Unifi Site to Site VPN new Interface

[@Fiskelord]

Short and sweet, no bullshit included, yet all necessary details are present. Good job on the video!

[@dawn9340]

Big YES to VPN troubleshooting.

[@ChristopherNealBUSHIDO49ERS]

"All right. Thanks!" LOVE that! This is a great video as I've been tasked to do exactly this for one of my clients. Extremely helpful. Thanks again.

[@feldmesserjeremy3229]

Very good video, clear, concise, easy to follow. Could you please do one showing the openVPN implementation as in the USG of site to site? (my ISP router isn't in Bridge mode so I'm behind NAT already)

[@andyrandy0815]

399 USD!

[@MichaelMcConaghy-ol7ee]

Cody, Great video!!! I'm currently setting up my business with this setup. I would love to see how I can forward an existing VLAN through the STS and assign it to a port on the outside location. Thank you for posting such great videos...

[@iStiflock]

I would love to see the multi site configuration actually done live. You mentioned it but didn’t do the configuration.

[@MactelecomNetworks]

It’s the exact same just on a bunch of consoles

[@iStiflock]

@@MactelecomNetworks I’m just wondering you would add all the subnets to each site to make them talk to each other right? So if there are four sites I would need to create a site to site 4 times on each right?

[@TheIceMan9304]

@@iStiflock I believe no, when they connect over vpn they get a local ip for the host, am I wrong Cody? That's why they can't be the same subnet as each other.

[@yt310yt]

Once the site to site VPN is configured, is there a way to route all traffic for a specific device through the remote site? For example, an Apple TV on my local network that routes all its internet traffic through the remote site WAN. THX!

[@SoFloCaribbrean]

With a site to site VPN, I understand that I understand that I can to access local resources from the Remote site provided that subnets are configured correctly (no conflicts). Can a site to site VPN be use to circumvent Geo-blocking. I have two UDM Pros. One in Miami and one in the Dominican Republic.

[@yt310yt]

+1 on this

[@asc684]

Thanks for the DDNS question, Dawn. I'd be interested in that as well urgently.

[@TheJuzy]

I have a site to site setup with DHCP WAN on both sides with DDNS. I just used OpenVPN protocol instead of manual IPSEC in the UDM-PROs.

[@ShaneNSAT]

@@TheJuzy Does Openvpn have hardware offloading on the UDM? this was the big drawback with using openvpn i thought.

[@MrTylerDIREC]

Hey Cody, wondering if you would do an advanced video on how to to this using OpenVPN due to having a dynamic ip (dyndns hostname assigned) on 1 or both sides. Between a USG-3P Site A that the hostname is assigned to (I have the ability to set in WAN settings this site as a static ip as it is on a cable modern in bridge mode and the IP rarely changes and a UDR at Site B that is behind NAT that I do not have access to the modem/router to create port forwards etc and it assigned a private ip on the WAN port. Please include firewall rules as well :) Thank you. If anyone knows how to do this or has had success please let me know. I've dug around online plenty and everything that is turning up I am not having any luck with. All hardware and controller/ OS is up to date as of this post.

[@nightdesigns395]

Troubleshooting would be handy. Is there even a status indicator in the new interface?

[@philip_james]

Did you ever find a way of viewing the Site to Site status?

[@MA-oh9zn]

Hi @philip_james Settings->VPN and you have a status and uptime column to look at. im running version 8.0.7

[@dawn9340]

This is amazing, thank you so much. What if the WAN IP changes on either side due to internet provider having dynamic addressing? Will the Ubiquiti devices’ cloud connection just fix it or?

[@dawn9340]

Well it would be really cool if it did. I looked into it and everyone says you need a DDNS (dynamic DNS) provider. Static IPs are usually around $10/month on a business plan. You should only need one.

[@CoolSteve08]

@@dawn9340 I believe this is possible when using the OpenVPN instead of Manual IPSec. Might require newer firmware/Network applications but I believe it's possible now without static IP's.

