What is the best port forwarding VPN for UniFi?

Choose PureVPN when the tunnel will terminate on the UniFi gateway or you need 2–15 selected ports. Choose Proton VPN when one Windows, macOS, or Linux host behind UniFi needs one incoming port and can run the Proton VPN app.

Does UniFi support a port-forwarding VPN?

Yes. A current UniFi gateway can connect to a provider with its WireGuard or OpenVPN VPN Client, route selected devices through that tunnel, and use Destination NAT plus firewall policy to send an incoming VPN port to a LAN host. The VPN provider must support and assign the incoming port first.

Can I use Proton VPN port forwarding with UniFi?

Yes, but the easiest setup is the Proton VPN app on the destination host. Proton assigns one active port on a supported P2P server. Manual WireGuard port forwarding uses NAT-PMP and requires a compatible device to request and refresh the mapping, so it is an advanced gateway-wide setup.

Can I use PureVPN port forwarding on a UniFi gateway?

Yes. PureVPN documents port-forwarding locations, manual configurations, and Member Area policies for selected ports. Import the supported configuration into the UniFi VPN Client, route the destination host through it, and map the allowed VPN port to that host.

Do I still need a normal UniFi WAN port-forward rule?

Not for the host-app setup: traffic terminates on the host's VPN interface. For a gateway-wide setup, use Destination NAT on the VPN Client interface to translate the provider-issued port to the LAN host. A standard WAN rule listens on the ISP-facing interface and is the wrong path for VPN inbound traffic.

How do I import a port-forwarding VPN into UniFi?

Download a supported WireGuard or OpenVPN configuration from the VPN provider, add it under the UniFi VPN Client settings, and create a Traffic Route for the destination device or VLAN. Then apply the provider's incoming-port policy and the matching Destination NAT and firewall rules.

Why is my UniFi VPN forwarded port still closed?

Check that the tunnel uses a port-forwarding location, the provider policy is active, the UniFi Traffic Route includes the destination, the service is listening on the same TCP or UDP port, the host firewall allows it, and the test targets the VPN exit address.

Which VPN should I use for multiple ports on UniFi?

Use PureVPN for 2–15 incoming ports. Its port-forwarding add-on lets you define selected ports in the Member Area and apply them to a supported location. Proton VPN assigns one active forwarded port per supported session.

Guide

15 min readAug 09, 2026

UniFi Port Forwarding VPN: Best Options and Setup

Choose a port-forwarding VPN that actually works with a UniFi host or gateway, then route, map, and test the provider-issued incoming port.

Quick Answer

PureVPN is the best fit when the VPN must run on the UniFi gateway or you need 2–15 chosen incoming ports. Proton VPN is the easiest option for one incoming port when you can install its app directly on the server or PC behind UniFi. The port is opened on the VPN provider's endpoint and returns through the tunnel, so test the VPN address and assigned port—not the regular ISP-facing WAN address.

Choose the right VPN Set it up on UniFi

Best Port-Forwarding VPNs for UniFi

If you want an incoming port through a VPN on a UDM, UDM Pro, UDM SE, or UniFi Cloud Gateway, buy the VPN that matches the way you will deploy it. PureVPN is the cleaner UniFi-gateway choice and the only recommendation here for 2–15 ports. Proton VPN is the easiest one-port choice when its app can run directly on the target server or PC.

The pain

A normal VPN tunnel carries outbound traffic, but it does not automatically give your UniFi service a reachable incoming port.

What the right VPN changes

The provider opens a port on its VPN endpoint and carries matching traffic back through the tunnel.

What you get

Your game server, NAS, camera, or remote app gets a usable public entry without exposing the service through the regular ISP-facing WAN.

Pick the Right Port-Forwarding VPN

Tell us how many incoming ports you need and whether the VPN will run on one host or on the UniFi gateway.

Incoming ports neededEnter a number from 1 to 15.

Where should the VPN run?

Best match: Proton VPN

Use the Proton VPN app on the target host

This is the quickest one-port setup: connect to a supported P2P server, enable port forwarding, and copy the active port into your service.

See the Proton VPN option

Not every VPN supports incoming port forwarding

The VPNs below are ones we researched and confirmed support this feature, and both publish generous refund policies. Choosing the wrong VPN and then finding out it cannot forward a port—and cannot be refunded—would be a painful surprise.

