Connecting Two UniFi Sites: Set Up a Site-to-Site VPN with Site Magic & IPsec

If you run two locations – say home and office, or a holiday home – you often want both networks to work as one: NAS backups between sites, a shared printer, or access to cameras. A site-to-site VPN does exactly that, permanently linking the two UniFi gateways through an encrypted tunnel. UniFi offers two routes for this: automatic Site Magic and classic, manual IPsec.

Two UniFi sites linked over an encrypted tunnel.

Two routes, one goal: Site Magic vs. IPsec

A site-to-site VPN connects entire networks, not individual devices. Instead of dialing in with a client VPN, devices at site A can reach devices at site B directly, as if they sat in the same building. UniFi provides two fundamentally different approaches, and the choice almost always comes down to what sits on the other end.

Site Magic – Auto-VPN between UniFi sites

Site Magic is Ubiquiti’s Auto-VPN and is the most convenient route whenever UniFi gateways sit at both locations and both belong to the same UniFi management (UniFi Site Manager, same organization). The tunnel is built on WireGuard essentially with a click: you select the sites involved, define the topology and enable the connection – UniFi establishes the encrypted gateway-to-gateway tunnel itself. There is no manual key exchange, no extra hardware and no recurring fee, and you don’t have to solve NAT traversal yourself.

Site Magic supports two topologies: Mesh (every site builds direct tunnels to every other, with no central node) and Hub & Spoke (a central hub concentrates traffic, which is why only the larger Cloud Gateways qualify as the hub). For two locations, a simple mesh connection is usually enough.

IPsec – manual, for non-UniFi endpoints

If the other end is not a UniFi device – for example a Fritzbox, a pfSense/OPNsense box, a corporate firewall cluster or a cloud provider’s gateway – then Site Magic is not an option. Here the path runs through IPsec, the vendor-neutral VPN standard. IPsec connects a UniFi gateway to any remote endpoint and uses a Pre-Shared Key (a shared secret) for authentication. Configuration is manual: the remote IP, the key and the subnets involved must be entered cleanly and consistently on both sides.

By default UniFi builds IPsec as a Route-Based tunnel (Policy-Based is the alternative). The advantage of the route-based approach: it uses a virtual network link between the sites, so the gateways add the necessary static routes automatically. The matching firewall rules are also created automatically for standard cases, keeping manual effort limited.

Requirements

Site Magic: A compatible UniFi gateway at both locations (e.g. UDM Pro, UDM SE, UDM Pro Max, UCG Max, UCG Ultra, UCG Fiber, Dream Router 7, UXG Pro/Enterprise), with both sites in the same UniFi management.
IPsec: A UniFi gateway on one side and an IPsec-capable endpoint on the other. The remote endpoint is entered as an IPv4 address – without a static public IP on both sides you’ll run into issues; DDNS is the alternative.
Always: The sites’ subnets must not overlap (see below).

The main pitfall: overlapping subnets

Whichever route you pick, the two networks must use different IP ranges. If both locations run the factory default 192.168.1.0/24, routing cannot decide whether an address is local or on the far side, and the connection is effectively useless. So assign separate ranges up front, for example 192.168.10.0/24 at site A and 192.168.20.0/24 at site B. Site Magic is more tolerant here than classic IPsec, but clean separation is the right foundation in both cases.

Rough setup flow for Site Magic

Adopt both locations under the same UniFi account so both sites appear in UniFi Site Manager.
Confirm in advance that the LAN subnets at the two locations differ.
In the Site Magic management, select the two sites you want to connect.
Choose the topology (mesh for two sites in most cases) and optionally define which networks or routes should be reachable over the tunnel.
Enable the connection – UniFi builds the tunnel. Then run a ping or share test between the locations.

The exact menu labels change across UniFi versions; when in doubt, follow the official Ubiquiti documentation (sources below).

Site Magic or IPsec? A direct comparison

Criterion	Site Magic	IPsec (manual)
Remote end	UniFi sites only (same management)	Any, incl. non-UniFi
Effort	Very low, essentially one click	Manual config on both sides
Technology	WireGuard-based	IPsec, route- or policy-based
Authentication	Automatic via UniFi account	Pre-Shared Key
Static IP needed	No (works behind dynamic IP)	Yes, or DDNS recommended
Topologies	Mesh and Hub & Spoke	Point-to-point
Subnet overlap	Tolerant, separation still advised	Must be strictly separated

Typical use cases

NAS backup between sites: The office NAS backs up automatically overnight to the home NAS (offsite backup) – without a cloud service.
Shared printer: A printer at the main location can also be reached from the holiday home.
Cameras & surveillance: Access the second site’s UniFi Protect or IP cameras without opening ports to the internet.
Shared services: Homelab, file servers or internal web interfaces become reachable across locations.

Frequently asked questions

Do I need a static public IP for Site Magic? No. Site Magic builds the tunnel via the UniFi cloud and works even behind dynamic IP addresses. Manual IPsec, by contrast, should have a static public IP on both ends or use DDNS.

Can I use Site Magic if only one site has a UniFi gateway? No. Site Magic only connects UniFi sites within the same management. For a mixed environment, IPsec is the right route.

Why can’t the devices reach each other despite the tunnel? The most common cause is identical subnets at both locations. Assign separate IP ranges and check that the relevant networks are actually enabled for the tunnel.

How many locations can I connect? A mesh topology lets you link several sites directly; for many locations, Hub & Spoke is more efficient, though it requires more capable Cloud Gateways as the hub.