The Hidden UDM Pro VPN Settings That Improve Remote Access

The Hidden UDM Pro VPN Settings That Improve Remote Access, you want to remote into your UniFi network, you might have tried something like the built-in Teleport VPN, which as an admin works pretty well. You just go into the Wi-Fi Man app, or on a desktop, the same thing. A couple of seconds and you are locally connected to that UniFi network.

The problem is that it exposes essentially the entire network to that remote VPN user, and it does not have split tunneling.

That is why you might then go to something like an OpenVPN server, which does have split tunneling, and in general that is what many people set up for clients. The issue with that is that you have to remote into the customer’s computer and every single other employee who needs VPN access and configure the VPN on each of their computers individually.

Read More: Best VPN on Router: The BEST Way to Secure Your Home Wi-Fi

But now UniFi Identity One-Click VPN supports split tunneling. In the Identity app, you just tap on the VPN icon and almost instantly you are connected to the local network. You can access any kind of work files on a server or a NAS securely. At the same time, if you go out to the web, YouTube or something, it will go through your own device’s internet connection and not through the office or the remote location you are remoting into. That is all done securely with a couple of firewall rules.

What Is UniFi Identity One-Click VPN?

UniFi Identity One-Click VPN is exactly what it sounds like. For the end user, connecting to the VPN takes just one tap. On desktop, there is a small icon with a VPN option, and on a smartphone it shows up as a tile. For the end user to set this up, they simply follow an automated email and can configure it on their computer or smartphone very easily.

It is also worth mentioning that this covers the free version of UniFi Identity Endpoint. There is an enterprise version that can do this and much more, but everything described here applies to the free version.

Requirements Before You Begin

Before setting this up, there are a couple of requirements to be aware of.

First, you need a UniFi Cloud Gateway. Essentially any of the available models should work fine.

Second, you need a public IP address. Not a private one, not one that starts with 172, 192, or 10 for the first octet. You need a public IP. Something like Starlink uses CGNAT, and those IP addresses are not public IPs. They start with 100. UniFi has a help article that gives you the specific range of IP addresses that will not work. Basically, you need a public IP for this to function.

Read More: Best VPN for Torrenting + Best VPN for Port Forwarding Options 2026

If you do not have a public IP, you will need to do port forwarding on your upstream router. As a note, UniFi’s Teleport VPN will work with CGNAT connections like Starlink, so that is an alternative in those cases.

Step 1: Enable UniFi Identity

Go into the UniFi dashboard and navigate to Settings, then Admin Users, then Identity Endpoints. It will give you a quick info screen. Read the terms of service and privacy policy if you like, then agree and get started.

By default it will enable a couple of services. You will want to disable those and only keep the One-Click VPN option enabled. Also disable auto-send invitations for now. This setting automatically sends an email to users as you create them to set up UniFi Identity, but you can handle that manually. Leave the expiration at 7 days.

Step 2: Enable Split Tunneling

This step is important. If you stop after the previous step, you will not get split tunneling. You have to go to Service Settings and enable split tunneling. This ensures that when users browse the web, such as going to Google or YouTube, they use their own internet connection and do not consume bandwidth from the office or remote location they are connected to. Apply the changes and close that out.

Step 3: Enable the Service for Users

From here you just need to enable the service for your users. You can integrate UniFi Identity with Microsoft or Google Workspace, but for basic setup just go to Users. All admins are also users by default, and you can create additional users as needed.

Click on a user to open their panel and go straight to Settings. Enable Network and One-Click VPN, then apply the changes. Once enabled, go to Overview and find the Identity Invitation. This is the email that will be sent to the user. You can copy the link or send it directly to their email address.

Step 4: Setting Up the App as an End User

From the end user’s perspective, here is what the setup looks like on an iPhone. The process is the same on Mac, iPad, or Windows.

1. The user receives the invitation email and clicks “Get Started”
2. It will prompt them to download the UniFi Identity app from the App Store or install the application through the web browser on desktop
3. Once installed, open the app and click “Get Started”
4. Go back to the email and tap “Load Your Credential”
5. Click Allow when prompted for permissions
6. Allow notifications if asked
7. Click on the VPN icon
8. Allow the VPN connection when prompted
9. The VPN icon will appear, confirming you are connected

By default, because split tunneling was enabled during setup, it will be active. Users can see this by clicking the three-dot menu in the app. If a user switches the toggle from split tunneling to all traffic, all of their internet traffic will route through the VPN tunnel.

Step 5: Configure Firewall Rules for Security

To keep the VPN more secure and restrict what users can access on the internal network, you can set up firewall rules. For example, if you only want employees to access a NAS and not the entire internal network, here is how to do it.

Read More: Complete NordVPN Reviews: How to Use NordVPN on All Devices in 2026

Go to Security, then Firewall. By default, the One-Click VPN zone is allowed to access all internal zone networks. You will want to change this.

Create a block rule:

1. Create a new policy and name it something like “Block Any VPN to All Internal”
2. Set the source zone to VPN
3. Set the action to Block
4. Set the destination to the entire internal zone
5. Add the policy

Create an allow rule for specific access:

1. Create another policy and name it something like “UniFi Identity VPN to NAS”
2. Set the source to the VPN zone
3. Set the action to Allow
4. Set the destination to the specific IP address of your NAS, or use a network object
5. Add the policy

Make sure the allow rule is ordered above the block rule by using the reorder option. With these rules in place, users on the VPN will only be able to access the NAS and nothing else on the internal network.

Optional: Prevent users from switching to all traffic mode:

If you do not want users to be able to route all their traffic through the VPN, you can create an additional rule to block VPN access to external/internet traffic. If a user tries to switch to all traffic mode, they simply will not have an internet connection, which discourages them from using that option.

A Note on Custom Subnet and Renaming

In the WireGuard VPN settings under Advanced Manual, you can set your own subnet for VPN clients. For example, using a specific VLAN ID and third octet makes it easier to identify connected VPN clients in your client device list.

You can also rename the One-Click VPN to your site name. When someone connects, they will see your site’s name instead of a generic VPN label. Note that the VPN will not automatically update if your public IP changes, such as when switching to a backup internet connection. In that case, you would need to manually update it in the settings.

A Note on Teleport VPN and CGNAT

If you need to use Teleport VPN for CGNAT reasons such as with Starlink, be aware that it does not show up in the zone-based firewall the same way. Teleport VPN devices will appear separately under Client Devices under the Teleport section. You can still create firewall rules for those devices by targeting the IP addresses they receive, but it is a bit more complicated to manage compared to the Identity VPN.

FAQ

What is UniFi Identity One-Click VPN?

It is a free VPN feature built into the UniFi ecosystem that allows users to connect to a remote UniFi network with a single tap or click. It supports split tunneling, meaning only work-related traffic goes through the VPN while general internet browsing uses the user’s own connection.

Do I need a public IP address to use UniFi Identity VPN?

Yes. A public IP address is required. Connections that use CGNAT, such as Starlink, will not work with UniFi Identity VPN unless port forwarding is configured on an upstream router. In those cases, Teleport VPN is an alternative.

What VPN protocol does UniFi Identity One-Click VPN use in the background?

It uses WireGuard, which is a modern and efficient VPN protocol. UniFi creates and manages the WireGuard server automatically when you enable Identity Endpoints.

What is split tunneling and why does it matter?

Split tunneling means that only traffic destined for the internal network goes through the VPN. Internet browsing goes through the user’s own connection. This saves bandwidth at the office or remote location and gives a better browsing experience for the remote user.

Can I restrict what VPN users can access on the internal network?

Yes. Using UniFi’s zone-based firewall, you can create rules that block VPN users from accessing the entire internal network and only allow access to specific IP addresses, such as a NAS or a server.

Is this suitable for connecting two office locations together?

No. UniFi Identity One-Click VPN is designed for individual remote users. For connecting two sites securely, you would want to use a site-to-site VPN solution, which UniFi refers to as Site Magic.

Is the free version of UniFi Identity Endpoint sufficient for most small businesses?

Yes. The free version supports One-Click VPN with split tunneling and user management, which covers the needs of most small business remote access scenarios. An enterprise version is available for more advanced features.

Conclusion

UniFi Identity One-Click VPN is an excellent solution for small businesses that need to give employees secure remote access without the complexity of configuring VPN clients on every individual device. With split tunneling enabled, employees can work remotely while using their own internet for general browsing, and firewall rules ensure they can only access what they need on the internal network. The setup process is straightforward from both the admin and end user perspective, making it a very practical choice for small business IT environments.

If you have two sites that need to stay connected securely, this is not the right approach. For that use case, you would want to look into a site-to-site VPN, which UniFi refers to as Site Magic.