Ubiquiti Travel Router (UTR) and Wireguard VPN Setup

Before diving into the technical details, I want to give credit where credit is due.

This whole journey started with a video by my colleague Dennis Schröder. I came across his content, watched his take on the UniFi Travel Router, and was immediately sold. His video is one of those rare pieces of content that doesn’t just show you a product – it makes you genuinely excited to try it yourself.

Dennis, if you’re reading this – thank you! Your video directly inspired this setup, and I hope this guide gives something back to the community in the same spirit you always do.

Check out Dennis’ Video here:

UniFi Travel Router (UTR) — Technical Overview

The UniFi Travel Router (UTR) is a compact, portable networking device developed by Ubiquiti as part of the UniFi ecosystem. It is designed for professionals and power users who require enterprise-grade network capabilities while on the road.

Form Factor & Hardware
The UTR is built in an ultra-compact form factor, making it ideal for travel. Despite its small size, it delivers surprisingly capable hardware specifications that allow it to handle VPN encryption, network segmentation, and wireless bridging simultaneously without significant performance degradation.

Core Functionality
The Travel Router operates in multiple modes:

• Hotel/Uplink Mode — connects to an existing WiFi network (e.g. hotel WiFi) and creates a private, isolated network behind it. All connected devices share a single uplink while remaining protected from other guests on the public network.
• Ethernet Uplink Mode — connects via wired Ethernet for maximum stability and throughput.
• Hotspot/Tethering Mode — uses a smartphone’s mobile data connection as the uplink source.

VPN Capabilities
One of the standout features of the UTR from an enterprise perspective is its native VPN client support:

• WireGuard — modern, lightweight, and extremely fast VPN protocol with minimal overhead. Ideal for site-to-home or road warrior scenarios.
• OpenVPN — widely supported legacy protocol for compatibility with existing infrastructure.

The VPN client runs directly on the router — meaning all connected devices benefit from the VPN tunnel automatically, without any individual client configuration. This is particularly powerful in corporate environments where end devices (laptops, phones) cannot or should not have VPN software installed directly.

UniFi Ecosystem Integration
The UTR integrates natively into the UniFi Network Application, allowing centralized management alongside other UniFi devices such as switches, access points, and gateways. For standalone use, it can also be operated without a UniFi controller via a local management interface.

Practical Use Case — HomeLab & Corporate Access
For IT professionals running a HomeLab or managing remote infrastructure, the UTR provides an elegant solution: plug it into any hotel network, activate the WireGuard VPN tunnel back to the home server, and all connected devices — including corporate laptops that cannot be individually configured — automatically route their traffic securely through the home network. All internal FQDNs, services, and resources become instantly accessible as if physically present in the home lab.

Infrastructure:

• SD-WAN Gateway / Router etc. with Port Forwarding
• Ubuntu 24.04 VM (or newer) on VMware ESXi 9.1
• 2 vCPU, 2 GB RAM, 20 GB Storage
• Network Adapter: VMXNET3
• UniFi Travel Router (UTR) as VPN Client

Prerequisites

• Ubuntu 24.04 VM (or newer) with a static internal IP
• Static public IP (or DDNS)
• Port Forwarding on the Gateway/Router: UDP Port 51820 → Ubuntu VM
• Root/sudo access to the VM

Installation

Step 1 – Update the VM / OS:

sudo apt update && sudo apt upgrade -y

sudo apt update && sudo apt upgrade -y

Step 2 – Install WireGuard

sudo apt install wireguard -y

sudo apt install wireguard -y

Step 3 – Check the NIC Name on the VMs the interface is often called ens160 instead of eth0:

ip link show

ip link show

Step 4 – Generate the Server Key Pair

sudo -i
cd /etc/wireguard
wg genkey | tee server_private.key | wg pubkey | tee server_public.key
chmod 600 server_private.key

# Store the Server Private Key securely — e.g. in a password manager. If lost, all clients need to be reconfigured!

sudo -i
cd /etc/wireguard
wg genkey | tee server_private.key | wg pubkey | tee server_public.key
chmod 600 server_private.key

# Store the Server Private Key securely — e.g. in a password manager. If lost, all clients need to be reconfigured!

Step 5 – Create the Server Configuration

nano /etc/wireguard/wg0.conf

[Interface]
PrivateKey = YOUR_SERVER_PRIVATE_KEY
Address = 10.0.0.1/24
ListenPort = 51820
SaveConfig = true

