UniFi Inter-VLAN Routing: Bypassing the Dream Machine Bottleneck

The Problem

When I added the USW Pro Max 16 PoE to the network, I expected to immediately see 2.5Gbps transfers between the PC and the NAS. Both devices support it. Both were plugged into 2.5G ports on the same switch.

Transfers were still capped at roughly 900Mbps.

The reason: without L3 inter-VLAN routing configured on the switch, all traffic between VLANs is sent to the default gateway — which in my case is the Dream Machine SE. The DM SE’s backplane is 1Gbps. Every byte going from the PC (Personal VLAN) to the NAS (Geek VLAN) was traversing the DM, getting bottlenecked, and coming back.

The hardware was capable. The routing topology was not.

The Solution

Configure inter-VLAN routing on the USW Pro Max 16 PoE itself. This makes the switch the dedicated L3 router for the VLANs that connect through it, so cross-VLAN traffic between devices on the same switch never has to leave it.

The DM SE remains the router for internet-bound traffic. The switch handles intra-switch VLAN routing.

Network Topology

Before the change, all inter-VLAN traffic went via the DM:

PC (Personal VLAN)
    │ 2.5Gbps
    ├──── USW Pro Max 16 PoE ──── USW Pro 24 ──── Dream Machine SE (1Gbps bottleneck)
    │                                                          │
NAS (Geek VLAN)                                     (L3 routing here)
    │ 2.5Gbps                                                  │
    └──── USW Pro Max 16 PoE ─────────────────────────────────┘

After the change:

PC (Personal VLAN)
    │ 2.5Gbps
    ├──── USW Pro Max 16 PoE ──── (L3 routing here)
    │                                     │
NAS (Geek VLAN)                           │
    │ 2.5Gbps                             │
    └──── USW Pro Max 16 PoE ─────────────┘
         │
         └──── USW Pro 24 ──── Dream Machine SE (internet only)

Traffic between PC and NAS now stays on the switch. The DM is only involved for internet-bound traffic.

Configuration

Requirements

USW Pro Max 16 PoE running firmware 6.x or later (L3 routing requires this)
Both VLANs already created in UniFi Network (with VLAN IDs, subnets, gateways)
Admin access to UniFi Network controller

Step 1 — Open the VLAN settings

In UniFi Network, navigate to:

Settings > Networks

You should see your existing VLANs listed — in my case, Personal Network and Geek Network.

Step 2 — Assign a dedicated router to each VLAN

Click on the first VLAN to open its settings panel on the right.

Look for the Content Filtering / Device Isolation section and find the Router field. Select the USW Pro Max 16 PoE as the router for this VLAN.

The rationale: choose the switch that both high-traffic devices are physically connected to. This minimises hops — traffic between the PC and NAS routes within the switch’s silicon rather than traversing any uplinks.

Repeat for the second VLAN.

After saving, devices will briefly lose connectivity while the routes establish. Allow around 5 minutes before testing.

Step 3 — Verify the route was created

In UniFi Network, go to:

Settings > Routing & Firewall > Static Routes

You should see a new Inter-VLAN Routing entry with VLAN ID 4040. This is the dedicated routing interface UniFi creates between the two VLANs on the switch.

Result

PC-to-NAS transfers should now run at the full 2.5Gbps the hardware supports, bypassing the DM entirely for intra-network traffic.

Firmware Note

If inter-VLAN routing is configured but traffic is still hairpinning through the Dream Machine, check your switch firmware version. L3 routing on the USW Pro Max 16 PoE requires firmware 6.x or later. Earlier firmware supports the configuration UI but does not actually perform L3 routing in hardware.

UniFi Devices > USW Pro Max 16 PoE > Overview > Firmware Version

If it is on 5.x, update it.

Caveat: This Breaks Port Forwarding and Gaming NAT

Inter-VLAN routing on the switch improves NAS throughput — but it has a side effect: asymmetric routing can break port forwarding and make gaming NAT go from Open to Moderate or Strict.

The short explanation: when the switch routes traffic between VLANs, the return path for some connections may go through the switch rather than the DM, and the DM’s NAT state tables get confused because they only saw the outbound flow.

If you run game servers, need port forwarding to work reliably, or rely on Open NAT for online gaming, see the follow-up article: Fixing NAT After Inter-VLAN Routing with OS-Level VLAN Tagging.

Related: