UniFi UDM-SE WAN, Security & IPv6 Audit Report#

Date: July 23, 2026
Gateway Device: Ubiquiti UniFi Dream Machine Special Edition (UDM-SE)
Firmware Version: 5.1.19.33549
Primary ISP (WAN1): Cogeco Connexion (1000 Mbps Down / 30 Mbps Up)
Failover ISP (WAN2): Vidéotron (Currently Down - Offline)
Secondary Backup ISP (WAN3): Starlink (CGNAT)

1. Executive Summary#

An in-depth audit of the UniFi Dream Machine SE gateway was performed via the UniFi API. The assessment evaluated the primary WAN (WAN1 - Cogeco Connexion), secondary failover WAN (WAN2 - Vidéotron), and backup satellite WAN (WAN3 - Starlink).

Final Assessment: OPTIMAL WITH CONSISTENT MULTI-WAN CONFIGURATION

• IPv6 Parity Across All WANs: All three WAN interfaces (WAN1, WAN2, WAN3) are uniformly configured for IPv4 operation without dynamic DHCPv6 Prefix Delegation. Link-local IPv6 addresses (fe80::...) exist at the Linux kernel level without sending WAN solicitations.
• Multi-WAN State:
  • WAN1 (Cogeco): Online / Active Primary (72.11.191.80 Public IPv4). Link state pristine.
  • WAN2 (Vidéotron): Offline / Down. Physical link is UP (1000 Mbps), but no IPv4 DHCP lease was granted by Vidéotron modem.
  • WAN3 (Starlink): Online / Active Backup (100.107.0.252 CGNAT /10). 802.3x Ethernet Flow Control is enabled as intended for Starlink Dishy handoffs.

2. Comprehensive Multi-WAN Comparison#

3. Deep-Dive Comparison & Technical Analysis#

3.1 IPv6 Uniformity#

In theory and in practice, all three WAN interfaces are configured consistently regarding IPv6:

• None of the 3 WAN connections request dynamic DHCPv6 prefixes from their respective upstream providers.
• No IPv6 WAN solicitations are emitted to Cogeco, Vidéotron, or Starlink.
• Internal private IPv6 ULA networks (Lab-VM on fd00:12::/64 and marcoue on fd00:19::/64) run independently of all three WANs.

3.2 Detailed Analysis of WAN 2 (Vidéotron - Currently Offline)#

• Physical Link vs Network Layer: Port 8 (eth7) shows physical carrier signal (up: true, speed: 1000), but the WAN state is offline because Vidéotron’s DHCP server has not supplied an IP address (address: null).
• Causes for Vidéotron Offline Status:
  1. Modem MAC Binding: Vidéotron modems typically lock to the first MAC address seen. If the modem was rebooted or swapped, power-cycling the Vidéotron modem for 3–5 minutes clears the MAC lock table.
  2. Port Remapping & PoE: Port 8 is a PoE-capable switch port remapped to WAN2. poe_mode is set to auto. Setting poe_mode: off on Port 8 is recommended to avoid delivering phantom PoE voltage to non-PoE modem network cards.

3.3 Detailed Analysis of WAN 3 (Starlink)#

• Flow Control Activation: flowctrl_rx: true is explicitly enabled on Port 5 (eth4). This is beneficial for Starlink because Dishy terminals use Ethernet 802.3x pause frames during satellite handovers and micro-bursts to prevent memory buffer overflow.
• Carrier-Grade NAT (CGNAT): Starlink operates on RFC 6598 space (100.107.0.252/10). Direct inbound IPv4 port forwarding is blocked by Starlink upstream. Remote access via WAN3 relies on outbound VPN connections (such as the enabled Teleport / WireGuard system).
• Interface Errors/Drops: 665 errors and 670 drops recorded on Starlink are normal operational statistics resulting from satellite passover transitions and brief atmospheric attenuation.

4. Recommendations for Multi-WAN Setup#

1. Vidéotron WAN2 Power Cycle: Power cycle the Vidéotron modem while Port 8 is connected to allow the modem to issue an IPv4 lease to MAC 70:a7:41:94:63:ec.
2. Disable PoE on Remapped WAN Ports (Ports 5 & 8): In UniFi Port Settings for Port 5 (Starlink) and Port 8 (Vidéotron), change PoE Mode from Auto to Off as a precautionary best practice against non-PoE modem network interface damage.
3. Flow Control Settings: Keep flowctrl_rx: true on Starlink (Port 5) and flowctrl_rx: false on Cogeco (Port 9) and Vidéotron (Port 8).

Report generated automatically via UniFi MCP Agent.