much as port count.
- Isolation goals: list networks for trusted clients, guests, IoT devices, and lab workloads before creating SSIDs or VLANs.
There is no universal access-point count. Construction materials, floor-plan shape, mounting height, interference, and the locations of wired runs determine whether one AP is enough or several are appropriate. Plan locations from the building rather than from a product name.
#1 Best Overall
- UBIQUITI UCG-MAX CLOUD GATEWAY MAX W/ 512GB SSD
The core equipment you need
1. Gateway and UniFi control plane
The gateway is the device that connects your home to the ISP, performs routing and firewall functions, and normally runs the UniFi Network application. A Cloud Gateway combines those jobs in one appliance. Ubiquiti’s Help Center says, “In most cases, the best way to get started is with a Cloud Gateway.” The statement is general guidance, not a promise that every Cloud Gateway has identical throughput, ports, or applications.
The compact UCG-Ultra is listed by Ubiquiti as an entry-level Cloud Gateway example. A rack-mounted Dream Machine may make more sense when the rest of the installation is in a rack, while a compact gateway is easier to place on a shelf or desk. Compare the selected model’s stated WAN throughput, supported UniFi applications, Ethernet ports, and expansion options with your requirements and ISP plan. Product specifications and software support can change, so confirm the current model data sheet before purchase.
2. UniFi access points
Access points provide Wi-Fi; they do not replace a router. Ubiquiti’s standalone-AP guidance states that an AP needs a gateway or router elsewhere unless it is part of an integrated product. In a conventional managed installation, adopt the APs to the UniFi console so one interface controls SSIDs, firmware, radio settings, and client visibility.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose the number and placement from your floor plan and available cable runs. Ceiling or wall locations with a wired uplink are usually easier to manage than trying to extend wireless coverage wirelessly. If you use multiple APs, a managed UniFi deployment provides centralized configuration. Standalone mode has important limitations: it does not provide seamless roaming across multiple APs and does not provide remote management.
3. Ethernet switch
A switch supplies additional Ethernet ports and, when it supports PoE, can power APs and other compatible devices over their network cable. Select ports for the gateway uplink, every AP, wired client, server, and at least the growth you realistically expect. A switch that has enough sockets but too little PoE capacity is not correctly sized.
For PoE, add the expected draw of every powered device and keep the total below the switch’s available PoE budget. Ubiquiti’s PoE Availability and Modes guidance lists 21 W for a U7 Pro and 9 W for a U6+. Those are device power figures from Ubiquiti’s guidance, not a universal allowance for every operating condition. Check the exact AP and switch documentation, the supported PoE mode, and the switch’s total wattage before connecting equipment.
4. Ethernet cabling
Run Ethernet between the gateway, switch, AP locations, and fixed clients. Label both ends of each cable and leave a service loop where practical. Ubiquiti’s setup guidance recommends checking physical connections and mentions its own cables as a compatibility recommendation; it does not establish that proprietary cabling is required. Use standards-compliant cable and connectors appropriate for the run, and verify link speed after installation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
5. Optional lab infrastructure
Servers, hypervisors, storage, UPS equipment, patch panels, and a rack are optional. Add them when your workload requires them rather than treating a rack as a prerequisite. A small desktop gateway, one switch, and one AP can support a useful lab; a rack is a packaging choice, not a definition of a homelab.
Choose the control-plane architecture
Your main decision is whether routing and UniFi management live together or separately. The following designs are all valid, but they shift cost, cabling, maintenance, and failure modes.
| Architecture | What it includes | Best fit | Trade-offs |
|---|---|---|---|
| Cloud Gateway | Routing, security, and UniFi Network in one appliance | Most new single-site installations | Less hardware and simpler adoption; capabilities depend on the chosen model |
| Independent gateway plus UniFi Console | A separate router/firewall and a CloudKey or other UniFi Console | Existing router that must remain, or a design that deliberately separates roles | More devices and compatibility checks; confirm that the console and gateway support the applications and configuration you need |
| UniFi OS Server | Self-hosted UniFi Network management on your own computer or server | Administrators comfortable maintaining a host and its software | You handle installation, updates, discovery, firewall rules, backups, and uptime; use an independent gateway rather than a Cloud Gateway |
| Official UniFi Hosting | Cloud-hosted UniFi Network management | Readers who want the control plane separate from local hardware | Review current plans and terms; pricing was not established here |
Ubiquiti states that a Cloud Gateway cannot be managed by an external UniFi OS Server because the Network application is already included. If you want a self-hosted server, plan around an independent gateway instead. A separate console also adds a dependency: if it is offline, the network may continue forwarding traffic, but management and visibility are unavailable until the console returns.
Size the switch and PoE budget
Count ports by function
Make a simple port schedule before selecting a switch:
Recommended Free Tools
| Connection | How to count it |
|---|---|
| Gateway-to-switch uplink | One port, unless you are deliberately designing another uplink arrangement |
| Access points | One port per wired AP |
| Fixed clients | One port for each desktop, server, NAS, printer, television, camera, or other Ethernet device |
| Expansion | Reserve ports for the devices you expect to add during the life of the installation |
Do not count only today’s devices. Replacing a full switch is more disruptive than leaving a few spare ports, especially when cables are hidden in walls or a rack is already organized.
