Ubiquiti recently released UniFi OS Server for managed service providers (MSPs) and power users looking to self-host their own UniFi controllers. Think of it as the next-generation hosted UniFi controller with a fully supported UniFi OS experience. In this post, I’ll walk you through the full setup process on a Linux-based cloud server, from deployment to securing it with SSL and locking it down with firewall rules.
And if you get stuck or want a professionally deployed UniFi OS environment, remember: Crosstalk Solutions is here to help! Contact us today!
Why Use UniFi OS Server?
Until now, running a self-hosted UniFi controller meant juggling updates manually, often through clunky CLI processes that could easily break things. UniFi OS Server changes the game by bundling the controller inside a containerized UniFi OS environment, complete with automatic updates for UniFi apps and the OS itself.
Some standout benefits:
- Auto-managed updates for UniFi OS and applications
- Access to premium features like UniFi Site Magic, InnerSpace, and Identity
- Cloud portal integration via unifi.ui.com for centralized control
- Ideal for managing non-UniFi OS devices like UXG Pro, Gateway Max, and others
If you’re an MSP managing multiple clients or a network admin building serious infrastructure, this is the route you want.
Choosing the Right Platform: Linux Is King
UniFi OS Server is available for Windows, macOS, and Linux — but let’s be real. If you’re just testing it out on a home lab or running a single site, sure, use Windows or macOS. But if you’re deploying this in production or managing multiple customers, Linux is the only serious option. Not only is it better supported, but it’s also more robust and scalable.
In this walkthrough, we deploy on a DigitalOcean Linux droplet, but the process is applicable to any cloud provider or bare metal server you prefer.
Step 1: Deploying the Linux Server
We start by creating a Linux virtual machine (droplet) in DigitalOcean with Ubuntu as the OS. I recommend a minimum of 2GB RAM and 50GB disk space, which exceeds UniFi OS Server’s base requirements and gives you a bit of breathing room.
You’ll also want to assign a fully qualified domain name (FQDN) to your server — something like unifiosserver.yourdomain.com. This is essential for setting up a valid SSL certificate later using Let’s Encrypt.
While the droplet is being created, head over to your DNS provider (I use Cloudflare which is super easy for the Let’s Encrypt steps below) and create a new A-Record for your server. This will be your FQDN (unifiosserver.yourdomain.com) + the IP address of your Digital Ocean droplet.
Step 2: Initial Server Setup
Once your droplet is live, log in via SSH and apply all system updates.
apt-get update && apt-get upgrade -yFrom there, install podman, the container engine UniFi OS Server runs on (similar to Docker, but Ubiquiti’s chosen tool).
apt install podman -yNext head to the UniFi OS Server 4.2.23 release page (or find the latest version) and scroll towards the bottom to the Download links section. Right-click on Linux (x64) and choose ‘Copy link address’
***NOTE: Version has changed since the release of this tutorial – current version as of 1/10/26 is 5.0.6 and it can be found here.
Now type the following in the Linux CLI to download and install UniFi OS Server (SHIFT+INS to paste the copied URL into the CLI):
wget https://fw-download.ubnt.com/data/unifi-os-server/8b93-linux-x64-4.2.23-158fa00b-6b2c-4cd8-94ea-e92bc4a81369.23-x64chmod +x 8b93-linux-x64-4.2.23-158fa00b-6b2c-4cd8-94ea-e92bc-4a81369.23-x64(Substitute the actual file name downloaded if the version is different). This sets the installer to be executable. Finally, run the executable like this:
./8b93-linux-x64-4.2.23-158fa00b-6b2c-4cd8-94ea-e92bc-4a81369.23-x64 installAfter it finishes, give it a minute or so to boot, then access it via https://your-server-ip:11443. You’ll get a browser warning at this point because SSL isn’t set up yet — but we’ll take care of that soon.
UPDATE: 9/10/2025 – I’ve now had my UniFi OS Server in production for just over a month, and one thing that I’ve noticed is that it locks up with 100% CPU utilization every 4-5 days (I emailed my contacts at Ubiquiti about this, but I never heard back). The band-aid fix is to stop and restart the server with:
UPDATE: 11/12/2025 – the swapfile does NOT fix the server locking up (though it’s still a good idea to implement). I have not yet found a fix for the lock-ups.
