Blog

Create Port Forwarding rules within UniFi Network in the Settings > Firewall & Security section. Refer to the troubleshooting steps below if your Port Forwarding or custom Destination NAT rule is not working.

Your UniFi Gateway does not have a public IP address (Double NAT).
This happens if your UniFi Gateway is located behind another router/modem that uses NAT. You are likely affected by this if your UniFi Gateway has a WAN IP address in one of the following ranges:

• 10.0.0.0/8 (10.0.0.0 – 10.255.255.255)
• 172.16.0.0/12 (172.16.0.0 – 172.31.255.255)
• 192.168.0.0/16 (192.168.0.0 – 192.168.255.255)
• 100.64.0.0/10 (100.64.0.0 – 100.127.255.255)

To fix this issue, try to re-configure your ISP modem/router into bridge mode so that your UniFi Gateway can obtain a public IP address on the WAN interface.

If that is not supported, you will need to first forward the port(s) on the upstream router/modem to the WAN address of your UniFi Gateway in addition to forwarding them from your UniFi Gateway to the desired location. You may wish to contact your ISP to assist with port forwarding or providing a DMZ option that allows you to automatically forward the ports.

Your UniFi Gateway is already forwarding the port to another device or has UPnP enabled.
A given WAN port can only be forwarded to a single device within your network. For example, TCP port 443 can only be forwarded to one LAN port.

Note: It is possible to forward multiple WAN ports to the same LAN port.

Another possible cause is that UPnP is enabled and is already using the port. Try disabling UPnP in your UniFi Network Application’s Internet Settings.

Incoming traffic is not reaching the WAN interface of your UniFi Gateway.
In this case, the traffic is most likely blocked somewhere upstream, such as at the ISP modem/router, or a third party firewall. We recommend disabling any upstream firewalls for testing, and then contacting your ISP for more details.

The LAN host is blocking the port with a local firewall, or does not have the correct route configured.
In this case, the host/server on the LAN is not allowing outside connections to access the port. On Windows computers, this may be a result of the Windows Firewall rules. On Linux machines, this could be a result of the connection not being allowed in the iptables firewall. We recommend consulting with the particular client’s manufacturer for more information.

There is an incorrect route configured on the LAN host.
It is possible that the LAN host does not know how to reach the IP address of the Internet client. This can result if the default gateway is not configured correctly. You should verify your routing settings on the local host to resolve this situation.

Source :
https://help.ui.com/hc/en-us/articles/235723207-UniFi-Network-Configuring-Port-Forwarding

Site-to-site VPNs are primarily used by businesses looking to connect numerous remote locations. If you are a home user, we strongly recommend Teleport VPN—our fast, secure, one-click remote access solution that requires no configuration. 

To learn more about Teleport and other UniFi VPN options, check out our Introduction to UniFi VPNs.

Setup

UniFi gateways support two site-to-site VPN protocols: IPsec and OpenVPN. Depending on the one you select, you will need to ensure that the following settings are the same for all gateways used to create site-to-site connections:

We recommend using UniFi gateways at all of your sites to maximize connection compatibility and performance. Additionally, some third-party gateways allow you to configure settings that are unavailable in the UniFi Network application. Troubleshooting these types of settings lies outside of Ubiquiti Support’s scope, but you can check out our Considerations for Third-Party Equipment: Site-to-Site VPNs for more information.

IPsec

• Pre-Shared Key: This is used to authenticate VPN connections. 
• UniFi Gateway IP: This is your UniFi gateway’s public IP address.
• Shared Remote Subnets: This is the list of networks shared by the remote gateway. Please note that UniFi gateways share all local networks. You must ensure that there are no overlaps within your sites’ local subnets.
• Remote IP: This is the remote gateway’s WAN IP address.

Additional Notes:

• There are also Advanced settings that should match across all gateways. We recommend using the default settings unless you are proficient with VPN security.
• Your UniFi gateway will automatically create the static routes required to direct traffic through the VPN. Do not try to create new ones for this purpose.

OpenVPN

The OpenVPN Site-to-site VPN uses a 512-character pre-shared key for authentication. The key should be the same for both gateways and shouldn’t contain line breaks. You can either create this key yourself or generate it on your UniFi gateway. To do this:

1. SSH into your UniFi gateway.
2. Generate your key by using the following command: openvpn –genkey secret /tmp/ovpn
3. You can now view/copy the key by running the command: cat /tmp/ovpn
   Note: Be sure to remove any line breaks when copying the key.

