UniFi VPN Management#

1 OpenVPN#

1.1 Client Profile#

The verified iPhone client uses OpenVPN Connect with these settings:

  • Profile name: marcoue.ddns.net [OpenVPN Server]
  • Server hostname: marcoue.ddns.net
  • Username: marcoue
  • Password: Saved in the OpenVPN client; do not document it here.
  • DDNS provider: No-IP (ddns.net)

The profile uses the hostname rather than a fixed IP, so the iPhone profile normally does not need to be edited when the ISP address changes.

The OpenVPN listening port and the exact UniFi port-forward rule were not captured in the available documentation. Verify those values in the UniFi Network application if the VPN still fails after DNS is corrected.

1.2 ISP Public IP Change Procedure#

The current home public IP recorded on 2026-08-12 is 208.96.219.86. This is dynamic and may change again.

1.2.1 Determine the New Home IP#

Run this from a device on the home network. Do not run it on the RackNerd VPS, because that returns the VPS IP instead:

curl -4 ifconfig.me

1.2.2 Update No-IP DDNS#

In the No-IP dashboard:

  1. Open DDNS & Remote Access → DNS Records.
  2. Locate marcoue.ddns.net.
  3. Update its A record to the new home public IP.
  4. Confirm the record’s TTL remains 60 seconds.

1.2.3 Verify DNS Resolution#

On the iPhone, open this URL in Safari:

https://dns.google/resolve?name=marcoue.ddns.net&type=A

The Answer value must equal the current home public IP. Wait one or two minutes for propagation if the old value is still cached.

1.2.4 Test OpenVPN#

Retry the existing OpenVPN Connect profile. No profile change is required when the hostname resolves to the new IP.

1.3 Important: VPS Firewall Is Separate#

The RackNerd Pangolin VPS (72.11.147.220) has separate UFW and Fail2ban rules for administrative SSH and the pull-based Pangolin backup. Those rules do not update the UniFi OpenVPN endpoint automatically.

If the home IP changes, update the VPS SSH allowlist separately:

sudo ufw allow from NEW_HOME_IP to any port 22 proto tcp
sudo ufw delete allow from OLD_HOME_IP to any port 22 proto tcp
sudo fail2ban-client set sshd addignoreip NEW_HOME_IP
sudo fail2ban-client set sshd delignoreip OLD_HOME_IP

Replace the old address with the new address in /etc/fail2ban/jail.local, then reload:

sudo fail2ban-client reload

These VPS commands are for Pangolin backup/SSH access only; they are not required merely because the UniFi OpenVPN DDNS address changed.

1.4 Troubleshooting Order#

  1. Confirm the No-IP record resolves to the current home IP.
  2. Confirm the OpenVPN profile still uses marcoue.ddns.net.
  3. Confirm the UniFi OpenVPN server is enabled.
  4. Confirm the UniFi WAN is online and the OpenVPN port-forward/firewall rule is present.
  5. Review the OpenVPN Connect log for the exact failure stage: DNS resolution, timeout, TLS negotiation, or authentication.

2 WireGuard#

WireGuard is a separate VPN service from OpenVPN. The following settings were verified in UniFi Network on 2026-08-12:

To download and import the WireGuard configuration file, open 1Password → Private → WiregardVPN - Marc.

  • Server name: WireGuard Server (Marc)
  • WAN interface: WAN1
  • Current WAN address: 208.96.219.86 (dynamic)
  • Endpoint port: UDP 51822
  • Listen on: All interfaces
  • Tunnel gateway/subnet: 10.1.12.1/24
  • Tunnel address range: 10.1.12.1–10.1.12.254
  • Configured client: Marc — 10.1.12.2
  • DNS: Automatic
  • MTU: Automatic
  • IPv4 MSS: Automatic
  • Alternate Address for Clients: Disabled
  • Public key: Stored in UniFi/client configuration; do not document key material here.

The UniFi WireGuard server currently displays the dynamic WAN IP directly and has Alternate Address for Clients disabled. If the ISP IP changes, WireGuard clients may retain the old endpoint until their endpoint address is updated or a stable DDNS hostname is configured as the alternate address.

2.1 WireGuard and ISP IP Changes#

WireGuard clients are affected by an ISP IP change only if their peer endpoint uses:

  • the old public IP directly; or
  • a DDNS hostname whose record did not update.

If WireGuard is configured to use marcoue.ddns.net as its client endpoint, follow the OpenVPN DDNS procedure above. Otherwise, update the client endpoint from the old public IP to the new one. Do not regenerate keys solely because the ISP IP changed.

After a home IP change, verify:

  1. The DDNS hostname resolves to the current home public IP.
  2. The UniFi WireGuard server is enabled.
  3. The UniFi WAN firewall/port-forward rule allows the documented WireGuard UDP port.
  4. The client’s peer endpoint uses the correct hostname or IP.
  5. The client has an up-to-date AllowedIPs and server public key.

A separate generic Ubuntu/UFW note documents UDP 51820; the current UniFi WireGuard server uses UDP 51822.

2.2 WireGuard Troubleshooting#

Check the client’s latest handshake time and transfer counters. A missing handshake usually indicates a stale endpoint, DNS resolution problem, blocked UDP port, or missing port-forward rule. A recent handshake with no useful traffic usually indicates an AllowedIPs, route, or firewall policy issue.

Backward Home Assistant Unifi UNAS-Pro Usage Inventory Plan Forward