UPDATE: 1/10/2026 – I have updated my own instance of UniFi OS Server to the latest (v5.0.6) using GlennR’s easy upgrade script. I will give it some time to see if the 4-5 day lockups have been fixed – but there is no mention of that issue in the release notes.
uosserver stop
uosserver startThis brings it back online, but it’s annoying to have to do that every few days. I thought perhaps maybe the server needs a swapfile to help alleviate that issue – so I added a 2G swapfile to my own server. I haven’t given it enough time yet as of the writing of this update to see if it solves that issue or not, but I will post an update in a week or two.
In the meantime, if you want to add a swapfile to your own server – this is how it’s done:
sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfileNow that you have your swapfile created and activated, it needs to survive a reboot. To do that, we need to add a line to the /etc/fstab file – so first edit it with:
sudo nano -w /etc/fstabThen add this line:
/swapfile none swap sw 0 0CTRL+X followed by Y to save and exit, and you’re all done.
Step 3: First-Time Setup and Multi-Site Mode
Once the web UI loads, walk through the initial configuration: name your server, sign in with your Ubiquiti account, and skip the backup restore if this is a fresh install.
Next, if you’re managing multiple clients or sites, enable multi-site mode from the settings menu. This lets you logically separate each customer’s devices and configurations, which is essential for MSP workflows.
BTW – Need help designing a multi-tenant UniFi environment? That’s exactly the kind of project we assist with at Crosstalk Solutions! Contact us today!
Step 4: Adding SSL with Let’s Encrypt
To secure your server with HTTPS, we use Let’s Encrypt along with DNS-based validation via Cloudflare. This avoids the need to open port 80, which is typically required for HTTP challenges. The process involves generating a Cloudflare API token, updating a configuration file on your server, and then running Certbot to obtain the certificate.
Follow the instructions written by awesome community member MiranoVerhoef: https://github.com/MiranoVerhoef/UniFi-OS-Server-SSL-Import
The only thing these instructions don’t properly cover is how to get your Cloudflare API token. To do that, log into Cloudflare, click your profile in the upper right-hand corner, and choose ‘Profile.’
Then pick API Tokens from the left-hand menu and click Create Token.
Click ‘Use template’ next to ‘Edit zone DNS’ and then under ‘Permissions,’ add a new one for Zone DNS Read.
Under ‘Zone Resources,’ select your domain. Then click ‘Continue to summary’ at the bottom followed by ‘Create Token’ on the following page.
You should now have your API token – copy it and save it in a safe location – this is the only time your token will ever be displayed!
Head back to Mirano Verhoef’s github page and follow the remainder of the instructions. Once you run the final script, it will stop UniFi, install the cert, and then restart UniFi. Give it about a minute and you should now be able to browse securely to the UniFi OS Server with your FQDN.
Step 5: Locking Down with UFW Firewall Rules
Out of the box, your server has every port wide open — which we obviously don’t want. Using UFW (Uncomplicated Firewall), we configure strict rules that only allow the specific ports UniFi requires, plus SSH (ideally locked down to your own IP).
Copy/paste these commands one by one to set up the UniFi OS Server firewall:
