Ubiquiti UniFi Cloud Gateway Ultra VPN client or server will not connect

The checks in more detail

If it is a private address, the VPN cannot receive connections until you fix the double NAT, as the double-NAT page explains. The second cause is the address the clients use: if your public address changes, use a dynamic DNS name, and make sure the clients point to it. Third, check that the VPN's port is open on any device in front and that the Ultra's firewall allows the VPN traffic, which the application creates automatically. For speed, a VPN is limited by the Ultra's processor.

Encrypted traffic is slower than plain routing, and with IDS/IPS also on, throughput falls further, as owners on the Ubiquiti community report, so test the VPN with threat management off to see the difference. WireGuard is generally faster than OpenVPN on this class of hardware. For a client VPN to a provider, check that the policy-based routing sends the right devices through the tunnel and that DNS does not leak. If a site-to-site tunnel drops, match the settings on both ends, such as the encryption, the subnets and the lifetimes, and make sure the subnets do not overlap, for example both using 192.168.1.0. Update the gateway and application.

Check the logs in the application for errors. If clients connect but cannot reach devices, check the allowed subnets and the firewall rules between the VPN network and your LAN. Use strong keys and remove unused clients. Remember to review the list of VPN clients every few months and delete the ones you no longer use. Each client holds a key that can reach your network, so a phone you sold or a laptop you replaced should lose its access. If you share a client with family, create separate ones so that you can revoke each separately. Check the gateway's logs for connection attempts from unfamiliar addresses and keep the application updated.