Set up UniFi Teleport remote access

Outcome and equipment

Connect a phone or laptop from an external internet connection and reach an authorised resource at home or work. Then revoke that device's access and prove that the connection no longer works. You need a compatible UniFi gateway, administrator access, WiFiman Mobile or Desktop, and a resource that already works locally. The example uses an HTTPS service at 192.168.10.150; substitute a real service that you control.

Teleport is accessed from the VPN settings and uses invitation-based enrolment. Ubiquiti documents a 24-hour invitation lifetime and a single-device invitation limit. An accepted device retains access until it is revoked; the invitation's expiry is not a timed guest-access policy. Some connection conditions require IPv6 on the gateway WAN, although LAN IPv6 is not required. [1]

Procedure

  1. From Main, open the chosen service and confirm that its account, network address and certificate configuration work. Write down its protocol and port. If it fails locally, repair that first; a VPN cannot correct an offline server or an incorrect application password.
  2. Check that the site's WAN is connected and the gateway is running a supported release. Keep the site reachable through your usual administrator method while testing. Remote management of UniFi itself and VPN access to other LAN resources are separate capabilities, so document which one you are testing. [2]
  3. In UniFi Network, open Settings, VPN and Teleport. Enable the service and generate an invitation for the first test device. Use the installed interface's actual labels. Open the invitation on the intended device, install the correct WiFiman application if prompted, then open the invitation again to complete enrolment. Create a separate invitation for a second device.
  4. Label the new device clearly in your records, including its owner and the date. Do not distribute one invitation to a group. A device that can establish a VPN does not automatically need administrative access to UniFi or to every server application.
  5. Inspect the device's source address and the policies used for its VPN traffic. Apply your remote-access policy to the actual VPN source or matching object. Allow the test device to reach 192.168.10.150 on the chosen service port and preserve its required responses. Keep Guest, camera endpoints and gateway administration outside its permission set unless the job requires them. Refer to Zone-based firewall guide for policy order.
  6. Move the phone onto mobile data, or connect the laptop through a separate internet service. Confirm it is no longer using the site's local WiFi. Enable Teleport and open the service by address. Log in with its normal application credentials. This verifies the tunnel, destination policy and application access together.
  7. If you want a friendly name, configure or use the site's intended DNS record and test it separately. UniFi local hostnames depend on the client querying the appropriate gateway DNS service. A name that resolves on one LAN does not prove that every remote resolver has the same information. [3]
  8. Test what the device must not reach. Attempt a known live service on an unrelated private device and attempt gateway administration. Then disconnect Teleport and repeat the authorised service test. The resource should stop being reachable through the private address unless another connection independently provides a route.
  9. Revoke access. For an invitation that has not been accepted, remove it through Invitation History. For an enrolled device, select its Teleport client in Client Devices and revoke access there. Reconnect from the external network and prove that it cannot establish useful access. Deleting a pending invitation does not substitute for removing an already enrolled client. [1]

Verification record

Record the test device, external connection, destination service, successful connection time and revocation result. If continuity matters, test reconnecting after the laptop sleeps and after the phone changes between WiFi and mobile data. Record actual behaviour rather than promising uninterrupted sessions. Check whether your test changes internet egress or DNS behaviour, especially when another VPN application is installed.

Troubleshooting and recovery

An invitation that does not enrol may be expired, already used or opened in the wrong application context. Generate a fresh invitation for that specific device. A connected tunnel with an unreachable resource points towards subnet overlap, destination firewall, route or service problems. Compare the remote client's local subnet with the site's private subnet; identical ranges can create ambiguous routing.

If IP access works and names fail, test the intended resolver and the record. If the tunnel itself fails, check WAN connectivity, supported software, IPv6 availability where required, and another external network. Do not open arbitrary WAN ports as a general Teleport repair. Disable the exercise's access rules and revoke its enrolled devices to remove the setup. Leave unrelated VPN services unchanged.

Sources

Back to the series

Leave a comment

Please note, comments need to be approved before they are published.