UniFi Network VPNs: A Comprehensive Guide to Secure Remote Access

Introduction to UniFi Network VPNs

Virtual Private Networks (VPNs) are essential tools for securing remote connections and accessing internal network resources. UniFi Network offers five different types of VPNs, each with its own unique features and use cases. This comprehensive guide will explore each type of VPN, how they work, and when to use them for optimal security and reliability in your remote connections.

Types of VPNs in UniFi Network

UniFi Network provides the following VPN options:

1. Teleport
2. VPN Server
3. VPN Client
4. Site-to-Site VPN
5. Site Magic (SD-WAN)

Let's examine each type in detail.

Teleport: One-Click VPN Solution

Teleport is UniFi's user-friendly, one-click install VPN solution. It's designed for ease of use and provides mobile devices with access to internal network resources.

Key Features of Teleport

• Quick and easy setup
• Secure access to internal network resources (e.g., Pi-hole, Home Assistant, Synology NAS)
• Secure web surfing through your home internet connection when abroad
• Protection from public Wi-Fi security risks

How to Enable Teleport

1. Navigate to Settings > Teleport and VPN in UniFi Network
2. Check the "Enabled" checkbox

Connecting Users to Teleport

• Administrators can log in to the Wi-Fi Man app using their Ubiquiti Single Sign-On account
• For non-administrator users, generate a secure link (expires in 24 hours if not accepted)
• Users click the Teleport link on their smart device to open the Wi-Fi Man app and connect

Limitations of Teleport

• Limited to devices that can run the Wi-Fi Man app (iOS and Android)
• Not compatible with Windows PCs

VPN Server: Flexible Remote Access Solution

VPN Server functionality in UniFi Network offers more flexibility than Teleport and supports a wider range of devices.

Key Features of VPN Server

• Access to internal network services remotely
• Secure web surfing through home internet connection
• Support for various devices beyond smartphones and tablets

Setting Up VPN Server

1. Go to Settings > Teleport and VPN > VPN Server tab
2. Choose the VPN type (WireGuard, OpenVPN, or L2TP)
3. Name your VPN Server
4. Configure advanced settings if necessary (e.g., VPN network subnet, DNS servers)
5. Add VPN clients for each device that needs to connect

VPN Server Types

• WireGuard: Lightweight, fast, and secure (recommended)
• OpenVPN: Previously the standard, still secure but less efficient than WireGuard
• L2TP: Older, less secure option (use only if required for compatibility)

Configuring VPN Clients

1. Click "Add Client" in the VPN Server settings
2. Name the client
3. Download the configuration file or scan the QR code
4. Import the configuration file into the WireGuard app on the client device

Securing VPN Access with Firewall Rules

By default, VPN clients have access to all internal networks. To enhance security, you can implement firewall rules to restrict access.

Creating IP Groups

1. Go to Settings > Profiles > IP Groups
2. Create groups for:
   • RFC 1918 subnets (all private subnet ranges)
   • Teleport VPN network
   • WireGuard VPN network

Implementing Firewall Rules

1. Navigate to Settings > Application Firewall > Firewall Rules
2. Create a rule to block all inter-VLAN traffic by default
3. Create rules to allow specific traffic between VPN networks and internal networks

VPN Client: Connecting to External VPN Servers

VPN Client allows UniFi Network to connect to external VPN servers, such as those provided by employers or VPN proxy services.

Use Cases for VPN Client

• Connecting to employer's VPN server for access to work resources
• Using VPN proxy services like Private Internet Access

Configuration Options

• Send traffic for specific domains through the VPN tunnel
• Create a separate VLAN for VPN-only traffic
• Set up specific devices to always use the VPN tunnel

Site-to-Site VPN: Connecting Remote Networks

Site-to-Site VPN establishes secure, permanent connections between different network routers.

Key Features of Site-to-Site VPN

• Connects remote networks with different equipment or firewalls
• Uses pre-shared keys for authentication
• Supports standard or policy-based routing between networks

Site Magic: UniFi's SD-WAN Solution

Site Magic is UniFi's implementation of Software-Defined Wide Area Network (SD-WAN) technology.

Key Features of Site Magic

• Configures Site-to-Site VPNs between UniFi networks
• Works with NAT, LTE, or 5G connections
• Connects up to five sites in a Site Magic group (limit to be increased in future updates)

Requirements for Site Magic

• UniFi gateway console (UDM Pro, UDM SE, Dreamwall, Dream Machine, or Dream Router)
• UniFi OS version 3.1 or higher
• At least one gateway with a public IP address on the WAN interface
• All gateways administered by the same UniFi account

Conclusion

UniFi Network offers a range of VPN solutions to meet various remote access and network connectivity needs. From the user-friendly Teleport to the advanced Site Magic SD-WAN, there's a VPN option for every scenario. By understanding the features and limitations of each VPN type, you can choose the best solution for your network and implement proper security measures to ensure safe and reliable remote access.

Remember to always keep your UniFi Network software up to date to take advantage of the latest VPN features and security improvements. With the right configuration and security practices, you can create a robust and flexible remote access solution for your UniFi Network.

Article created from: https://youtu.be/54hCV9nce0o?si=QkVdRT7F1hWBVHJB