Originally Posted: July 20th, 2020
Last Edited: April 29th, 2024

UniFi Gateway Comparison: USG vs UDM vs UXG

UniFi gateway routers, like the Dream Machine or next-gen Gateway Lite, appear simple until you dig below the surface. There are two categories and a few models in each. Ubiquiti also have UISP Routers and EdgeRouters, which may be a better option for more advanced networks. UniFi is separate from UISP, and this guide focuses on UniFi.

UniFi networks are modular, and you can add and remove parts as needed. You don’t need a UniFi gateway to run a UniFi network. Going with a full stack has both benefits and limitations. UniFi offers basic routing, firewall, and several VPN options. It’s relatively easy to use, but more complicated networks that require dynamic routing, custom NAT or advanced firewall features might not be well served by UniFi.

Mixing UniFi switches and access points with an EdgeRouter or 3rd party firewall is a common alternative. The right solution depends on what kind of network you are trying to build, and what features you need to accomplish that. This guide covers all UniFi gateway options, so you can understand the differences and pick the right one.

There are two categories: Gateways and Cloud Gateways.

Gateways are just routers and nothing else. These are managed by a Cloud Key or self-hosted UniFi Network application. They don't run any software, and don't do anything besides act as a firewall/gateway/router.

Cloud Gateways are routers that run software. At a minimum they run the UniFi Network application. They manage themselves and other UniFi switches and APs. They can't be managed by a Cloud Key or self-hosted controller*.

• These have been called "UniFi OS Consoles" or "Gateway Consoles" and other terms, but Cloud Gateway is the current branding.

• Some of these run other UniFi software like Protect, Talk, Access, or Identity.

• *Besides the new UniFi Express (UX), which can be used as an access point. There is always an asterisk on everything.

Controller is a general term for a device that runs the UniFi Network application. It can be self-hosted on your own hardware, a Cloud Key, a cloud server, or a UniFi Cloud Gateway™ like the Dream Machine Pro or UniFi Express.

Standalone, Independent UniFi Gateways

These require a Cloud Key or some other UniFi Network controller.

• Security Gateway (USG) — Discontinued

• Security Gateway Pro (USG-Pro) — Discontinued

• Security Gateway XG 8 (USG-XG-8) — Discontinued

• Gateway Lite (UXG-Lite)

• Gateway Max (UXG-Max)

• Gateway Pro (UXG-Pro)

UniFi Cloud Gateways

These act as their own controller and can’t be joined to a Cloud Key or other UniFi Network controller.

• Cloud Gateway Ultra (UCG-Ultra) = Controller + Gateway + 4-port switch

• Express (UX) = Controller + Gateway + Wi-Fi

• Dream Router (UDR) = Controller + Gateway + 4-port switch (2 PoE out) + Wi-Fi

• Dream Machine (UDM) = Controller + Gateway + 4-port switch + Wi-Fi

• Dream Machine Pro (UDM-Pro) = Controller + Gateway + 8-port switch

• Dream Machine SE (UDM-SE) = Controller + Gateway + 8-port PoE switch

• Dream Machine Pro Max (UDM-Pro-Max) = A more powerful UDM-Pro/UDM-SE

• Dream Wall (UDW) = Controller + Gateway + 16-port PoE switch + Wi-Fi

Current and Unlisted

The first two charts below break up all gateway models into current and unlisted. The unlisted models might still be available on store.ui.com via search, but otherwise aren’t shown in the store or on their website. The USG and USG-Pro were recently discontinued, and should be replaced if you are still using them.

Gateways — USG and UXG

The 3rd chart is for the standalone, independent UniFi gateways that require a Cloud Key or some other controller. These are the USG and UXG models. These gateways require the UniFi Network application to be run on another piece of hardware such as a Cloud Key, local PC/server, or cloud service.

Cloud Gateways — Dream Machines

The last three compare all of the UniFi Cloud Gateways. These have been called UniFi OS Consoles, Gateway Consoles, and now Cloud Gateways. They act as routers or firewalls, and also run the UniFi software applications like Network and Protect. These can’t be used with Cloud Keys, cloud services, or a self-hosted UniFi Network application.

