Ubiquiti UniFi Cloud Gateway Ultra Review: $129 Buys the Entire UniFi Brain

Verdict: The Cloud Gateway Ultra is the cheapest honest entry into UniFi, and at $129 it is the best value Ubiquiti currently sells. It collapses what used to be two boxes — a UniFi Security Gateway plus a Cloud Key controller, well over $300 together — into one palm-sized unit that runs on a USB-C brick and draws less power than a light bulb. It routes a full gigabit with intrusion detection switched on, manages 30+ UniFi devices and 300+ clients, and gives you the segmentation, VLAN, and per-client visibility tooling that made UniFi worth learning in the first place. The catch is entirely on the port panel: the 2.5 GbE WAN port feeds four 1 GbE LAN ports with no link aggregation, so no single wired device will ever see more than a gigabit. There's no Wi-Fi radio, no PoE output, and no drive bay for camera recording. If your internet is a gigabit or slower and you're pairing this with separate access points and a switch, it's close to a no-brainer. If you have multi-gig fiber, you want the Cloud Gateway Max instead.

Check the current price on Amazon →

Key Specs at a Glance

What It Is — and What It Isn't

This trips up nearly every first-time buyer, so let's be blunt about it: the Cloud Gateway Ultra is not a Wi-Fi router. There is no wireless radio inside it. If you plug it in and expect an SSID to appear, nothing will happen.

What it actually is: the brain of a UniFi network. It does three jobs that used to require separate purchases.

1. It routes. It sits between your modem and your LAN, doing NAT, firewalling, DHCP, and VLAN routing. This is the box that replaces your ISP gateway's routing function — see modem vs. router vs. gateway if that distinction is fuzzy.
2. It runs the UniFi Network controller locally. No Cloud Key, no Raspberry Pi, no always-on PC, no subscription. The controller software lives on the 16 GB of onboard storage, and every UniFi access point and switch you add adopts into it.
3. It inspects traffic. The IDS/IPS engine runs 55,000+ signatures with CyberSecure enabled.

So the shopping list for a complete network is the gateway, a switch, and one or more access points. That's the trade: you assemble it yourself, and in exchange you get software that a $400 consumer mesh system can't touch — real VLAN segmentation, per-client bandwidth history going back months, proper firewall rules, and a traffic view that actually tells you which device is saturating your uplink.

The Port Layout Is the Whole Story

Ubiquiti gives you one 2.5 GbE WAN port and four 1 GbE LAN ports. Understanding what that asymmetry does — and doesn't — cost you is the single most important thing about this review.

What the 2.5G WAN port genuinely buys you. A gigabit Ethernet link doesn't actually carry a gigabit of payload; framing and negotiation overhead put the practical ceiling around 940 Mbps. If your ISP sells you "1 Gig" and actually delivers 1,100–1,200 Mbps (many fiber and DOCSIS 3.1 plans over-provision), a 1 GbE WAN port throws that headroom away. The 2.5G port captures it. It also gives you aggregate room for many clients pulling at once.

What it does not buy you. No single device on your LAN will ever exceed a gigabit, because every LAN port is 1 GbE and there is no link aggregation to bond them. If you're moving large files to a NAS, doing multi-gig backups, or you've already run 2.5GbE or 10GbE inside the house, this gateway is a bottleneck in the middle of your own network.

There's a reasonable workaround for the LAN side: put a 2.5G or 10G switch behind the gateway and keep your high-speed transfers local to that switch, so they never traverse the gateway at all. NAS-to-desktop traffic on the same switch runs at switch speed. Only routed traffic — anything crossing VLANs or heading to the internet — hits the 1 GbE ceiling. If you're picking that switch, managed vs. unmanaged matters here: to use the gateway's VLAN features you want a managed one.

Performance: A Real Gigabit, With Inspection On

The rated figure is 1 Gbps IDS/IPS routing, and independent hands-on testing backs it up. iFeeltech measured roughly 900–950 Mbps sustained with IDS/IPS enabled, and LazyAdmin reports sustained gigabit routing with inspection running.

That number deserves credit. Plenty of consumer routers advertise deep packet inspection and then fall to a third of their line-rate throughput the moment you switch it on. The UCG-Ultra holds essentially full gigabit with the security engine active, which means you don't have to choose between your paid-for speed and your threat detection. On a gigabit plan, you will not feel this device working.

It also means the ceiling is genuinely a ceiling. If you're on a 2 Gbps or faster plan, inspection caps you at roughly half your bandwidth, and no firmware update changes that — it's the CPU.

One practical note: the gateway's Smart Queues / QoS feature is where you fix latency under load, not raw speed. If your video calls fall apart when someone starts an upload, that's bufferbloat, and enabling Smart Queues here will cost you some peak throughput in exchange for dramatically better ping under saturation. On a gigabit connection that trade is usually worth making.

VPN: Great Feature List, CPU-Bound Speeds

The VPN story is unusually generous for the price. You get WireGuard, OpenVPN, IPsec, and L2TP servers and clients; Teleport, which is a genuinely slick one-click remote access system that needs no client configuration; and Site Magic, Ubiquiti's license-free SD-WAN that meshes multiple UniFi sites together in a few clicks. There is no subscription attached to any of it.

Speed is the limitation. WireGuard and Site Magic throughput lands around 300 Mbps in real-world use rather than the ~500 Mbps the hardware suggests on paper, because the Cortex-A53 does the crypto in software with no hardware offload. For remote access to files, cameras, or a home lab, 300 Mbps is plenty. For routing your entire household's internet through a commercial VPN at gigabit speed, it isn't — and no gateway near this price does that.

