Ubiquiti Express 7 Router Migration

I’m switching my home-office connection from the stock Astro RG21 to a Ubiquiti Express 7 and need the Express 7 promoted to primary router while still taking advantage of the public-IP add-on that currently lands on the RG21.

Here’s what I’m after:

• WAN hand-off: the Express 7 must receive and hold the public IPv4 address now assigned to the RG21, whether that’s via bridge, passthrough, or an alternate method you suggest.
• Internal network: create a clean DHCP scope, reserve a handful of static leases, and retire the RG21’s DHCP completely.
• Remote access: stand up a VPN on the Express 7 (IPSec or OpenVPN—open to your guidance) so I can reach my lab gear when I’m away.
• Security hardening: review firewall/NAT rules, disable unused services, and make sure remote management is safely locked down.

Everything will be done through the UniFi interface; CLI/SSH tweaks are fine if needed. I’ll provide remote access to the RG21 admin page, the UniFi Controller, and a test workstation so you can verify end-to-end connectivity. Final deliverable is a fully operational Express 7 acting as the only router in the path with working DHCP, VPN, and secure perimeter.