[@air1jdg]

Great details. I am planning on setting up my primary house where I have a UDM-SE with my vacation home where I will be putting in a UDR. Would you say that the Unifi Site to Site VPN is the best way to gain access to my Buffalo NAS and a few other resources while I'm at the other home? Some folks on a user group are saying I should look at something else to do it.

[@jamesbarnette4350]

wont let me same if the subnet overlaps with the internal IP address of the UDM-PRO. How did you get around it? It let you save it no problem. I have one side internal IP is 192.168.1.1 with shared subnet 192.168.1.0/24 and I have one side internal IP is 192.168.2.1 with shared subnet 192.168.2.0/24 but when I got to save it says that it is invalid because there is overlap

[@luiscobarrus4046]

Eres muy guapo, siempre veo tus videos, por que me sirven mucho, para saber cosas nuevas, 🙂

[@didierb5314]

Thanks for this cristal clear video. My job was to interconnect 2 UDMPro's which are physically located in the same cabinet without going thru Internet. In my config, the VPN is wired between the 2 secondary WAN interfaces using a private RFC 1918 IP network (and a fake ip gateway address). The VPN configuration on both UDM's was really straightforward (which is not always the case in the Unifi world. ^^).

[@pcm1ke]

why would you use a vpn to connect two udmp's that are in the same cabinet and not just plug them in to one another physically?

[@macjonte]

Do both sides need to have public IP? One site for us has carrier IP (100.x.x.x). Why can't it just connect to the HQ with a good connection?

[@KeithSangster]

Did you ever do a troubleshooting VPN video? This should be easy enough but failing miserably. I had this configured a while ago and it worked fine. I've since reconfigured the UDM's and added the new config to re-establish the link but it's not working. Wondering if it's the latest firmware or just me doing something stupid.

[@BigFourHead]

Thanks for this. What sort of traffic rules can you put into place and firewall rules.

[@Elkadetodd]

For client-to-site (dialin) VPN, the Unifi UI won't let you assign IPs in from your LAN subnet to the remote clients. Which means besides problems accessing resources, the client can't do split-tunneling. My older Edgerouters all do that just fine. I'd love to see a video on how to do that manually in the config files.

[@TheJuzy]

Hello! For split tunneling on Client to Site VPN, try the new WireGuard setup instead. You can run it at the same time as the L2TP server is up. For once, you can assign every user an reserved IP (This is great for making traffic routes and rules). And you can configure split-tunneling on the client side as well through the WireGuard client config file.

[@scholziallvideo]

so when can we use dyndns names for the site2site VPNs. No one have got static public ip when you are not a business isp conenction.??

[@bigdoggetom6549]

If I have three sites, and I set up an S2S between A and B and A and C, will sites B and C be able to communicate via site A, or do I need to set up a further S2S?

[@macautomatic7906]

how about I dont have unifi device in other site except for stand alone camera only. would it be added to nvr using vpn?

[@ryantfinchum]

i set this up EXACTLY as you described, but to no avail...it refuses to ping a device remotely that is responding locally to ping commands...both using debug terminal in UniFi... 2 UDM Pros, setup with public/static IPs from Comcast, both up to date, quadruple checked settings to be the same...nothing...ideas?

[@KJ-hi8er]

Hi , im tring to create site to site VPN with cisco asa device and I can not find any phase 2 details from Unifi device end ? can you help me with this .

[@bareeves]

Cody when you get a second UDMP or SE and you need to configure it for the second site, can you setup the second UDMP on the Original network that the 1st UDMP is running? or will the second UDMP conflict? WHen you make a video on setting up a new UDMP.. did you disconnect your ORIGINAL UDMP??

[@dextorjpw]

So I ran into an issue. So I have three sites, A, B and C. I setup A to B and it works perfectly. When I add C into the mix so that A talks to C but then A and B cannot talk to each other. I disable A to C and then A to B starts working again. Any ideas?

[@7jasonlam]

We established the S2S VPN between 2 sites but couldn't join the PCs in site A to the AD in site B. Able to ping and resolve the DNS. Any ideas? Thanks.

[@zyxwvutsrqponmlkh]

So the remote gateway/subnets are the subnets on the far end not on the local end right? Cant I just have one subnet or vlan that everything on both ends sits on?

