{"id":317,"date":"2026-08-29T23:46:03","date_gmt":"2026-08-29T23:46:03","guid":{"rendered":"https:\/\/netguide.io\/network\/connect-two-unifi-sites-site-to-site-vpn\/"},"modified":"2026-08-29T23:47:04","modified_gmt":"2026-08-29T23:47:04","slug":"connect-two-unifi-sites-site-to-site-vpn","status":"publish","type":"post","link":"https:\/\/netguide.io\/network\/en\/connect-two-unifi-sites-site-to-site-vpn\/","title":{"rendered":"Connecting Two UniFi Sites: Set Up a Site-to-Site VPN with Site Magic &#038; IPsec"},"content":{"rendered":"<div id=\"netgu-2412315250\" class=\"netgu-before-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"3494115342\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><p class=\"wp-block-paragraph\"><strong>If you run two locations \u2013 say home and office, or a holiday home \u2013 you often want both networks to work as one: NAS backups between sites, a shared printer, or access to cameras. A site-to-site VPN does exactly that, permanently linking the two UniFi gateways through an encrypted tunnel. UniFi offers two routes for this: automatic <em>Site Magic<\/em> and classic, manual <em>IPsec<\/em>.<\/strong><\/p>\n\n\n<figure style=\"text-align:center;margin:1.5em 0\"><svg viewBox=\"0 0 820 300\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" role=\"img\" style=\"max-width:100%;height:auto;font-family:system-ui,Arial,sans-serif\"><rect x=\"0\" y=\"0\" width=\"820\" height=\"300\" fill=\"#f7f9fc\"\/><rect x=\"30\" y=\"70\" width=\"190\" height=\"44\" rx=\"8\" fill=\"#dbeafe\" stroke=\"#2563eb\" stroke-width=\"2\"\/><text x=\"125\" y=\"97\" font-size=\"13\" text-anchor=\"middle\">Site A \u00b7 Gateway<\/text><rect x=\"600\" y=\"70\" width=\"190\" height=\"44\" rx=\"8\" fill=\"#dbeafe\" stroke=\"#2563eb\" stroke-width=\"2\"\/><text x=\"695\" y=\"97\" font-size=\"13\" text-anchor=\"middle\">Site B \u00b7 Gateway<\/text><ellipse cx=\"410\" cy=\"92\" rx=\"90\" ry=\"36\" fill=\"#eef2f7\" stroke=\"#94a3b8\" stroke-width=\"2\"\/><text x=\"410\" y=\"97\" font-size=\"13\" text-anchor=\"middle\" fill=\"#475569\">Internet<\/text><line x1=\"220\" y1=\"92\" x2=\"320\" y2=\"92\" stroke=\"#16a34a\" stroke-width=\"3\" stroke-dasharray=\"6 4\"\/><line x1=\"500\" y1=\"92\" x2=\"600\" y2=\"92\" stroke=\"#16a34a\" stroke-width=\"3\" stroke-dasharray=\"6 4\"\/><text x=\"410\" y=\"150\" font-size=\"13\" text-anchor=\"middle\" fill=\"#16a34a\">encrypted tunnel (Site Magic \/ IPsec)<\/text><rect x=\"60\" y=\"200\" width=\"130\" height=\"40\" rx=\"10\" fill=\"#fef9c3\" stroke=\"#ca8a04\" stroke-width=\"2\"\/><text x=\"125\" y=\"225\" font-size=\"13\" text-anchor=\"middle\">LAN \u00b7 NAS \u00b7 cameras<\/text><rect x=\"630\" y=\"200\" width=\"130\" height=\"40\" rx=\"10\" fill=\"#fef9c3\" stroke=\"#ca8a04\" stroke-width=\"2\"\/><text x=\"695\" y=\"225\" font-size=\"13\" text-anchor=\"middle\">LAN \u00b7 NAS \u00b7 cameras<\/text><line x1=\"125\" y1=\"114\" x2=\"125\" y2=\"200\" stroke=\"#5b6b7e\" stroke-width=\"2\"\/><line x1=\"695\" y1=\"114\" x2=\"695\" y2=\"200\" stroke=\"#5b6b7e\" stroke-width=\"2\"\/><\/svg><figcaption style=\"font-size:13px;color:#64748b\">Two UniFi sites linked over an encrypted tunnel.<\/figcaption><\/figure>\n\n\n<h2 class=\"wp-block-heading\">Two routes, one goal: Site Magic vs. IPsec<\/h2>\n\n<p class=\"wp-block-paragraph\">A site-to-site VPN connects entire networks, not individual devices. Instead of dialing in with a client VPN, devices at site A can reach devices at site B directly, as if they sat in the same building. UniFi provides two fundamentally different approaches, and the choice almost always comes down to what sits on the other end.