![\"\"](\"https:\/\/james-batchelor.com\/wp-content\/uploads\/2026\/07\/usg_01.jpg\")
<\/a><\/figure>\n\n\n\nThe UCG Pro claims 1 Gbps IPS throughput, which fits my 900Mbps\/105Mbps connection. Let\u2019s see if it becomes a suitable replacement\u2026<\/p>\n\n\n\n\n\n\n\n
Why Switch Now?<\/h2>\n\n\n\n
Going down the Draytek route initially was due to a “eat your own dog food” scenario, where my previous employer deployed these in mass, so it was handy to have a router I was familiar with and a point of local reference for any capabilities or troubleshooting.<\/p>\n\n\n\n
At the time (circa 2018), the feature set that a Draytek offered for the price point seemed superior to the Unifi offering, which at the time, personally seemed a bit of a style of substance.<\/p>\n\n\n\n
Fast forward to today, and the realisation that I no longer need to touch a Draytek again, a few \u201cfeatures\u201d of DrayOS are really starting to grate on me:<\/p>\n\n\n\n
- \n
- IPv6 compatibility: It ignores my delegated \/48 prefix assigned by my ISP (Zen), instead configuring a single \/128 address. I can set this up manually per machine, but its seemingly impossible to assign a \/64 per VLAN and configure it with SLAAC or DHCPv6.<\/li>\n\n\n\n
- Change something = reboot: Almost every change on the web GUI results in a reboot prompt. I\u2019ve been advised on a \u201cDCNA\u201d course that these can be clicked away from, but the ambiguity of what changes stick after a power loss is a guessing game. Couple of examples; changing authorised SNMP IP\u2019s work instantly, but if powers lost before a commanded reboot, it returns to the previous values. Also, IPv6 WAN setup will appear changed in the GUI, but will not actually take effect until reboot.<\/li>\n\n\n\n
- Hardware acceleration: The 2927 was advertised as offering 950Mbps WAN throughput, but only if hardware acceleration is enabled. Without, the max I get is around 550Mbps. What the route decides to pass onto HW processing is very hit and miss, consecutive speed tests can return 950Mbps or 550Mbps seemingly at random.<\/li>\n\n\n\n
- Route policy: The routing \/ load balancing options are great. However, every change regardless of its priority results in the router slamming closed every open NAT session. Extremely annoying when streaming anything with a large buffer (such as radio on a smart speaker stopping 10 seconds after making a change).<\/li>\n<\/ul>\n\n\n\n
Why Unifi?<\/h2>\n\n\n\n
Apart from recent recommendations, I already use their access points for WiFi coverage, as they are far superior to any Draytek WiFi implementation, these AP\u2019s are managed via a cloud controller running on a local Debian VM.<\/p>\n\n\n\n
The GUI, despite being limited to AP\u2019s only, seems information rich and doesn’t seem to require that much upskilling to translate network setup from a Draytek to Unifi point of view.<\/p>\n\n\n\n
As mentioned, 10 years ago I heard (second hand) that the entry level routers seemed lacking in certain features, such as VPN options and the ability to load balance over multiple WANs. But a bit of research seemed to suggest that entry level Unifi\u2019s have now caught up.<\/p>\n\n\n\n
Impressions on the Unifi UGC Ultra<\/h2>\n\n\n\n
Setup<\/h3>\n\n\n\n
On first hands on, I\u2019d like that you can access the router GUI with a local username and password, no Unifi account required. This alleviates any concerns that issues with Unifi (outage or moving to paid subscription model) will not lock you out of your own device\u2026 for now. It does nudge you heavily to adding an account (akin to old Windows 10 installations), but the GUI is reachable without. The only caveat of local only access is that remote access to the GUI is not available unless an account is added, but once an account is added, local access is still available.<\/p>\n\n\n\n
Once in the GUI, there is a little hand-holding wizard in getting the WAN connection up, and assumes a DHCP connection. However, PPPoE is clearly available and easy to get you up and running (without a reboot, looking at you Draytek). <\/p>\n\n\n\n
With WAN connected, it performs a speed test with the results used to set the anticipated speeds (presumably for QoS), then hopes of surviving a reboot are quashed by a substantial update and restart. Reboot times are approx. 2-3 minutes, so will be noticeable to the casual browsing session.<\/p>\n\n\n\n
From there, the hand-holding stops and you\u2019re left at the main GUI. Configuring a network setup is pretty intuitive, but I get the feeling that a few of the settings are in awkward places in the aim to preserve a tight menu structure. It’s been a few days since adding an SNMP community string, and I\u2019ve lost where it is already.<\/p>\n\n\n\n
L2 VLAN setup and configuration of the different networks is straightforward and a quick task to replicate for another router (all without rebooting), Although use of the \u201cauto\u201d options is disabled to replicate another network one to one.<\/p>\n\n\n\n
Throughput<\/h3>\n\n\n\n
As advertised, speeds are able to reliably achieve advertised speeds, within the confines of my 900Mbps\/105Mbps connection (Openreach profile speed is 1Gbps\/115Mbps).<\/p>\n\n\n
\n![\"\"](\"https:\/\/james-batchelor.com\/wp-content\/uploads\/2026\/07\/19439067347.png\")
<\/figure><\/div>\n\n\nIPv6<\/h3>\n\n\n\n
The pressing reason for getting this unit was to get a working IPv6 setup. Luckily, this has been achieved. <\/p>\n\n\n\n
Zen\u2019s IPv6 was discovered by the router by setting the WAN configuration to SLAAC connection and specifying the prefix delegation option, giving use of the \/48 range.<\/p>\n\n\n\n