Note: USGs must use generate vpn openvpn-key /tmp/ovpn to generate the key, then sudo cat /tmp/ovpn to view/copy the key.

Additionally, the following information is required:

• Local Tunnel IP Address: This is the IP used for your local “tunnel”. Traffic sent to the remote gateway will be routed through this IP address. This address should be available on the local and remote site. We recommend selecting a private IP from a subnet that is unused on both gateways.
• Local Port: By default, UDP Port 1194 is used for OvenVPN. This port must not be used by other services or other OpenVPN connections. If you’re using multiple OpenVPN tunnels, each one must be assigned to its own port. The local and remote ports do not need to be the same. 
• Shared Remote Subnets: This is the list of networks shared by the remote gateway. Please note that UniFi gateways share all local networks. You must ensure that there are no overlaps within your sites’ local subnets.
• Remote IP Address: This is the remote gateway’s WAN IP address.
• Remote Tunnel IP Address: This is the IP address of the remote gateway’s tunnel. Do not enter the gateway’s WAN IP.
• Remote Port: This is the remote gateway’s OpenVPN port. The local and remote ports do not need to be the same.

Note: Your UniFI gateway will automatically create the static routes required to direct traffic through the VPN. Do not try to create new ones for this purpose.

Troubleshooting

If you’re unable to establish a VPN tunnel between your sites, or your connection drops periodically, you likely have at least one site with an incorrect VPN or network configuration. Please refer to the common mistakes below.

Your UniFi Gateway Does Not Have a Public IP address (Double NAT)

This typically occurs if your UniFi Gateway is located behind another router/modem that uses Network Address Translation (NAT). You are likely affected if your UniFi Gateway has a WAN IP address in one of the following ranges:

• 10.0.0.0/8 (10.0.0.0 – 10.255.255.255)
• 172.16.0.0/12 (172.16.0.0 – 172.31.255.255)
• 192.168.0.0/16 (192.168.0.0 – 192.168.255.255)
• 100.64.0.0/10 (100.64.0.0 – 100.127.255.255)

To resolve this, set your upstream router to Bridge Mode. If this is not possible, try forwarding the necessary ports from the upstream router/modem to your UniFi gateway. IPsec uses UDP Port 500 and 4500. By default, OpenVPN uses UDP Port 1194, but this can be changed. Please note that this will not work if your upstream router doesn’t have a public IP address. 

If this doesn’t work, we recommend contacting your ISP. Please note that IP addresses in the 100.64.0.0/10 subnet range always require ISP assistance in order to establish a VPN connection.

Required Ports are Blocked by an Upstream Device or Forwarded by Your UniFi Gateway to Another Device on Your Local Network

Make sure that no third-party routers, firewalls, or ISP modems are blocking the required ports from reaching any of the gateways supporting your site-to-site VPN. IPsec uses UDP Port 500 and 4500. By default, OpenVPN uses UDP Port 1194, but this can be changed. Please note that if you reconfigure a port for one gateway, you must also reconfigure the same port for all other site-to-site VPN gateways.

Once you confirm that your traffic is not being blocked, please ensure that your UniFi gateway is not forwarding these ports to another device on your local network. You can remove existing port forwarding rules in the Firewall & Security section of your UniFi Network application.

Authentication Failures Due to Mismatched Gateway Configurations

Every gateway supporting your site-to-site VPN must have the same configuration, including Advanced settings. Failure to do so will prevent you from establishing a VPN connection or sustaining one for a long period of time.

We recommend using UniFi gateways at all of your sites to maximize connection compatibility and performance. This is because some third-party gateways allow you to configure settings that are not available in the UniFi Network application, but rather automatically set in the background. A mismatch in these configurations can still result in a connection failure. Troubleshooting these types of settings lies outside of Ubiquiti Support’s scope, but you can check out our Considerations for Third-Party Equipment: Site-to-Site VPNs for more information.

Also, please note that UniFi gateways are configured to share all local networks. Ensure these are configured in the paired gateway’s Shared Remote Subnets list.

Your Client Is Routing Over the VPN, but Its Traffic is Prohibited

In this scenario, the client can connect to the VPN but cannot communicate with any other devices on the local network.

To resolve this, please ensure that there are no traffic or firewall rules preventing VPN clients from communicating with your local network. Alternatively, individual clients on the local network could be dropping incoming traffic at their local firewalls. The Windows firewall, for example, drops all ICMPv4 (ping) traffic by default. 

If you are testing with ping, then you will need to allow the traffic through the Windows firewall. For more details, please refer to Microsoft’s support page.

