Ubiquiti UDM-Pro 10G Cloud Gateway Subnet Settings

Ubiquiti UDM-Pro 10G Cloud Gateway Subnet Settings Guide

The Ubiquiti UDM-Pro 10G Cloud Gateway is the leading prosumer and homelab networking gateway in 2026. Unlike consumer routers, the UDM Pro is designed from the start for multi-VLAN deployments. Creating separate networks with different subnets is a first-class feature in the UniFi OS console. Each network gets its own CIDR block, DHCP range, firewall zone, and optional VPN policy.

Specifications¹

Default subnet configuration

The UDM Pro ships with a 192.168.1.0/24 LAN,² placing the router at .1 and allocating DHCP from .6 to .254. Five addresses (.1 through .5) are reserved for static assignments to the gateway and management services. In contrast to consumer routers, the UDM Pro treats the default network as just one of many possible networks. Adding a second network takes three clicks in the UniFi console and immediately provisions a new DHCP server and firewall zone. Building on this, the default network typically serves management devices (switches, APs) while additional networks serve user segments, IoT devices, and cameras in well-designed UniFi deployments.

Adding networks in UniFi OS

Log into the UniFi console at https://unifi.ui.com or https://192.168.1.1. Navigate to Settings > Networks > Create New Network. Enter a name, choose the purpose (Corporate, Guest, VLAN Only), and set the CIDR subnet. For example, 10.0.10.0/24 is a solid choice for an IoT VLAN. The VLAN ID field assigns an 802.1Q tag (e.g., VLAN 10). Enable DHCP and set the pool range. UniFi OS automatically creates inter-VLAN routing rules and firewall zones. Consequently, restricting IoT devices from reaching the main LAN requires one firewall rule: Block IoT Zone to LAN Zone in Settings > Firewall Policies. The UDM Pro enforces these rules at hardware speed for throughput above 1 Gbps.

Multi-subnet and VLAN patterns

A typical UDM Pro homelab deployment uses 5 to 8 VLANs: Management (10.0.0.0/24), Trusted LAN (10.0.1.0/24), IoT (10.0.2.0/24), Guest (10.0.3.0/24), Cameras (10.0.4.0/24), Servers (10.0.5.0/24), VPN clients (10.0.6.0/24).³ Planning these from a parent /20 block (10.0.0.0/20) keeps all subnets within one summarizable prefix that simplifies firewall summarization and route tables across the UDM Pro routing engine. Building on this, UniFi OS supports site-to-site VPN between UDM Pro units and requires that each site publish a unique non-overlapping prefix so tunnel traffic routes without ambiguity during failover or mesh reconvergence. CapyToolkit's subnet calculator verifies each CIDR allocation before you commit values to the UniFi console and prevents overlapping ranges from breaking pooled address plans.

Allocating CIDR blocks across trust zones

When you segment the available address block into flat /24 networks, you can leave headroom for future expansion by reserving CIDR prefixes on tier boundaries. The UDM Pro itself supports route summarization across six to eight contiguous networks at once, which means that a single advertising entry for 10.0.0.0/21 covers your IoT, Guest, Cameras, and Servers VLANs in one route table line rather than four individual entries that complicate leaks during topology changes. This summarization behavior is essential to keep the UniFi OS routing engine from bloating dynamic rules across multiple SD-WAN tunnels during multi-site failover events. CapyToolkit's subnet calculator enumerates each CIDR prefix in the recommended order so the entire plan fits inside one summarizable block before you enter the first CIDR value into the console.

DHCP configuration per VLAN on the UDM Pro

Each network on the UDM Pro runs its own DHCP server with an independently configurable pool. After creating a VLAN network at 10.0.10.0/24, the DHCP pool defaults to the full subnet range. Narrowing the pool (for example, 10.0.10.100 through 10.0.10.200) reserves addresses below .100 for static assignments to servers, printers, and access points. Building on this, DHCP reservations under Settings > Networks > [Network Name] > DHCP Name Server let you bind specific MAC addresses to fixed IPs within the pool. A UniFi access point that always receives 10.0.10.2 retains that address even after firmware updates or replacement hardware; simply update the MAC address in the reservation to match the new device.

Firewall rule design for multi-VLAN deployments

UniFi OS creates automatic firewall zones for each network: default, guest, VPN, and any custom VLAN networks you add. Inter-VLAN routing is enabled by default, which means devices on any network can reach devices on any other network unless you block it. A single firewall rule blocking IoT Zone to LAN Zone at Settings > Firewall Policies restricts IoT devices to internet-only access while allowing LAN devices to initiate connections to IoT endpoints for management. Building on this, placing blocking rules above allowing rules in the policy list matters: UniFi OS processes rules top-to-bottom, and the first matching rule wins. Adding an allow rule for a specific port above a blanket block gives granular exceptions without opening the entire zone.

DNS configuration across VLANs

The UDM Pro's built-in DNS forwarder serves all VLANs by default. Conditional DNS forwarding under Settings > Networks > [Network] > DHCP Name Server lets you specify which DNS server handles each VLAN. Directing IoT VLAN DNS queries to a Pi-hole or AdGuard instance at 10.0.2.10, while keeping the primary LAN on Cloudflare's 1.1.1.1, gives you per-zone DNS filtering without separate physical hardware. Clients within each VLAN inherit the DNS server automatically through DHCP option 6.

VPN integration with VLAN-backed subnets

The UDM Pro supports L2TP, OpenVPN (via Teleport), and WireGuard (since UniFi OS 3.x). Remote access VPN clients receive an IP from a dedicated VPN subnet configured under Settings > Teleport & VPN. Building on this, adding a firewall rule that permits VPN Zone traffic to specific VLAN subnets (for example, allowing VPN clients to reach 10.0.5.0/24 for the Servers VLAN but not 10.0.2.0/24 for the IoT VLAN) provides secure remote access to management interfaces without exposing the entire network. Site-to-site WireGuard tunnels between two UDM Pro units require non-overlapping CIDR allocations at each site; planning these from separate /20 blocks (10.0.0.0/20 for site A, 10.16.0.0/20 for site B) ensures no routing conflicts when the tunnel comes up. split a /20 across VPN sites on the Dream Machine Pro so each tunnel gets a unique prefix before the link comes up.

Monitoring traffic between VLANs

UniFi OS traffic identification classifies packets by application type and displays per-client statistics in the UDM Pro dashboard. Under Insights > Traffic, you can filter by VLAN to see bandwidth consumption per zone. Setting traffic rules with bandwidth profiles (for example, limiting the Guest VLAN to 50 Mbps aggregate) prevents one segment from saturating the uplink. CapyToolkit's subnet calculator helps plan the CIDR allocations that feed into this entire workflow: each VLAN's subnet size determines the DHCP pool, which determines the address range your firewall rules target.

This traffic identification runs through the UDM Pro's Deep Packet Inspection engine, which the official tech specs rate at 3.5 Gbps of combined IDS/IPS throughput. Because that inspection capacity is shared across every VLAN, a Guest network saturating its bandwidth cap still leaves headroom for the DPI engine to keep classifying traffic on the Servers and Management VLANs without dropping visibility into either segment.