[@callumrogers7825]

Would be interested to see a S2S configured where the DC has a DHCP server. Unsure if the UDM Pro/SE allows DHCP relay/L3 routing.

[@Random_Innovation]

I tried site to site auto VPN and manual & neither works for me. The Unifi support team couldn’t figure this issue out either.

[@Migueruzo]

Hello im trying to config a vpn site to site from my usg to a microtik FW. But the conection fails on phase 2 cause the microtik need a phase 2 on the cliente Fw. Is there a solution for this kind issue?

[@cooperadventures]

Any idea or where I should start looking, as I cannot get my 2 udm pro to connect site to site using ipsec, I can get it to work using openvpn. Any help would be appropriate. I've set it up as you described.

[@futurecactus]

I missed the poll but I hope you still do the maglock video.

[@drpglobalsolutionsllc6926]

CAN YOU PLEASE DO A VIDEO ON THE LAYER 3 SWITHC REQUIREMENTS TO USE IT FOR DHCP AND ROUTING. IT DOESNT SEE TO WORK AS EXPECTED.

[@jamesbarnette4350]

did exactly what is here but wont save the remote subnets says there is overlap. Which I mean of course there no?

[@michaelcannizzo1076]

I know and have setup a PIA/NordVPN and tagged it to a specific port/SSID. Is there a way to do the same with a site to site VPN? 1 SSID goes out the local ISP and another VPNs back to the other UDM or tag a port in the same manner so when I jack into a specific port on the switch it is a VPN connect to the other UDM? Although it sometimes has it's uses, I don't want the whole site to connect back to another site.

[@camerontgore]

Will this work if I have a Unifi controller at home as a VM and a UDM SE at the remote location?

[@EduZn1]

Hi, if I will connect these two sites over LAN (fiber port) and don't by internet, should I use this same configuration Site to Site VPN, or another one setup?

[@letthatsinkin4128]

Would a UDM-SE on the main network work with something like an Edgerouter 4 on the other end?

[@DavidC-rt3or]

Assuming the ports 500/4500 would only need to be UDP for IPSec? (NAT Traversal)

[@MikeyD2487]

So would firewall rules for that site to site connection be considered LAN IN? How would that work?

[@YCIT926]

Hi, Is the Site-to-Site-VPN for Ubiquiti support multiple sites connecting to the Main site? each site is different location with different static IPs Example: Main site A I need to connect Sites B and C to site A.

[@DommeDE99]

Is it possible to use DDNS Namens instead of Static IP adresses? I only have a static public IP adress on one side.

[@micholy]

do the IP have to be static on both sides or can I use dynamic IP?

[@amilaperera8209]

Hi, with this VPN, can we create one hotspot on Head Office UDM for multiple Sites ? I need advice on that.

[@Foiliagegaming]

I have been struggling getting my vpn up and running just with pfsense. I can not figure out the issue. I wish I would have just gone the easier route with all ubiquiti. Next time...

[@ThePcarneiro]

Hello, great video, I made this vpn to vpn between my udm pro and a udm pro se, it says its on oline on both of them. But i cant ping neither sides or acess services and shares. what am I missing? please give some help.

[@PowerUsr1]

Are different ciphers available? What are remote access solutions?

[@Slip-ri3fj]

Thank you for the great video. Good information. Will it be possible to create and share a video where only the one side has a static IP and the other one has a nonstatic?

[@MactelecomNetworks]

Hmm that's possible. They are coming out with a new type of vpn which will make it a lot easier

[@rick5056]

Do you need a static ip to work? Then a home package from Telus that changes public ip will not work then?

[@musicid93]

Static IP would make it alot easier, but its still possible without it. Look up DDNS for Site to Site VPN. tons of videos on options and How to's

[@rick5056]

@@musicid93 Thanks for the useful info.

[@rangawork7158]

@@musicid93 only if you use openvpn though

[@rafaelrodriguez3400]

What about a video on how to do the openvpn configuration on the udm?

[@consecratedtech]

you say they are in bridge more. I have heard some horror stories about ISPs not completly allowing bridge more and worse doing things like changing ports. how do you stay on this?