What $129 Actually Replaces

The value argument is the strongest thing about this product. The previous generation of this setup was a UniFi Security Gateway plus a Cloud Key Gen2 to run the controller — two boxes, two power supplies, and comfortably north of $300 together. The UCG-Ultra does both jobs for $129, in one box, off a USB-C brick, at 6.2W.

A few things that follow from that consolidation and are easy to under-rate:

• The controller is local and free. No monthly fee, no cloud dependency for the network to keep running. Remote management via the UniFi app is optional, not required.
• 6.2W maximum draw means it's cheap to run 24/7 and it's fanless and silent.
• USB-C power means a standard power bank or a small UPS keeps your router alive through an outage without a dedicated network UPS.
• Multi-WAN with up to 4 WAN ports — you can reassign LAN ports to WAN duty for failover or load balancing across, say, fiber plus a cellular backup. That's a feature normally reserved for far more expensive gear.
• OSPF and BGP are here too. Almost nobody at home needs them, but their presence tells you what this firmware actually is.

Running the gateway also cleanly solves double NAT if you put your ISP box in bridge mode, and gives you the port forwarding and UPnP control that determines your NAT type for gaming.

What's Missing

Four absences, and you should check all of them against your plans before ordering.

No Wi-Fi. Budget for at least one access point. In the UniFi line that's a U7 Pro Max or a U7 Enterprise, and either will need an Ethernet run to wherever it mounts — if that's a project, run the cable first.

No PoE output. The four LAN ports are data only. Since UniFi access points are powered over Ethernet, you need either a PoE switch or an injector per AP. This is a real line item people forget: a gateway plus two APs is actually a gateway, two APs, and a PoE switch.

No drive bay. There's 16 GB of onboard storage for the controller and nothing else. UniFi Protect camera recording needs separate hardware, so if security cameras are on your roadmap, price that in now rather than replacing the gateway later.

Single site, and it can't be adopted. The UCG-Ultra manages one site and cannot itself be adopted into another controller. For a home or a single small office that's irrelevant; for someone managing several properties from one pane of glass, it's a hard limit (Site Magic links sites for VPN purposes, but doesn't merge their management).

Pros and Cons

Pros

• $129 for a router, a local controller, and an IDS/IPS engine — replaces a $300+ two-box stack
• Holds ~900–950 Mbps with threat inspection enabled, where most consumer gear collapses
• 2.5 GbE WAN port captures the over-provisioning on "gigabit" plans that a 1G port would waste
• No subscriptions for the controller, VPN, SD-WAN, or remote access
• 6.2W, fanless, silent, USB-C powered — trivially UPS-backed with a power bank
• Up to 4 WAN ports for failover and load balancing at a price where that's unheard of
• The best network software in the category — real VLANs, firewall rules, months of per-client history
• NDAA compliant, which matters for some business and government-adjacent buyers

Cons

• Four 1 GbE LAN ports and no link aggregation — no wired client ever exceeds a gigabit
• 1 Gbps IDS/IPS ceiling — a hard cap if you're on 2 Gbps or faster fiber
• VPN throughput ~300 Mbps in practice; no crypto offload
• No Wi-Fi radio — access points are a separate, mandatory purchase
• No PoE output — add a PoE switch or an injector for every AP
• No drive bay — UniFi Protect recording needs other hardware
• Single-site, and cannot be adopted by another controller
• The learning curve is real — this is not a plug-it-in-and-forget-it consumer router

UCG-Ultra vs. Cloud Gateway Max vs. Dream Router 7

The three gateways a UniFi buyer actually cross-shops:

The read: the deciding question is your internet speed and your LAN speed, in that order. On a gigabit-or-slower connection with a 1 GbE LAN, the Ultra gives you everything the Max does for $70 less, and the extra money buys headroom you won't use. Cross either threshold — multi-gig fiber, or 2.5G gear already in the house — and the Max fixes both of the Ultra's real constraints at once, which is why it's the more future-proof buy for anyone who expects their connection to get faster within a few years.

The Dream Router 7 is a different proposition: it folds Wi-Fi 7 and camera storage into the same chassis, which is genuinely convenient for a small apartment where one box in one place can cover everything. You give up placement flexibility — a gateway wants to live next to your modem, and an access point wants to live in the middle of your home, and those are rarely the same spot. For anything larger than a one-bedroom, a separate gateway plus a properly placed AP will out-perform it.

Bottom Line

The Cloud Gateway Ultra is the rare piece of networking gear where the value case is almost unarguable. For $129 you get the routing, the controller, and the security engine that Ubiquiti used to sell as separate boxes for more than twice the money, in a silent 6.2W unit that runs off a USB-C cable. The software remains the reason to be here — nothing at this price gives you comparable segmentation, visibility, and firewall control — and Ubiquiti attaches no subscription to any of it.

Buy it with clear eyes about what it isn't. It has no Wi-Fi, so an access point is mandatory, and no PoE, so a PoE switch or injector is mandatory too — the real cost of a UniFi network starting here is closer to $350 than $129. And take the port panel seriously: four 1 GbE LAN ports with no aggregation means this is a gigabit device with a 2.5G WAN port, not a multi-gig device. If you're on a gigabit plan, that's a non-issue and this is the one to buy. If you're on 2 Gbps fiber or you've already wired the house for 2.5G, spend the extra $70 on the Cloud Gateway Max and don't look back.

A note on where to buy it. $129.00 is Ubiquiti's own MSRP at store.ui.com, and that is the price this review is built around. Amazon is not currently carrying a new-condition first-party listing for the UCG-Ultra — at the time of writing the featured offer on the main product page is a used unit from a third-party seller with a multi-week delivery estimate. Our link goes to Amazon search rather than a specific listing so it keeps working as stock rotates, but check the seller and the condition before you order, and buy direct from Ubiquiti if the Amazon offers are marked up.

Rating: 4.3 / 5

Check the current price on Amazon →