UniFi Dream Machine WireGuard Remote Access: Browser RDP and SSH to Your Whole LAN

The UniFi Dream Machine line sits at the edge of a huge number of the networks European MSPs manage: the UDM, UDM Pro, UDM SE, the Dream Router, and the newer UniFi Cloud Gateway models (UCG-Ultra, UCG-Max, UXG) are everywhere in offices, clinics, retail units, and hospitality sites. Modern UniFi Network releases ship WireGuard as a first-class VPN option, which turns any of these gateways into a clean ProxyLink tunnel host. One outbound WireGuard peer on the gateway covers every device on the LAN and every VLAN behind it, with nothing installed on the machines you actually need to reach.

The reason this matters: most sites run on whatever broadband or LTE line was cheapest to install, with a dynamic IP and, increasingly, carrier-grade NAT (CGNAT). There is no static address to point a tool at and no port to forward. Because a ProxyLink tunnel dials outbound and holds itself open with a keepalive, none of that is relevant. The gateway never accepts an inbound connection, so a scan of the site's ISP range finds nothing to connect to.

Before You Start

Confirm the gateway runs a recent UniFi Network version that exposes WireGuard under the VPN settings. If you do not see a WireGuard option, update UniFi Network first. Have the site's LAN subnet to hand (the UniFi default is often 192.168.1.0/24) and a list of any extra VLANs the gateway serves. You configure everything from the UniFi Network application.

Getting the Config from ProxyLink

In ProxyLink, create a new tunnel for the site and set the LAN subnet to match the gateway. ProxyLink assigns the UniFi gateway a peer address in the 10.100.0.0/16 range and shows you the relay public key and endpoint. The values you need are:

Address    = 10.100.0.X/16
PublicKey  = <proxylink-server-public-key>
Endpoint   = 46.225.153.241:51820
AllowedIPs = 10.100.0.0/16
PersistentKeepalive = 25

AllowedIPs = 10.100.0.0/16 sends only ProxyLink tunnel traffic through the VPN, so the site's normal internet traffic still exits through the WAN. PersistentKeepalive = 25 is not optional: it keeps the NAT mapping alive and re-initiates the handshake after a reboot or an ISP reconnect.

Configuring WireGuard on the Dream Machine

In the UniFi Network application, open Settings → VPN and create a new VPN of type Site-to-Site using the manual WireGuard option. The gateway generates its own key pair for the local WireGuard interface; you do not paste ProxyLink's private key here. Take the gateway's own public key that UniFi shows you and enter it back into the ProxyLink tunnel as the peer key, so the two ends agree on keys. Set the local tunnel interface address to the assigned 10.100.0.X/16.

Now configure the remote peer pointing at the relay:

Peer Public Key: the ProxyLink relay public key from the config.
Remote Endpoint: 46.225.153.241, port 51820.
Allowed IPs: 10.100.0.0/16.
Persistent Keepalive: 25.

Save and apply. The gateway dials outbound to the relay and the tunnel forms within a few seconds.

Routing and Firewall

A formed tunnel is not the same as a reachable LAN. The gateway needs to route and forward traffic between the WireGuard interface and your local networks. On UniFi, confirm no firewall rule blocks traffic sourced from the 10.100.0.0/16 relay range toward your LAN and VLAN networks. If the site uses tight inter-VLAN rules, permit the tunnel range to reach each network you manage.

Multi-VLAN Sites

You do not need a second tunnel for a segmented network, and UniFi sites are almost always segmented. Declare each extra subnet in ProxyLink under Additional Subnets, and every declared subnet becomes reachable through the same peer. A site with a main LAN on 192.168.1.0/24, a voice VLAN on 192.168.10.0/24, and a camera VLAN on 192.168.20.0/24 uses one Dream Machine and one ProxyLink tunnel. Keep the peer's Allowed IPs at the relay range only.

What Engineers Access

Once the tunnel is up, create a proxy link for each device and service:

Windows PCs and servers (port 3389): browser RDP, no mstsc.exe or VPN client on the engineer's laptop.
Linux and the gateway itself (port 22): browser SSH terminal, with session recording on paid plans.
The UniFi controller (port 443 or 8443): an HTTPS proxy link to the UniFi Network application, with SSL termination so the browser shows a valid certificate instead of a self-signed warning.
NVRs, cameras, and PBX panels (port 80 or 443): HTTP or HTTPS proxy links to the web UI, no port forwarding.

Every session is logged with engineer identity, target IP and port, start time, and duration. The site keeps zero open inbound ports, and access requires a ProxyLink login with two-factor authentication. The relay runs on EU infrastructure in Germany with no third-party remote-access network in the path.

Verifying the Tunnel

Check the WireGuard status in the UniFi VPN settings. A healthy tunnel shows a recent handshake and a non-zero received-bytes count. If the handshake never completes, confirm outbound UDP 51820 is not blocked upstream, check the ProxyLink relay public key was pasted exactly, and confirm the keepalive is set to 25.

Try ProxyLink free at app.proxylink.dev, no card required, free during early access. A UniFi site takes about 10 minutes to configure. Setup guides for MikroTik, pfSense, OPNsense, OpenWRT, and EdgeRouter are in the docs.