Starlink + UniFi
Passenger Wi-Fi Setup

1. 1

   Confirm the Starlink service plan

   The Standard kit is approved for vessels, but most plans are not. A daily ferry also passes Roam's limit of 5 consecutive days and 60 days per year in territorial waters.

   Plan	On this vessel	Notes
   Residential / Standard / Priority	Not allowed	In-motion use is not permitted
   Roam	Short-term only	Coastal waters, with day limits. Not for a daily commercial route
   Roam + Ocean Mode	Works	Beyond 12 nautical miles and past the day limits. Billed per GB
   Business Maritime / Mobile Priority	Recommended	Commercial use, network priority

   Verify: Starlink or a local reseller confirms in writing that the plan covers commercial passenger Wi-Fi on your route.
2. 2

   Measure every cable run on board

   • Dish position (compass deck) down to the wheelhouse. Compare with the supplied Starlink cable length.
   • Wheelhouse to the 2nd deck switch location (midships).
   • Each switch to each AP position, including vertical drops and tray detours.

   Verify: every Cat6 run is under 90 m, leaving margin under the 100 m Ethernet limit.
3. 3

   Check power at both equipment points

   The Starlink power supply runs on 100–240 V AC. Confirm 220 V AC outlets in the wheelhouse and at the 2nd deck switch location. Add an inverter only where AC is missing.

   Clear every bulkhead and deck penetration with the shipping line's naval architect before drilling. Each pass needs an approved fire- and watertight transit.

The dish cable runs down to the router in the wheelhouse. The UCG Ultra feeds Switch 1 for the three 3rd deck APs and the crew PC, and one uplink cable drops to Switch 2 midships on the 2nd deck for the remaining three APs.

1. 1

   Install the wheelhouse cabinet safely

   • Keep the UPS and network gear at least 1–2 m from the magnetic compass.
   • Use a closed, ventilated cabinet out of direct sun.
   • Route network cables away from radar, GPS and VHF/GMDSS wiring. Don't share their power circuit.

   Verify: compass deviation is checked after installation.
2. 2

   Pull spare Cat6 while cabling

   Run one extra cable to a second ceiling position at each end of both bunk rooms and the reclining room. Bulkhead transits are the expensive part, so adding an AP later becomes a simple mount.

1. 1

   Mount the dish and power up

   Bolt the rigid mount to structure on the compass deck centerline. Connect the dish cable to the router and power the router through the supplied UTP-253L power supply on the UPS.

   Verify: the Starlink app shows online, and the obstruction map is clear in all directions.
2. 2

   Connect the router to the UCG Ultra

   The UTR-251 has two Ethernet ports. One carries the dish. Run Cat6 from the free port to the UCG Ultra WAN (2.5G) port.

3. 3

   Enable bypass mode

   In the Starlink app, open Settings and turn on Bypass Mode. The router's Wi-Fi switches off. To undo it later you must factory reset the router.

   Verify: the UCG WAN shows a Starlink address, not 192.168.1.x. A 192.168.1.x address means bypass is not active (it still works, with double NAT).

1. 1

   Adopt and update

   Adopt the UCG in the UniFi app or at unifi.ui.com. Set WAN to DHCP. Update UniFi OS and the Network application before configuring anything else.

2. 2

   Create the networks

   Network	VLAN	Security	Portal	Users
   Management	1	—	No	UniFi devices only
   Crew	10	WPA2/WPA3 password	No	Crew phones, laptops, POS
   Guests	20	Open, type Guest / Hotspot	Voucher	Passengers

3. 3

   Wire the wheelhouse PC

   The wheelhouse has no AP. Plug the PC into a free UCG Ultra LAN port with a normal Cat6 cable, then set that port's network to Crew (VLAN 10) in UniFi so it skips the voucher portal.

   Verify: the PC gets a Crew VLAN address and browses without a login page.
4. 4

   Secure remote access

   Enable remote access so the network can be managed from shore. Protect the UI account with a strong password and two-factor authentication.

   Verify: you can open the vessel's site from unifi.ui.com on a phone off the ship's network.

