What is the difference between UniFi Site Magic and Teleport?

Site Magic joins whole sites together (network to network). Teleport connects a single device back to one network for remote access. Use Site Magic for office-to-office, Teleport for yourself on the go.

Is UniFi Teleport secure?

Teleport builds an encrypted WireGuard-based tunnel and access is controlled by invitations you issue, which you can revoke at any time from the UniFi app.

October 9, 2026 Javelin Networks

UniFi VPN: Site-to-Site and Remote Access the Easy Way

Q: Can I reach UniFi Protect cameras at another site over the VPN?

Yes. Once Site Magic links the sites, devices including an NVR or cameras are reachable across the tunnel as if local, subject to any firewall rules you set.

One of the quiet superpowers of a UniFi network is that secure connectivity — office to office, or you to the office from anywhere — is built into the gateway. No extra subscription, no third-party VPN service. This guide covers the three ways to do it and when to use each. The gateways below are in stock at Javelin Networks.

Three tools, three jobs

Site Magic

Best for: Linking two or more of your own UniFi sites

Type Site-to-siteSetup Auto, a few clicksNeeds UniFi gateway each end

Teleport

Best for: You, on a laptop or phone, reaching home/office

Type Remote accessSetup One-tap, QR inviteNeeds UniFi gateway + app

VPN Server (WireGuard/L2TP/OpenVPN)

Best for: Third-party clients or non-UniFi sites

Type Remote / siteSetup ManualNeeds Client config

Site-to-site with Site Magic

If you run UniFi at two or more locations, Site Magic is the easiest site-to-site VPN there is. Because both gateways already report to your UniFi account, Site Magic auto-discovers them and builds the tunnel for you — in the UniFi Network app go to Settings → VPN → Site Magic, pick the sites, and enable it. It handles the routing so devices at one site can reach the other as if they were local. You need a UniFi gateway at each end, such as two Cloud Gateway Ultras or a mix of Dream Machines. The UniFi Help Center has the current step-by-step.

Remote access with Teleport

Teleport is UniFi's one-tap remote-access VPN. From the UniFi app you create an invitation link; open it on your laptop or phone and you are on your home or office network in seconds, with no manual keys or client config. It is the fastest way for an individual to get back to their own network on the road. Any current UniFi gateway supports it.

Manual VPN server (WireGuard, L2TP, OpenVPN)

When you need to connect a non-UniFi site, or give a third-party device a tunnel, use the gateway's built-in VPN Server under Settings → VPN. UniFi gateways can run a WireGuard or L2TP/OpenVPN server; you create user credentials or a WireGuard peer and import the config into any standard client. It is more hands-on than Site Magic or Teleport but works with anything.

Which should you use?

Two UniFi offices → Site Magic.
Just you, getting back to your own network → Teleport.
A non-UniFi site, or third-party VPN clients → the manual WireGuard/L2TP VPN server.

Frequently asked questions

Does UniFi VPN cost extra?

No. Site Magic, Teleport, and the VPN server are all built into UniFi gateways at no additional charge — there is no separate VPN subscription.

Do both ends need to be UniFi for site-to-site?

For Site Magic, yes — it links UniFi gateways automatically. To connect a non-UniFi site, use the manual WireGuard or IPsec/L2TP VPN server instead and configure the other end to match.

What's the difference between Site Magic and Teleport?

Site Magic joins whole sites together (network to network). Teleport connects a single device (your laptop or phone) back to one network for remote access. Use Site Magic for office-to-office, Teleport for yourself on the go.

Can I reach UniFi Protect cameras at another site over the VPN?

Yes. Once Site Magic links the sites, devices — including an NVR or cameras — are reachable across the tunnel as if local, subject to any firewall rules you set.

Is Teleport secure?

Teleport builds an encrypted WireGuard-based tunnel and access is controlled by the invitations you issue, which you can revoke at any time from the UniFi app.