Calculate PoE load
Write down the maximum or stated draw for each powered device, then add the figures. For example, one U7 Pro at 21 W and two U6+ units at 9 W each represent 39 W of device demand before any other PoE equipment. The switch’s available PoE budget must exceed that combined load; port count alone says nothing about whether the switch can power it.
Rank #2
- UBIQUITI UNIFI GATEWAY LITE
Also check whether the switch offers the PoE mode required by each device. A device can have a compatible Ethernet connector and still fail to power if the switch does not provide the expected standard or if its remaining budget is exhausted.
Design VLANs and SSIDs for a homelab
VLANs let one physical switching fabric carry separate logical networks. A practical starting design might include a trusted network for administrator devices, a guest network, an IoT network, and a lab network for servers or experiments. The names and number are yours to choose; create only the segments you can secure and maintain.
Map each wireless network to a VLAN
In UniFi, an SSID can be assigned to a selected network or VLAN. The AP’s uplink and every switch port between that AP and the gateway must carry the relevant VLAN IDs. Ubiquiti warns that clients may fail to join when an intervening port does not allow the selected VLAN. This is one of the most common causes of a new SSID appearing correctly in the interface but not working over the air.
Plan traffic rules at the gateway
Decide which networks may initiate connections to one another and which may reach the internet. Use gateway firewall rules for inter-VLAN and internet policy. Ubiquiti describes firewall rules as the standard way to control traffic between VLANs and to or from the internet. Switch ACL capabilities vary by model, so do not assume that every switch can enforce the same policy as the gateway.
Keep an administrative path available while testing. If you block trusted devices from the management network too early, you can lock yourself out of the console, switch, or APs and need a local recovery procedure.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Build and adopt the network
- Prepare the layout. Draw the gateway, switch, APs, cable runs, VLANs, and intended SSIDs. Confirm that the gateway model supports your required routing and UniFi applications.
- Install Ethernet. Terminate and label cables, then test each run. Connect the ISP handoff to the gateway’s WAN side and the switch to a LAN port or designated uplink.
- Power the equipment. Connect the gateway, switch, and APs. If APs use PoE, verify that the switch is providing the correct mode and has sufficient remaining wattage.
- Start the Cloud Gateway setup. Ubiquiti’s standard flow is to power the device, connect it to the same network, and adopt it through the UniFi mobile app. Follow the current on-screen setup labels because software wording changes.
- Adopt the switch and APs. Wait for each device to appear in the UniFi application, confirm its physical identity, and approve adoption. Do not adopt an unknown device on a production network.
- Create networks. Define the trusted, guest, IoT, and lab networks you actually need. Assign VLAN IDs deliberately and record them in your documentation.
- Create SSIDs. Map each wireless network to its intended VLAN. Configure the AP uplink and every intermediate switch port to carry the required VLANs.
- Apply firewall policy. Start with the least access necessary, then add explicit exceptions for services such as DNS, printing, administration, or monitoring. Test from a client in every segment.
- Validate and document. Check internet access, DHCP addresses, DNS, roaming between APs, wired link speeds, PoE status, and access between VLANs. Save a diagram, port map, VLAN list, and recovery credentials.
Test the finished installation
- Gateway: verify the WAN address, negotiated link, expected internet speed, and firewall status.
- Switch: confirm every cable is on the intended port, links negotiate at the expected speed, and PoE draw is visible for powered devices.
- Wireless: join each SSID from a test device, verify its VLAN address, and walk between AP coverage areas to observe roaming.
- Segmentation: test both allowed and denied paths between trusted, guest, IoT, and lab networks. A network is not isolated merely because it has a different SSID.
- Management: update firmware during a maintenance window, back up configuration where supported, and confirm that you can still reach the console after applying firewall rules.
Common mistakes and how to correct them
Buying an AP as the whole network
An AP supplies wireless access, not internet routing. Add a gateway/router, or use an integrated product that includes one.
Sizing only by switch ports
A switch can have enough sockets and still run out of PoE. Recalculate the total device draw and compare it with the model’s available budget and supported modes.
Leaving VLANs off an uplink
If an SSID client cannot obtain an address or cannot reach its gateway, trace the path from AP to switch to gateway and verify that the VLAN is allowed on every link.
Assuming switch ACLs equal gateway firewall rules
Feature sets differ across UniFi switch models. Put inter-VLAN policy on the gateway unless the specific switch documentation confirms the ACL behavior you require.
Choosing a controller without checking applications
Control-plane products do not all run the same UniFi applications. Confirm support for the applications, site count, and configuration features you intend to use before committing to a Cloud Gateway, separate console, self-hosted server, or hosting plan.
Ignoring maintenance and recovery
A self-hosted UniFi OS Server requires an operating system, updates, discovery configuration, firewall access, backups, and reliable uptime. An integrated gateway reduces that workload but does not remove the need for firmware maintenance and configuration backups.
A sensible starting build
For a typical single-home deployment, begin with one Cloud Gateway, one wired UniFi AP for each area the floor plan requires, and a switch sized for the gateway uplink, APs, wired clients, and expected additions. Choose a PoE model when it simplifies AP placement and power, and verify its wattage against the connected devices. Add VLANs for guest, IoT, or lab traffic only when you are ready to define the firewall policy and test it.
Ubiquiti’s product names, specifications, software features, hosting terms, prices, and stock can change. Treat the current model data sheet and Help Center instructions as the final check before ordering or installing.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
