UniFi UDM‑Pro Client VPN Setup (L2TP)

This guide walks through setting up a client‑to‑server VPN using the UniFi Dream Machine Pro (UDM‑Pro) so you can securely connect to your local network from anywhere in the world. The setup uses L2TP as the VPN protocol, which is natively supported on most client devices such as iPhones, Android phones, and Windows PCs.

What is a Client VPN?

A client VPN allows you to use your phone or another client device from outside your network and create a secure network tunnel from that device into your UniFi network. This is useful when you need to access local resources such as web servers, file servers, or other internal services while you are away from home or the office.

Site‑to‑Site vs Client‑to‑Server VPN

In this series, a site‑to‑site VPN is not covered. A site‑to‑site VPN connects one firewall to another instead of a single client device to a firewall. There are too many variations of site‑to‑site setups (UniFi to UniFi, UniFi to edge router, UniFi to Cisco, and so on) and each has its own nuances. This guide focuses only on a simple L2TP client‑to‑server or client‑to‑firewall VPN on the UDM‑Pro.

Network and WAN Requirements

Before configuring the VPN, ensure your UDM‑Pro’s WAN connection uses a routable public IP address and not a private IP address. If your ISP provides a private IP address (for example, behind a double‑NAT setup), you should configure your ISP’s modem in bridge mode so that the public WAN IP is directly assigned to the UDM‑Pro interface.

If you are unsure, search for “bridge mode” together with your ISP’s name and follow their instructions. If bridge mode is not possible, you must correctly configure port forwarding for the UDM‑Pro, but that is beyond the scope of this basic setup.

Creating the Client VPN Network

Log in to the UniFi dashboard.
Go to Settings → Networks.
Click Add New Network.
Name the network Client VPN.
Under VPN settings, select Remote Access. This option enables users to securely connect to your network from a remote location.

Configuring VPN Settings

Under VPN protocol, choose L2TP. This is the only option available for this type of setup.
Enter a Pre‑Shared Secret key. In this example, the key is iloveunifi (all lowercase).
Select the WAN IP address that will host the VPN connection. In this case, the WAN1 IP address is used.

Setting Up Users and Access

Under User Access, leave the RADIUS profile set to Default. Creating a custom RADIUS profile is beyond the scope of this guide and not required for basic client VPN access.

Under User List, add at least one user:

Click Add User.
Enter a username (for example, sherwood2).
Enter a secure password.
Click Create User.

The users created here are the accounts that will be allowed to connect to the remote client VPN from their devices.

VPN Subnet Details

When you expand the Advanced section, you can see the subnet assigned to the client VPN. In this example, it is 192.168.2.0/24, which corresponds to the subnet mask 255.255.255.0. This subnet provides 248 usable host addresses by default. You can reduce this number if needed, but for a basic setup, the default configuration is sufficient.

All other advanced options are left at their default values to keep the configuration as simple as possible. After confirming the settings, click Add Network.

You should now see the Client VPN network listed with the 192.168.2.0/24 subnet and a VPN checkbox indicating this is a VPN‑enabled network.

Configuring the Client Device (iPhone Example)

This example uses an iPhone, but the process is similar on other devices such as Windows PCs, Android phones, or tablets.

On the iPhone, open Settings.
Tap VPN.
Tap Add VPN Configuration.
Select Type: L2TP.
Enter a Description, such as UDM‑Pro.
In Server, enter your UDM‑Pro’s WAN IP address (e.g., the address ending in .29 in this example).

If your WAN IP is dynamic, consider using a dynamic DNS service (for example, home.example.com) so that the hostname always points to your current public IP address.

In Account, enter the username you created in UniFi (e.g., sherwood2).
In Password, enter the password for that user.
In Secret, enter the pre‑shared secret you configured earlier (e.g., iloveunifi).
Leave Send All Traffic enabled. This routes all of the device’s traffic through the VPN tunnel and the UDM‑Pro. Disabling this option requires additional routing rules, which are outside the scope of this basic setup.
Tap Done.

You should now see two VPN entries: the original one (for example, Private Internet Access) and the new UDM‑Pro VPN. Select UDM‑Pro so it is checked, then tap Connect.

Testing the VPN Connection

Once connected:

The iPhone shows a small VPN icon in the status bar, indicating a VPN‑protected connection over the LTE network (not Wi‑Fi).
The device receives an IP address within the VPN subnet, such as 192.168.2.6. This confirms that the device is inside the correct client VPN network.

Using a network analysis tool or ping utility, you can:

Ping an external website (for example, slashdot.org) to confirm that DNS and internet access are working.
Check the external IP address through a site such as WhatIsMyIP.com and confirm that it matches the WAN IP of the UDM‑Pro (for example, the address ending in .29).

You should also be able to ping the UDM‑Pro’s WAN IP address and access the UniFi controller directly over the VPN connection without using a cloud‑based login.

Security and Firewall Considerations

By default, the client VPN configuration is fairly permissive. Advanced users may want to add firewall rules to restrict VPN users from reaching certain networks or services. This includes limiting access between the VPN subnet and other internal networks (such as LAN or IoT) when required.

Frequently Asked Questions (FAQ)

Q: What type of VPN does this guide configure?
A: This guide sets up an L2TP client‑to‑server VPN on the UniFi UDM‑Pro, allowing remote devices to connect securely into your network.

Q: Can I use a dynamic public IP address for VPN access?
A: Yes. If your ISP assigns a dynamic IP, you can use a dynamic DNS service and enter the hostname (for example, home.example.com) as the server address on the client.

Q: Do I need bridge mode on my ISP modem?
A: It is strongly recommended that your UDM‑Pro receives a public WAN IP address directly. If your modem is not in bridge mode, there may be double NAT issues that complicate VPN connectivity.

Q: Can I use this VPN on Android or Windows devices?
A: Yes. The L2TP configuration process is very similar on Android phones and Windows PCs; simply choose L2TP in the VPN settings and enter the same server address, username, password, and pre‑shared secret.

Q: Why leave “Send All Traffic” enabled?
A: Enabling “Send All Traffic” routes all device traffic through the VPN tunnel and the UDM‑Pro. Disabling it requires custom routing and firewall rules, which are more complex and not covered in this basic setup.

Conclusion

This guide shows how to set up a basic L2TP client‑to‑server VPN on the UniFi UDM‑Pro and connect from a remote iPhone. The configuration provides a secure tunnel into your local network, enabling access to internal servers and services while you are away. While this is a simple setup, you can further harden it by adding custom firewall rules and limiting access between VPN users and other network segments.