Your Sites Have Overlapping IP Ranges

Overlapping IPs can prevent a VPN from establishing. Even if the VPN tunnel is established, it may prevent proper communication across the VPN. This is because a client will always prioritize IP addresses on a local network connection rather than those on the opposite end of a VPN. The only way to prevent overlapping is to review each gateway’s local networks and, if necessary, adjust their IP address ranges. For example, if one gateway has a local network configured to 192.168.0.0/24, its IP addresses range from 192.168.0.1 – 192.168.0.255. Your remote gateway should not use any addresses within that range.

Overlapping IPs ranges may prevent proper communication across your VPN, or it can prevent the connection from establishing altogether. Assuming the VPN establishes,

Your Client Has Split Tunneling

This will prevent clients from communicating with certain VPN-connected devices despite being connected to the network itself. To resolve this, we recommend routing all traffic through your VPN:

• For Windows clients, enable Use default gateway on remote network in the Advanced TCP/IP Settings.
• For Mac clients, enable Send all traffic over VPN connection in your VPN network preferences.

For more OS-specific guidance, please contact your device’s manufacturer.

Source :
https://help.ui.com/hc/en-us/articles/360002426234-UniFi-Network-Configuring-Site-to-Site-VPNs

The main factors that contribute to wired speeds are:

• Physical (Layer 1) connections between your networking devices
• Available device resources (e.g., CPU and Memory)
• Protocol limitations
• Software or configuration limitations

Follow these guidelines, and those in Optimizing Wireless Network Speeds, to maximize your total network throughput.

Recommendations 

Check Your Cabling

Make sure your cables are undamaged and securely connected to their respective ports. If your speeds are slower than you expect, swap out your cables for new ones. We recommend using SFP/SFP+ modules or DAC cables, when possible, to maximize speeds. Otherwise, use CAT6 RJ45 cables. 

Check out our Beginner’s Guide to Network Cabling for more information. 

Ensure That All Ports Negotiate Proper Speeds

All UniFi devices automatically negotiate their speeds. Some clients, however, may be incapable of doing so. For these devices, we recommend manually setting their link speed in the Port Management section,  found in the UniFi Devices tab of the Network Application. 

Please be sure to check each client’s specifications. Not all clients have a Network Interface Card (NIC) capable of negotiating at faster rates, such as 1 Gbps.

Note: Clients with speed negotiation issues often result in dropped connectivity. This is a telltale sign to look for if you suspect a client-specific issue.

Disable Resource-intensive Software Features

Resource-intensive features such as Threat Management and Smart Queues may reduce throughput by up to 30%. Please consider this when prioritizing network speed, performance, and security.

Note: Smart Queues are only recommended if you have expected Internet speeds of 250 Mbps or less and you consistently have more internet traffic than your bandwidth can support.

Other features that may impact throughput include: 

• Device and Traffic Identification (Deep Packet Inspection)
• Firewall Rules
• Content Filters
• VPNs 

To approximate your deployment’s resource usage, try our UniFi OS Console Resource Calculator. 

Note: These features will only affect traffic routed through your gateway or to the internet. It should not affect LAN traffic between devices on the same network.

Minimize Network Congestion

A high number of concurrent clients routing traffic through a local network device, like a single switch, may reduce throughput. To resolve this, we recommend separating network traffic or adopting an additional Layer 3 switch.

Be Aware of Protocol and Client Limitations

Certain protocols offer  lower performance. For example, L2TP VPNs are relatively slower compared to Wireguard or Teleport. Another example of a traditionally slow protocol is SMB file transfers.

Similarly, some clients may be limited by the resource intensity of the applications they run, independently of your network.

Use DHCP or Static WAN (Internet) Connection When Possible

PPPoE is a very CPU-intensive protocol that may reduce throughput compared to DHCP or Static IP configurations.

Remove Traffic Rules and Bandwidth Profiles That Limit Client Traffic

We always recommend taking a moment to verify that there are no active Traffic Rules or Bandwidth Profiles reducing client throughput.

Expedite Your Support Request

Please include answers to the following in your request to expedite your support experience:

• What are your expected speeds?
• How are you hosting your UniFi Network Application (i.e., UniFi OS Console vs. self-hosted)?
• What version of UniFi Network are you running? What firmware versions are your network devices running (e.g., switches, APs, gateway, etc.)? Please refer to our Software Releases directory to verify everything is up-to-date.
• If you are using a UniFi OS Console, what version of UniFi OS are you running? Please refer to our Software Releases directory to verify if you are running the most up-to-date UniFi OS.
• How widespread is your throughput issue? Does it affect wired clients, wireless ones, both, or just certain devices?
• When did this issue start?
  
