← All guides

Ubiquiti guide

This guide covers UniFi gateways (Dream Machine, Cloud Gateway, UXG) running UniFi Network 8.1 or later. These support WireGuard as a VPN Client.

Good to know:

• UniFi cannot do automatic failover between two VPN clients. You set up both tunnels, but only one is active at a time; if that PoP drops, you switch over yourself. If you want automatic failover, use a MikroTik (see that guide; you can also buy a preconfigured MikroTik from us).
• Not every version lets you forward incoming traffic on your fixed IP through the regular screens. Is the VPN client missing from the list of interfaces in step 3? Then choose one of the alternatives at the bottom.

1. The configuration files

Create two files on your computer. fixedip1.conf:

[Interface]
PrivateKey = PRIVATE_KEY
Address = TUNNEL_IP_1/32, FIXED_IP/32
MTU = 1420

[Peer]
PublicKey = SERVER_PUBLIC_KEY_1
Endpoint = ENDPOINT_1:PORT
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

And fixedip2.conf, the same but with SERVER_PUBLIC_KEY_2 and ENDPOINT_2:

[Interface]
PrivateKey = PRIVATE_KEY
Address = TUNNEL_IP_2/32, FIXED_IP/32
MTU = 1420

[Peer]
PublicKey = SERVER_PUBLIC_KEY_2
Endpoint = ENDPOINT_2:PORT
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

With UniFi, you set your fixed IP directly as the tunnel address.

2. The VPN clients

1. Settings › VPN › VPN Client → Create New.
2. Choose WireGuard, name it fixedip1 and choose Upload File: select fixedip1.conf. Save.
3. Do the same for fixedip2 with fixedip2.conf, and then pause that second client (off).

UniFi does not send anything through the tunnel yet: you decide that yourself with a route.

Your gateway must answer ping on the tunnels: our tunnel servers ping each tunnel to know which one works. If you block ICMP on the VPN client, we don't send your fixed IP to that tunnel.

3. Forwarding incoming traffic

Settings › Routing › Port Forwarding (in older versions: Settings › Firewall & Security › Port Forwarding) → Create Entry:

Field	Value
Interface	fixedip1 (the active VPN client)
From	Any
Port	443 (or the port you need)
Forward IP	LAN_HOST
Forward Port	443
Protocol	TCP

4. Replies and outgoing traffic through the tunnel

Settings › Routing › Policy-Based Routes (in older versions: Traffic Routes) → Create Entry:

Field	Value
Name	fixedip
Interface	fixedip1 (the active VPN client)
Devices	the device with address LAN_HOST
Destination	Any
Kill Switch	off

That way both your server's replies and its outgoing traffic go over your fixed IP. The other devices on your network notice nothing.

5. Switching over to PoP 2

Has PoP 1 dropped (the fixedip1 client stays on Connecting)? Then pause fixedip1, enable fixedip2 and select the fixedip2 interface in the Port Forward and the Policy-Based Route. Switching back works the same way.

Checking

• The active VPN client should show Connected.
• On LAN_HOST, open the site https://ifconfig.me: you should see your fixed IP.
• Test from outside, for example with your phone on mobile data: https://FIXED_IP should end up at your server.

Rolling back

Remove the Policy-Based Route, the Port Forward and finally both VPN clients.

Alternatives

• A MikroTik behind your UniFi gateway: follow the MikroTik guide; you then get automatic failover too. You can buy a preconfigured MikroTik from us.
• On the server itself: run WireGuard directly on your server; see the Linux guide. Your UniFi gateway then does not need to do anything.

Problems?

• Client stays on Connecting: check ENDPOINT_1/ENDPOINT_2, PORT and the keys.
• Connections hang: set MTU = 1360, upload the file again and reconnect.
• Nothing reachable from outside: check that the Policy-Based Route contains the right device and the active VPN client; without that route, the replies leave over your regular internet connection.

Stuck? E-mail us at info@fixedip.be