Once a homeowner has settled on UniFi Protect for their cameras, the next question is always the same: do I buy an all-in-one Cloud Gateway and call it done, or do I step up to a dedicated UNVR? The answer depends almost entirely on a few numbers most people don’t know they need to estimate. This post walks through the math for a real-world target — a twelve-camera install, the size we see most often on a 4,000–6,000 sq ft Utah custom build.
If you’re still picking between gateway models in general, start with our Dream Machine vs Cloud Gateway Ultra vs UDM Pro rundown. This post is more specific: at twelve cameras, where does the all-in-one stop being enough?
The short version
- UCG-Max or UDM Pro: works fine up to about 8–10 cameras at 4 MP, 4–6 cameras at 4K. Past that you start hitting CPU, storage, or IDS/IPS throughput limits.
- UNVR or UNVR Pro: separates camera recording from gateway routing. Twelve 4K cameras is comfortable. Sixteen is the practical ceiling on the standard UNVR.
- The right answer for a 12-camera 4K install: a UDM Pro or Cloud Gateway Max for routing, a separate UNVR for recording. Not one box doing both.
Why people try to do it all on one box
The Cloud Gateway Max and UDM Pro both ship with a drive bay and run UniFi Protect natively. On the spec sheet, they look like everything you need: router, switch, controller, and NVR in a single device. UniFi markets them that way. For a four-camera doorbell-and- garage install, they really are everything you need.
The problem starts when you scale past what the box was actually designed to do. The CPU on the gateway is shared between routing, IDS/IPS deep packet inspection, threat management, the controller, the Protect recorder, and the H.265 transcoder for live view. At low camera counts, there’s headroom. At 12 cameras streaming 4K H.265, there isn’t.
What twelve cameras actually demand
Let’s do the math. Our NVR storage sizing post covers the storage side. Here we’re going to focus on what the recorder itself has to do in real time.
Assume twelve UniFi Protect cameras: a mix that’s typical for a 5,500 sq ft Holladay or Alpine home — four 4K G5 Bullets covering the perimeter, four 4 MP G5 Domes under eaves and at side doors, two 4K G5 Pros at the driveway and front entry, a G5 Doorbell Pro, and a G5 PTZ on the backyard. Bitrates at default Protect settings:
- 4 × 4K Bullet @ ~12 Mbps = 48 Mbps
- 4 × 4 MP Dome @ ~6 Mbps = 24 Mbps
- 2 × 4K Pro @ ~16 Mbps = 32 Mbps (smart detect crank)
- 1 × Doorbell Pro @ ~6 Mbps = 6 Mbps
- 1 × 4K PTZ @ ~14 Mbps = 14 Mbps
Total ingest: roughly 124 Mbps sustained of camera traffic 24/7, with peaks higher during motion events and smart-detection re-encodes. That’s ~1.3 TB per day before any compression tuning, ~40 TB per month of raw write activity.
The disk subsystem has to swallow that continuously while also serving live-view streams to phones and tablets and re-encoding clips for smart-detection events. Live view is not free — every Protect mobile client connected to the system pulls a transcoded stream from the recorder.
Where the Cloud Gateway Max actually struggles at 12 cameras
The Cloud Gateway Max is a strong piece of hardware — quad-core CPU, dual NVMe slot, dual 2.5 GbE WAN. On paper it should handle twelve cameras. In our actual installs, here’s where it gets uncomfortable:
- IDS/IPS throughput. With deep packet inspection turned on (which most clients want, because that’s a big part of the point of a UniFi gateway), the CPU budget for Protect tightens. A 12-camera 4K Protect workload plus full IDS on a multi-gig WAN puts the CPU at 70–85% routinely. Once a smart-detection burst hits during a busy network moment, you see momentary frame drops in the live view.
- Single drive bay. The Cloud Gateway Max takes a single NVMe. At 4K-heavy bitrates you can put a 4 TB or 8 TB NVMe in there, but you’re storing 30–45 days of footage at most without aggressive motion-only settings. There’s no RAID, so a drive failure is a total footage loss.
- Live-view scaling. Three simultaneous mobile viewers hitting the live view of all twelve cameras through the Protect app is enough to hit the transcoder ceiling. Frames stay, but latency on the live view goes from ~500 ms to 2–3 seconds.
- No expansion path. If you grow to 16 cameras or add a Protect Connector for a third-party RTSP cam, you’re past the intended workload and there’s nowhere to put the new load.
UDM Pro: same story, different chassis
The UDM Pro’s 3.5” bay can fit a single 14–20 TB spinning disk, which solves the storage-quantity problem the Cloud Gateway Max has. It does not solve the “same CPU is doing routing and recording” problem. We have UDM Pro installs that ran a 6-camera Protect workload happily for years. The same boxes upgraded to 12 cameras started getting CPU alarms within a month.
The UDM Pro Max (the newer SE-replacement model) does better here because it has a noticeably stronger CPU, but you’re still putting routing and recording on the same silicon. At twelve 4K cameras, the cost-of-failure case for splitting them onto separate hardware is starting to make sense.