<\/p>\n\n<h3 class=\"wp-block-heading\">Site Magic \u2013 Auto-VPN between UniFi sites<\/h3>\n\n<p class=\"wp-block-paragraph\">Site Magic is Ubiquiti&#8217;s Auto-VPN and is the most convenient route whenever UniFi gateways sit at <strong>both<\/strong> locations and both belong to the same UniFi management (UniFi Site Manager, same organization). The tunnel is built on WireGuard essentially with a click: you select the sites involved, define the topology and enable the connection \u2013 UniFi establishes the encrypted gateway-to-gateway tunnel itself. There is no manual key exchange, no extra hardware and no recurring fee, and you don&#8217;t have to solve NAT traversal yourself.<\/p>\n\n<p class=\"wp-block-paragraph\">Site Magic supports two topologies: <strong>Mesh<\/strong> (every site builds direct tunnels to every other, with no central node) and <strong>Hub &amp; Spoke<\/strong> (a central hub concentrates traffic, which is why only the larger Cloud Gateways qualify as the hub). For two locations, a simple mesh connection is usually enough.<\/p>\n\n<h3 class=\"wp-block-heading\">IPsec \u2013 manual, for non-UniFi endpoints<\/h3>\n\n<p class=\"wp-block-paragraph\">If the other end is <strong>not<\/strong> a UniFi device \u2013 for example a Fritzbox, a pfSense\/OPNsense box, a corporate firewall cluster or a cloud provider&#8217;s gateway \u2013 then Site Magic is not an option. Here the path runs through IPsec, the vendor-neutral VPN standard. IPsec connects a UniFi gateway to any remote endpoint and uses a <em>Pre-Shared Key<\/em> (a shared secret) for authentication. Configuration is manual: the remote IP, the key and the subnets involved must be entered cleanly and consistently on both sides.<\/p>\n\n<p class=\"wp-block-paragraph\">By default UniFi builds IPsec as a <strong>Route-Based<\/strong> tunnel (Policy-Based is the alternative). The advantage of the route-based approach: it uses a virtual network link between the sites, so the gateways add the necessary static routes automatically. The matching firewall rules are also created automatically for standard cases, keeping manual effort limited.<\/p>\n\n<h2 class=\"wp-block-heading\">Requirements<\/h2>\n\n<ul class=\"wp-block-list\"><li><strong>Site Magic:<\/strong> A compatible UniFi gateway at both locations (e.g. UDM Pro, UDM SE, UDM Pro Max, UCG Max, UCG Ultra, UCG Fiber, Dream Router 7, UXG Pro\/Enterprise), with both sites in the same UniFi management.<\/li><li><strong>IPsec:<\/strong> A UniFi gateway on one side and an IPsec-capable endpoint on the other. The remote endpoint is entered as an IPv4 address \u2013 without a static public IP on both sides you&#8217;ll run into issues; DDNS is the alternative.<\/li><li><strong>Always:<\/strong> The sites&#8217; subnets must not overlap (see below).<\/li><\/ul>\n\n<h2 class=\"wp-block-heading\">The main pitfall: overlapping subnets<\/h2>\n\n<p class=\"wp-block-paragraph\">Whichever route you pick, the two networks must use different IP ranges. If both locations run the factory default <code>192.168.1.0\/24<\/code>, routing cannot decide whether an address is local or on the far side, and the connection is effectively useless. So assign separate ranges up front, for example <code>192.168.10.0\/24<\/code> at site A and <code>192.168.20.0\/24<\/code> at site B. Site Magic is more tolerant here than classic IPsec, but clean separation is the right foundation in both cases.