UniFi WireGuard VPN: how to set it up (2026)

UniFi gateways have a WireGuard VPN server built into UniFi Network. You enable it, pick a port (UDP 51820 by default), add a client, and hand that person a configuration file or a QR code. They import it into the WireGuard app and connect.

The catch is reachability. The gateway needs a public IP address, or a forwarded port on the router in front of it. If you can't give it one, Teleport is the better fit.

This guide covers what you need, the server setup, client files and QR codes, split tunneling, the WireGuard client, and the problems people search for most. Sources are Ubiquiti's help center and release notes, read on September 25, 2026.

What you need

• A UniFi gateway. Ubiquiti's WireGuard VPN Server article says "A UniFi Gateway or UniFi Cloud Gateway is required."
• A recent UniFi Network version. WireGuard server support reached the Dream Machines with UniFi OS 3.0.20 in April 2023.
• A public IP address on the gateway, or a port forward on the upstream router. More on that below.
• The WireGuard app on each device that connects. It's available for Windows, macOS, Linux, iOS and Android from wireguard.com/install.

The VPN server runs on the gateway, so it doesn't matter where the controller runs. Cloud Gateways such as the UCG-Ultra, UCG-Max and UCG-Fiber list a WireGuard server and a WireGuard client in their tech specs. So does the standalone Gateway Max (UXG-Max). The standalone UniFi Gateways also get their own WireGuard fixes in Ubiquiti's gateway firmware notes, for example version 3.2.15 in March 2024.

How the UniFi WireGuard server works

Ubiquiti describes the flow in three steps. You enable WireGuard and specify a port, add a client, and share the configuration file with that person. On phones, scanning the QR code adds the VPN automatically.

Each client gets its own entry on the server and its own configuration file. That file holds the keys, the tunnel address, the DNS server and the address of your gateway. The WireGuard app needs nothing else.

Ubiquiti recommends Teleport or WireGuard over L2TP, which it calls "a traditional VPN that is losing support". For laptops and desktops, it recommends Teleport and WireGuard over OpenVPN (OpenVPN Server). If you still need OpenVPN, our OpenVPN guide covers it.

How to set up the WireGuard server

1. In UniFi Network, open the VPN section of the settings. Ubiquiti's Teleport article gives the path as Network Settings > VPN.
2. Create a WireGuard VPN server.
3. Keep the default port, UDP 51820, or choose another one. If you change it, use the new port in your port forward too.
4. Add a client for each person or device. Use a name you'll recognize later, such as "Anna laptop".
5. Share that client's configuration file, or let them scan its QR code.

Ubiquiti's mobile app changed its Teleport and VPN settings screens in September 2026 (UniFi Android 11.0.1). Button labels may differ from older screenshots. The steps above follow Ubiquiti's own wording.

Point clients at a hostname

By default, a client file points at the gateway's current WAN IP address. If your ISP changes that address, every client stops working.

Two settings fix this. First, create a Dynamic DNS entry in the Internet settings of UniFi Network (Dynamic DNS). Second, use the server's IP/hostname override, added in UniFi Network 8.0.7. It writes a custom hostname or IP address into the client configuration files. In the UniFi mobile app, the VPN Server settings have a "Use Alternate Address for Clients" option (UniFi Android 10.38.2), which looks like the same setting.

IPv6

UniFi Network 10.2.105 (March 2026) added IPv6 support for WireGuard. It requires UniFi OS 5.1 or newer on the gateway.

Connect a phone or a computer

On a phone:

1. Install WireGuard from the App Store or Google Play.
2. Add a tunnel and scan the QR code from UniFi Network.
3. Switch the tunnel on.

On Windows, macOS or Linux:

1. Install WireGuard from wireguard.com/install.
2. Import the configuration file you downloaded for that client.
3. Activate the tunnel.

Use one client entry per device. If a laptop is lost, you remove its entry and the other devices keep working.

Public IP, port forwarding and CGNAT

WireGuard needs to reach your gateway from the internet. Ubiquiti recommends running it "on a UniFi gateway that has access to a public IP address" (WireGuard VPN Server).

If the gateway sits behind another router, forward the port on that router:

Ubiquiti warns that performance or port forwarding problems on the upstream router can make the VPN disconnect. Bridge mode on the ISP router avoids the double layer.

Check the WAN address the gateway shows. Ubiquiti's Dynamic DNS article says a gateway needs a public IP, and that a WAN address in these ranges rules out Dynamic DNS:

• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16
• 100.64.0.0/10, the range ISPs use for carrier-grade NAT (CGNAT)

An address in 100.64.0.0/10 means your ISP shares one public address across many customers. A port forward on your own router won't help then. Ubiquiti's UMR site-to-site article says the same: a WireGuard server behind CG-NAT can't accept incoming VPN connections. Ask the ISP for a public IP, or use Teleport. WireGuard over IPv6 may also work if both ends have IPv6, but we haven't tested that. Our guide to UniFi remote work with Starlink and Teleport covers remote access over Starlink.

Split tunneling and the AllowedIPs line

Every WireGuard configuration file has an AllowedIPs line. On the client, it works as a routing table. WireGuard sends traffic for those addresses through the tunnel and everything else over the normal connection (wireguard.com).

