the bill · deep dive
The Network
Fiber to the closet, then wired to every corner — including the deck. The gateway and switch are picked to cash whatever speed AT&T ends up selling, not just what it sells today.
On this page
The Rundown
≈$1,210 all-in · $945 AT&T-gated · updated jul 19 2026
- ◆ decided The pick chain: UCG Fiber ($279) + Flex 2.5G 8 PoE ($278 honest) — ≈$945 AT&T-gated, ~2× the routing headroom of the old plan, plus a 10G spine, all-port PoE, and an NVR bay the old plan never had.
- ◆ decided Retired: the UCG Ultra ($129) — its only 2.5G port is the WAN, live-confirmed from Ubiquiti's own spec JSON; all four LAN ports are stock 1GbE. Wrong brain for a fiber house.
- ◆ decided The adapter gotcha: the Flex 2.5G 8 PoE's power adapter is NOT in the box — $199 sticker, $278 real price. Said loudly so it doesn't happen at checkout.
- ◆ decided Fiber tiers, live-checked: 300M/500M/1G/5G, no distinct 2-Gig tier; start at 1-Gig ($50/mo promo) — nothing in this chain needs replacing at any tier AT&T sells.
- ◆ decided Drops land in the attic window, now: four home runs plus a smurf-tube spare — this doesn't wait on the AT&T date the way the gateway and APs do.
- ◆ decided The closet: hall closet top shelf holds the ONT, gateway, switch, and UPS — vented to the hallway, never the attic.
The Shape
fiber to closet to every corner
One path, drawn once: fiber lands at the ONT, the ONT hands its public IP to the router, the router hands 2.5GbE down to a PoE switch, and the switch feeds everything with a radio or a wire — the hall AP, the deck AP, the Zigbee coordinator, kara, and a spare port for whatever's next.
The Scrutiny
the bang-for-buck section
The UniFi gateway on the old plan — the Cloud Gateway Ultra, $129 — is retired. Its only 2.5G port is the WAN; live-confirmed against Ubiquiti's own spec JSON, all four LAN ports are stock 1GbE, and the IPS routing ceiling tops out at 1Gbps. Every AP backhaul on that gateway caps at 1G forever. It's the wrong brain for a fiber house.
5Gbps IDS/IPS routing on its own A73 cores, a 10G SFP+ WAN port, a 10G SFP+ LAN port, a 10GbE RJ45 WAN port, four 2.5GbE switch ports (one PoE+, 30W budget), and an NVMe bay — the future-cameras answer that never taxes kara.
Eight 2.5GbE ports, all PoE, 196W of budget, a 10G SFP+/RJ45 uplink to the gateway's own SFP+ LAN port. The power adapter is NOT in the box — skipping that line is how this switch quietly becomes $79 more expensive at the register.
UCG Fiber solo plus two PoE+ injectors: same routing brain, one AP riding the gateway's own PoE+ port, the switch deferred until cameras actually show up. The tradeoff is real — injector wall-warts instead of port-level control — but it's an honest way to spend less now.
| Tier | Chain | Total | Where it bottlenecks |
|---|---|---|---|
| Field | Ultra + Flex | $407 | 1G LAN backhaul — wastes both APs. |
| Field | Max + Flex | $557 | 2.3G routing, 2.5G everywhere, no 10G path. |
| Pick | Fiber + Flex | $557 | Only at the APs' own 2.5G uplinks — the one ceiling no gateway removes. Same money as the Max chain, ~2× the routing headroom, a 10G spine, a spare PoE+ port, the NVR bay. |
| Field | Fiber solo (budget) | $279–324 | No switch yet — injector wall-warts, no port-level control. |
Fiber tiers, live-checked July 2026: AT&T's national lineup is 300M/500M/1G/5G — a distinct 2-Gig tier did not appear; confirm at the address. The 1-Gig promo runs $50/mo with $30/mo of bundle-and-autopay discounts folded in. The 5-Gig tier's single-device ceiling is 4.7Gbps, by AT&T's own fine print — no single device on this network will ever see the number on the box. Strategy: start at 1-Gig. Nothing in this chain needs replacing at any tier AT&T sells — the 10G WAN covers even 5-Gig with room left over.
