Control plane vs data plane: how APs, switches, and gateways reach your hosted controller — and what traffic stays on your LAN.
How UniFi Devices Connect to i2unifi Cloud
This map explains how on-site UniFi gear talks to your hosted controller at i2unifi — and what does not go through the cloud.
Two paths: data vs control
| Path | What it is | Where it goes |
|---|---|---|
| Data plane | User WiFi, browsing, streaming, LAN printing | Client → AP → switch → your gateway → internet |
| Control plane | Adoption, config, stats, firmware orchestration | Device → internet → i2unifi hosted controller |
Important: Customer WiFi traffic does not tunnel through i2unifi. Only management traffic reaches the cloud controller.
Cloud connectivity map
CUSTOMER SITE (your building) i2unifi CLOUD
============================== =================
[Phone/Laptop] ---- WiFi ----> [Access Point] [Hosted UniFi Controller]
| | ^
| | PoE switch |
v v | HTTPS / inform
(internet browsing) [UniFi Switch] |
| | |
+---------- LAN --------------+-------- [UniFi Gateway] -------+
| | NAT/firewall |
| | | |
+------------------------------+--------------+ |
| | |
v v v
[Internet] ======================> [i2unifi]
[Your admin PC / UniFi app] ======================================> [same controller URL]
What each device sends to the cloud
| Device | Typical cloud traffic | Stays local |
|---|---|---|
| Access Point | Inform, config download, telemetry | All client WiFi data |
| Switch | Management, stats | Switched Ethernet frames |
| Gateway | Management, optional telemetry | NAT, DHCP, firewall, routing |
What must work at your site
For adoption and steady operation:
- Outbound internet from devices (APs/switches/gateway can reach the internet).
- DNS resolves your controller hostname (from the i2unifi Servers page).
- No outbound blocking of HTTPS to your controller URL (firewall “deny all outbound” breaks management).
- Correct inform path for Layer 3 adoption — see Adopting UniFi Devices.
Firewall guidance (outbound)
Allow from UniFi devices / LAN → internet:
- DNS (UDP/TCP 53)
- HTTPS (TCP 443) to your controller and general updates
- STUN/NAT helper (often UDP 3478) — helps devices reach the controller through NAT
You generally do not need inbound port forwards from the internet to APs for normal cloud management.
Admin access
- You open a browser (or UniFi mobile app) to the same hosted controller URL.
- That is separate from AP traffic — admins also use HTTPS to i2unifi.
Common misconceptions
| Myth | Reality |
|---|---|
| “WiFi goes through i2unifi” | Only management does; user data uses your gateway |
| “APs need inbound ports from the internet” | Usually outbound from site is enough |
| “Controller down = no internet” | LAN/internet may still work; you cannot change config until controller is reachable |
Troubleshooting checklist
- [ ] Device shows offline in UniFi OS but clients still have internet → focus on management path, not ISP
- [ ] New device pending adoption → inform URL, DNS, outbound firewall
- [ ] Controller URL unreachable in browser → i2unifi server/platform (open a ticket)
- [ ] Double NAT on ISP modem → see Double NAT and ISP Modem Setup
Related resources
- Tools → Cloud Connectivity Map (PDF) — printable poster
- Small Office Network Topology — physical layout with VLANs
- What i2unifi Hosts vs What You Manage — support responsibilities
- Adopting UniFi Devices — Layer 2/3 adoption steps