<\/p>\n\n<h2 class=\"wp-block-heading\">Rough setup flow for Site Magic<\/h2>\n\n<ol class=\"wp-block-list\"><li>Adopt both locations under the same UniFi account so both sites appear in UniFi Site Manager.<\/li><li>Confirm in advance that the LAN subnets at the two locations differ.<\/li><li>In the Site Magic management, select the two sites you want to connect.<\/li><li>Choose the topology (mesh for two sites in most cases) and optionally define which networks or routes should be reachable over the tunnel.<\/li><li>Enable the connection \u2013 UniFi builds the tunnel. Then run a ping or share test between the locations.<\/li><\/ol>\n\n<p class=\"wp-block-paragraph\">The exact menu labels change across UniFi versions; when in doubt, follow the official Ubiquiti documentation (sources below).<\/p>\n\n<h2 class=\"wp-block-heading\">Site Magic or IPsec? A direct comparison<\/h2>\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Criterion<\/th><th>Site Magic<\/th><th>IPsec (manual)<\/th><\/tr><\/thead><tbody><tr><td>Remote end<\/td><td>UniFi sites only (same management)<\/td><td>Any, incl. non-UniFi<\/td><\/tr><tr><td>Effort<\/td><td>Very low, essentially one click<\/td><td>Manual config on both sides<\/td><\/tr><tr><td>Technology<\/td><td>WireGuard-based<\/td><td>IPsec, route- or policy-based<\/td><\/tr><tr><td>Authentication<\/td><td>Automatic via UniFi account<\/td><td>Pre-Shared Key<\/td><\/tr><tr><td>Static IP needed<\/td><td>No (works behind dynamic IP)<\/td><td>Yes, or DDNS recommended<\/td><\/tr><tr><td>Topologies<\/td><td>Mesh and Hub &amp; Spoke<\/td><td>Point-to-point<\/td><\/tr><tr><td>Subnet overlap<\/td><td>Tolerant, separation still advised<\/td><td>Must be strictly separated<\/td><\/tr><\/tbody><\/table><\/figure>\n\n<h2 class=\"wp-block-heading\">Typical use cases<\/h2>\n\n<ul class=\"wp-block-list\"><li><strong>NAS backup between sites:<\/strong> The office NAS backs up automatically overnight to the home NAS (offsite backup) \u2013 without a cloud service.<\/li><li><strong>Shared printer:<\/strong> A printer at the main location can also be reached from the holiday home.<\/li><li><strong>Cameras &amp; surveillance:<\/strong> Access the second site&#8217;s UniFi Protect or IP cameras without opening ports to the internet.<\/li><li><strong>Shared services:<\/strong> Homelab, file servers or internal web interfaces become reachable across locations.<\/li><\/ul>\n\n<h2 class=\"wp-block-heading\">Frequently asked questions<\/h2>\n\n<p class=\"wp-block-paragraph\"><strong>Do I need a static public IP for Site Magic?<\/strong> No. Site Magic builds the tunnel via the UniFi cloud and works even behind dynamic IP addresses. Manual IPsec, by contrast, should have a static public IP on both ends or use DDNS.<\/p>\n\n<p class=\"wp-block-paragraph\"><strong>Can I use Site Magic if only one site has a UniFi gateway?<\/strong> No. Site Magic only connects UniFi sites within the same management. For a mixed environment, IPsec is the right route.<\/p>\n\n<p class=\"wp-block-paragraph\"><strong>Why can&#8217;t the devices reach each other despite the tunnel?<\/strong> The most common cause is identical subnets at both locations. Assign separate IP ranges and check that the relevant networks are actually enabled for the tunnel.