UNVR: the dedicated recorder
The UNVR is purpose-built for Protect. It’s a four-bay 1U unit with a CPU and storage subsystem tuned specifically for camera recording. It does not route traffic. It does not run the UniFi controller. It’s a Protect appliance, full stop, and that’s the point.
- Four 3.5” bays in RAID: we typically run RAID-1 mirrored pairs or a 4-disk RAID-10. Twelve 4K cameras with 60 days of retention fit comfortably on a 24 TB usable array.
- Dedicated CPU and NIC: the Protect workload doesn’t fight for CPU with IDS, routing, or controller updates. Smart- detection bursts don’t cause live-view glitches.
- Survives a gateway reboot: the biggest underrated benefit. Update the UDM Pro, reboot the controller, take down the network for five minutes — your cameras keep recording. They can’t talk to the world during that window, but everything that was already on the LAN keeps writing to the UNVR. With an all-in-one, a gateway reboot is a recording gap.
- UNVR Pro adds 7-bay capacity and a slightly faster CPU. Worth it past 16 cameras or for very long retention windows. For most 12- camera homes the standard UNVR is more than enough.
The IDS/IPS throughput trade-off
There’s a less-discussed reason to split routing from recording: gateway IDS throughput drops sharply when the same CPU is doing both. On a UDM Pro running a 12-camera Protect load, IDS will throttle to roughly half its rated throughput. If you’ve got a 2.5 Gbps fiber WAN, that’s the difference between getting your full advertised speed with full security inspection and getting a noticeable hit on speed tests.
Move Protect onto a dedicated UNVR, and the gateway CPU is free to do what it’s actually good at. Speed tests on the same WAN, with the same IDS rules, go up. This is one of those changes that users feel after the install, even though it wasn’t the main thing they were buying.
What 4K does to the gateway specifically
4K cameras aren’t three times as much data as 1080p — they’re typically four to five times, because the encoder targets a higher quality factor on detailed scenes. Worse, every smart-detection event triggers a re-encode of the relevant clip on the recorder for searchable thumbnails. On a Cloud Gateway Max, that re-encode runs on the same CPU that’s routing the family’s 4K Netflix stream and inspecting it for IDS rules. A garbage truck rolling past at 6 AM kicks off a ten-second smart-detection burst on three perimeter cameras simultaneously, and the gateway CPU spikes hard.
On a UNVR, that same burst is a non-event. Different box, different CPU.
What we actually install
For Wasatch Front installs we’ve scoped in 2025 and 2026, the cutoff is roughly:
- 1–6 cameras, 1080p or 4 MP: Cloud Gateway Max with a single NVMe is fine. No UNVR needed.
- 6–10 cameras, mostly 4 MP, light 4K: UDM Pro with a 14–20 TB single spinning drive. Watch CPU during smart-detection storms.
- 10–16 cameras, 4K-heavy: UDM Pro or Cloud Gateway Max for routing, standard UNVR with 4 disks for recording. This is the sweet spot we install most often.
- 16+ cameras, or commercial / multi- building: UDM Pro Max for routing, UNVR Pro for recording. Or split further onto dedicated controllers.
Twelve cameras at 4K, in our experience, almost always lands in the third bucket. The temptation to save $400 by skipping the UNVR is real, but the cost of getting it wrong is a Protect system that records fine for three months and then starts dropping frames every time the controller does a routine update. We’ve been called out to fix that exact symptom on installs that someone else specced.
What about the 4K cameras themselves?
Worth a side note: not every camera needs to be 4K. A doorbell at 6 feet away from a face doesn’t need 4K. A driveway camera covering 60 feet of cars does. Spec the resolution to the scene — see our megapixels guide — and you’ll often find a 12-camera install only really needs four or five 4K streams. That can tip a borderline UDM Pro install back into “all- in-one is fine” territory.
Power, rack, and UPS considerations
A UDM Pro plus a UNVR plus a 24-port PoE+ switch is roughly 250–350 W under camera load. Not huge, but enough that you should size your rack UPS with the Protect workload in mind, especially if you’re also running a proper server rack with smart-home hubs and a NAS. We typically spec a 1500 VA pure-sine UPS for this layout, which gets you a clean 15–20 minutes during a power blink.
If you’re building or wiring fresh, this is also the time to think about keeping the network alive through a real outage. A 12-camera install losing power for an hour at 3 AM is a security gap that’s entirely preventable.
Bottom line
For a typical 12-camera 4K install on a Wasatch Front home, run a UDM Pro (or Cloud Gateway Max) for routing and a separate UNVR for recording. The all- in-one boxes are better than ever, but at this camera count and resolution, splitting the workload pays for itself in reliability, IDS throughput, and clean upgrades.
Below 8 cameras, all-in-one is genuinely fine. Past 16 cameras or once you start mixing in commercial rooms or outbuildings, you’re into UNVR Pro territory. Twelve sits right on the line, which is why the question keeps coming up.
Keystone Integration installs UniFi Protect systems across Holladay, Draper, Alpine, Park City, and the rest of the Wasatch Front — sized to the camera count and tuned for the way the household actually uses the system. See the full service list or get in touch for a Protect scope on your floor plan.