Access Server: Configure a Ubiquiti (EdgeMAX/EdgeOS) Router as a VPN Client

Overview

You can configure a Ubiquiti router to connect as a VPN client to your Access Server. Follow these steps to complete the configuration.

Important Note: At the time of writing, Ubiquiti (EdgeMAX/EdgeOS) routers do not support TLS-Crypt v2 for control channel security. Ensure your Access Server is configured to use TLS-Crypt, TLS-Auth, or no control channel security. You can adjust this in the Advanced VPN Settings page of the Admin Web UI.

Step 1: Create a user for the Ubiquiti router

1. Sign on to your Access Server Admin Web UI.
2. Click User Management > User Permissions.
   
3. Under New Username, enter a username for your Ubiquiti router (e.g., "Ubiquiti"):
   
   
4. Check the Allow Auto-login option.
5. Click Save Settings and Update Running Server.

Step 2: Download a connection profile (.ovpn file) for the Ubiquiti router

1. Click User Management > User Profiles:
   
2. Select your Ubiquiti User and click New Profile:
   
3. Choose Autologin, and ensure the TLS-Crypt v2 option is disabled, then click Create Profile.
   
   
   • The connection profile (.ovpn file) downloads to your computer.
     
4. Rename the downloaded file to "Ubiquiti.ovpn" for easy management:
   

At this point, Access Server configuration is complete. Next, configure the Ubiquiti router.

Step 3: Configure the Ubiquiti router

At the time of writing, Ubiquiti routers don't support configuring OpenVPN as a VPN client through the GUI. Instead, use the command-line interface (CLI) embedded in the Ubiquiti GUI or via SSH.

• You can use the embedded CLI from the Ubiquiti GUI:
  
• Or connect using SSH if you have this allowed in your router:

Steps:

1. Use the embedded CLi in the Ubiquiti GUI or connect via SSH if enabled.
2. Open the connection profile (Ubiquiti.ovpn) and copy the entire contents of the profile.
3. Run the following commands on the Ubiquiti command line:
   

   sudo su
   vi /etc/openvpn/Ubiquiti.conf

   • Ensure the filename ends with .conf. You will see something like this:
     
4. Press the i key on your keyboard to enter insert mode in the CLI.
5. Paste the content of your connection profile (Ubiquiti.ovpn):
   
6. Press the ESC key on your keyboard.
7. Type :wq! on your keyboard to exit.
8. Run the below command to connect to the VPN:
   

   systemctl start openvpn@Ubiquiti

   • Where Ubiquiti is the name of the OpenVPN profile in the /etc/openvpn/ folder.
9. Check the VPN connection status:

   systemctl status openvpn@Ubiquit

10. To ensure the VPN connection is re-established automatically after a reboot, run:

    systemctl enable openvpn@Ubiquiti

11. You can also verify the router's connection in the Access Server Admin Web UI:

If you have additional questions, please submit a ticket.