Starlink is often working perfectly well at the moment a UniFi or Omada gateway decides it is down. The gateway's health checks were built with fibre in mind, and Starlink's normal behaviour looks like a fault to them. The result is a network that flaps, fails over for no reason, drops VPNs and cuts calls, while the Starlink app insists everything is fine. Almost all of it is fixed in settings rather than hardware.
The 30-second version
- Your gateway is not broken and neither is Starlink. The default health checks are too strict for a satellite link.
- UniFi: build a custom SLA that requires both probes to fail, and relax or disable the latency and jitter thresholds.
- Omada: set Online Detection to Manual with public targets, not the default Auto.
- Put the Starlink router in bypass mode so you are not running two routers and double NAT.
- Starlink uses CGNAT, so inbound VPNs and port forwarding will not work on a standard plan.
- Starlink reboots itself for updates, by default around 3am. That is usually your mystery overnight outage.
On this page
Why Starlink confuses a business gateway
A fibre line has steady latency, often under 10ms, and almost never loses a packet. Starlink is different by design. The dish is constantly handing over from one satellite to the next, so latency rises and falls through the day and there are short blips of packet loss, usually lasting a second or two. Your users rarely notice. Your gateway does.
Both UniFi and Omada continually test the internet connection by pinging or looking up known servers. If enough of those tests fail or come back slow, the gateway marks the connection as down and acts on it. On Starlink, those tests trip far more often than they should.
The symptoms:
- The WAN shows as offline or High Latency in the dashboard, while browsing works fine.
- The gateway fails over to a backup line, sometimes several times an hour, and occasionally sticks there after Starlink has recovered.
- The gateway drops and re-establishes its connection, which looks like the whole network resetting.
- Site to site VPNs, remote access tunnels and VoIP calls drop every time it happens.
- A flood of alerts and push notifications that nobody can act on.
If that sounds familiar, the fix is usually to tell the gateway what normal looks like on Starlink.
Fix 1: a Starlink-friendly health check in UniFi
By default UniFi runs three probes, a ping to ping.ui.com and DNS lookups of ui.com through Cloudflare and Google, and marks the WAN down if any two fail. That is sensible on fibre and too twitchy on satellite.
Go to Settings, Internet, Create New SLA. You can set the verification servers, how often each is tested, the period results are averaged over, and thresholds for packet loss, latency and jitter. These are the starting values we use on Starlink.
| Setting | Starting value | Why |
|---|---|---|
| Server Condition | All | Both servers must fail before the WAN is marked down, so one bad probe is ignored |
| Verification servers | Ping 1.1.1.1 and ping 8.8.8.8 | Two reliable, independent targets |
| Ping interval | 5 seconds | Frequent enough to spot a real outage |
| Time period | 60 seconds | Averages out handover blips instead of reacting to each one |
| Packet loss threshold | 25% | Brief loss during handovers stays under it, a real outage does not |
| Latency threshold | Off, or 300ms | Starlink latency moves constantly, a tight limit causes false alarms |
| Jitter threshold | Off | Jitter is normal on Starlink and is not a sign of an outage |
Then open the Starlink WAN under Settings, Internet and select your new SLA in place of Auto. Menu names shift slightly between UniFi Network versions, but the options are the same.
The trade-off, stated plainly
A looser check means a genuine outage takes a little longer to detect, typically under a minute. For most businesses that is far better than a network that fails over every time a satellite hands over. If Starlink is your backup rather than your main line, keep the stricter Auto check on the fibre and use the relaxed SLA only on Starlink.
Fix 2: Omada Online Detection
On Omada the setting that matters is Online Detection, which decides whether a WAN port is online and drives both Link Backup and Load Balancing. It has three modes.
- Auto sends DNS lookups to the WAN port's own DNS server. If that server is slow or unreachable over Starlink, the port is marked offline even when the internet works.
- Manual lets you choose your own ping and DNS targets. The port stays online as long as either test gets a reply, and is only marked offline when both fail.
- Always Online never marks the port offline. That stops false alarms, but failover will never trigger.
For Starlink, use Manual with public targets such as 1.1.1.1 for ping and 8.8.8.8 for DNS. Do not point it at the Starlink router or its gateway address, which may not answer pings. Because only one of the two tests needs to succeed, this is naturally tolerant of Starlink's short blips.
