Dustin C. Hatch
a1ca06a3c5
The VPN capability of the UniFi Security Gateway is extremely limited. It does not support road-warrior IPsec/IKEv2 configuration, and its OpenVPN configuration is inflexible. As with DHCP, the best solution is to simply move service to another machine. To that end, I created a new VM, *vpn0.pyrocufflink.blue*, to host both strongSwan and OpenVPN. For this to work, the necessary TCP/UDP ports need to be forwarded, of course, and all of the remote subnets need static routes on the gateway, specifying this machine as the next hop. Additionally, ICMP redirects need to be disabled, to prevent confusing the routing tables of devices on the same subnet as the VPN gateway.