Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThere is no single best VPN for Ubiquiti devices, because the phrase covers two different jobs. If you want to reach your own UniFi network from outside your home or office, you need a UniFi VPN server, and the best choice is usually Teleport or WireGuard. If you want devices on your UniFi network to send their internet traffic out through a commercial VPN provider, you need a UniFi VPN client configured on the gateway, and the provider must supply a WireGuard or OpenVPN configuration that the gateway can use. Start by deciding which of those two jobs you have, then check your gateway model and your internet connection type. The rest of this guide walks through each step.
Decide which VPN job you actually need
UniFi groups its VPN features into three functions: server (remote access into your network), client (the gateway connects out to an external VPN provider), and site-to-site (linking two networks). Ubiquiti’s own overview lists OpenVPN, WireGuard, and L2TP as server protocols, WireGuard and OpenVPN as client protocols, and OpenVPN/IPsec for site-to-site. It also describes Teleport as its easy-to-create remote-access option and Site Magic as its managed site-to-site option. This article focuses on remote access and provider-based client setups; site-to-site is a separate project.
As an Amazon Associate I earn from qualifying purchases.
The distinction matters because installing a commercial VPN app on a single phone or laptop is not the same as configuring the UniFi gateway as a VPN client. A gateway-level client connection is what lets UniFi-managed devices use a provider tunnel, and it requires its own routing configuration as described below.
Recommended Free Tools
Compare the UniFi VPN options at a glance
The table below lists the documented requirements for each option. Where Ubiquiti’s pages do not state a value, the cell says so rather than guessing.
#1 Best Overall
![Ubiquiti UniFi UTR Router, Wireless Gigabit Ethernet Dual-band [2.4 GHz/5 GHz] Bianco (Ubiquiti UniFi Travel Router - UTR)](https://m.media-amazon.com/images/I/21TmHNaJBhL._SL160_.jpg)
- Router Ubiquiti UniFi Wifi 5 2x RJ45 5GHz - UTR
| Option | Purpose | Gateway requirement | Documented default port | Public IP or NAT | Traffic Route needed? |
|---|---|---|---|---|---|
| Teleport | Remote access to your network | Not stated | Not stated | Can work with gateway and client both behind NAT; in some cases the gateway WAN needs IPv6 | Not applicable |
| WireGuard server | Remote access to your network | UniFi Gateway or UniFi Cloud Gateway | UDP 51820 | Behind another NAT router, forward the port to the gateway’s WAN address; a public IP is recommended | Not applicable |
| OpenVPN server | Remote access to your network | Next-Gen UniFi Gateway or UniFi Cloud Gateway; Network application 7.4 or newer | 1194 | Upstream NAT requires port forwarding | Not applicable |
| L2TP server | Remote access (legacy) | Not stated | Not stated | Carries NAT and client-configuration caveats | Not applicable |
| WireGuard client | Route devices through a provider | Next-Gen UniFi Gateway or UniFi Cloud Gateway | Not stated | Not stated | Yes |
| OpenVPN client | Route devices through a provider | Next-Gen UniFi Gateway or UniFi Cloud Gateway | Not stated | Not stated | Yes |
Remote access options
Teleport
Teleport is the simplest option if your goal is to reach your UniFi network from a phone or laptop. Ubiquiti describes it as a zero-configuration VPN that uses WireGuard and the WiFiman app. Its invitation expires after 24 hours, and each invitation can be used by one device at a time, so you will need a new invitation for each additional device. Because it is designed to work when both ends sit behind NAT, it avoids the port-forwarding work that the other server options require. Ubiquiti recommends it for mobile clients.
WireGuard server
The WireGuard server suits desktops and laptops, and it is configurable enough for users who want control over their setup. It requires a UniFi Gateway or UniFi Cloud Gateway and uses UDP port 51820 by default. If your gateway sits behind another router, forward UDP 51820 on that upstream router to the gateway’s WAN address. Ubiquiti recommends a public IP because upstream forwarding or performance issues can interrupt connectivity. Ubiquiti’s WireGuard server documentation states: “Using Teleport or WireGuard is highly recommended.” That line comes from the official UniFi Gateway WireGuard VPN Server page, which does not name an individual author.
OpenVPN server
The OpenVPN server requires a Next-Gen UniFi Gateway or UniFi Cloud Gateway and Network application version 7.4 or newer. Its documented default port is 1194. If the gateway is behind upstream NAT, you need to forward that port. Ubiquiti recommends Teleport for mobile clients and either Teleport or WireGuard for desktop and laptop clients, so OpenVPN is best reserved for cases where you specifically need it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- Immediate replacement shipment; no need to wait for inspection results
- Priority processing applied throughout the entire RMA application process
- Prepaid return shipping fees are included
L2TP (legacy)
Ubiquiti lists L2TP as a server protocol but treats it as legacy. The company says operating-system support for it is declining, notes NAT and client-configuration caveats, and recommends Teleport for mobile use or WireGuard for desktop and laptop use on newer gateways. Do not choose L2TP for a new setup unless you have a specific reason tied to an existing client.
