Written in December 2016. Check out latest controller and firmware release notes as hopefully by mid 2017 they will have fixed this!
This is most definitely the lame duck of the Ubuiquiti Unifi range. Hopefully updates to the Unifi controller and the firmware of the device will sort this out in time.
It readily works when I resorted to basics and set it up from scratch with its own controller instance in a "sandbox" environment, but to date I still haven't successfully retrofitted it into a pre-existing network and a quick search of the community forums is rife with similar tales.
Although it has the potential to be very powerful the integration with the controller is very flawed and limited, with myself and many in the community reporting problems in integrating it into anything other than a single subnet network. One of the major issues is that as soon as you get more complex the USG will inherit the network configurations from the controller and very likely adopt another IP address (you have NO direct control of the USG LAN IP from the UI) and at this point the controller loses contact with it.
The majority of people that seem to have got it to work have ended up programming it via the CLI, but that defeats the object of having it as part of the Unifi range, and apparently as soon as the Unifi controller provisions anything to it it wipes out tweaks made via CLI.
Until recently it had almost no "user accessible" fiorewall controls, howwever the latest controller/firmware has introduced a handful of firewall programability such as port fowarding and static routes, but far more limited than many other firewall products and NAT is still mandatory (other than via CLI edits), which means if you want native IP routing to an upstream firewall with source based WAN selectivity (as I do) you are scuppered.
Lucky it's so cheap otherwise it would be on its way back to 4Gon. I'm going to hang onto it and keep an eye on controller and firmware release notes and re-integrate it when they have fixed it.