The UniFi Dream Machine SE can run several kinds of VPN, WireGuard, OpenVPN, L2TP and Teleport among them, and when one will not connect or does not reach your network, the cause is usually the address, the port or the client's setup, and the UniFi Network application shows where. Open Settings, VPN, and look at the VPN server you set up. Make sure it is enabled, and note its port and protocol. A VPN server on the gateway can only be reached from outside if the gateway has a public address on its WAN;
The checks in more detail
check the WAN address in the app, and if it is private, a provider is placing the gateway behind carrier-grade NAT, and a direct VPN will not work; Teleport, which relays through Ubiquiti, may still do so. If the gateway sits behind a modem that routes, forward the port from the modem or put it in bridge mode. The second common issue is the changing address. Use a dynamic DNS service, set under Settings, Internet, Dynamic DNS, and put the name in the client rather than the number.
Check the firewall: a rule that blocks WAN to LAN or that blocks the VPN network can stop access, and the VPN has its own zone with its own rules, so make sure traffic from the VPN to the networks you want is allowed. For WireGuard, check the keys, the allowed addresses and the endpoint on the client; a wrong key or a client time that is wrong produces no handshake. If the VPN connects but you cannot reach devices, check the subnet of the VPN against your home network, since overlapping subnets stop routing, and the DNS the VPN gives the client.
If it connects but is slow, the gateway's VPN throughput is limited, and heavy IDS adds to it. A client on a network that blocks the VPN port, such as a hotel, may need a different port or protocol; OpenVPN on TCP 443 is more likely to pass. Update the firmware, restart and test from mobile data. Remove old VPN clients from the list to avoid conflicts. Use strong keys and keep your gateway updated since a VPN is a door. If a VPN stops after an update, re-create the client configuration. Ubiquiti's help pages and community can assist with logs.
Differential
Likely causes of “Ubiquiti UniFi Dream Machine Special Edition VPN client or server will not connect”, and how to tell them apart
- 1
A private WAN address or a modem in front
What separates it Nothing connects from outside
How to confirm Ask for a public address, bridge the modem or use Teleport
- 2
A changing address
What separates it It worked and then stopped
How to confirm Use dynamic DNS
- 3
A firewall rule or wrong zone
What separates it Connects but no access
How to confirm Allow VPN traffic to the networks needed
- 4
Wrong keys or client time
What separates it No handshake
How to confirm Re-create the client configuration
- 5
Overlapping subnets
What separates it Connected but no routing
How to confirm Change one of the subnets
Before you touch a setting
Record this first — changing settings destroys the evidence
- The VPN type and port
- The WAN address
- The client's network
- The firewall rules
Try in this order
0 of 6 completedCheck the VPN server
ReversibleEnabled, port and protocol.
Check the WAN address
ReversibleIt must be public.
Set up dynamic DNS
ReversibleAnd use the name.
Check firewall rules
ReversibleFor the VPN zone.
Check the subnets
ReversibleFor overlap.
Test from mobile data
ReversibleFrom outside.
Model-specific
What is true of this model and not of its siblings
- Public address
- Needed for a direct VPN.
- Subnets
- Overlap breaks routing.
Stop boundary
When this stops being a self-service repair
- !If the VPN stops after an update, re-create the configuration
- !Ask Ubiquiti or the community with logs
- !Keep the gateway updated
Evidence ledger
Sources behind this answer
Exact questions
Common questions
Which VPNs does the UDM SE support?+
WireGuard, OpenVPN, L2TP and Teleport among others.
Why can't I connect?+
A private WAN address or a blocked port.
Why can I connect but not reach devices?+
A firewall rule or overlapping subnets.
Is Teleport an option?+
Yes, it relays through Ubiquiti.