How to Choose a UniFi Gateway in 2026

This guide covers the eight gateways the site tracks, all of them cloud gateways or Dream Machines. The UniFi Express models, the Dream Wall, the Cloud Gateway Industrial, the Dream Router 5G Max, the Dream Machine Beast, and the Enterprise Firewall units sit outside it, as do the discontinued USG models.

Some of these eight also record cameras and serve Wi-Fi, which is why the set is harder to read than a price list suggests. A gateway is one device doing between two and five jobs, and the right one is the cheapest that does the jobs your site actually needs.

IDS/IPS throughput is the ceiling once threat inspection is switched on, and it is not the same as the WAN port speed. A 2.5 GbE port in front of a 1 Gbps inspection rating means a faster line, not faster protected traffic. Ubiquiti's ratings here run from 1 Gbps to 5 Gbps.

The WAN port decides what your service can hand over. A multi-gig line on copper needs a 2.5 GbE or 10 GbE RJ45, and a fibre handoff needs SFP+. Two of the eight are limited to a gigabit on copper: the Dream Router, which has no SFP+ either, and the UDM-Pro, which does.

PoE is the row buyers most often miss. Only four of these gateways supply any power at all, and the amounts differ by more than ten times, from 15.4 W to 180 W. PoE budget planning works through what a given set of cameras and access points needs.

Protect storage decides whether cameras need a separate recorder. One of the eight holds nothing at all, two take an NVMe SSD, the two Dream Routers use on-board flash, and the three rack units take 3.5-inch drives. Protect storage sizing turns a camera count into a disk size.

Wi-Fi is built into exactly two of them, both Dream Routers. Every other gateway here assumes a separate access point, which is usually the better answer in any building bigger than a flat because the radio can then go where the coverage is needed.

Every figure below is Ubiquiti's own, from techspecs.ui.com. Device and user counts are catalog ratings rather than measured capacity, so read them as tiers rather than limits.

Model	Price	IDS/IPS	WAN	PoE	Protect storage	Devices
Cloud Gateway Ultra	$129	1 Gbps	2.5 GbE	—	—	30+
Dream Router	$199	1 Gbps	1 GbE	40 W	128 GB SSD	20+
Cloud Gateway Max	$279	2.3 Gbps	2.5 GbE	—	NVMe to 2 TB	30+
Cloud Gateway Fiber	$279	5 Gbps	10 GbE + SFP+	30 W	NVMe to 2 TB	50+
Dream Router 7	$279	2.3 Gbps	2.5 GbE + SFP+	15.4 W	64 GB microSD	30+
UDM-Pro	$379	3.5 Gbps	1 GbE + SFP+	—	(1) 3.5" bay	100+
Dream Machine SE	$499	3.5 Gbps	2.5 GbE + SFP+	180 W	(1) 3.5" + SSD	100+
Dream Machine Pro Max	$599	5 Gbps	2.5 GbE + SFP+	—	(2) 3.5" + SSD	200+

Read it in groups rather than as a ladder, because price does not track capability here. The three at $279 are the clearest case. The Cloud Gateway Max is uniform 2.5 GbE, and the Cloud Gateway Fiber matches the top inspection rating of the eight at 5 Gbps while adding 10G ports. The Dream Router 7 spends the same money on a tri-band Wi-Fi 7 radio. Cloud Gateway Max vs Cloud Gateway Fiber is the pairing most buyers get stuck on.

Two more inversions are worth knowing before you spend. The $279 Cloud Gateway Fiber inspects faster than the $379 UDM-Pro and the $499 Dream Machine SE, and among the rack units the cheaper Dream Machine SE is the only one with PoE while the $599 Pro Max has none. Neither is a mistake. They are different machines aimed at different buildings.

A gigabit line and an existing switch. The Cloud Gateway Ultra reaches every ceiling that line can present, at 6.2 W and in silence. Spending more buys headroom you cannot use today. That is a reasonable purchase, but it should be a deliberate one.

A multi-gig or fibre line. The Cloud Gateway Fiber is the answer under $500, because its 10 GbE RJ45 takes a copper handoff, its SFP+ ports take fibre, and 5 Gbps of inspection keeps IPS on at those speeds. Cloud Gateway Fiber vs UDM-Pro covers why the cheaper box wins that particular argument.

One box for a flat or a small house. The Dream Router 7 routes, serves tri-band Wi-Fi 7 over 160 m², switches four 2.5 GbE ports and records a camera. Its predecessor still has a place: the Dream Router carries 40 W of PoE across two ports where the 7 has 15.4 W on one, which Dream Router vs Dream Router 7 works through.

A rack with cameras and access points. The Dream Machine SE is the one to start from, because its eight PoE ports share a 180 W budget and can power a small camera set directly, saving a PoE switch. Past that budget or past 100 UniFi devices, the Dream Machine Pro Max doubles the ratings but gives the PoE back.

A large site. The Dream Machine Pro Max is rated for 200+ devices, 2,000+ users and 50 HD cameras across two drive bays, and it assumes a switch beside it for power.

These two rows decide how many devices end up in the cabinet, which is usually what people are really choosing between. A gateway with neither means a PoE switch and a recorder alongside it, and that is two more things to buy, power and find space for.

The amounts matter as much as the presence. Thirty watts is one camera or one access point; 180 W is most of a small camera fleet. A G6 Bullet draws 9.9 W and a U7 Pro up to 21 W, so the arithmetic is quick once the device list exists.

Storage divides the same way. The rack units take 3.5-inch disks and hold weeks of footage, the two Cloud Gateways take NVMe drives sized in terabytes, and the Dream Routers record to on-board flash rated for 5 HD cameras. How to choose a UniFi camera covers what those cameras need from the recorder.

The separation is a feature rather than a cost. A built-in radio sits wherever the gateway has to sit, which is normally beside the incoming line and rarely where the Wi-Fi is wanted, and that is the argument for a ceiling access point in anything larger than a flat.

Port count follows the same logic. None of these gateways is a switch, even the rack units, which carry eight or nine gigabit ports, so plan the switch alongside rather than after. How to choose a UniFi switch sets out port counts, PoE standards and budgets across the switches this site tracks.