UniFi lets you set DNS servers in the WAN or network settings, and Ubiquiti's update troubleshooting recommends reliable resolvers such as 1.1.1.1 or 8.8.8.8 when updates fail. Content filtering is built on DNS: Ubiquiti's article explains that filtering redirects DNS traffic to the gateway for inspection, compares requests with its blocklists and denies access before the browser connects, which is why it needs no client configuration.
The checks in more detail
The consequence is that internal or manually chosen DNS servers, such as Active Directory domain controllers, may stop resolving unless you add a DNS forwarding rule with your internal domain and the domain controller's address, and, for some VPN topologies, a source NAT rule. Enter only the base domain, not SRV records or host names. DNS Shield cannot be used with content filtering on gateways running version 4.2 and earlier. If sites do not load, check that the WAN has working DNS, that clients receive the gateway as DNS,
that a device with private DNS is not bypassing it and that filtering is not blocking the site: add it to the allowlist to test. Change one setting at a time and note the previous values. After a reset the defaults return, so re-enter custom servers. If your household relies on a specific resolver for a reason, such as a filtering service, set it on the gateway and let clients inherit it, rather than setting it on each device, so that one setting controls everything.
Check the clients received the gateway's DHCP DNS setting by looking at a device's network details; a device that shows another resolver is using its own setting. Keep a note of which policies use DNS interception, since that explains odd behavior with VPNs and internal names. If you change DNS and a smart TV or console stops working, look at whether it hard-codes its own resolver, since some devices do, and decide whether to allow that or redirect it.
Differential
Likely causes of “Ubiquiti UniFi gateways cannot open websites because DNS fails”, and how to tell them apart
- 1
A filtering policy
What separates it A site is blocked because a content filtering policy stops it
How to confirm Add the site to the allowlist as a test, and see whether it then loads
- 2
Internal DNS not forwarded
What separates it Internal names fail because internal DNS queries are not forwarded to the right server
How to confirm Add a DNS forwarding rule for the internal domain, pointing at the internal server
- 3
Missing SNAT
What separates it A domain reached through a VPN fails because a source NAT rule is missing
How to confirm Add a source NAT rule where the VPN setup requires one, and test again
- 4
An unreachable resolver
What separates it Everything fails to resolve because the resolver in use cannot be reached
How to confirm Use reliable resolvers such as 1.1.1.1 or 8.8.8.8, and then test again
- 5
A device with private DNS
What separates it One device behaves differently because it uses a private DNS setting of its own
How to confirm Turn the private DNS off on the device, so that it uses the DNS of the network
Before you touch a setting
Record this first — changing settings destroys the evidence
- The DNS servers that are set for the WAN and the network
- Which filtering policy applies to the devices that fail
- Which names fail to resolve, and which still work
- The network topology for internal domains
Try in this order
0 of 7 completedCheck the WAN DNS
ReversibleCheck the WAN DNS settings, and use reliable resolvers such as 1.1.1.1 or 8.8.8.8, and then test again to see whether it helped.
Check filtering
ReversibleCheck the filtering policy, and use an allowlist as a test, to see whether it blocks the site.
Add a forwarding rule
ReversibleAdd a forwarding rule for internal domains, so that internal names go to the internal server.
Add SNAT if needed
ReversibleAdd source NAT if needed, since some VPN setups need it for the domains that they reach.
Test names
ReversibleTest names both inside and outside your network, to see where the failure happens, and then test again to see whether it helped.
Revert if needed
ReversibleRevert to the previous values if a change made things worse than they were before.
Document
ReversibleDocument the settings by writing down what you set, so you can restore them later.
Model-specific
What is true of this model and not of its siblings
- Models this page covers
- UniFi Dream Machine Pro, Dream Machine Special Edition and Cloud Gateway Ultra. Ubiquiti writes one help article per fault for its UniFi gateways; the notes name where the ports and mounting differ.
- Versions
- Menu paths differ between Network 9.3 and 9.4.
- Filtering
- Enhanced filtering uses Cloudflare category lists.
- Tools and supplies
- An Ethernet cable rated Cat6 or better, a paperclip or pin for the Reset button, the UniFi mobile app, a laptop and a pen and paper for the model, MAC address and serial number. No screwdriver is needed and a console should not be opened.
- Repair cost
- Restarts, resets and settings changes cost nothing. UniFi hardware is replaced rather than repaired: Ubiquiti's warranty page gives a two-year warranty for products bought from its own webstore, help.ui.com routes in-warranty replacements through its RMA portal, and UI Care extends hardware coverage up to five years. Reference list prices from Ubiquiti's store and retailer listings: Dream Machine Pro $379, Dream Machine SE $499, Cloud Gateway Ultra $129, U7 Pro $189, U6 Pro $159 and Switch Pro Max 24 PoE $799. A bad cable or a provider fault costs the same whichever UniFi device you own.
- Other models this page answers
- These steps also fit the UniFi Dream Machine Special Edition, UniFi Cloud Gateway Ultra.
Stop boundary
When this stops being a self-service repair
- !If names fail on reliable resolvers, check the WAN and contact the provider
- !If internal domains fail after forwarding rules, review SNAT needs
- !If the setting will not save, contact Ubiquiti support
Evidence ledger
Sources behind this answer
Where the manufacturer's article stops. The figures and steps on this page are Ubiquiti's own, and the prices are its published list prices. Replacement prices are Ubiquiti store list prices and vary by retailer.
DNS-level content filtering.
Update Manager, auto-updates and update troubleshooting.
LED states, IP address checks and TCP 8080.
VLAN and DNS reachability.
The company and its products.
Exact questions
Common questions
How does content filtering work?+
Content filtering redirects DNS traffic to the gateway, so that it can be inspected.
Why do internal names fail?+
Internal names fail because filtering intercepts DNS, unless you forward the internal domains.
What do I enter for a forwarding rule?+
For a forwarding rule, enter the base domain and the address of the domain controller.
Which DNS does Ubiquiti suggest for updates?+
Ubiquiti suggests 1.1.1.1 or 8.8.8.8, for updates and for reliable name lookups.
What is DNS Shield?+
DNS Shield is a DNS feature that cannot be combined with filtering on version 4.2 and earlier.
When is SNAT needed?+
SNAT is needed for policy based IPsec or route based VPNs that have no VTI addresses.
Can I use an allowlist?+
Yes, an allowlist lets you permit a site that a filter would otherwise block.
Does a reset clear DNS?+
Yes, a reset clears the DNS settings, and you need to enter them again.
Can clients bypass it?+
Clients can bypass the filter, if they use private DNS or a VPN of their own.