If you want comparison charts of all UniFi gateways, access points, and switches, refer to my UniFi Comparison Charts or other posts in my Ubiquiti Guide.

To fully understand UniFi gateways, there are more details on cover than what is shown on a spec comparison. Let’s start with the oldest, the USG and USG-Pro security gateways.

Security Gateways — USG and USG-Pro

USG Specs

Dimensions:
135 x 135 x 28.3 mm
(5.32 x 5.32 x 1.11")
Weight: 366 g (12.9 oz)
Max. Power Consumption: 7W
Power Supply: 12VDC, 1A Power Adapter
Networking Interfaces:
(1) RJ45 Serial Console PORT
(3) gigabit RJ45
Layer 3 Forwarding Performance:
64 Byte Packets: 1,000,000 pps
512 Bytes or Larger: 3 Gbps
Processor: Dual-Core 500 MHz, MIPS64
System Memory: 512 MB DDR2 RAM
On-Board Flash Storage: 2 GB

The classic USG and USG-Pro are ancient in technology terms. They are not listed as vintage or obsolete products yet, so they’re still technically supported. Because they are near the end of their useful life, I would not recommend the USG or USG-Pro for a new network. The UXG-Lite or UXG-Pro are the options you should consider buying going forward, but the security gateway models are worth discussing and understanding.

USG

The USG is a small, fanless, wall-mountable router with a dual-core, 500 MHz MIPS64 processor. It has 3 gigabit Ethernet ports for data, with the 3rd being configurable as a 2nd LAN or 2nd WAN port. Layer 3 forwarding performance is 1 million packets per second with 64 Bytes packets, and line rate (3 Gbps) with 512 Bytes or larger packets. If you’re comparing to the EdgeRouter line, the EdgeRouter Lite and the USG share a CPU, and have very similar performance.

If you only want a basic router, the limited performance of the USG might be enough. The USG can route at 1 Gbps, but performance quickly suffers as you enable security features, especially the Intrusion Detection System or Intrusion Prevention System (IDS/IPS) or a VPN. With IPS/IDS enabled, the USG drops to around 85 Mbps of throughput, due to it’s old and slow CPU and limited hardware offloading for encryption and inspection.

For VPNs, the USG does support L2TP for remote access and IPsec and OpenVPN for site-to-site, but performance is limited around 40 Mbps of throughput. For most this is going to be a severe limitation, making the USG a good fit for only slow WAN connections and basic network needs. As a firewall, it doesn’t have enough features or performance to be competitive. Most of the limitations come from the slow MIPS CPU and limited hardware offloading settings.

USG Hardware Offloading

If you search for USG throughput issues, a lot of posts refer to features that can’t be offloaded, or hardware-accelerated. Hardware offloading is used to execute functions using hardware instead of software, which makes the general purpose CPU do all the work. Hardware offloading helps increase speed and throughput, by not depending on the slow CPU for forwarding decisions. The problem is that not all features can be offloaded. This EdgeRouter help page explains this in more detail.

A lot of networking equipment, including the USG, has specialized ASICs or chips that accelerate common network processes like routing decisions. The USG can handle routing gigabit connections with hardware offload enabled. The USG and USG-Pro have IPv4 forwarding, NAT, VLAN, GRE, PPPOE and limited IPsec offloading (3DES, AES-128, AES-256, MD5, and SHA-1 only). Unfortunately, they lack any QoS or IDS/IPS acceleration hardware, and don’t have a powerful enough CPU to do that at line rate. Hardware offloading must be disabled to use QoS or IDS/IPS, which severely limits performance.

Typically, routers can quickly look at a packet header and make a routing decision. Enabling QoS and IPS/IDS complicates that. They are CPU-intensive because the router has to inspect the contents of every packet for arbitrary patterns, not just look at the packet header. To do this with hardware, you need an expensive proprietary ASIC. Ubiquiti doesn’t offer that. If you are looking for multi-gigabit firewall or VPN performance, there are other vendors such as Palo Alto that do.