Provider-based client options
A gateway-level VPN client sends traffic from your UniFi network to an external provider. Two points apply to both WireGuard and OpenVPN clients:
- The gateway needs a Next-Gen UniFi Gateway or UniFi Cloud Gateway.
- Connecting the tunnel does not by itself route any device through it. You must create a Traffic Route that directs the devices you choose through the tunnel.
WireGuard client
You can set up the WireGuard client by uploading a provider configuration file or by entering the settings manually. Ubiquiti says any provider that supports WireGuard can work. After the tunnel is established, create a Traffic Route to send selected device traffic through it. If you enter settings manually, use the exact values your provider gives you; the provider documentation is the authority for keys, endpoints, and addresses.
OpenVPN client
The OpenVPN client also requires a Next-Gen UniFi Gateway or UniFi Cloud Gateway. The configuration file is generally supplied by the provider. As with WireGuard, the tunnel does not route devices automatically, so a Traffic Route is still required. Ubiquiti says any provider that supports OpenVPN can work.
Check your connection type before you choose
Whether a VPN works depends on how your gateway reaches the internet, and the requirement differs by protocol.
- Public IP: Ubiquiti says most VPN server options require a public IP address. Teleport is the exception.
- Behind another NAT router: WireGuard and OpenVPN servers need port forwarding on the upstream router. Teleport can operate with both ends behind NAT.
- Carrier-grade NAT: If your provider places you behind shared addressing, you may not be able to forward a port at all. Teleport is the option most likely to work in that case, though Ubiquiti notes that the gateway WAN may need IPv6 in some circumstances.
- Port forwarding versus VPN: Ubiquiti’s remote-access guide separates encrypted, authenticated VPN access from simple port forwarding. Forwarding exposes a service directly and does not encrypt traffic by default, so a VPN is the safer way to reach your network.
Choosing a commercial VPN provider
This article does not rank commercial VPN providers. Ubiquiti’s documentation establishes which protocols the gateway supports, but it does not cover provider privacy policies, server locations, speeds, streaming access, simultaneous connection limits, or prices, so those claims cannot be made from this source. Before you sign up, check the following on the provider’s own site:
Rank #4
- UBIQUITI UNIFI GATEWAY LITE
- Does it provide a WireGuard or OpenVPN configuration file, or the values needed to enter a WireGuard setup manually?
- Does its documentation explain how to use that configuration on a router or gateway rather than only on a desktop app?
- Does it publish a current privacy policy and the server locations you need?
- Does its pricing match your budget at the time you sign up? Pricing changes frequently.
A popular desktop app is not evidence that the provider works with UniFi. The relevant question is whether the provider supplies a usable WireGuard or OpenVPN configuration.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Hardware and software checks before you buy
Hardware support is the step most likely to block a plan. The documented requirements are:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute- WireGuard server: UniFi Gateway or UniFi Cloud Gateway.
- OpenVPN server: Next-Gen UniFi Gateway or UniFi Cloud Gateway, with Network application 7.4 or newer.
- WireGuard and OpenVPN clients: Next-Gen UniFi Gateway or UniFi Cloud Gateway.
- Teleport and L2TP: requirements are not stated on the pages reviewed for this article; check the current UniFi documentation for your model.
Ubiquiti’s pages are undated and feature requirements change, so confirm the exact gateway model and software version against current official documentation before purchasing. This article does not recommend a specific gateway model or retailer.
Best Value
- Integration with Unifi Controller. Powerful firewall performance
- Convenient VLAN support. QoS for enterprise VoIP
- VPN server for secure communications. 10/100/1000Base-T
- 3 Ports - Management Port - SlotsGigabit Ethernet - Wall Mountable, Desktop
- Refer instruction manual for troubleshooting steps.
Limitations of this guide
The official UniFi pages describe protocol support, configuration steps, and software requirements. They do not establish which VPN provider performs best, how fast any tunnel will be, or whether a particular streaming service will allow traffic from a given server. Treat any statement of that kind as unverified unless it comes from the provider’s current authoritative documentation.
For remote access, the decision is mostly technical and straightforward: Teleport for mobile devices and the simplest setup, WireGuard for desktop control, and OpenVPN when you have a specific reason to use it. For provider routing, the decision depends on the provider’s configuration support and on whether your gateway is one of the supported models.
Quick Recap
Common setup mistakes
- Tunnel connected, devices unchanged: the client tunnel is up but no Traffic Route sends device traffic through it.
- Remote access fails behind a second router: the WireGuard or OpenVPN port is not forwarded on the upstream router, or the gateway has no public IP.
- Teleport invitation rejected: the invitation is more than 24 hours old or is already in use by another device.
- OpenVPN server not available: the Network application is older than 7.4.
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
