Why a UniFi Cloud Gateway Is Not a Stable VPN Gateway

UniFi Cloud Gateways (UCG, UDM, UDM Pro, etc.) are powerful devices for WiFi, switching and basic routing.

Many users, however, also try to implement complex VPN scenarios with them – for example:

“An entire WiFi network should permanently go out to the internet via a German IP address.”

In practice, this often ends in a frustrating result:

• It works for a while

• After a restart, update or overnight, problems appear

• Email, iCloud, apps or streaming services drop out sporadically

Why this is no coincidence, we explain here.

---

The misunderstanding: “VPN-capable = VPN gateway”

A UniFi Cloud Gateway can:

• Establish WireGuard or IPsec connections

• Route networks and VLANs

• Manage firewalls

But:

👉 A full-fledged, stateful VPN gateway is something else.

The decisive difference is not in the VPN itself, but in the routing behavior.

---

The core problem: routing without session binding

How stable VPNs should work

For stable VPN setups, a simple rule applies:

A connection decides its path once – and stays on it.

This is called:

• stateful routing

• conntrack-based routing

• session-persistent routing

No matter how many packets follow – they always take the same exit.

---

How UniFi Cloud Gateways work

UniFi gateways make routing decisions:

• dynamically

• rule-based

• not bound to the connection

In simplified terms, that means:

• Packet A goes through the VPN tunnel

• Packet B of the same connection may suddenly go out via the normal internet connection

For short connections, that often doesn’t matter.

For long-lived connections, it’s fatal.

---

Why browsers work – but email and apps don’t

Browsers

• open many short connections

• reconnect automatically

• errors often go unnoticed

Email, iCloud, banking, APIs

• keep connections open for a long time

• expect a constant IP, route and NAT state

• react sensitively to the slightest deviation

If UniFi changes the routing path during an existing session:

• the connection breaks

• the app often reports no error

• the user only notices much later

---

The second big problem: lack of persistence

Another weak point is the lack of configuration resilience.

What regularly happens with UniFi

• Gateway restart

• Automatic provisioning

• Firmware update

• Network change in the backend

In the process, internally:

• firewall tables are rebuilt

• routing decisions are recalculated

• VPN states are briefly discarded

For classic home networks, no problem.

For VPN-based country routing, a risk.

---

Why the problem is “sometimes there, sometimes gone”

Many users report:

• “Yesterday everything worked”

• “This morning email isn’t working”

• “After a restart it’s fine again”

That’s because:

• sessions are rebuilt

• routing briefly fits

• the behavior changes again later

👉 The system is not deterministic enough for this use case.

---

Why MTU, MSS and DNS don’t solve the problem

People often try:

• lowering the MTU

• forcing the MSS

• changing the DNS

• raising keepalives

These measures can ease the symptoms, but not fix the cause.

Because:

• MTU solves fragmentation problems

• DNS solves name resolution

• keepalive keeps the tunnel open

❌ None of these measures enforces connection-stable routing.

---

Why UniFi wasn’t built for this either

UniFi Cloud Gateways are designed for:

• central management

• simple network separation

• convenient administration

• typical business and home networks

Not for:

• complex policy-based routing

• country routing over VPN

• Apple TV-capable VPN gateways

• asymmetry-free multi-path routing

This is not a flaw – it’s a design decision.

---

The clean alternative

Stable solutions separate the tasks:

✔️ Dedicated VPN gateway

• establishes the WireGuard connection

• makes routing decisions per session

• stays stable across restarts

✔️ UniFi behind it

• WiFi

• VLANs

• Switching

• device management

That way, each system does what it’s good at.

---

Conclusion

A UniFi Cloud Gateway is a very good network device –

but not a dependable VPN gateway for country-based internet routing.

If:

• apps don’t work sporadically

• email gets stuck

• problems only appear after hours

the cause is usually not the VPN,

but the way routing is handled internally.

Technology works best when it isn’t forced beyond its role.