With USG hardware offloading turned off, the general purpose CPU in the USG has to do extra calculations, bringing routing performance down to around 300 Mbps. If you turn on Smart Queues/QoS, routing becomes more complicated, and performance suffers further. When you turn on IPS/IDS, the USG has to inspect and process every packet, which brings throughput down to around 85 Mbps. Enabling these features will affect all processes on the USG, including inter-VLAN routing speed, unless you have a separate layer 3 switch. The USG doesn’t have a built-in switching ASIC, even though some EdgeRouter models do.

You can confirm your offload settings in the UniFi Network application under Devices -> USG -> Config -> Advanced. For the best performance, you want to enable hardware offload, scheduler, and layer 2 blocking.

USG with Hardware Offload Off

• Basic routing, including inter-VLAN, may perform below line rate

• Can use IDS/IPS

• Can use QoS/smart queues

• Can use DPI (Starting in USG firmware version 4.4.18)

• Can not use GeoIP filtering

USG with Hardware Offload On

• Able to perform basic routing functions at line rate

• Cannot use IDS/IPS

• Cannot use QoS/Smart Queues

• Can use DPI

• Can use GeoIP filtering

Bottom line: the USG was released in 2014, and the hardware isn’t powerful enough. If you have an Internet connection with more than a couple hundred megabits of bandwidth, the USG requires choosing which features you can live without. If you want higher speeds, you should look at the UXG-Lite, UXG-Pro, EdgeRouter, or a 3rd party alternative.

USG-Pro Specs

Dimensions:
484 x 44 x 164 mm
(19.06 x 1.73 x 6.46")
Weight: 2.3 kg (5.07 lb)
Max. Power Consumption: 40W
Power Supply: Internal AC/DC Power Adapter, 60W (24V, 2.5A)
Networking Interfaces:
(1) RJ45 Serial Console
(2) gigabit RJ45 LAN
(2) Gigabit RJ45/SFP WAN
Layer 3 Forwarding Performance:
64 Byte Packets: 2,400,000 pps
512 Bytes or Larger: 4 Gbps
Processor: Dual-Core 1 GHz MIPS64
System Memory: 2 GB DDR3 RAM
On-Board Flash Storage: 4 GB

USG-Pro

Like the USG, the USG-Pro is old, and most of the limitations apply. The USG-Pro has slightly more powerful hardware than the USG, but not by much. If you’re comparing to the EdgeRouter line, the EdgeRouter Pro (discontinued) and the USG-Pro share a CPU, and have similar performance.

The USG-Pro is rackmount, and it raises IDS/IPS performance to 250 Mbps, and adds 2 SFP ports and a 2nd gigabit Ethernet WAN port. The WAN ports on the USG-Pro are combination ports. That means you can use either RJ45 or SFP, but you are limited to a total of 2 WAN ports and 2 LAN ports.

The USG and USG-Pro both support load balancing between two WAN connections.The secondary WAN can be used for failover or weighted load balancing. Dual WAN setups can be a little tricky to setup and optimize, and there aren’t many controls in the UniFi interface for these kind of setups. If you are looking to make a dual WAN network, I recommend you read this help article about policy-based routing.

For a long time, the dual-WAN UniFi OS Consoles like the UDM-Pro and UDM-SE only supported failover, so this is one area where the USG and USG-Pro had an advantage. That has changed with the psuedo policy-based routing “Traffic Rules” and “Traffic Routes” features on newer hardware. These allow you to direct clients or applications to a specific WAN, restrict or block traffic, and enforce speed limits. The USG and USG-Pro don’t support these features, and are unlikely to get most new features added to UniFi.

USG: Legacy Platform, with benefits

While the USG and USG-Pro are older, they have some features which have not shown up in the newer products. Namely, any feature which requires manually editing the JSON config file on the USG is not possible with the UXGs or Dream Machines. The newer hardware doesn’t have the same underlying architecture, and does not have the same JSON config file workaround. You are limited to what features are exposed in the web interface.

Here’s a good example of how to configure an USG to route traffic over an OpenVPN tunnel. If this type of configuration is intimidating to you, take a hard look at what is officially supported. You will be limited to the settings in the web interface unless you are willing to create custom, breakable configurations on old hardware.

Ubiquiti never officially supported editing the JSON configuration file, but it allowed for flexibility. It was never a good system, and those modifications were never guaranteed to work, or survive firmware updates. It is an old, unsupported way of managing a UniFi network. Unfortunately, there are situations and features where this is the only option.

