Built on the UDR-5G-Max as gateway. Corrected device names, wired-first coverage, isolated camera path, and the blind spots that decide whether this holds up.
Wireless mesh does not travel well through concrete floors. In a 3-story house, a 5/6 GHz backhaul between floors will be slow and flaky. Run one Cat6 riser per floor during the 2–3 week window and wire every AP. Wired backhaul is the difference between "fast everywhere" and "works near the router." Treat mesh as a fallback for a single blind spot, never as the plan.
| Device | Where | Role | Uplink | Note |
|---|---|---|---|---|
| UDR-5G-Max | Ground | Gateway, load-balance 3 WAN, ground-floor Wi-Fi, console | 2 fiber + SIM | Load balance + failover, not bonding |
| PoE switch USW-Flex-2.5G-PoE or Lite-8-PoE | Ground | Port + PoE expansion for APs and cameras | 2.5G to UDR | UDR has only 1 PoE port, you need this |
| UX7 or U7 Pro | First | Wired AP (preferred) or wireless mesh (fallback) | Cat6 riser | UX7 = 1 LAN port only, no PoE |
| U7 Lite | Third | Wired AP, light coverage for the rarely-used floor | Cat6 riser | Do not overspend here |
| Local 4G/5G CPE | Ground | Cellular WAN source (PTA-approved) | Ethernet to a WAN port | Sidesteps IMEI registration entirely |
| UNVR (later) | Ground | Camera recording + retention | 2.5G to switch | 64 GB microSD on UDR is too small for CCTV |
Skip the TP-Link repeaters. In a UniFi network they break seamless roaming and central management and add a weak security island. A wired U7 Lite on the third floor solves the same blind spot properly.
Leave both ONTs in place, they convert fiber to Ethernet. In each ONT admin, enable bridge mode so the UDR does the routing. PTCL is usually PPPoE (enter the PPPoE username and password from your ISP on the UDR WAN). StormFiber is often DHCP, and may need MAC clone. If an ISP refuses bridge, accept double-NAT: it still load-balances, but you lose inbound ports and clean VPN.
In UniFi Network, set PTCL on the SFP+ or a 2.5G port, StormFiber on a second 2.5G port. Set each WAN type (PPPoE or DHCP). Choose Load Balancing with a weight, or Failover priority if you want one primary. Enable per-WAN health checks so a flapping line is dropped automatically.
If using the UDR internal SIM: insert the nano-SIM, open the Cellular WAN, set the APN. Zong data: zonginternet. Jazz data: jazzconnect.mobilinkworld.com. Confirm the current APN with the carrier, they change. Prefer failover for the SIM to avoid burning data, and set a hard data cap and alert. If using a local CPE instead, put it in bridge or drop-in mode and feed a WAN port. Expect CGNAT: outbound and failover only, no inbound.
Reuse the Berlin model: MGMT, LAN, IoT, Guest, Cameras, Servers. Default deny between VLANs. Cameras get no internet egress. Guest gets client isolation and internet only. IoT cannot reach LAN or MGMT.
WPA3, strong PSK, one SSID per trust zone, 6 GHz enabled for near-router devices. Set country = Pakistan so channels and power are legal. Enable fast roaming so clients hand off cleanly between the wired APs. Disable WPS.
Change all defaults, enable MFA on the Ubiquiti account, use WireGuard or Teleport for remote admin rather than exposing the UI. Turn IDS/IPS on. Disable UPnP. Review and minimise port forwards. Keep firmware auto-update in a low-use window.
| Feature | Risk | Mitigation |
|---|---|---|
| Load balancing | Source IP flaps between lines, banking and some streaming sites log you out or block | Pin those apps to one WAN with a policy route |
| Cellular CGNAT | No inbound, IP changes on failover break live sessions | Use cellular as failover only, not for hosting |
| Double-NAT | Breaks port forwarding, some gaming and P2P, complicates VPN | Push for ISP bridge mode first, DMZ the UDR as last resort |
| Wireless mesh | Shared airtime halves throughput, concrete floors kill backhaul | Wire every AP, mesh only one blind spot |
| TP-Link repeater | Rogue SSID, no roaming, weak security, unmanaged | Remove, use a wired UniFi AP |
| UPnP enabled | Apps auto-open inbound ports without you knowing | Disable, forward ports manually if truly needed |
| Public service exposure | Every open port is patch pressure and attack surface | Keep everything behind VPN, never expose the UI or cameras |
| Camera microSD | Tiny retention, card wear-out | Move to a UNVR, size retention to your days of footage |
| Imported modem IMEI | Cellular blocked after the DIRBS grace period | Use a local PTA-approved CPE, or register and pay duty |
Bonding sits at the very edge, upstream of the gateway. The bonder eats the two fibers plus a cellular source, bonds them at the packet level with WAN Smoothing and FEC (the part that actually masks your packet loss), and hands one clean link to the UDR-5G-Max WAN. Mode: bonding plus hot failover. Endpoint: a VPS sized above your combined speed, placed for low ping to Lahore.
If a bonder is handling cellular, the UDR-5G-Max's own SIM becomes redundant. For a committed bonding build, a plain UCG-Max plus the bonder plus a local CPE is more logical and cheaper than paying for the UDR's modem you would not use. Decide bonding vs load balancing before you buy the gateway, it changes which gateway to buy.
UniFi Protect runs on the UDR-5G-Max, but it manages only a handful of cameras and its 64 GB card is too small for continuous CCTV. Power the cameras from the PoE switch, not the UDR's single PoE port. Put every camera on an isolated Cameras VLAN with no internet egress, so a compromised camera cannot phone home. For real retention add a UNVR and size storage to your days of footage at your resolution and camera count. Never forward a port to a camera or the NVR, reach them over VPN.