• AllowedIPs = 0.0.0.0/0 sends all IPv4 traffic through the tunnel, internet traffic included. Ubiquiti's WireGuard client article calls 0.0.0.0/0 "the default route".
• AllowedIPs = 192.168.1.0/24 sends only traffic for that one network through the tunnel. That's split tunneling.

To split the tunnel, edit the AllowedIPs line in the client file before you import it. List the site's networks, separated by commas. Check the file UniFi Network generated first, so you know what you're changing.

Access to local networks and firewall rules

On gateways with the zone-based firewall (UniFi Network 9.0 and newer), WireGuard users land in the VPN zone. The default policy from the VPN zone to the Internal zone is Allow All (Zone-Based Firewalls in UniFi).

So a new WireGuard user can reach your internal networks straight away. To limit that, add policies from the VPN zone to the networks that person shouldn't reach. Test each policy from a connected client.

The UniFi WireGuard client

The WireGuard client works the other way round. It connects your UniFi gateway to an outside WireGuard server, such as a commercial VPN provider (UniFi Gateway - WireGuard VPN Client).

• You upload the provider's configuration file, or fill in the keys and server address by hand.
• The client connects as soon as you apply it. No traffic uses it until you add a route for it.
• Ubiquiti's 2023 article calls that a Traffic Route. Newer releases call them policy-based routes, and since UniFi Network 9.3.43 the kill switch is on by default for new ones.
• A gateway supports up to 8 VPN clients, using OpenVPN or WireGuard (Introduction to VPNs).

If the status stays on Connecting, the keys don't match or the server can't be reached. Ubiquiti suggests checking both against the provider's details.

Site-to-site with WireGuard

Ubiquiti's VPN overview lists OpenVPN and IPsec for site-to-site links, plus Site Magic SD-WAN between UniFi gateways. WireGuard appears there as a VPN server and a VPN client.

There is one related setting. Clients on a WireGuard server have a Remote Client Networks option for networks that sit behind that client. It has carried that name since UniFi Network 8.1.127, which renamed it from Additional Routes. Ubiquiti documents one site-to-site use of it, for its UniFi Mobile Router (UMR). You add the UMR as a client on the gateway's WireGuard server and enter the UMR's LAN under Remote Client Networks (WireGuard S2S VPN for UMR). For links between two UniFi gateways, Site Magic SD-WAN is the documented route.

Teleport or WireGuard?

Teleport is Ubiquiti's zero-configuration VPN, and it runs on WireGuard too. You send an invitation, and the other person connects through the WiFiman app.

Pick Teleport when the site has no public IP, or when you just need to get one person in fast. Pick WireGuard when you want standard config files, your own split tunnel, or a client that isn't WiFiman. Our Teleport guide covers the invitation flow and WiFiman on Windows, Mac and Linux.

Troubleshooting

The client never connects

• Check that UDP 51820, or your custom port, reaches the gateway. A missing port forward upstream is the most common cause.
• Check the gateway's WAN address. A CGNAT address (anything from 100.64.0.0 to 100.127.255.255) can't receive incoming connections.
• Check that the client file points at the current address. Use Dynamic DNS and the hostname override so it keeps working.

The QR code doesn't work

The QR code carries the same configuration as the file. If scanning fails, download the configuration file and import it into the WireGuard app instead. On Windows, update UniFi Network: version 9.0.114 fixed configuration files that stopped working after a Windows update.

Connected, but no access to the local network

• Check that AllowedIPs in the client file includes the site's networks.
• Check your firewall policies from the VPN zone to the Internal zone.
• Check the address range of the network the device is on. If it's the same as the site's range, the device can't tell the two apart.

The connection drops on mobile

Keep the gateway firmware current. Several UniFi OS and gateway releases improved WireGuard disconnection detection for mobile devices and WireGuard stability. For example, UniFi Gateways 5.1.26 (July 2026) improved "WireGuard connectivity resiliency".

Frequently asked questions

Does UniFi support WireGuard?

Yes. UniFi gateways and Cloud Gateways run a WireGuard VPN server and a WireGuard VPN client. You configure both in the VPN section of UniFi Network.

Which port does UniFi WireGuard use?

UDP 51820 by default. You can choose another port when you set up the server.

Do I need a public IP for WireGuard on UniFi?

Yes, in practice. Ubiquiti recommends a public IP on the gateway, and a port forward if it sits behind another router. Without one, use Teleport.

Can I use WireGuard with a hosted UniFi controller?

It should work. The VPN runs on the UniFi gateway at the site, and the controller holds the settings. Ubiquiti's store says the Gateway Max can be managed by Official UniFi Hosting or UniFi OS Server, and its tech specs list a WireGuard server. We haven't lab-tested this on a hosted controller yet. Cloud Gateways run their own controller.

How many WireGuard users can connect?

Ubiquiti's WireGuard server article gives no limit. The limit of 8 applies to VPN clients, the outgoing connections from your gateway.

Final thoughts

The WireGuard setup itself is short once the gateway is reachable. Most of the work is the public IP, the port forward and a stable hostname. After that, it's one client file per device.

Running it for your own network is perfectly reasonable. When you look after many client networks, each site's VPN still lives on its gateway. The controller behind all of them is one more server to keep patched and backed up. UniHosted runs that controller for MSPs, with daily backups and tested updates on paid plans.