UniFi Layer 3 Switching: When to Move Inter-VLAN Routing Off the Gateway

Have you checked what your UniFi gateway is doing when the nightly NAS backup starts? If your workstations sit on one VLAN and your storage sits on another, every byte of that backup goes up the uplink to the gateway, gets routed, and comes straight back down the same cable.

That hairpin is how UniFi works by default, and for most segmented networks it is the right design. That said, as a network grows — more VLANs, more 2.5GbE and 10GbE clients, more traffic moving between them — the gateway can quietly become the slowest hop on the network.

Layer 3 switching moves inter-VLAN routing for the networks you choose off the gateway and onto a capable UniFi switch, where the switching hardware handles it. This guide covers when that trade makes sense, what it does to your firewall policies, and which switches support it.

On a standard UniFi deployment, the gateway owns the default-gateway address for every network you create. Each VLAN reaches the gateway over a tagged trunk, and the gateway routes traffic between subnets — the classic router-on-a-stick design covered in our UniFi VLANs explained guide.

The benefit is central control. Every packet that crosses a VLAN boundary passes through the gateway, so UniFi zone-based firewall policies, traffic identification, and IDS/IPS all see it.

The cost is that a large transfer crosses the same physical path twice. A file copy from a workstation VLAN to a storage VLAN travels up the trunk to the gateway and back down the trunk to the core switch, sharing that link with everything else headed for the internet.

In practice, a few separate constraints stack up on this path:

• Uplink contention. The trunk between your core switch and the gateway carries north-south internet traffic and hairpinned east-west traffic at the same time. A single 1GbE or 2.5GbE uplink fills up quickly when two fast clients on different VLANs start a large transfer.
• Gateway forwarding capacity. The gateway routes in software on its CPU, alongside NAT, VPN tunnels, DNS, DHCP, and the rest of its services. Routing capacity varies a lot across the Cloud Gateway, Dream Machine, and Enterprise Fortress Gateway lines, so check the spec for your exact model.
• Inspection overhead. When IDS/IPS is enabled, inter-VLAN traffic is inspected as well, and inspection costs throughput. Our UniFi IDS/IPS throughput guide explains why the inspected rate is usually far below the gateway's headline routing figure.

All of these constraints share one root cause: the gateway is doing the routing for traffic that never needs to leave the building. Keep in mind that you can relieve the first constraint with a faster uplink or link aggregation, as covered in our UniFi uplinks and aggregation guide, but the second and third stay in place until the routing itself moves.

Layer 3 switching solves one specific problem: high-volume traffic between internal VLANs. It does nothing for internet throughput, because north-south traffic still leaves through the gateway for NAT and WAN routing.

The clearest signals that you've outgrown gateway-only routing include but are not limited to:

• Transfers between VLANs run well below the client link speed. A 10GbE workstation copying to a 10GbE NAS on another VLAN that tops out near the uplink or gateway ceiling is the textbook case. Put the same two devices on one VLAN, and the copy runs at full link speed.
• Gateway CPU spikes during internal transfers. If the gateway's resource graph climbs every time a backup, a media library scan, or a VM migration runs, it is spending cycles on traffic it never needed to touch.
• Internet performance drops while internal jobs run. When video calls stutter during a nightly backup, the hairpinned traffic is competing with WAN traffic on the uplink.
• You've already upgraded the uplink and still hit the wall. Once aggregation or a faster uplink has stopped helping, the gateway's own forwarding or inspection rate is usually the limit.

The workloads that typically trigger these signals are predictable. Backups from a trusted client VLAN to a storage or server VLAN, media servers streaming to clients on another subnet, and hypervisor hosts whose management, storage, and VM networks sit on separate VLANs all generate sustained east-west traffic.

On the contrary, a home or small office where the only cross-VLAN traffic is a phone controlling smart plugs or a laptop reaching a printer gains very little. That traffic is light, it benefits from the gateway firewall, and moving it would cost you inspection without a meaningful speed gain.

This is why the decision is usually made network by network, not all at once. Most operators move only their trusted, high-volume networks onto the switch and leave everything else where it is.

This is the part that catches people out. When two networks are routed by the same Layer 3 switch, traffic between them never reaches the gateway — so the gateway cannot filter, inspect, or log it.