[@MactelecomNetworks]

Hey, For this company they have static ips so I don't need to worry about that. But you can always user ddns

[@georgekaplan6451]

In the new interface is there any way to see the VPN status like there is the widget for the old one?

[@philip_james]

I too need to see Site to site VPN connection status. Did you find any way to view this?

[@nxllpo]

Ok like this SITE TO Site yes but is it possible to just buil a tunnel for Trunk Ubiquity anD PA-220 ... i would just make a tunnel and then put a switch with the port trunk and then other ports that are already ...with 2 VLANS ... basicaly i moved one flor to another building with noi physical connection ... is it possible to achieve this ??? PA is configured with Agregate ports

[@mikemacb7rs4]

Is this different then "site magic"?

[@3r2]

@MactelecomNetworks ZERO success with this.. haha. Followed your instructions to the letter. Both of my DMP Pro's are bridged. I can ping the remote IP address from debug/Unifi, but not the remote (local) address. Any way you can post that troubleshooting video?

[@troyfisher2262]

Great Video, what if i wanted to ping by the hostname on the site to site vpn, is that possible?

[@NoName-wy4hf]

Do you need to pay for static public IP?

[@MaferCatia]

hi, can you please help with a site 2 site vpn or wireguard with Starlink internet provider??? i already try both and open vpn and wont work. :(

[@RobertMerriamSWDG]

I've tried everything I can't get that to work at all

[@pcleats]

Cody, I have an interesting question for you about VPN's. Currently I use the USG-Pro-4 and auto VPN to connect to my 5 different sites. I want to use the new UXG-Pro, but it is my understanding that it no longer supports Auto VPN. If that is the case how does one manage all the different sites from a single controller? I do not have a controller running at any of my remote sites. Any suggestions on how I can manage all my sites from a single controller going forward?

[@brunomallmannformulo6271]

I don't have the answer to your question. But I have a question, you have 5 VPN sites connected, do you use the same ISP provider on the 5?

[@ThePirateGod]

Need a trouble shooting video I did all of this and it just doesn't connect.

[@agdielnavarroperez2729]

I have not been able to connect two udm pro with this, this problem is already killing me. Does anyone know of any option that is happening to me or something else that should be done. Ubiquiti has not helped much.

[@ac7ma]

Does each UDM have its own management account?

[@brunomallmannformulo6271]

I have a Site-to-Site VPN set up and working perfectly. Using the same ISP provider. However when adding another VPN site from another ISP provider does not work. Can anyone help me?

[@christianschroeder7343]

Thx. for Your Video. One question. After establishing the site2site tunnel i can ping from 192.168.1.x to 192.168.10.x. Reverse is not possible. So pinging from 192.168.10.x to 192.168.1.x does not work. Any ideas? Hardware used is a dream machine on 192.168.10.x and a Ubiquiti EdgeRouter on 192.x168.1.x.

[@pradeepgupta6373]

I gat error subnet overlay. How to fix help.. Thanks

[@terrorwolf0213]

Does anyone know if all traffic is routed through the site to site VPN or if only certain traffic is routed through the VPN?

[@ConorPorter]

You lost me on the bridge requirement. Bridge mode to my knowledge means the provider modem/router is passing IP to avoid double-NAT.

[@MactelecomNetworks]

Yes. If you’re isp modem router isn’t in bridge mode you need to port forward

[@ags5080]

can we get an updated video?

[@chriseau6984]

How are you not pointing the fact that the UDM cannot use an FQDN while setting up the remote location in the s2s-VPN... This guide is useless unless you have a static IP on both site.

[@EscapeEFT]

Can this work between 2 different gateways? For example Site 1 Cisco, Site 2 Unifi.

[@MactelecomNetworks]

Absolutely \

[@alexalam1670]

how to do site to site VPN with one IP only subnet/32?

[@jerrylerma9269]

This is a great video, but can you do a video for client vpn

[@konnormcferran6744]

I followed all the steps but they can't talk to each other all setting at the same but the remote devices configuration has the infor of the other sight.

[@konnormcferran6744]

I got it working re did them and it worked must have been a typo or something.

