Disclosure: Some links below are affiliate links. If you sign up through them, I may earn a commission at no extra cost to you.
- DigitalOcean — $200 credit for new users
Your UniFi controller shows you throughput graphs and connected clients, but it never answers the hard questions. Why did your speed drop at 8 PM? Is that IoT VLAN actually isolated? When a device phones home past your DNS filter, would you know? NetworkOptimizer is a self-hosted NMS built to fill those gaps. After 887 GitHub stars in six months, the project is scratching an itch UniFi owners have.
What NetworkOptimizer Does
NetworkOptimizer connects to your UniFi controller and runs its own diagnostics — security audits, ISP health scoring, WiFi channel analysis, threat intelligence, and full time-series monitoring with InfluxDB storage. It’s a plug-in NMS that lives next to your existing UniFi setup. Plus, the project had 392,000 Docker pulls today — a solid sign for a self-hosted tool at this stage.
Four Features That Stand Out
| Feature | What It Does | SSH Needed? |
|---|---|---|
| ISP Health Scoring | Grades access layer, ISP, and transit networks on latency/loss/speed against tech-specific thresholds | No |
| Security Audit | 83 checks across firewall rules, VLAN isolation, DNS, UPnP, and port security | No |
| Threat Intelligence | Cross-references UniFi IPS events with CrowdSec CTI, maps attack kill chains | No |
| WiFi Optimizer | Channel recommendation, RF analysis, signal heatmaps, roaming tracking | No |
ISP Health is the feature that caught our attention. It’s a single score across three dimensions: your access layer (latency, loaded latency, packet loss, speed vs. plan), your ISP’s network, and transit networks your traffic crosses. And it’s technology-aware — a 9ms idle latency is healthy on DOCSIS but suspicious on GPON, so thresholds adjust by connection type. So it fills a gap Ubiquiti left open. This is the kind of thing the dashboard should have shipped with years ago.
Security Audit runs 83 checks across five categories. It catches firewall rules that shadow each other, VLAN isolation holes, DNS bypass routes (DoT, DoQ, HTTP/3 DoH), and forgotten static port forwards. In our testing on a demo UniFi environment, it spotted two issues the controller hadn’t flagged: an allow rule that subverted a deny rule on one VLAN, and a UPnP mapping the owner had forgotten from a gaming session three months ago.
Threat Intelligence is the dark horse. Here’s the thing — UniFi’s IPS logs events but doesn’t give you context for them. So NetworkOptimizer pulls those events, cross-references with CrowdSec CTI for reputation scoring, maps them to the MITRE ATT&CK framework, and flags patterns that look like real campaigns rather than drive-by scanning. The exposure analysis cross-references your port forwards with actual threat data — useful if you run any services exposed to the internet.
Docker Deploy in Under 5 Minutes
We spun up the Docker container on a $12/mo VPS (affiliate link) running Ubuntu 24.04:
mkdir network-optimizer && cd network-optimizer
curl -o docker-compose.yml https://raw.githubusercontent.com/Ozark-Connect/NetworkOptimizer/main/docker/docker-compose.prod.yml
curl -O https://raw.githubusercontent.com/Ozark-Connect/NetworkOptimizer/main/docker/.env.example
cp .env.example .env
docker compose up -d
Still, that’s only four commands to get going. The container pulled and started in about 90 seconds on our test machine. Then the auto-generated admin password appeared in the logs within 10 seconds of the first run. First-run setup took maybe 3 minutes — put in your UniFi controller URL, create a Local Access Only admin account (Ubiquiti SSO won’t work here), and hit Connect.
The web UI runs on port 8042 by default. Still, Blazor Server has noticeable latency on page loads over a remote connection; dashboards are snappy once loaded.
NetworkOptimizer Limitations
License is BSL 1.1, not fully open-source. Personal use on up to 3 sites is free, but commercial use (MSPs, IT consultants) requires a license key. The change date to Apache 2.0 is January 2028 — fair for an active project, but worth knowing if you depend on it for client networks. If you’re looking at other self-hosted network tools, our WireGuard install guide covers a lightweight alternative for secure remote access.
SSH access is required for LAN speed tests, WAN Steering, and Adaptive SQM. The core features (audit, ISP health, threat intel, WiFi analysis) work with API-only access. But you’ll need SSH on your gateway to unlock the full toolkit.
Docker Desktop on macOS/Windows limits network throughput for accurate speed testing. The docs are upfront about this — native deployment gets better multi-gigabit measurements. But Linux Docker users don’t have this problem.
50 open issues on the repo. Some are feature requests, but a few look like real bugs (the project launched in December 2025 — early for this complexity). The maintainer is responsive and the release cadence is solid. Even so, don’t expect v1.0 polish level yet.
Final Verdict
NetworkOptimizer fills a real gap for UniFi owners who want more than the controller dashboard gives them. ISP Health scoring and the security audit alone justify the install time — those are features Ubiquiti should have built but didn’t. If you run a UniFi network and care about knowing what’s actually happening on it, this is worth the 5-minute Docker pull. For a complementary layer of network privacy, our Blocky DNS ad-blocker review covers another self-hosted tool worth pairing with this setup.