UniFi Identity - Troubleshoot VPN Issues

No Users Can Connect to One-Click VPN

If all your users cannot connect to One-Click VPN, please follow the steps below to troubleshoot the issue:

  • Ensure your UniFi Console’s WAN IP is a public IP. To view your console’s WAN IP, go to your OS Settings > About > WAN IP
    • If the console's WAN IP is not a public IP but its higher-level router has a public IP, configure port forwarding on the higher-level router. You may need to contact your ISP for assistance.
  • Ensure your public IP is not within the CGNAT IP range. You may need to contact your ISP for more information.

If your WAN IP is a public IP and your public IP is not within the CGNAT IP range, and the issue persists, please contact uid.support@ui.com with the following information.

  • The support files of UniFi Console and Identity mobile and desktop apps.
    • UniFi Console: OS Settings > Console Settings > Download Support File.
    • Identity app for iOS and Android: Tap your upper-right profile picture > Export Support File.
    • Identity app for macOS and Windows: Click the Gear icon > Export Support File.
  • The time and time zone when the connection failed.

The message “System Extension Blocked” prompted on a macOS device

The Identity app needs a system extension to connect to Wireguard VPN. Follow the steps below to allow the app to load a new system extension.

macOS 13 Ventura and macOS 14

  1. Do either of the following:

    • Click Open System Settings in the popup to go to the Privacy & Security page.
    • Go to your Apple menu > System Settings > Privacy & Security.
      WGVPN1.png
  2. Go to System software from application ''Identity'' was blocked from loading and click Allow.
    WGVPN2.png

  3. Verify your identity using Touch ID or password and click Unlock to unlock Privacy & Security settings and allow the Identity app to add a system extension.
    WGVPN3.png

macOS 12 Monterey and Below

  1. Do either of the following:

    • Click Open System Preferences in the prompt to go to the Privacy & Security page.
    • Go to your Apple menu > System Preferences > Security & Privacy > General.
      WGVPN2-1.png
  2. Click the Lock icon.
    WGVPN2-2.png

  3. Verify your identity using Touch ID or password and click Unlock to unlock the Privacy & Security settings.
    WGVPN2-3.png

  4. Go to System software from application ''Identity'' was blocked from loading and click Allow.

WGVPN2-4.png

The message “Identity Would Like to Add VPN Configurations” prompted on a macOS device

The Identity app needs to add VPN configurations to allow VPN connections. Click Allow when the message below prompts. Once VPN configurations are added, all network activities on the device will be filtered and monitored when connecting to the VPN. WGVPN3-1.png

I cannot Allow Identity to load new system extensions

If the message “Click System Preferences and allow Identity to load a new system extension” shows on your Identity macOS app, but no window prompts after clicking System Preferences, please check if your device is enrolled in MDM. Also, check if your admin has deployed System Extensions MDM payload settings that restrict users from approving additional system extensions not explicitly allowed by configuration profiles. Please see Apple’s help article for details.

If the System Extensions MDM payload settings have been deployed, your admin can add the following configuration to your MDM settings.

  • Team Identifier: 4P645293E8
  • Bundle identifier: com.ui.uid.standard-desktop.network-extension
Was this article helpful?
1 out of 6 found this helpful