Subdivisions <\/a>and allocation of the range on the LAN side was not as customisable as I\u2019d hope, however. When enabled on a VLAN, a \/64 range is allocated and the subnet address cannot be customised, the first range configured gets ::1\/64, the second 1::1\/64 and so on. Since my VLAN IDs take a non sequential arrangement, I\u2019d prefer a more customisable setup to match my VLAN IDs.<\/p>\n\n\n\n
VPN<\/h3>\n\n\n\n
Possibly the weakest feature of the USG discovered so far, whereas a Draytek offers all options for dial-in or LAN to LAN (inc. dial-out), the Unifi offers a lesser selection: <\/p>\n\n\n\n
– Dial-in: Wireguard, OpenVPN, L2TP
– Dial-out: Wireguard, OpenVPN
– LAN to LAN: OpenVPN, IPsec<\/p>\n\n\n\nThe goal for my setup was to re-establish an IPsec VPN with a remote site running a Draytek 2763, however this highlighted a compatibility issue that I may go into with a future post.<\/p>\n\n\n\n
As a compromise, a Wireguard session was established, with Unifi as the server, Draytek as the dial-out client. This works and is stable, but not without a performance hit, seeing throughput drop from 115Mbps over IPsec (limited by the FTTP upload profile) to around 60Mbps which is not the best outcome.<\/p>\n\n\n
\n![\"\"](\"https:\/\/james-batchelor.com\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-17-115815.png\")
<\/figure><\/div>\n\n\nLogging<\/h3>\n\n\n\n
The Unifi GUI is truly superior in finding out what your clients are doing, but not comprehensive. <\/p>\n\n\n\n
Traffic logging by each network device is available for easy viewing, along with application insights to help surmise where the traffic is going (albeit based on Unifi\u2019s interpretation of the destination by IP).<\/p>\n\n\n
\n![\"\"](\"https:\/\/james-batchelor.com\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-16-145555-1024x352.png\")
FireTV doing FireTV things<\/figcaption><\/figure><\/div>\n\n\n This is something you could only dream of while using a Draytek, but as mentioned, not perfect. <\/p>\n\n\n\n
I always get suspicious when my Grafana dashboards plot a spike a spike in WAN traffic that I was not expecting, and while I can see the spike in the Unifi dashboard, drilling down to the specific device is not as easy, and you\u2019ll easily resort to checking every device to see the culprit.<\/p>\n\n\n\n
Firewall logging on the other hand is as verbose as possible, showing each time my commercial cameras attempt to call home.<\/p>\n\n\n\n
A little detail, but a possible concern. The WAN connections show a little icon of the ISP\u2019s logo. Sure it’s a little touch to the UI, and the source code links to the ASN of the ISP, but it’s hard to dismiss if other metrics are being collected on your usage of the product.<\/p>\n\n\n\n
Under the hood<\/h3>\n\n\n\n
One of the most surprising discoveries is this unit is just a Linux box, running Debian 11 on ARM:<\/p>\n\n\n
\n![\"\"](\"https:\/\/james-batchelor.com\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-16-143819.png\")
<\/figure><\/div>\n\n\nEnabling SSH on the controller gives you root access to the OS, where you discover that it’s running familiar open source applications. This gives great troubleshooting options (as found with the aforementioned VPN issue) as resources are available from both the Unifi and wider Linux community. Changes to configuration files may be more tricky, as the GUI autogenerates the files upon each save, but certainly better for beginners than trying to navigate a closed source CLI..<\/p>\n\n\n\n
This also helps for SNMP collection, as the generic Linux device template in Zabbix suffices.<\/p>\n\n\n\n
The only reservation is that it is running Debian 11, which enters end of life on 31st August 2026. Hopefully these units will undergo a next version upgrade, or that Unifi will maintain the kernel past public withdrawal.<\/p>\n\n\n\n
Summary<\/h2>\n\n\n\n
Simply put, for the price point, it makes for a great upgrade for any ISP supplied router, or as a quick replacement for any business class router running a 1Gbps service, assuming WiFi is handled elsewhere.<\/p>\n","protected":false},"excerpt":{"rendered":"
I\u2019ve been using Draytek at home for routing for the past 10 years or so, with the latest being the 2927 in use for the last few years. With the release of the newer 2928 model this year, it’s inevitable that my router will be going end-of-life pretty soon. Instead of following on to its … Continue reading “Unifi UGC Ultra Migration”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,212],"tags":[293,424,339,423],"class_list":["post-1088","post","type-post","status-publish","format-standard","hentry","category-blog","category-network","tag-draytek","tag-router","tag-unifi","tag-unifi-ucg"],"_links":{"self":[{"href":"https:\/\/james-batchelor.com\/index.php\/wp-json\/wp\/v2\/posts\/1088","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/james-batchelor.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/james-batchelor.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/james-batchelor.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/james-batchelor.com\/index.php\/wp-json\/wp\/v2\/comments?post=1088"}],"version-history":[{"count":1,"href":"https:\/\/james-batchelor.com\/index.php\/wp-json\/wp\/v2\/posts\/1088\/revisions"}],"predecessor-version":[{"id":1094,"href":"https:\/\/james-batchelor.com\/index.php\/wp-json\/wp\/v2\/posts\/1088\/revisions\/1094"}],"wp:attachment":[{"href":"https:\/\/james-batchelor.com\/index.php\/wp-json\/wp\/v2\/media?parent=1088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/james-batchelor.com\/index.php\/wp-json\/wp\/v2\/categories?post=1088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/james-batchelor.com\/index.php\/wp-json\/wp\/v2\/tags?post=1088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}