The universal ceiling, stated honestly: any single access point maxes out at its own 2.5G uplink, full stop. The 10G spine isn't for one device — it's for the aggregate, and for anything that's actually wired.
The Gear
piece by piece
What: AT&T's ONT and gateway in one box, pushed into IP Passthrough — there's no true bridge mode, so passthrough is the closest thing to invisible this box gets. Serves: hands the public IP straight to the UCG Fiber; nothing else touches it. Lives: closet top shelf, radios off. Gotchas: firmware pushes have a habit of re-enabling WiFi and resetting passthrough — recheck after every update. Worse, and easy to miss: a second toggle buried in Home Network → Public Subnet → Allow Inbound Traffic has to be ON, or inbound traffic stays firewalled even with passthrough enabled. The -500 and -505 hardware revisions both work the same; the blue 5G port is the one that feeds the gateway.
What: the routing brain — 5Gbps IDS/IPS on its own A73 cores, a 10G SFP+ WAN port, a 10G SFP+ LAN port, a 10GbE RJ45 WAN port, four 2.5GbE switch ports (one PoE+, 30W budget), and an NVMe bay that answers the future-cameras question before it's asked (Protect NVR, no tax on kara). Serves: everything downstream — the switch, the APs, eventually a camera or two. Lives: closet top shelf, next to the BGW320. store.ui.com/us/en/products/ucg-fiber
What: eight 2.5GbE ports, all PoE, 196W of budget, a 10G SFP+/RJ45 uplink back to the gateway's SFP+ LAN port. The catch, loudly: the PoE power adapter isn't in the box — it's a separate $79 line. Serves: the U7 Pro (21W, confirmed 2.5G uplink), the U7 Outdoor (19W, confirmed 2.5G), the SLZB-06M (802.3af, ~2W), and two future cameras with room to spare. Lives: closet top shelf, below the gateway. store.ui.com/us/en/products/usw-flex-2-5g-8-poe
What: the indoor access point, 2.5G PoE+ uplink. Serves: the house proper — every room that isn't the deck. Lives: hall ceiling, center-of-house — textbook AP placement. store.ui.com/us/en/products/u7-pro
What: the outdoor access point. Serves: the deck, the recteq, the yard — the actual dead-zone fix, not a Deco slid closer to the door. Lives: under the eave, facing the deck. store.ui.com/us/en/products/u7-outdoor
What: the PoE Zigbee coordinator — not WiFi, but a drop client all the same, riding the same home run as the hall AP. Serves: the whole Zigbee mesh, network-attached so no USB passthrough ties it to one box. Lives: hall ceiling, beside the U7 Pro. smlight.tech/product/slzb-06m
What: the closet UPS. Serves: the ONT, the gateway, and the switch — a combined load around 25–40W. Lives: closet top shelf. Honest note: runtime at that load is hours-class, but APC only publishes an interactive runtime chart for this model, not a table — verify the number before trusting it. Stepped-sine output is fine for this load; kara's pure-sine CyberPower is a separate unit for a reason. apc.com/.../BE600M1
The Closet
center-of-house, tucked away, vented right
The hall closet's top shelf is the termination point — ONT/BGW320 (radios off), the UCG Fiber, the Flex 2.5G PoE switch, and the UPS, all wired, nothing radiating. The radios live outside: the U7 Pro on the hallway ceiling just past the door — center-of-house is textbook AP placement — with the SLZB-06M beside it, both fed through the attic on their own home runs.
- Heat, honestly: the whole stack idles at 60–100W — one lightbulb — so it vents, it doesn't cool.