Where to find it:
- Standalone router: Transmission, Load Balancing, Online Detection, then edit the Starlink WAN port.
- Omada controller: Network Config, Internet, where you also set the Online Detection Interval.
On the interval, TP-Link's own guidance is that a shorter interval makes failover faster but sends more test traffic. On Starlink, avoid the most aggressive setting. A slightly longer interval stops the gateway reacting to every handover, at the cost of a few extra seconds before a real outage triggers failover.
Only use Always Online if Starlink is your only connection and you have no failover to protect.
Fix 3: Starlink router bypass mode
If your UniFi or Omada gateway sits behind the Starlink router in its normal mode, you have two routers doing the same job. That is double NAT. It causes problems with VPNs and video calls, and it means a Starlink router restart takes your gateway's connection down with it. Bypass mode turns off the Starlink router's Wi-Fi, routing and DHCP so your own gateway does all of it.
| Starlink kit | How to connect your gateway |
|---|---|
| Standard with Gen 3 router | Enable bypass in the Starlink app, then plug the gateway's WAN port into one of the router's Ethernet ports |
| Standard Actuated with Gen 2 router | Needs the Starlink Ethernet adapter first, as the Gen 2 router has no Ethernet port |
| Mini | Use the official Starlink Mini Ethernet cable |
| Enterprise or High Performance with Gen 2 router | No bypass needed, plug the gateway into the power supply |
Things to know before you switch it on:
- The Starlink Wi-Fi disappears immediately, so have your own access points ready.
- The only way back out of bypass mode is a factory reset of the Starlink router.
- Set the gateway's WAN to DHCP. Starlink addresses are dynamic.
- You can still check the dish, obstructions and outages in the Starlink app.
Fix 4: planning around CGNAT
On most Starlink plans you do not get your own public IP address. Starlink uses carrier grade NAT, so your gateway receives a private address in the 100.64.x.x range and many customers share one public address. Bypass mode does not change this. It removes your local double NAT, not Starlink's.
- Port forwarding will not work. Remote access to a CCTV recorder, alarm panel or server by opening a port is a non-starter.
- Inbound VPNs will not work. A remote worker cannot dial in to a VPN server on the gateway, and a site to site VPN cannot be initiated towards the Starlink site.
- Outbound-initiated tools generally do work, because the connection starts from inside the network. Cloud-managed remote access, and VPNs where the Starlink site dials out, are the usual answer.
If you need a proper public address, Starlink's Local Priority and Global Priority plans offer one as an option. It is public but not guaranteed static, so pair it with dynamic DNS for anything that connects by name. If inbound access is central to how you work, a fixed IP SIM or a fixed line is usually the cleaner answer.
Fix 5: the smaller things that still catch people out
Nightly software updates
Starlink updates its software roughly every two weeks and reboots to install it, by default at 3am local time, give or take 30 minutes. If your gateway shows an outage in the small hours, this is usually why. You can move the window in the Starlink app under Settings, Starlink, Software Updates to Overnight, Morning, Afternoon or Evening. Keep it clear of overnight backups, CCTV uploads and, for hotels or care homes, any time the site is busy at night.
Smart Queues and QoS
UniFi Smart Queues and similar bandwidth controls need you to enter your line speed. Starlink speeds vary through the day, so a fixed figure is either too high to help or too low and caps you. Leave them off unless you have a specific problem to solve, and if you do use them, set them conservatively and test.
Obstructions
No gateway setting fixes a tree. Check the obstruction map in the Starlink app before changing anything else. Regular drops at the same time each day usually point at something in the dish's view.
Quick checklist
- Starlink router in bypass mode, gateway WAN set to DHCP.
- UniFi: custom SLA on the Starlink WAN, both servers required to fail, latency and jitter relaxed or off.
- Omada: Online Detection on Manual, pointed at public targets, with a sensible interval.
- Remote access and VPNs set up to dial out, or a Priority plan with a public IP if you need inbound.
- Starlink update window moved away from backups and busy hours.
- Smart Queues off, or set conservatively.
- Obstruction map checked in the Starlink app.
Still flapping after all that?
If you have worked through this and the network still drops, the cause is usually specific to the site: cabling, the power supply to the dish, or a failover setup that does not fail back cleanly. We set up and support UniFi and Omada networks on Starlink, 4G, 5G and fibre every week.