  Source :
  https://help.ui.com/hc/en-us/articles/6949005136919-UniFi-Network-Optimizing-Wired-Network-Speeds

There are a few simple principles that can help achieve optimal wireless client connectivity:

1. Ensure all firmware and software is up to date. You can refer to UniFi Updates for more information on automatic update management. Please refer to community.ui.com/releases for our latest release notes. 
2. Use a full stack of Ubiquiti equipment, including a gateway (including DHCP server), APs, and switches for maximum compatibility.
3. Use the default settings when creating a new WiFi SSID. These settings have been selected to achieve maximum compatibility, as supported by continuous quality testing. 
4. Maintain sufficient signal strength on all of your client devices. We recommend at least -65dBm. You may need to increase AP TX Power, move client devices closer to an AP, or install more APs to increase your coverage area.

If you are experiencing client disconnections, please note that connectivity can be affected by your settings, client specifications, and any interference related to utilization or RF environment congestion.

Consider the suggestions below:

Disable Protected Management Frames (PMF) for Improved Compatibility
We recommend disabling PMF to maximize compatibility. Many devices, especially legacy ones, are incompatible with PMF and experience resulting connectivity issues.. 

Use a Basic WPA2 Security Mode
WPA3 requires PMF which, as mentioned, may create client  connectivity issues.

Furthermore, we recommend testing with a non-enterprise security mode. Enterprise modes use RADIUS servers to authenticate clients. This adds an additional layer of complexity in order to verify clear communication between clients and their server, as well as whether or not the server is properly configured. 

Reduce the Minimum Data Rate to Improve Legacy Device Compatibility
 The default minimum data rate for the 2.4 GHz channel is set at 1 Mbps to maximize compatibility. This is because some clients, particularly legacy devices (802.11b), require a low data rate in order to connect. If you have changed this value and noticed issues specific to legacy clients, we recommend setting it back to 1 Mbps.

Properly Configure the DTIM Period
The DTIM Period is a WiFi SSID setting that tells clients when to “wake”. Having a period that is too high may result in the device disconnections. We recommend:

• 2.4GHz = 1
• 5GHz = 3

Select Non-Overlapping and Low-Interference Channels
We recommend enabling Nightly Channel Optimization to ensure you are on the least-crowded, non-overlapping channels. Your network will continue to work during nightly scans.

Wireless clients use a shared airspace for communication. This is true for all devices in a given area, even if they are not connected to your network (e.g., your neighbor has a lot of IoT devices). This is why having high-density deployments may contribute to speed or connectivity issues. 

If you prefer to manually assign channels, here are a couple of rules to keep in mind:

1. If you must use 2.4 GHz, you should only ever use Channel 1, 6, or 11. These will optimize connectivity since they are the only non-overlapping channels.
2. Nearby APs should use different channels. If you have three APs, you can set one each to Channel 1, 6, and 11 on the 2.4 GHz band. This concept applies to 5 GHz as well.
3. You can perform an RF Scan in the UniFi Network Application to identify channels with the lowest interference. Unlike Nightly Channel Optimization, this scan  may interrupt client connectivity while in progress..

Decrease Channel Width
UniFi Network supports the following channel widths:

• 2.4 GHz: 20 MHz (Default) / 40 MHz
• 5 GHz: 20 MHz / 40 MHz (Default) / 80 MHz / 160 MHz

Although larger channel widths enable faster speeds, they result in more interference and decreased range. If you have a high-density deployment or high utilization, we recommend reducing your channel widths. 

Use Band Steering to Move Compatible Clients to 5 GHz
The 2.4 GHz band is generally much more congested than 5 GHz. This congestion can result in dropped packets and device disconnections. We recommend enabling Band Steering in your WiFi SSID settings to prioritize the movement of all compatibility clients to the 5 GHz band.

Increase Your Minimum Data Rate to Reduce Network Congestion
As mentioned, some clients require you to reduce the Minimum Data Rate to maximize their compatibility. However, there are instances where increasing it may be more beneficial for high-density deployments in a congested RF environment. 

Increasing this rate will ensure more efficient airtime utilization, which may resolve client connectivity and packet dropping issues. Please exercise caution when modifying this rate as it can also negatively impact client connectivity if incorrectly tuned.