Before investing in one, verify that the USG or USG-Pro can do everything you need before purchasing. If they fit your network needs they are still technically supported. Just keep in mind that they come with a long list of asterisks and limitations.

UniFi Dream Machine and UniFi Dream Machine Pro

UDM Specs

Dimensions:
110 X 110 x 184.2 mm
(4.33 X 4.33 x 7.25")
Weight: 1.05 kg (2.32 lb)
Networking Interfaces:
(4) Gigabit RJ45 LAN
(1) Gigabit RJ45 WAN
IDS/IPS Throughput: 850 Mbps
Processor: Quad-Core ARM A57 at 1.7 GHz
System Memory: 2 GB DDR4 RAM
Flash Storage: 16 GB
Max Power Consumption: 26W
Additional Features:
4-port Switch
Built-in UniFi Network controller
Built-in Wi-Fi Access Point (802.11ac Wave 2)

In 2019, the UniFi Dream Machine (UDM) and UniFi Dream Machine Pro (UDM-Pro) were released. They were not straightforward replacements for the USG and USG-Pro.

The UDM is an all-in-one UniFi OS Console, or UniFi Cloud Gateway. It acts as a firewall/router, switch, and wireless access point. It also runs the UniFi Network application.

The UDM-Pro is a rackmount UniFi Cloud Gateway. It acts as a firewall/router, switch, and network video recorder. It runs all UniFi applications — Network, Protect, Talk, Access, Connect, and Identity.

Compared to the old Security Gateways, Dream Machines have more powerful hardware, higher performance, additional software features. They also have some new limitations. The Dream Machines have an integrated UniFi Network controller. They cannot be managed by an external UniFi Network controller such as a UniFi Cloud Key, or a self-hosted UniFi Network install.

UDM

The UniFi Dream Machine gives you everything you need for an UniFi network in one device. It looks like a normal all-in-one home router. In UniFi terms, it is a UniFi OS Console, router, switch, and wireless access point.

It has the same modern ARM CPU as the UDM-Pro, making it a capable security gateway for fast Internet connections. The managed gigabit switch lacks POE, but lets you connect four devices or additional switches. The 4x4 802.11ac Wave 2 wireless access point is equivalent to a nanoHD — good enough to cover apartments or small-to-medium sized houses and businesses.

You can think of the UDM as a UniFi starter kit. Integrating all the components in one device has a lot of benefits, but also some limitations. It complicates the upgrade path from a USG-based network, which required a Cloud Key or self-hosted solution. For more details, you can read my full review of the UDM.

UDM Complications: UniFi OS, Built-In Controller, missing features

The UDM and UDM-Pro run a new operating system underneath, UniFi OS. UniFi OS is Ubiquiti’s name for the software which run UniFi applications, such as Network, Protect, Access, LED, and Talk. The UDM only runs the Network application and UID. Those additional applications require a different UniFi Console like the UDM-Pro, or Cloud Key Gen 2+.

The UDM and UniFi OS Consoles in general were a big change in the UniFi line. Before, it was easy to run the UniFi Network application anywhere, and add any devices you wanted. With the UDM, you’re forced to use the built-in Network application, meaning you can’t add a UDM to a Cloud Key or self-hosted UniFi Network controller.

If you need to manage multiple UDMs or access them remotely, you’ll need to setup a VPN or use Ubiquiti’s free cloud service (unifi.ui.com). Each UDM has their own instance of the UniFi Network application, with their own networks and settings. You cannot manage them as individual sites within a single external controller, like you can with a USG. A lot of managed service providers relied on this feature to deploy many customer sites within their self-hosted UniFi controller. That’s not possible with a UDM, but it is still possible with UniFi switches and wireless access points.

Despite being a few years old, the UDM still has some missing features. Some of those features listed may not affect you, but things like bridge mode, advanced dynamic routing, and a lot of IPv6 features are not supported. With the USG, you are able to create a custom configurations to get around the limits, but the UDM lacks the ability to manually edit the JSON config file. Keep these feature limits in mind when considering purchasing any of the UniFi OS Consoles.

