Sanity check: UniFi WireGuard split tunnel for a remote user to RDP to their office PC

Networking & Firewalls
1

Hey all,

For personal stuff I’d normally just use Tailscale. This one is a business setup, though, and I want to build it with what the UniFi gateway can do natively. I’ll build and test it in my homelab first, before the business deployment. I want to work out the different ways to set it up, lock it down, and confirm nothing else on the network is reachable, mostly for my own peace of mind. Once that works, I can reuse it for similar requests later. The environment is small, so only a few more users would end up on this setup. Before I roll it out, I’d like to confirm the plan makes sense or hear what I’m missing.

Scenario

  • User A has Desktop-A at the office. It runs a warehouse inventory app that’s desktop-only for now (a web version is planned).
  • User A gets a laptop (Laptop-B) for home with a local Admin account (IT only) and a Standard user account for daily work. M365 (Outlook, OneDrive, Office apps) runs locally on the laptop.
  • When they need the inventory app, they connect to the office and RDP into Desktop-A. The app and its data stay on the office LAN; only RDP goes over the VPN.

WireGuard VPN
WireGuard VPN1265×529 57.9 KB

My plan

  • UniFi WireGuard server, with one client config per laptop.
  • Split tunnel: AllowedIPs = <Desktop-A IP>/32, so home internet and M365 traffic never go through the office.
  • DNS: I’d like to keep Quad9 like the gateway uses. Since the tunnel only routes one IP, I’m planning to set DNS = 9.9.9.9, 149.112.112.112 in the client config so lookups don’t depend on the VPN being up. The other option is adding the gateway’s IP to AllowedIPs and using it for DNS, but then any VPN hiccup kills the laptop’s internet. Curious what others do here.
  • I import and activate the tunnel as Admin and leave it always on, since Standard users can’t toggle WireGuard on Windows by default.
  • UniFi firewall (zone-based): the VPN client gets a fixed tunnel IP and can only reach Desktop-A on 3389. Everything else on the LAN is blocked. Remote printing to the office printers may come up later, but I’ll deal with that separately.
  • Desktop-A: Windows Pro, DHCP reservation, sleep disabled, RDP with NLA, and the Windows firewall RDP rule scoped to the LAN + VPN subnet.
  • A saved .rdp shortcut on the Standard user’s desktop, so it’s just double-click and log in.

Questions

  1. Does this setup make sense, or is there a gotcha I’m missing? Mainly the always-on tunnel, DNS handling, and getting the zone-based firewall rules right for VPN clients.
  2. Would Identity / One-Click VPN or Teleport be a better fit for a non-technical Standard user? I haven’t used either, but I plan to test them for future use cases. Is there anything about them (licensing, routing control, Standard user permissions) that makes one a better fit than WireGuard here?

Thanks!

2
  1. Yes, setup makes sense but if you are going to have a persistent on tunnel make sure you have that system properly secured as it will be a persistent way to get in.
  2. Teleport, unless they changed it recently, does not offer split tunnel.

I have a video on the UniFi VPN rules here https://youtu.be/xzR2c3OO41s

3

Thank you Tom, I appreciate it. I’ll look into the video for the VPN rules and make sure the laptop is locked down for the always-on tunnel. Good to know about the Teleport VPN.

4

UniFi have overly permissive default VPN rules and I walk through how to lock them down.

1 Like
5

[quote=“Stageone, post:1, topic:27160”]
* DNS: I’d like to keep Quad9 like the gateway uses. Since the tunnel only routes one IP, I’m planning to set `DNS = 9.9.9.9, 149.112.112.112` in the client config so lookups don’t depend on the VPN being up. The other option is adding the gateway’s IP to AllowedIPs and using it for DNS, but then any VPN hiccup kills the laptop’s internet. Curious what others do here.
[/quote]

Howdy. My understanding of using DNS = in client config is that that IPs you list after the = must be allowed through the tunnel. If you’re only routing/allowing one IP over the tunnel, I think you will break DNS resolution on the client machine once you activate the tunnel? I think you want to let laptop B just use its regular DNS settings.

6

Hey @chiet_tacochiet_taco, I did some tests of this in my lab and DNS seemed to worked fine with the tunnel active, though I’m not 100% sure on the exact routing under the hood and will have to look into it more. I mainly added Quad9 there just so the laptop had a safer DNS. Letting the laptop use its regular network settings (or setting Quad9 directly on the Windows adapter) and keeping DNS = out of the WireGuard config makes a lot of sense. I implemented the DNS on the laptop itself and it seems to work find so I will keep that setting. Thanks!

7

ah i had a similar split tunnel and just left DNS on the local adapter instead of wiring it into wg it worked fine and avoids the hiccup you mentioned edit if you need to force the office name you can add a static host entry on the laptop

8

That’s good to know, as of now that works as the use case for this scenario since it’s not a permanent remote host