UFW firewall rules
# It is a good practice to start by resetting UFW to a clean state.
# WARNING: This will remove all existing rules.
# You will be prompted to confirm this action.
sudo ufw reset
# Set the default policy to deny all incoming traffic and allow all outgoing traffic.
# This is a secure starting point.
sudo ufw default deny incoming
sudo ufw default allow outgoing
# UniFi Network Application Ports (both TCP and UDP unless specified)
# The 'allow' command with just a port number automatically applies to both TCP and UDP.
# UniFi Network Discovery (STUN)
sudo ufw allow 3478 comment 'UniFi Discovery'
# UniFi Network Controller ports
sudo ufw allow 5005 comment 'UniFi Controller Discovery'
sudo ufw allow 5514 comment 'UniFi Remote Logging'
sudo ufw allow 6789 comment 'UniFi Device Adoption'
sudo ufw allow 8080 comment 'UniFi HTTP Portal'
sudo ufw allow 8443 comment 'UniFi HTTPS Portal (Web UI)'
sudo ufw allow 8880 comment 'UniFi HTTP Redirect'
sudo ufw allow 8881 comment 'UniFi HTTPS Redirect'
sudo ufw allow 8882 comment 'UniFi STUN Server'
sudo ufw allow 9543 comment 'UniFi API'
sudo ufw allow 10003 comment 'UniFi AP/Device Monitoring'
sudo ufw allow 11443 comment 'UniFi WebSockets'
# UniFi Network Server Port, not used in all versions, but good to add
sudo ufw allow 8843 comment 'UniFi Server Port'
# UniFi Hotspot Portal
sudo ufw allow 8880 comment 'UniFi Hotspot Portal'
# Allow SSH (port 22) from your specific WAN IP subnet only
# Replace '1.2.3.4/32' with your actual WAN IP/subnet if different.
sudo ufw allow from 1.2.3.4/32 to any port 22 proto tcp comment 'Allow SSH from trusted subnet'
# Enable the firewall to apply the rules.
# WARNING: After running this command, only the ports and IPs you have explicitly
# allowed will be able to connect to the server.
sudo ufw enable
# Verify that all rules have been configured correctly.
sudo ufw status verboseAfter applying and enabling the rules, verify you still have access and that UniFi is working as expected. Always test SSH in a second session before closing your terminal — just in case something went wrong.
Step 6: Adopting a Gateway from a Remote Site
As a final test, I connected a UniFi UXG Gateway from a separate internet connection (via T-Mobile Home Internet) to simulate a remote client site. After preconfiguring the site’s network settings and adopting the gateway via UniFi’s UI, everything worked seamlessly — including firmware updates and full management.
This proves the setup works not just in theory, but in real-world, multi-site scenarios.
Wrapping Up
UniFi OS Server is the future of self-hosted UniFi, and in my opinion, the best option for MSPs and network professionals who want control, scalability, and ease of use. With features like auto updates, multi-site management, and tight integration with the cloud portal, it finally brings the convenience of cloud hosting to self-managed environments.
And if you need help getting your UniFi OS Server up and running — or want to outsource the whole thing — Crosstalk Solutions is here for you. We offer design, deployment, troubleshooting, and managed support for everything UniFi and beyond.
Comments 33
Towards the end for configuring the UFW firewall there is faster method.
1. Create sh file
nano setup-ufw-unifi.sh in this file copy and paste below and save.
#—————————————-!/bin/bash
echo “Starting UFW configuration for UniFi…”
# Reset UFW (WARNING: This removes all existing rules)
read -p “Are you sure you want to reset UFW? This will remove all existing rules. [y/N]: ” confirm
if [[ “$confirm” =~ ^[Yy]$ ]]; then
sudo ufw reset
else
echo “Aborted UFW reset.”
exit 1
fi
# Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing
# UniFi STUN discovery
sudo ufw allow 3478 comment ‘UniFi Discovery’
# UniFi controller and management ports
sudo ufw allow 5005 comment ‘UniFi Controller Discovery’
sudo ufw allow 5514 comment ‘UniFi Remote Logging’
sudo ufw allow 6789 comment ‘UniFi Device Adoption’
sudo ufw allow 8080 comment ‘UniFi HTTP Portal’
sudo ufw allow 8443 comment ‘UniFi HTTPS Portal (Web UI)’
sudo ufw allow 8880 comment ‘UniFi HTTP Redirect / Hotspot Portal’
sudo ufw allow 8881 comment ‘UniFi HTTPS Redirect’
sudo ufw allow 8882 comment ‘UniFi STUN Server’
sudo ufw allow 9543 comment ‘UniFi API’
sudo ufw allow 10003 comment ‘UniFi AP/Device Monitoring’
sudo ufw allow 11443 comment ‘UniFi WebSockets’
sudo ufw allow 8843 comment ‘UniFi Server Port’
# SSH access only from trusted IP (replace with your actual IP/subnet)
TRUSTED_SSH_IP=”1.2.3.4/32″
sudo ufw allow from $TRUSTED_SSH_IP to any port 22 proto tcp comment ‘Allow SSH from trusted subnet’
# Enable UFW
sudo ufw –force enable
# Show current rules
sudo ufw status verbose
echo “UFW firewall configuration completed.”