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens160 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ens160 -j MASQUERADE

# Replace ens160 with your actual interface name if different!

nano /etc/wireguard/wg0.conf

[Interface]
PrivateKey = YOUR_SERVER_PRIVATE_KEY
Address = 10.0.0.1/24
ListenPort = 51820
SaveConfig = true

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens160 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ens160 -j MASQUERADE

# Replace ens160 with your actual interface name if different!

Step 6 – Enable IP Forwarding

nano /etc/sysctl.conf

# Uncomment this line:

net.ipv4.ip_forward=1

# Apply immediately:

sysctl -p

nano /etc/sysctl.conf

# Uncomment this line:

net.ipv4.ip_forward=1

# Apply immediately:

sysctl -p

Step 7 — Start WireGuard & Enable Autostart

sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0
sudo systemctl status wg-quick@wg0

sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0
sudo systemctl status wg-quick@wg0

Step 8 — Configure the Firewall

sudo ufw allow ssh
sudo ufw allow 51820/udp
sudo ufw enable
sudo ufw status

sudo ufw allow ssh
sudo ufw allow 51820/udp
sudo ufw enable
sudo ufw status

Client Configuration — UniFi Travel Router

The UniFi Travel Router generates its own public key pair internally — you cannot import an externally generated public key. The correct workflow is therefore different from a standard WireGuard client setup!

Step 1 – Before implementing the public key from the UTR, create a QR Code, which you can scan.

sudo apt install qrencode -y
sudo bash -c 'qrencode -t ansiutf8 < /etc/wireguard/client.conf'

sudo apt install qrencode -y
sudo bash -c 'qrencode -t ansiutf8 < /etc/wireguard/client.conf'

As soon as you scan the QR Code the UTR will provide a public key. Note down the **Public Key** (Öffentlicher Schlüssel in German) displayed by the Travel Router:

Step 2 – Add the Travel Router Public Key to the Server

sudo -i
wg set wg0 peer TRAVEL_ROUTER_PUBLIC_KEY allowed-ips 10.0.0.3/32
wg-quick save wg0

sudo -i
wg set wg0 peer TRAVEL_ROUTER_PUBLIC_KEY allowed-ips 10.0.0.3/32
wg-quick save wg0

Step 3 — Activate and Verify the Connection

# Activate the connection on the Travel Router, then check on the server:

wg show

# A successful connection looks like this:

peer: b6glBcL/lxhpZ+tb/Xg41weGzf4AxCOMfZtwmNgzLCY=
  endpoint: XX.XX.XX.XX:XXXXX
  allowed ips: 10.0.0.3/32
  latest handshake: 3 seconds ago
  transfer: 360 B received, 184 B sent

# Activate the connection on the Travel Router, then check on the server:

wg show

# A successful connection looks like this:

peer: b6glBcL/lxhpZ+tb/Xg41weGzf4AxCOMfZtwmNgzLCY=
  endpoint: XX.XX.XX.XX:XXXXX
  allowed ips: 10.0.0.3/32
  latest handshake: 3 seconds ago
  transfer: 360 B received, 184 B sent

Useful Commands

# Check WireGuard status
sudo wg show

# Monitor live traffic
sudo tcpdump -i ens160 udp port 51820

# Save configuration
sudo wg-quick save wg0

# Restart WireGuard
sudo systemctl restart wg-quick@wg0

# Add a peer
sudo wg set wg0 peer PUBLIC_KEY allowed-ips 10.0.0.X/32

# Remove a peer
sudo wg set wg0 peer PUBLIC_KEY remove

# Check public IP
curl ifconfig.me

# Generate QR Code for a client
sudo apt install qrencode -y
sudo bash -c 'qrencode -t ansiutf8 < /etc/wireguard/client.conf'

# Check WireGuard status
sudo wg show

# Monitor live traffic
sudo tcpdump -i ens160 udp port 51820

# Save configuration
sudo wg-quick save wg0

# Restart WireGuard
sudo systemctl restart wg-quick@wg0

# Add a peer
sudo wg set wg0 peer PUBLIC_KEY allowed-ips 10.0.0.X/32

# Remove a peer
sudo wg set wg0 peer PUBLIC_KEY remove

# Check public IP
curl ifconfig.me

# Generate QR Code for a client
sudo apt install qrencode -y
sudo bash -c 'qrencode -t ansiutf8 < /etc/wireguard/client.conf'

That’s it from this post, if you have any questions please use the comment section below! 🙂