UDM-Pro and UDM-SE

The UDM-Pro is a 1U rackmount model like the USG-Pro, with added features and faster performance. The UDM-SE was released in 2021. For $120 extra, the UDM Special Edition upgrades from 1 Gbps to 2.5 Gbps on it’s RJ45 WAN port, adds a 128GB SSD, and PoE out. Along with the UXG-Pro, these are the current high-end, rackmount router options in the UniFi line.

UDM-Pro Specs

Dimensions:
442.4 x 43.7 x 285.6 mm
(17.42 x 1.72 x 11.24")
Weight: 3.90 kg (8.60 lb)
Networking Interfaces:
(8) gigabit RJ45 LAN
(1) gigabit RJ45 WAN
(1) 1/10G SFP+ LAN
(1) 1/10G SFP+ WAN
IDS/IPS throughput: 3.5 Gbps
Processor: Quad- Core ARM A57 at 1.7 GHz
System Memory: 4 GB DDR4
Flash Storage: 16 GB
Max. Power Consumption: 33W
Additional Features:
Runs all UniFi applications
8-port gigabit switch
(1) 3.5 “ HDD bay
1.3” touchscreen
Redundant power with USP-RPS

The UDM-Pro and UDM-SE are full UniFi Cloud Gateways, and they can run all of the UniFi applications:

• UniFi Network, for managing UniFi access points and switches

• UniFi Protect — security cameras and video doorbells

• UniFi Talk — VoIP phones

• UniFi Access — access control and door locks

• UniFi Identity — subscription cloud service for identity management.

For WAN interfaces, the UDM-Pro has a 10 Gbps SFP+ and a 1 Gbps RJ45 port. For LAN interfaces, the UDM-Pro has a 10 Gbps SFP+, and a 8-port gigabit RJ45 Ethernet switch.

The UDM-SE is mostly the same as the UDM-Pro. It upgrades to a 2.5 Gbps RJ45 WAN port. It also adds PoE support to the 8-port switch, with two 802.3at PoE+, and six 802.3af PoE ports. The UDM-SE also has 128 GB of internal storage for UniFi Protect.

Both models feature a 1.3” touchscreen on the front. The screen displays information about the network and the device. It allows you to view the current IP address, number of clients, current temperature and fan speed, uptime, and stats on the integrated applications like Protect and Talk. This feature was also added to the 2nd generation UniFi switches. Another change is the addition of the proprietary power port on the back, which lets you attach a UniFi Smart Power RPS for redundant power.

The other big hardware feature to note is the hard drive bay. The hard drive bay supports 3.5” and 2.5” drives to record video on with UniFi Protect. If you are planning on adding a hard drive, make sure to buy one that is supported. If you want more details, you can read my original, outdated review of the UDM-Pro.

Latest Additions: UDR, UXG-Pro, UDW

UniFi Dream Router (UDR)

The UniFi Dream Router is a newer model, fitting under the UDM for $199 in the US store. It’s a UniFi Dream Machine with a few changes. Compared to the UniFi Dream Machine (UDM), the UniFi Dream Router (UDR):

• Downgrades from a quad-core to a dual-core ARM CPU, resulting in a 700 Mbps limit for IDS/IPS throughput.

• Upgrades to Wi-Fi 6 on 5 GHz radio.

• Adds UniFi Protect, Talk and Access support. Only one of these can be run at a time, in addition to the built-in UniFi Network application.

• Adds 802.3af (15W) PoE out on two of the four gigabit LAN ports

• Adds 128 GB of internal storage, which can be used for motion (not always on) video recording with Protect

• Adds an SD card slot for additional storage

• Costs $100 less — $199 vs $299 US MSRP

The slower CPU makes it a bit of a step down in raw computational power, but the addition of PoE out, storage, and support for one other UniFi application makes it a bit more powerful than the UDM. The UDR will work well for a small network with a few switches, APs, or cameras. It would not be a good solution for a large network with a lot of clients. For most, the slower CPU will just lead to slower performance loading videos from Protect, or loading the UniFi Network application interface. For others, it makes the UDR not able to handle their needs.