[@MactelecomNetworks]

Great glad you got it working

[@Christian-yn2ky]

Has anyone found a way to have a new SSID have all traffic route to/from the site-to-site VPN?

[@mikeChisina]

Hello is it possible to have site to site VPN between UDM pro and a Cisco 1800?

[@MactelecomNetworks]

I dont see why not

[@Ghost-pt5eu]

UDM Site to Site will only connect to UDR. UDM is unable to connect to pfSense. How do I see Phase 2? Configuration only seems to show Phase 1.

[@MactelecomNetworks]

I have a video on site to site between a UDM and PFsense

[@Ghost-pt5eu]

@@MactelecomNetworks That's how I set it up. Did not work. Nobody seems to know how to access the Phase 2 settings. My pfSense and Synology Router communicate fine.

[@Ghost-pt5eu]

FYI The lifetimes for Phases 1 and 2 are 28800 and 3600 seconds. This needs to be matched on the third-party gateway. (These parameters are default and can not be modified yet on UniFi Gateways)

[@scotthowison8754]

Dose the site to site use split vpn droping internet traffic ?

[@friendorabox7792]

Based on what I have been trying, I believe it is. But I do hope someone could show me wrong. I tried to setup two UDMs, one in HQ and one in remote site, and create a full tunnel site-to-site VPN tunnel in between. I would like to tunnel back ALL traffics back to the HQ. But so far I have no luck.

[@ronan4681]

Site to site VPN between Sophos XG and UDM…. I can’t get it to work

[@allandresner]

It works - mine is working fine. IPSec

[@mikeraineri4018]

How about site to site with Vlans, for protect cameras, with a UNVR at only one of the sites. Example: site 1 (192.168.1.x for pcs and servers and 192.168.10.x for cameras and UNVR) while site 2 (192.168.2.x for pcs and servers and 192.168.11.x for cameras). Please

[@MactelecomNetworks]

I wouldn’t recommend this as it would use a ton of bandwidth on your isp link and cause you performance issues

[@ls1powered240sx]

Can you set up site to site VPN between dream routers?

[@rangawork7158]

Yes you can. Disclaimer I am running early access firmware / software

[@ls1powered240sx]

@@rangawork7158 cool thank you

[@lukey3030]

You can not run routing protocols over site to site vpns. This is not a scaleable solution

[@MactelecomNetworks]

Are you talking like ospf, bgp? My customer are small to midsize that do not use these anyways

[@lordcarnorjax8599]

This was where the UniFi auto site to site VPN came in. If you have multiple USG's in a single controller you would turn on auto site to site VPN and it built out the tunnels for you to all the sites, it could even handle dynamic IP's. UniFi is a supposedly a SDN product after all and that's a SDN feature. Problem is that the new UXG-Pro's don't support auto site to site VPN for some reason and UDM's have to run in their own controller per site so auto site to site VPN was never a option for them.

[@wprivera]

VPN's. Yes. VPN's.

[@allandresner]

Still no FQDN support ugh

[@rangawork7158]

OpenVPN supports this on the UDM site to site. I had to do this due to dynamic IP's

[@allandresner]

@@rangawork7158 is this a new feature?

[@rangawork7158]

@@allandresner I am not 100% sure, but what I found was ddns to a domain name + openvpn means on re-boot as soon as the network app is up and running. site to site works 🙂

[@wkmescudi]

Greeting's from Kenya do you have some UVC-G4-DOME ?

[@clarksonham942]

This is going to be probably the dumbest comment here but how do you decide what subnet to use ?

[@MactelecomNetworks]

Not dumb at all. I just create subnets that are different from each other. As long as they are not over lapping you are good

[@nielstaildeman]

IKEv1, SHA1??? Please don't use unsafe protocols

[@MactelecomNetworks]

People can change what ever they like I was just leaving at default for the video

[@joshmoreau6058]

@@MactelecomNetworks My console only allows for SHA1 or MD5, but I need to use SHA2-256 on IKEv2. Is that possible?

[@eldmaster]

I wish teleport was available on pc.

[@MactelecomNetworks]

I believed there will be a client for windows eventually