Enable Multicast and Broadcast Control to Reduce Network Congestion
Multicast and broadcast traffic drastically increase utilization, which may create more interference in crowded environments. Multicast and Broadcast Control is a WiFi SSID setting that will block all multicast and broadcast traffic, thus drastically reducing congestion. 

You should add exceptions for any devices that require multicast or broadcast traffic. For example, failing to add exceptions for your gateway and/or DHCP server will prevent clients from obtaining IP addresses, and thus being unable to connect to your network.

Note: This will also inhibit Chromecast or AirPlay usage. For more details, please refer to Best Practices for Chromecast and AirPlay.

Reduce TX Power to Reduce Network Congestion
We recommend keeping TX Power set to High or Auto to maximize signal strength for clients. However, if you can reduce the signal strength and still maintain full coverage, this may reduce interference. 

Please use our Design Center or the Signal Mapper in the WiFiman mobile app (iOS / Android) to assess your deployment’s WiFi coverage needs.

Minimize Meshed Network Usage
When possible, you should hardwire your APs instead of meshing them. For more details, please see Considerations for Optimal Wireless Mesh Networks.

Avoid DFS Channels

Dynamic Frequency Selection (DFS) consists of 5 GHz channels that are normally reserved for things like radar, military, weather, or satellite communication. Although these channels offer increased availability and less interference, wireless clients will disconnect if radar events are detected. This is a compliance requirement that varies by country, often ranging from 1 minute to 10 minutes. These channels are only recommended in areas that do not encounter these external radar events. 

Disable Minimum RSSI
Minimum RSSI sets a signal strength threshold. All devices that fall below it are automatically  disconnected from your network. The purpose of this setting is to facilitate roaming within deployments with tightly-packed APs. If it is set incorrectly, though, you may experience client instability. 

Expedite Your Support Request

Prior to reaching out to support, we recommend gathering/verifying the following information. Including these details in your request will expedite your support experience.

• Is the issue affecting all of your clients, or just specific ones? What is the make and model of the affected device(s)?
• Is the issue affecting all of your APs, or just specific ones? What is the model and firmware version of the AP(s)? You can refer to community.ui.com/releases for the latest available versions.
• Is your issue related to establishing connectivity or keeping it?
• What is the maximum number of concurrent wireless clients connected at a given time?
• Does rebooting your AP improve connectivity?
• Did this issue start after an AP firmware or UniFi Network update?
• Does this issue occur frequently, randomly, during specific times, in certain locations, or at particular proximities from your AP?

In addition to the information above, it is beneficial to share the appropriate support logs after the issue occurs. To obtain these:

1. Enable Syslog and Syslog & Netconsole in the System settings of your Network Application.

2. Once the issue occurs, download the appropriate support file. Users with a UniFi OS Console should obtain the logs from the UniFi OS settings (*.tgz extension), whereas users who downloaded a self-hosted copy of the Network Application can obtain their support file from the Network Application settings (*.supp extension). More details can be found here.

3. You should provide the MAC Address(es) of the client(s) experiencing the issue, along with the timestamp of when this issue occurred. This will help us identify the relevant information from the files you provide.

Source :
https://help.ui.com/hc/en-us/articles/221029967-UniFi-Network-Optimizing-Wireless-Client-Connectivity

Check out our UniFi Expert’s Corner video for a quick overview of wireless speeds. Follow these guidelines, and those in Optimizing Wired Network Speeds, to maximize your total network throughput.

Introduction

Wireless throughput is affected by more than just how you configure your network and UniFi Access Points (APs). This article will explore the most common causes of slow speeds and provide suggestions for improving them.

Before you continue, please note that maximized speeds are not the ultimate benchmark of a high-performance network. For context, streaming Ultra HD content on Netflix only requires 25 Mbps of bandwidth. Achieving the highest rate possible isn’t required to ensure quality connectivity. As such, your most pressing concern should be achieving stable speed and bandwidth rates that reliably support all connected devices.

Setting Realistic Expectations

Unlike wired connections that support full-duplex communication, wireless communication is half-duplex. This means that a 1 Gbps wireless connection can only support a simultaneous upload/download speed of 500 Mbps.

Furthermore, wireless protocol overheads typically result in 25-40% speed reduction compared to the theoretical maximum. This applies to all vendors and wireless access points.

In general, it is safe to assume that you are in good shape if you are achieving ~50% of your theoretical maximum speeds.

Recommendations 

Increase Your Channel Width

Larger channel widths allow for faster speeds. Doubling your channel width will nearly double your wireless speed. Increase widths cautiously, though, as this will decrease your WiFi range and could increase channel interference. High-density or crowded RF environments with a large channel width can decrease network performance and cause more device disconnections.