Best for UniFi gateways & 2–15 ports

PureVPN

Choose up to 15 incoming ports in the PureVPN Member Area
Download a port-forwarding location config for a router or UniFi VPN Client
3M+ users and 17 years in cybersecurity
31-day refund window for eligible initial purchases

Best for one port on one UniFi host

Proton VPN

One VPN-assigned incoming port for a server or app behind UniFi
Install the app on the target host, connect, and copy the active port
100M+ accounts across the Proton privacy ecosystem
30-day refund window for eligible paid-plan purchases

PureVPN vs Proton VPN for UniFi

Decision	PureVPN	Proton VPN
Best fit	UniFi VPN Client, router-wide routing, or 2–15 incoming ports	One incoming port on one Windows, macOS, or Linux host behind UniFi
Port control	Choose specific ports in the Member Area	Receives one active port from the connected P2P server
Fastest setup	Import a supported manual configuration into UniFi, then apply a Traffic Route	Install the Proton VPN app directly on the server or PC
Good for	NAS, cameras, game servers, remote services, and several listeners	A single downloader, game service, or self-hosted app

How to Use a Port-Forwarding VPN with UniFi

Easiest

Install the VPN app on the target host

Best when one PC, NAS app, or game server needs the incoming port.

1Install Proton VPN for one port, or PureVPN when the host needs several ports.
2Connect to a location marked for P2P or port forwarding.
3Enable port forwarding and copy the assigned or chosen port.
4Set the service to listen on that port, allow it in the host firewall, and test the VPN exit IP.

Whole UniFi path

Terminate the VPN on the UniFi gateway

Best when the destination cannot run a VPN app or several LAN services share the tunnel.

1
Choose a PureVPN PF location
Buy the port-forwarding add-on, open the Member Area, select the incoming ports, and download a manual configuration from a location marked for port forwarding.
2
Import the VPN configuration
In UniFi Network, open Settings > VPN > VPN Client and import the provider's WireGuard or OpenVPN configuration. Confirm that the client shows connected.
3
Route the destination through the VPN
Create a Traffic Route or policy-based route for the server, NAS, camera, or VLAN that should use the VPN Client interface.
4
Map the provider port to the LAN host
Create a Destination NAT policy on the VPN Client interface using the allowed incoming port, target LAN IP, translated port, and required TCP or UDP protocol.
5
Allow the VPN-to-LAN flow
Confirm the matching zone firewall policy and allow the same port in the destination operating-system firewall. Keep the return path on the VPN tunnel.
6
Test the VPN endpoint
Keep the service listening, switch the test device to another network, and check the VPN exit address with the exact provider-issued port and protocol.

Verify the VPN Port, Not the ISP WAN Port

Test the address and port issued by the VPN provider while the service is running. That proves the path your buyer actually paid for.

VPN session

The destination host or UniFi Traffic Route is using the intended VPN tunnel.

Provider port

The port is active in Proton VPN or allowed in the PureVPN Member Area.

Local listener

The service and host firewall accept the same TCP or UDP port.

Outside test

A different network reaches the VPN exit address and forwarded port.

UniFi VPN Port Forwarding Not Working

What you see	Likely cause	Fix
The port checker still says closed	Nothing is listening on the VPN-assigned port	Keep the service running and set its listening port to the exact port shown by the VPN provider.
The app works, but traffic uses the normal WAN	The UniFi Traffic Route does not include the destination host	Route that device or VLAN through the VPN Client and enable the kill switch if WAN fallback would expose the service.
PureVPN connects, but the chosen ports do not open	The tunnel uses a location without port-forwarding support	Download a configuration from the PF-filtered location list and apply the port policy in the Member Area before reconnecting.
Traffic reaches the UniFi VPN interface but not the LAN host	The Destination NAT or zone policy does not match the VPN port	Match the VPN Client interface, assigned port, target LAN IP, protocol, and return route in the same policy set.
Proton worked until the VPN reconnected	The active Proton port changed with the new session	Copy the new active port into the service, or automate the update on a compatible host.

UniFi Port Forwarding VPN FAQ

Compare more VPNs with port forwarding Understand WireGuard port forwarding Set up a VPN on a router Fix a port that still appears closed

Official Sources

Share this article