On a Ubiquiti UniFi gateway, you connect Access Gate with two switch ports and add two settings in the UniFi Network application: one route for the twin addresses, and one rule that sends a whole machine subnet through the gate. Nothing changes on the machines, and removing the rule undoes it.
What you will build
The examples use these addresses. Replace them with yours.
| What | Example |
|---|---|
| Admin network | Admin, VLAN 254, 192.168.254.0/24, gateway 192.168.254.1 |
| Dedicated network for the gate | AG-Protect, VLAN 65, 100.65.0.0/29: gateway 100.65.0.1, gate 100.65.0.6 |
| Twin addresses | 100.64.0.0/16 |
| Your machine subnet | 192.168.1.0/24, PLC 192.168.1.10 (twin address 100.64.1.10) |
1. Connect two ports
- In Settings → Networks, create two networks:
Admin: VLAN 254,192.168.254.0/24, gateway192.168.254.1.AG-Protect: VLAN 65,100.65.0.0/29, gateway100.65.0.1.
- In Ports → [port] → Port Manager, set one port to Native VLAN = Admin and another to Native VLAN = AG-Protect.
- Cable the
Adminport to the Access Gate admin port (5) and theAG-Protectport to its protection port (1).
The admin port takes an address from your admin network over DHCP, or uses 10.0.0.1 after about a minute if there is none. You can set it to a fixed address, such as 192.168.254.50, from the console.
2. Add the route for twin addresses
Access Gate gives each machine a twin address in 100.64.0.0/16. In Settings → Routing → Static Routes, add:
- Destination:
100.64.0.0/16 - Next hop:
100.65.0.6
Nothing uses these addresses yet, so this changes nothing on its own. It is what lets replies come back through the gate after step 3.
3. Switch with one rule
This rule sends everything coming from your machine subnet to the gate first, whatever its destination. In Settings → Routing → Policy-Based Routes, add:
- Source: your machine network (
192.168.1.0/24) - Destination: any
- Next hop / interface:
AG-Protect(100.65.0.6)
Saving the rule is the switch. Your machines keep their address, gateway and settings.
To undo: delete the policy-based route.
4. Check it works
From a machine, reach something it usually talks to, exactly as before:
ping 192.168.2.20
In the Access Gate console, the flow now appears under its enclave. Access Gate starts in a dry run, so it shows what it would block without blocking anything until you approve the rules.
You can also test the other direction: from an IT computer, reach the machine by its twin address (ping 100.64.1.10). The route from step 2 carries it to the gate, which passes it on to the real machine.
Other options
Older controller without Policy-Based Routes
Policy-based routing is only on newer UniFi OS gateways. On an older controller, use the route from step 2, which always works: people and systems reach each machine by its twin address or name, and that traffic goes through the gate, whoever sent it. To cover one machine only, add a static route for its twin address in Settings → Routing → Static Routes:
- Destination:
100.64.1.10/32 - Next hop:
100.65.0.6
You can also apply the one rule on an upstream device that supports it, such as a Catalyst switch. For how the twin address pattern works in general, see Redirect traffic with your router's NAT.
Reach machines by name
Access Gate answers DNS at 100.65.0.6 and gives each machine a name that points to its twin address. Either hand that resolver to a network: edit it in Settings → Networks and, under DHCP → DNS Server, set a manual value of 100.65.0.6.
Or keep your DNS and forward one subdomain to the gate. The UniFi gateway does not reliably forward a single zone, so add a conditional forwarder for secure.acme.corp → 100.65.0.6 on your site DNS server (Windows DNS, BIND, or Infoblox). See Give your machines easy names.
Which traffic the rule covers
The rule in step 3 covers everything that leaves the machine subnet: machines to IT, and machines to other networks. Traffic coming into the subnet from IT is covered when it is sent to a twin address or a name (the route in step 2 already handles it).
Machines that talk to each other on the same network, with no router in between, never pass the gateway's routing. For those, see Redirect traffic on your switches.
What stays on the gateway
The UniFi gateway holds one route and one rule, written once. Who may reach which machine, sign-in, session recording, encryption and logs all live on Access Gate. When the network team asks what changes on the gateway, the answer is: one rule, once.