<\/p>\n\n<p class=\"wp-block-paragraph\"><strong>How many locations can I connect?<\/strong> A mesh topology lets you link several sites directly; for many locations, Hub &amp; Spoke is more efficient, though it requires more capable Cloud Gateways as the hub.<\/p>\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n<h3 class=\"wp-block-heading\">Sources<\/h3>\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/help.ui.com\/hc\/en-us\/articles\/7951513517079-UniFi-Gateway-Introduction-to-VPNs\">Ubiquiti Help Center \u2013 UniFi Gateway: Introduction to VPNs<\/a><\/li><li><a href=\"https:\/\/help.ui.com\/hc\/en-us\/articles\/360002426234-UniFi-Gateway-Site-to-Site-IPsec-VPN\">Ubiquiti Help Center \u2013 UniFi Gateway: Site-to-Site IPsec VPN<\/a><\/li><\/ul><div id=\"netgu-2393873780\" class=\"netgu-after-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"4559785002\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Link home and office with a site-to-site VPN: Site Magic (Auto-VPN) vs. manual IPsec, requirements, subnets and setup flow.<\/p>\n","protected":false},"author":1,"featured_media":239,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[73],"tags":[],"class_list":["post-317","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-vpn-en"],"uagb_featured_image_src":{"full":["https:\/\/netguide.io\/network\/wp-content\/uploads\/sites\/10\/2026\/08\/nw-3.jpg",1200,800,false],"thumbnail":["https:\/\/netguide.io\/network\/wp-content\/uploads\/sites\/10\/2026\/08\/nw-3-150x150.jpg",150,150,true],"medium":["https:\/\/netguide.io\/network\/wp-content\/uploads\/sites\/10\/2026\/08\/nw-3-300x200.jpg",300,200,true],"medium_large":["https:\/\/netguide.io\/network\/wp-content\/uploads\/sites\/10\/2026\/08\/nw-3-768x512.jpg",768,512,true],"large":["https:\/\/netguide.io\/network\/wp-content\/uploads\/sites\/10\/2026\/08\/nw-3-1024x683.jpg",1024,683,true],"1536x1536":["https:\/\/netguide.io\/network\/wp-content\/uploads\/sites\/10\/2026\/08\/nw-3.jpg",1200,800,false],"2048x2048":["https:\/\/netguide.io\/network\/wp-content\/uploads\/sites\/10\/2026\/08\/nw-3.jpg",1200,800,false]},"uagb_author_info":{"display_name":"Tobias","author_link":"https:\/\/netguide.io\/network\/author\/tobias-pries\/"},"uagb_comment_info":0,"uagb_excerpt":"Link home and office with a site-to-site VPN: Site Magic (Auto-VPN) vs. manual IPsec, requirements, subnets and setup flow.","brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/network\/wp-json\/wp\/v2\/posts\/317","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/network\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/network\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/network\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/network\/wp-json\/wp\/v2\/comments?post=317"}],"version-history":[{"count":2,"href":"https:\/\/netguide.io\/network\/wp-json\/wp\/v2\/posts\/317\/revisions"}],"predecessor-version":[{"id":329,"href":"https:\/\/netguide.io\/network\/wp-json\/wp\/v2\/posts\/317\/revisions\/329"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/netguide.io\/network\/wp-json\/wp\/v2\/media\/239"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/network\/wp-json\/wp\/v2\/media?parent=317"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/network\/wp-json\/wp\/v2\/categories?post=317"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/network\/wp-json\/wp\/v2\/tags?post=317"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}