#———————————————————-
2. Run the following command: chmod +x setup-ufw-unifi.sh
3. execute the script: ./setup-ufw-unifi.sh
4. accept modification with y.
Check that first command. You don’t need the get
apt get update && apt get upgrade -y
Hi Guys, a way to set 8080 to other else port?
Did you ever find a way to change the default inform port to something else?
Thanks
Does it provide API access? Can I migrate data from the self hosted unifi network controller to the unifi server os?
When running the installation I ran into an interesting issue. Not sure if it’s an actual issue or just my lack of knowledge of containers and/or podman.
TLDR: The Unifi OS Server is not using Ubuntu’s DNS. It comes preconfigured with a DNS server.
Some context:
I installed the Unifi OS Server on a fresh local/internal Virtual Ubuntu Machine.
I have a pihole running as my home’s DNS and DHCP is handing out the DNS IP.
I have a Firewall blocking DNS requests that are not specifically to my pihole. The pihole has public DNS access in a separate firewall rule.
I was able to install Ubuntu, run updates, download podman, and download the Unifi OS Server on Ubuntu. When running Unifi OS Setup and trying to log into my UI account, I was met with a “You must have an active internet connection to enable remote access” error. Meaning it wasn’t able to do 2FA. I went back and opted to not sign in to finish the setup.
Once I was in, I tried enabling remote access and was hit with the same error. After some troubleshooting I’ve come to understand that the Unifi OS Server is not using Ubuntu’s DNS server/settings. It seems to be using a preconfigured DNS server. I created a test rule above my “block public dns requests” rule to allow everything from the VM to anywhere on the internet and the Unifi OS server took right off. At the same time I had the Network app on my phone attempting to access the new server. As soon as I made the new firewall rule allowing DNS to go anywhere, the app connected to my Unifi OS Server. I then move this rule below the DNS blocking rule, as the rules are being processed top down in my firewall, and the Unifi Server stopped communicating with the app on my phone.
Again, not sure if this is an issue, a misconfiguration in podman, a misconfiguration in the Unifi OS Server, or just my lack of container knowledge. However, I thought it would be a good comment to the post. By default I would think the Unifi OS Server would use the host’s DNS IP.
Thank you,
-Hunter
I think your firewall rules could be a bit more polished. You have to many protocols open (some ports only need UDP and some only need TCP). If you need more info, check here for the origional documentation: https://help.ui.com/hc/en-us/articles/218506997-Required-Ports-Reference
I am following your instructions to build a testing vm. Nothing to crazy just load Debian 13, install podman, and UnifiOS Server. The server started as expected. My first attempt was to restore from my latest backup.
Unifi OS Server runs Network Controller 9.3.43. The current backup of my existing machine is v9.3.45. Needless to say the software complaint is the backup is a newer version than the installed v9.3.43.
Is there an upgrade command for Unifi OS Server to run to upgrade Network Controller?
Same here, what is the best procedure to update Network Controller to 9.3.45?
GlennR’s script did not recognize the install yet.
Excellent tutorial as always!!
Once your droplet is live, log in via SSH and apply all system updates.
you forgot the “-” 🙂
apt get update && apt get upgrade -y
to apt-get update && apt-get upgrade -y
Thanks for the thorough instructions! Anyone else have issues with high CPU usage? My UOSServer instance runs fine for about 24-hours and then just racks up CPU usage until the server grinds to a halt, requiring a restart.
Yes, same thing with UniFi OS 5.0.6. Do you have a solution?
Just want to add additional ports listed for the latest version of UOS server.
# Allow UniFi device adoption & control
sudo ufw allow 8080/tcp # device inform/adoption
sudo ufw allow 8444/tcp # remote proxy / app services
sudo ufw allow 9543/tcp # WebSocket API (events/streams)
sudo ufw allow 11443/tcp # UniFi OS HTTPS management
# Device discovery & NAT traversal
sudo ufw allow 3478/udp # STUN for NAT traversal
sudo ufw allow 10003/udp # device discovery broadcasts
# Guest portal (optional – only if you use Guest Wi-Fi)
sudo ufw allow 8880/tcp # guest HTTP redirect
sudo ufw allow 8881/tcp # guest HTTPS portal
sudo ufw allow 8882/tcp # guest API support
# Logs & speed test
sudo ufw allow 5514/tcp # syslog
sudo ufw allow 5514/udp # syslog
sudo ufw allow 6789/tcp # device speed test
# Video/VoIP (Protect / Talk)
sudo ufw allow 5005/udp # RTP video/audio
sudo ufw allow 11084/tcp # Protect/Talk inter-service comms
If anyone finds this in error please just post fix.
hello. how do i customize the ports as we used to in system.properties? thanks
Thanks for the guide!
