Remote access: WireGuard vs Teleport
Pick Teleport for one-tap access from a phone, or when your connection sits behind carrier-grade NAT (CGNAT), as with Starlink and many mobile broadband plans. Pick WireGuard when you have a public IP and want per-device profiles and split tunnelling. Both are built into UniFi gateways at no extra cost.
Which one?
| Teleport | WireGuard | |
|---|---|---|
| Needs a public IP | No: works when both the gateway and the device are behind NAT | Yes, or a port forward on any router in front of the gateway |
| Setup | Switch it on, then share an invitation | Create a server, then a profile per device |
| App | WiFiman (iOS, Android, Windows, macOS, Linux) | WireGuard (all major platforms) |
| Per-device access | One device per invitation; invitations expire after 24 hours | One config file or QR code per device |
| Split tunnel | No options documented | Yes, by editing AllowedIPs in the client config |
| Best for | Phones, family, occasional access | Laptops, power users, always-on access |
You'll need
- A UniFi gateway or Cloud Gateway; every UniFi VPN server runs on one.
- For Teleport: the WiFiman app on each device; no public IP is needed.
- For WireGuard: a public IP on your WAN. Compare the WAN IP shown in UniFi with what a "what is my IP" site reports. If they differ, you're probably behind CGNAT or another router.
Australian ISPs: public IP or CGNAT?
WireGuard needs a public IPv4 address, and several Australian ISPs put residential customers behind CGNAT by default. Most will switch you to a public IP for free or a small monthly fee; otherwise, use Teleport.
| ISP | CGNAT by default? | Getting a public IPv4 |
|---|---|---|
| Telstra | No | Already public; static IP $10 a month |
| Aussie Broadband | Yes, on residential plans without a static IP | Opt out through Aussie Broadband, or add a static IP |
| Superloop | Yes, where available | Free opt-out by phoning 1300 459 125 (the IP can change); static IP $5 a month |
| Dodo | Yes, for services connected since April 2023 | Opt out through customer service (the IP can change); static IP $5 a month |
| Exetel | Implied: Exetel offers an opt-out | Opt out through online chat; no static IPs |
| Leaptel | Yes | Turn CGNAT off in the Members Portal; static IP $10 a month, included on some plans |
| Belong | Yes, for most customers | No opt-out or static IP mentioned |
| Internode | Not stated | Dynamic public IPv4; a static IP comes with the $10-a-month Power Pack |
| iiNet | Not stated | Dynamic IP; static IPs only on TPG Telecom Business NBN plans |
| Vodafone | Not stated | No static IPs |
| Starlink | Often, according to Ubiquiti | Use Teleport |
Optus and TPG don't state their NBN CGNAT policy on their own sites, and mobile or 5G home internet often lacks a public IP, so check your WAN IP (see You'll need). Teleport works either way.
IPv6 can help. CGNAT only affects IPv4. Aussie Broadband, Internode, Leaptel and Launtel provide IPv6, and Superloop says it's still rolling out. With IPv6, WireGuard can also run over IPv6 (Network 10.2.105 and later), though only from networks that support it.
Option A — Teleport
- Go to Settings › VPN, open Teleport and switch it on.
- Generate an invitation. Each one works for one device and expires after 24 hours.
- On the device, install WiFiman, open the invitation link and connect.
- Admins don't need invitations: since Network 10.2.105, any admin can start Teleport from WiFiman.
- To revoke access, cancel pending invitations in Invitation History and remove accepted devices from the client list.
Option B — WireGuard
- Go to Settings › VPN, create a new VPN server and choose WireGuard.
- Name it and keep the default port, UDP 51820.
- If your IP changes, set up dynamic DNS and use that hostname in your client configs instead of the IP address.
- VPN subnet: leave it on auto, or choose one that doesn't overlap any of your VLANs.
- Save the server.
- Add a client for each device, then download its config file or show its QR code. Leave Remote Client Networks empty: Ubiquiti uses it for the network behind a client router in site-to-site setups.
-
Import it into the WireGuard app. If the AllowedIPs line reads
0.0.0.0/0, all your traffic goes through home. For a split tunnel, edit it to list just your home subnets, such as192.168.1.0/24, 192.168.40.0/24. - If another router sits in front of your UniFi gateway, forward UDP 51820 to the gateway on that router too.
Check it worked
- Turn off Wi-Fi on your phone and connect over mobile data.
- Open something only reachable at home, such as a NAS, and check that names resolve (DNS works).
- With a full tunnel, a "what is my IP" site shows your home IP.
Other remote-access options in UniFi
- OpenVPN server: still available. Use it only for devices that can't run WireGuard, because it's slower.
- L2TP server: legacy devices only; it can't push routes.
- Site Magic: links two or more UniFi sites, such as home and a holiday house. All gateways must belong to one UI owner, a hub needs a public IP, and subnets mustn't overlap. Mesh mode handles up to 20 sites; IPv6 isn't supported.
- UniFi Identity One-Click VPN: suits small businesses with several staff. It's licence-free and set up under Settings › Identity.
- Site Manager (unifi.ui.com): manages UniFi from anywhere, but doesn't give you access to the devices on your network.
Watch out for
- VPN users can reach your main network. The VPN zone can reach Internal by default, so add VPN-zone policies to limit what remote users see; our VLAN guide explains zone policies. Network 11 also fixes isolated networks still being reachable from the VPN zone.
- Teleport has few documented options. Ubiquiti doesn't document split tunnelling or subnet choices for it.
- One WireGuard profile per device. Each device needs its own keys, so never share a profile.
- Direct Remote Connection in the console settings needs a public IP and port 443. Leave it off unless you need it.
Sources: WireGuard server · Teleport · WireGuard site-to-site for UMR · OpenVPN server · L2TP server · Site Magic SD-WAN · Remote access: VPN and port forwarding · Public access to local resources · Remote management via Site Manager · UniFi Endpoint and Identity · WiFiman desktop · Network release notes · Telstra IP addresses · Aussie Broadband CGNAT · Superloop NBN · Superloop price schedule (PDF) · Dodo technical advice · Exetel NBN summary (PDF) · Leaptel CGNAT · Leaptel FAQs · Belong CGNAT · Internode NBN features · iiNet NBN plans · Vodafone NBN · Aussie Broadband IPv6 · Internode IPv6 · Launtel IPv6 · Leaptel IPv6
Disclaimer: This guide reflects UniFi software and official documentation as of 22 October 2026. Menus, features, plans and policies change, so check each step on your own equipment and back up first. It's general information, not legal advice, and you use it at your own risk. UniFi is a trademark of Ubiquiti Inc., and other names belong to their owners.