1. 1

   Connect and adopt both switches

   Connect Switch 1 (wheelhouse) to UCG LAN port 1. Connect Switch 2 (2nd deck, midships) to Switch 1 through the uplink cable, using a non-PoE port on Switch 1 so its four PoE ports stay free for APs. Adopt both.

2. 2

   Mount and adopt the APs

   Plug each AP into its switch and adopt them one at a time. Name each by location so the crew can find it.

   AP-D3-Canteen
   AP-D3-Reclining
   AP-D3-VIP-Hall
   AP-D2-Bunk-Aft
   AP-D2-Bunk-Fwd
   AP-D2-Economy

   Copy
3. 3

   Create the SSIDs and tune radios

   • Crew SSID on VLAN 10, WPA2/WPA3.
   • Passenger SSID on VLAN 20, open, Hotspot portal enabled, client isolation on.
   • Channel width 20 MHz on 2.4 GHz and 40 MHz on 5 GHz. Lower transmit power on neighboring APs.

   Verify: all 6 APs show online. Each VIP suite gets usable signal with its door closed; add an in-wall AP to any suite that doesn't.

1. 1

   Enable the portal

   Open Hotspot Manager, then Portal. Enable it on the Guests network and set authentication to Voucher.

2. 2

   Brand the landing page

   In the Landing Page editor add the logo, a vessel photo as background, terms of use, English and Filipino text, and a help note such as "Ask the purser for help." For full design control later, an on-board external portal server is an option.

3. 3

   Create the voucher packages

   Start with three and adjust after the first trips. Set prices against your Starlink data cost.

   Package	Duration	Devices	Down / up	Data cap	Price (PHP)
   Quick	1 hour	1	2 / 1 Mbps	None	—
   Day pass	24 hours	1	3 / 1 Mbps	500 MB	—
   Trip pass	Full voyage	2	3 / 1 Mbps	2 GB	—

4. 4

   Print and sell

   • Print voucher batches before departure. Lock unsold slips with the cash box.
   • Log every sale: code, package, time.
   • Tell passengers: join the passenger Wi-Fi, wait for the login page, enter the code.
   • No login page? Open any http:// site, or turn Wi-Fi off and on.
   • Everyone connected but nothing loads? Check the Starlink app before blaming vouchers.

   Verify: one test voucher works on a phone in every room.

1. 1

   Block the Starlink dish from passengers

   Add a firewall rule in the Policy Engine so the guest VLAN can't open the dish interface.

   Action: Block
   Source: Guests (VLAN 20)
   Destination: 192.168.100.1/32

   Copy

   Verify: from a passenger phone, http://192.168.100.1 and crew devices do not load.
2. 2

   Apply caps and traffic rules

   • Per-voucher speed cap of about 2–3 Mbps. At 100–200 Mbps of Starlink, that serves roughly 30–60 streaming users at once.
   • Per-voucher data cap to protect per-GB ocean data.
   • Traffic rules on Guests to limit video streaming, OS updates and P2P.
3. 3

   Handle hotspot sharing

   Some Android phones can share the ship's Wi-Fi through their own hotspot. UniFi sees the whole group as one device, so the voucher's speed and data cap covers everyone behind it. Hard blocking needs TTL filtering, which UniFi doesn't offer.

   Verify: share a 2 Mbps test voucher from an Android phone to a second device. Both speed tests together stay under 2 Mbps and count against one voucher.

• Starlink plan confirmed for commercial use (Ocean Mode or Business Maritime)
• Dish on rigid mount with a clear obstruction map
• Power through UPS survives a generator switchover
• Bypass mode on, UCG WAN online
• Firmware updated on UCG, both switches and all APs
• 2nd deck switch adopted and uplink online
• Crew and Guests VLANs created
• Wheelhouse PC on Crew VLAN, no login page
• Passengers cannot reach 192.168.100.1 or crew devices
• Voucher tested in every room, each VIP suite with door closed
• Speed and data caps confirmed on each package
• Magnetic compass deviation checked after wheelhouse install
• Remote access working from shore
• Crew briefed on selling and troubleshooting