UniFi Network supports the following channel widths:

• 2.4 GHz: 20 MHz (Default) / 40 MHz
• 5 GHz: 20 MHz / 40 MHz (Default) / 80 MHz / 160 MHz

Larger channel widths result in more interference. If you have a high-density deployment or  high utilization, we recommend reducing your channel widths.

Use Band Steering to Move Compatible Clients to 5 GHz

UniFi APs currently only support the 2.4 and 5 GHz bands. Soon, we will launch  the U6-Enterprise which will support the upcoming 6 GHz standard and deliver the fastest possible WiFi speeds. Here’s a simple breakdown of the two currently supported bands:

• 2.4 GHz: Delivers slower speeds and more interference, but broadcasts further due to better signal penetration through solid surfaces. 
• 5 GHz: Delivers faster speeds and offers less-crowded channels. However, some legacy clients are incompatible with the band.

Enable Band Steering to automatically move compatible clients to the 5 GHz band.

Improve Client Signal Strength

To maximize your speeds, we recommend maintaining signal strengths between -50dbm and -60dbm. Numbers closer to zero indicate higher signal strength and throughput.

You can improve your signal strength by: 

• Moving clients closer to your AP.
• Adding more APs to your network.
• Setting your TX power to Auto or High.

Note: Increasing the transmit power of your devices can negatively impact their performance, especially in a very high density environment. 

Select Non-Overlapping and Low-Interference Channels

We recommend enabling Nightly Channel Optimization to ensure you are on the least-crowded, non-overlapping channels. Your network will continue to work during nightly scans.

Wireless clients use a shared airspace for communication. This is true for all devices in a given area, even if they are not connected to your network (e.g., your neighbor has a lot of IoT devices). This is why having high-density deployments may contribute to speed or connectivity issues. 

If you prefer to manually assign channels, here are a couple of rules to keep in mind:

1. If you must use 2.4 GHz, you should only ever use Channel 1, 6, or 11. These will optimize connectivity since they are the only non-overlapping channels.
2. Nearby APs should use different channels. If you have three APs, you can set one each to Channel 1, 6, and 11 on the 2.4 GHz band. This concept applies to 5 GHz as well.
3. You can perform an RF Scan in the UniFi Network Application to identify channels with the lowest interference. Unlike Nightly Channel Optimization, this scan  may interrupt client connectivity while in progress.

Use APs That Support the Latest WiFi Standards and Technology

Each AP has its own specifications (such as WiFi standard or supported MIMO streams) that affect its maximum speeds. For optimal performance, we recommend our WiFi 6 access points. 

For more details about U6 APs, please visit the UI Store, or review their respective datasheets.

Ensure That Your Clients Support the Latest WiFi Technology

Client specifications are just as important as your AP’s. A legacy client connected to the 2.4 GHz band using the WiFi 1 (802.11b) standard with 1×1 MIMO support will never be able to experience the benefits of your U6 Pro (e.g., 5 GHz WiFi 6 connectivity, 4×4 MU-MIMO and OFDMA functionality, etc.).

Remove Upstream Bottlenecks from Your Network

It is important to identify any bottlenecks throttling your speeds. For example, a wireless client will never achieve a 25 Mbps Netflix stream if it is limited by a 10 Mbps Internet connection or switch port / Ethernet connection upstream.

Minimize Meshed Network Usage

It is always preferable to hardwire APs to your network. Wirelessly meshing APs typically results in a ~50% throughput reduction per hop. If you prefer a meshed network, we recommend no more than two hops between a downstream AP and its first hardwired uplink.

Expedite Your Support Request

Prior to reaching out to support, we recommend gathering/verifying the following information. Including these details in your request will expedite your support experience.

• What are your expected speeds?
• How widespread is your throughput issue? Does it affect wired clients, wireless ones, both, or just certain devices?
• What is your channel width? You can find this in your Global AP Settings, or by opening the device details panel of a specific AP.

Also, please include the following information, which can be found by selecting the affected device(s) on the Client Device page in your Network application.

• Make and model
• Band utilization (2.4 or 5GHz)
• MIMO support (e.g., 1×1, 2×2)
• WiFi standard (e.g., WiFi 5, WiFi 6)
• Signal strength while experiencing reduced throughput
  
  Source :
  https://help.ui.com/hc/en-us/articles/360012947634-UniFi-Network-Optimizing-Wireless-Network-Speeds