Ubiquiti's gateway VPN options are Teleport, WireGuard and legacy types. Teleport is a zero-configuration VPN: enable it under Network Settings, VPN on a Next-Gen or Cloud Gateway running UniFi OS, generate an invitation, and share it. If the recipient already has the WiFiman mobile or desktop app the invitation adds the VPN automatically, and if not it prompts them to install it. An invitation expires in 24 hours and works for one device at a time.
The checks in more detail
Teleport can require an IPv6 connection on the gateway's WAN in some circumstances, and it need not be enabled on the LAN. Ubiquiti's FAQ says Teleport can be used when the gateway is behind NAT. WireGuard is the alternative for site to site and client connections, with its own server and client articles. Ubiquiti recommends WireGuard or Teleport instead of UPnP or port forwarding for reaching devices at home.
If a VPN will not connect, check the invitation has not expired, that the app is current, that the WAN has a route out, that a double NAT is not blocking WireGuard's port and that the client's network allows the traffic. Revoke access from the VPN page when someone no longer needs it. Decide who needs access and for how long. A Teleport invitation for a family member or contractor should be revoked when the need ends, and a WireGuard peer should be removed the same way.
Use a strong, unique credential where a credential is involved, and keep the gateway updated, since a remote-access feature is the part of the network most exposed to the internet. Test from a different network, not from inside the house, and note the round trip time. If the VPN connects but shows no traffic, check the allowed routes and that the remote device is not also using another VPN, since two tunnels on one device commonly conflict.
Differential
Likely causes of “Ubiquiti UniFi gateways VPN client or server will not connect”, and how to tell them apart
- 1
An expired invitation
What separates it You cannot add the VPN because the invitation has expired
How to confirm Generate a new invitation, and use it within twenty four hours
- 2
A missing IPv6 WAN
What separates it Teleport will not connect because the WAN does not have IPv6 enabled
How to confirm Enable IPv6 on the WAN, if your provider supports it, and try again
- 3
Double NAT
What separates it WireGuard is unreachable because there is a double NAT in front of the gateway
How to confirm Fix the double NAT first, since inbound connections cannot pass through two routers
- 4
An old app
What separates it The invitation fails because the WiFiman app on the phone is out of date
How to confirm Update the WiFiman app to the newest version, and accept the invitation again
- 5
An old gateway
What separates it The feature is missing because the gateway runs an old version of UniFi OS
How to confirm Update UniFi OS, so that the VPN features are available on your gateway
Before you touch a setting
Record this first — changing settings destroys the evidence
- Which type of VPN you are trying to use
- The exact error message that the app shows
- The WAN address and IPv6 state
- Whether the gateway is behind NAT
Try in this order
0 of 7 completedOpen VPN
ReversibleOpen the VPN settings, which are under Network Settings and then VPN in the application.
Enable Teleport
ReversibleEnable Teleport, or WireGuard, depending on which type of VPN you want to use, and then test again to see whether it helped.
Create an invitation
ReversibleCreate an invitation, and share it once, with the person or device that will use it.
Install WiFiman
ReversibleInstall WiFiman on the device, and accept the invitation from inside the app, and then test again to see whether it helped.
Check IPv6
ReversibleCheck IPv6 on the WAN if it is needed, since Teleport can need it in some situations.
Test remotely
ReversibleTest remotely, by connecting on mobile data instead of your home wifi, and then test again to see whether it helped.
Revoke when done
ReversibleRevoke access when it is no longer needed, from the VPN page in the application.
Model-specific
What is true of this model and not of its siblings
- Support
- Teleport needs a Next-Gen gateway or UniFi Cloud Gateway running UniFi OS.
- Legacy
- Older gateways offer L2TP and other legacy VPNs.
Stop boundary
When this stops being a self-service repair
- !If Teleport fails with a valid invitation and IPv6, contact Ubiquiti support
- !If WireGuard fails behind carrier NAT, use Teleport or get a public address
- !If the feature is missing, check the gateway type
Evidence ledger
Sources behind this answer
Teleport invitations and IPv6.
WireGuard server.
Choosing a VPN.
UPnP and its risks.
The company and its products.
Exact questions
Common questions
What is Teleport?+
Teleport is a zero configuration VPN that is powered by WireGuard.
How long does an invitation last?+
An invitation lasts twenty four hours, so use it within that time.
How many devices per invitation?+
One device can use an invitation at a time, so create one for each device.
Does Teleport need IPv6?+
In some circumstances Teleport needs IPv6 on the WAN, so check that if it will not connect.
Can it work behind NAT?+
Yes, it can work behind NAT, according to Ubiquiti.
What app is needed?+
You need the WiFiman app on the device, to accept the invitation and connect.
Can I revoke access?+
Yes, you can revoke access at any time, from the VPN page in the application.
Is WireGuard available?+
Yes, WireGuard is available as an option, alongside Teleport.
Is a VPN better than port forwarding?+
Ubiquiti recommends a VPN over port forwarding, since it exposes less to the internet.