- Vent to the hallway, never the attic: a closet vent into the attic is a hole in the new air-seal plane. A louvered door or a low-intake + high-exhaust grille pair does the job passively.
- AIRPLATE only if it's earned: if the closet still runs 10°F over the hall after the passive venting, a temp-controlled whisper fan (AC Infinity AIRPLATE-class, ~$50) through the high grille ends it — not before.
- A $15 Zigbee temp sensor inside makes closet heat a dashboard fact instead of a guess — the UPS battery is the one resident that actually cares about the number.
- While the attic's open: fire-caulk the cable penetrations through the top plate, and drop a smurf tube for the next pull — cheap insurance against opening the wall again.
The Drops
the attic-window wiring plan
Four home runs from the closet, while the attic's already open for the insulation work: (1) the hall-ceiling AP, (2) the SLZB-06M beside it, (3) the eave for the U7 Outdoor, (4) a hardline to kara — plus a smurf-tube spare for whatever gets added next.
| Materials | Why | Price |
|---|---|---|
| 500ft solid-copper CMR Cat6 | Never CCA — copper-clad aluminum runs at ~60% the conductivity, heats under PoE load, and fails at punch-downs. That's a code reason and a PoE reason, not a preference. | $85–140 |
| Keystones, plates, boxes, pass-through crimps, punch tool | Everything else the run needs, both ends | ≈$165–250 |
Terminate keystones on both ends, label every run, test continuity before the blow-in buries it — a mislabeled or dead run is invisible again the moment the insulation goes back in.
The Networks
SSIDs, VLANs, and who can see whom
- Main — the people network. Phones, laptops, the stuff that should just work.
- IoT — client-isolated, both 2.4 and 5GHz, for the 30-plus gadgets that don't need to talk to each other: plugs, the printer, the recteq, the ecobee, and everything else on this bill with a radio in it.
- Guest — optional, isolated the same way, for anyone who just needs internet.
- DNS: AdGuard Home on kara, for all three networks — one filtering layer, not three.
- DHCP reservations: kara and the printer, so neither address wanders again (kara's already has, once).
- The firewall posture, in one line: IoT can't see main; only Home Assistant reaches into IoT to talk to the gadgets it manages.
The Cutover
zero-drama, on paper
Run AT&T and Xfinity in parallel — don't cancel anything until the new network's proven itself. Stand up the new SSIDs, test the IoT VLAN with a handful of devices before committing the other 25-plus, then batch-migrate the fleet — the slow part, one gadget at a time. Cancel Xfinity after 48–72 stable hours, not a minute sooner.
- After that: sell the Decos as a kit (~$60–120) or keep one wired as a spare — free hardware either way.
- The gotchas repeat here, as a checklist: recheck the BGW320 after every firmware push — it has a habit of re-enabling WiFi and resetting passthrough. Confirm the buried Home Network → Public Subnet → Allow Inbound Traffic toggle is still on, or inbound traffic goes dark again with no error to explain why. Size the IoT DHCP pool generously before the batch-migrate, not during it.
The Money
≈$1,210 all-in · ≈$945 of it AT&T-gated
| Item | Price |
|---|---|
| UCG Fiber (gateway) | $279 |
| Flex 2.5G 8 PoE (switch, w/ adapter) | $278 |
| U7 Pro | $189 |
| U7 Outdoor | $199 |
| Drops (Cat6 + keystones + tools) | ~$200 |
| Closet vent kit (grilles or louvered door) | ~$50 |
| Closet temp sensor | $15 |
| Total | ≈$1,210 |
≈$945 of that is AT&T-gated hardware — the gateway, switch, and two APs wait on the install date. The drops and closet prep don't wait; they're doable in the attic window now. Honest delta vs. the old "$520" plan: the extra ~$430 buys the 10G spine, all-port PoE, and the NVMe/NVR bay — not scope creep, a different gateway entirely.