I’m trying to install UOS on Ubunutu Server 24.04LTS and not having much success. I first tried GlennR’s script without success, then tried the manual method detailed above. the server installs fine, and is available on 11443.
I can connect to the portal, and go through the initial setup of name and logging in with my unifi account; the server sits there saying completing setup, takes about a minute…..before coming up with “UniFi OS Server Setup Error : An unexpected error occurred during setup.”
Anyone else seen this issue?
I have the same issue here. Anyone found a fix?
Has anyone tried using the swapfile method, because the author never put an update on this situation.
If you have tried using it, is it a solid solution, as in will this work permanently, or is it only temporary.
Or has anyone found a different method ?
I would love to get some feedback on this before I apply this to my unifi OS VPS.
Appreciate the guide.
However, at the part of using a swapfile, there is still no feedback posted by the author.
Has anyone tried this method and is it a permanent solution?
Or does anyone have a different method to prevent the OS from using up so much RAM
Thanks for guide all worked perfectly and ive got it all setup. But like you also having to reboot it every couple of days. It did an OS update not so long ago but still occuring on that version as well.
Love to know if there is a fix for it as pain to restart every morning or 1-2 days.
Author
Nope – the swap file didn’t fix it. I ended up creating an n8n automation that restarts the service when it’s detected as down.
Can you share it with us?
I’m not seeing this issue. I’m on an ESXi VM with Ubuntu 24.04.1. What are y’all using?
I’m hosting Ubuntu 25.10 on Digital Ocean droplet. Having to cycle power on droplet about every 4-5 days.
We’ve got the memory leak issue as well. I’m running a VM on ProxMox. 16 Cores and 64GB of RAM allocated to it. We run about 150 sites on this controller. We make it about 8-10 hours and then it falls on its face. I was hopeful 5.0.6 would fix it, but no go. Curious to see what you find.
I’m not using Cloudflare. Would I be able to follow basically the same instructions with the old blog with setting up Hosted Unifi? In that version you set up lets encrypt but used something called Cerbot to automate the process.
I ended up making a cron job to reboot the virtual machine running Unifi OS. Working very nicely.. atleast until Ubiquiti fix this issue.
Just updated Unifi OS Server to 5.0.6 the classic way (didn’t know Glenn had added a script). Hope memory leak is gone (running Ubuntu 24.04 on ESXi 7). We had actually added more RAM to alleviate the problem.
Control Plane mentions available update of Network Application (10.1.85) but update consistently fails w/o error message. Anyone knows where logs are?
OK so the problem was that our FW was blocking docker.io.
As this is a ‘major’ release (9 -> 10), container updates were required.
Thanks for this guide!
Just a note: I recomend to open port 11443 *before* installing UOS Server, otherwise it could be frustrating that the installation is complete but the WebGUI cannot be reached.
Bye
Arti
thanks for this guide, it really did go quite smoothly.. i also added a domain through cloudflare which went quite seamless..
my issue is that on the control plane it shows that the network application is 9.5.21 there is an option to “Update to 10.1.89” but when clicked it flashes “Update Queued” then nothing..
Any advise as to how to update the network application.. on doing some research i’m seeing that Ubuntu 25.10 is unsupported with UniFi OS Server..
thanks..
Follow this tuto to install it in a linuxmint version in an old tiny pc…. everything went well at the beginning then had some little trouble to make it work along a fortinet firewall and 2 unifi AP.
Now everything is almost done…but i have a serious doubt…i can manage everything from my Android smartphone outside the lan….!!!!
It is nice to check and do some troubleshooting but i did not create any rule on fortigate firewall to allow that!!!!
I am missing some security there!!!?
Thank you for the guide, works a treat.
Thank you for the great article.
It would be amazing to include an article on IPS/IDS (Suricata) to prevent port scans and or vulnerability scans.