For $199, the UniFi Dream Router is a good deal. It makes the $299 UDM a more awkward recommendation, due to the UDM costing more, but lacking some features that are on the cheaper UDR.

UniFi Dream Wall (UDW)

The UniFi Dream Wall is another new UniFi Cloud Gateway, released in March 2023. The $999 UDW is meant to mounted on the wall, rather than in a rack or on a shelf like the other models.

Dream Wall features:

• UniFi Cloud Gateway supporting all UniFi applications: Network, Protect, Talk, Access, Connect, and Identity.

• Dual-WAN gateway with 2.5 Gbps RJ45 Ethernet and 10 Gbps SFP+ ports

• Built-in Wi-Fi with Wi-Fi 6 support on 5 GHz.

• Built-in switch, with 1 SFP+ slot and 17 gigabit RJ45 LAN ports, 4 with PoE, 4 with PoE+, and 4 with PoE++ ports

• Built-in 128 GB SSD and SD card slot for UniFi Protect motion recording, with a 512 GB SD card pre-installed.

• 1.3” Touchscreen, the same as on the 2nd gen USW switches and UniFi Dream Machine Pros

UXGs and Latest Additions

The UXG-Pro was finally added to general access in March 2022, after spending nearly 2 years in the Early Access store. The UXG-Pro is not a UniFi OS Console, meaning it can be used with self or cloud-hosted UniFi Network controllers, like the USG line could. The UXG-Pro doesn’t run any UniFi applications, making it a standalone router just like a USG or USG-Pro.

It has similar hardware to the UDM-Pro, without the hard drive bay. The UXG-Pro has two 10 Gbps SFP+ ports, and two 1 Gbps RJ45 ports. It has the same CPU as the UDM-Pro, but half the RAM. It supports dual-WAN configurations, and the same policy-based routing and load balancing options as the Dream Machines.

In 2023, we got the UXG-Lite, which is a small desktop-size gateway, similar to the USG. It only has one gigabit WAN and one gigabit LAN port, but it has much more powerful internals and supports the modern security features. For more details, see my UXG-Lite Preview.

It took many years, but the UXG models are now the solutions for those looking to upgrade from a USG or USG-Pro. They are also the solution for those that want the flexibility and scalability of a multi-site UniFi Network controller, hosted on their own hardware or preferred cloud service.

Lastly, in 2023 and 2024, we’ve seen a lot of additional options:

• UXG-Lite and UXG-Max

• Cloud Gateway Ultra

• UniFi Express

• UDM Pro Max

The list of models will continue to grow over time, but those will mostly be additive. I expect to see more high-end options which follow the same pattern as the models we’ve covered here. The UDM-Pro-Max is one example. The Pro Max is very similar to the regular UDM-Pro, but with higher performance and a few feature additions.

If you understand what the UDM-Pro is, the Max version is easy to understand. The more important distinctions are Gateway vs. Cloud Gateway, and UniFi vs. UISP.

UniFi Routers vs. EdgeRouters

UniFi and EdgeMAX devices sometimes share hardware, but they are different products, aimed at different uses, and are managed using different tools. Management of UniFi devices by EdgeMAX software or UISP is not possible.

EdgeRouters expose more networking features in their web interface, and can be configured through a command line. EdgeRouters are more traditional networking equipment, where UniFi is “software defined” and managed by the UniFi Network application. Outside of a few setup wizards, the EdgeRouter and EdgeSwitch products don’t hold your hand, and they expect you to be able to configure things manually.

Functionality that is not accessible through the UniFi controller may be available on EdgeMAX products. EdgeRouters lack the tight integration and simplicity of the UniFi ecosystem, but they offer more support for common networking configurations. Willie Howe has a great video which goes over some of the finer differences.

In general, setting up a UniFi network is like hitting the Easy Button. If you just need to setup a basic network with some VLANs and basic security protections, UniFi makes that simple. If you need features outside what UniFi offers, an EdgeRouter is going to be a better fit.

There is more scope for inexperienced users to get in over their head with the EdgeRouters, but most network professionals prefer the flexibility. If reading this post made you think “They don’t support that!?” I would recommend you look into EdgeRouters or another brand for routing. You can still use UniFi for switching and wireless if you want.