In concrete terms, traffic between two switch-routed networks bypasses:

• Zone-based firewall policies. The policies you built in the Network application apply at the gateway. Traffic routed inside the switch never reaches them.
• IDS/IPS inspection. Threat signatures and anomaly detection run on the gateway. A compromised host on one switch-routed VLAN can reach another switch-routed VLAN without that path being inspected.
• Gateway traffic visibility. Traffic identification, flow insights, and content filtering on that path depend on the gateway seeing the packets. Expect less visibility into east-west flows once they move.
• Gateway-hosted services. DHCP for a switch-routed network typically moves to the switch, and services such as mDNS reflection or DNS-based filtering may behave differently. Check the current Network application release notes for the exact behavior on your version.

What replaces the gateway firewall on that path is the switch's ACL capability. Switch ACLs can permit or block traffic by source, destination, subnet, and port, and the switch enforces them in hardware.

However, switch ACLs are stateless. They have no connection tracking, so there is no equivalent of the gateway's return-traffic handling — you write rules with both directions in mind, and you test them against real traffic before you rely on them.

There is good news. Traffic between a switch-routed network and a gateway-routed network still crosses the gateway: the switch forwards it over its transit link to the gateway, which routes it and applies zone policies and IDS/IPS as usual.

That behavior gives you a clean design rule. Route your trusted, high-volume networks — workstations, servers, storage, hypervisors — on the switch, and keep untrusted segments routed by the gateway.

Untrusted segments include your IoT VLAN, which our Home Assistant IoT VLAN on UniFi guide walks through, and your guest networks, covered in UniFi guest networks. Camera networks belong on the gateway side too, since cameras are exactly the kind of device whose traffic you want inspected.

Note that the trusted networks you move to the switch can still talk to the untrusted ones only through the gateway. The fast path stays fast, and every boundary that matters still sits behind a stateful firewall.

Layer 3 routing is a feature of Ubiquiti's higher-tier switching lines, not the whole catalog. As of this writing, the capability appears across these families:

• Pro and Pro Max series. The Pro and Pro Max 24- and 48-port models, including the PoE variants, list Layer 3 routing on their spec sheets. These are the most common choice for a core switch in a growing network.
• Enterprise series. The Enterprise switches pair Layer 3 routing with 2.5GbE access ports and 10GbE uplinks, which suits networks where many clients run multi-gig.
• Pro Aggregation. The Pro Aggregation is a 10GbE and 25GbE aggregation switch with Layer 3 support. It works well as the routing core when access switches hang off it in a hub-and-spoke layout.

Meanwhile, the Lite, Flex, Ultra, and standard non-Pro switches are Layer 2 devices. The standard Aggregation switch is also Layer 2, despite its name, so it cannot take over routing.

Product lines change, so remember to confirm that Layer 3 routing appears on the datasheet for the exact SKU before you buy. Our UniFi switch buying guide and the UniFi switches gear page break down the current lineup by tier.

Placement matters as much as model choice. The Layer 3 switch should sit at the core, where the high-volume devices connect directly or through short uplinks, because traffic that has to cross several access switches to reach the router still pays for every hop.

If your NAS and servers connect to an access switch at the edge of the network, consider moving them to the core switch at the same time. Also check your PoE budget before consolidating powered devices onto one switch — our PoE budget planning guide covers the math.

Moving routing is a change to the network's core, so treat it like one. Here's a sequence that keeps the risk contained:

1. Inventory your east-west flows. Use the gateway's traffic insights to identify which VLAN pairs carry the heavy traffic. Usually two or three networks account for most of it.
2. Decide which networks move. Only trusted, high-volume networks should move to the switch. Write down every network that stays on the gateway, and why.
3. Write switch ACLs before the cutover. If two trusted networks still need some separation, such as servers that should not accept connections from every workstation, draft those ACLs in advance. Remember that they are stateless, so plan both directions.
4. Audit DHCP and static assignments. Since the switch will typically take over DHCP for the networks it routes, review reservations, lease times, and any custom DHCP options first.
5. Schedule a maintenance window. When you change a network's router from the gateway to the switch in the Network application, clients on that network briefly lose their default gateway while the switch takes over. Do it when a short interruption is acceptable.
6. Verify, then verify again. A traceroute from a client should show the switch as the first hop for inter-VLAN destinations, and a large transfer between moved networks should no longer move the gateway's CPU graph. Confirm that traffic to gateway-routed networks still hits your zone policies.

Finally, keep the rollback simple. Changing the network's router back to the gateway restores the original design, so document your switch ACLs and DHCP settings in case you need to recreate them.

Once the migration is done, revisit your UniFi port profiles to confirm that trunk and access ports still carry the right VLANs. If you're still weighing whether the gateway itself needs an upgrade instead of a routing change, our UniFi gateway buying guide compares inspection and routing capacity across the lineup — and for many growing networks, the right answer turns out to be both.