¶ Connecting UniFi Protect over a tunnel
If your cameras run on UniFi hardware, we collect the footage from the recorder ourselves — we sign in to it over an encrypted tunnel and pull the material into your storage. This page walks you through the whole set-up: downloading the configuration file in the panel, four settings on your UniFi gateway, and a final check that the tunnel really is up.
Set aside one visit to the site and roughly half an hour. Everything you click on the gateway is done in the UniFi Network application, and everything you click on our side is done in the panel at cvr.webdisk.io.
¶ How it works, in three sentences
Your UniFi gateway (a UCG, UDM or Dream Machine, for example) opens the connection to us itself — it calls us, not the other way round. Because of that, you do not need a fixed IP address or port forwarding on your router; it works even when your provider gives you internet without a public address. Once the connection is up, we use it to sign in to the UniFi Protect application on your device, download the recordings and save them in the storage you bought in WebDisk Files.
We call this connection a WireGuard tunnel. WireGuard is a way of setting up an encrypted channel between two devices — nobody can eavesdrop on the traffic inside it, and nothing from your network is exposed to the internet outside the tunnel.
⚠️ A break in the tunnel means a delay, not lost footage. Your UniFi recorder saves material locally first, on its own disk. If the tunnel goes down — because of a power cut, a loss of internet, or a fault on our side — recordings keep being made at your site, and once the connection returns we catch up and download whatever we missed. There is one limit: the capacity of the disk in the recorder itself. If the outage lasts longer than the period after which your device starts overwriting the oldest recordings, the oldest material will disappear at your end before it ever reaches us. So it is worth knowing how many days your recorder keeps locally — that is your real window for fixing a fault.
¶ Before you start
Check that you have everything — missing any one of these will stop you halfway:
- Administrator access to the local portal of the UniFi OS device — that is, signing in to the gateway's own address on your network, not to your Ubiquiti cloud account.
- An active CVR subscription for this recorder (PLN 45 net per month per device).
- Storage in WebDisk Files linked to the site and verified — without it we have nowhere to save the recordings, and the transfer will not start at all.
- A few minutes at the device itself, because some of the settings are made in its local portal.
¶ Step 1. Download the tunnel configuration from the panel
The configuration file is a small text file holding your tunnel's key and the address the gateway should call. We generate it for you in the panel.
- Sign in at cvr.webdisk.io.
- On the tab bar, click Recorder.
- At the top of the section you will find UniFi connection. Click Generate configuration.
- You will see the contents of the file printed on screen and a Download .conf file button. Click it — a file named
webdisk-cvr.confwill be saved to your disk. - Move that file to the computer you will use to configure the gateway.
⚠️ We show this configuration exactly once. We do not keep your tunnel's private key on our side — once you close this page, we cannot show you the file again, even if you ask us through a support request. Download the file straight away, before you go any further.
¶ What is in the file
You do not need to change anything in it — it is meant to work exactly as you receive it. It is still worth knowing what the individual entries mean, because you will come back to two of them when you configure the gateway:
| Entry in the file | What it means |
|---|---|
Address = 10.80.x.y/32 |
The address at which your gateway is visible inside the tunnel. Every customer gets their own single address. You will enter this same address for the recorder later. |
DNS = 9.9.9.9 |
A public name server, not ours. We do not want to see which addresses your network looks up, and a fault on our side must never break name resolution at your site. The UniFi application refuses to import a file without this entry — which is why it is there. |
Endpoint = <address>:51820 |
Our receiving point and the port the gateway calls (port 51820, UDP). The address is already filled in. |
AllowedIPs = 10.80.0.0/16 |
The most important entry for the security of your network. It tells the gateway: send traffic through this tunnel only to our pool of addresses. There is no 0.0.0.0/0 here, meaning "all traffic" — we do not become your internet provider, and we do not see the traffic of your computers or cameras beyond what we come for. |
PersistentKeepalive = 25 |
Every 25 seconds the gateway sends a short keep-alive signal. Without it, your provider's router would "forget" about the connection and we would not be able to reach the gateway, even though the tunnel is formally up. |
¶ If you lose the file
There is no way to recover the old file — but there is a simple way to issue a new one. In the panel, in the same UniFi connection section, click Issue new configuration and confirm.
Here is what happens then:
- a new key pair is created, and the old one stops working the moment the new one is issued;
- the gateway loses its connection and will not get it back until you import the new file — so plan this for a moment when you can go straight into UniFi Network;
- the address inside the tunnel stays the same, so the recorder settings, the route and the firewall rule are unchanged;
- the Protect account and every recorder you have added are left untouched;
- the archive already held with us is not affected in any way.
¶ Step 2. Import the configuration into UniFi Network
- Open the local portal of your UniFi OS device and go into the UniFi Network application.
- Go to Settings → VPN → VPN Client.
- Click Create New, choose the WireGuard type, then use the Import option and point it at the
webdisk-cvr.conffile you downloaded. - Name the connection
CVR. This is not cosmetic — in a moment you will have to pick it from a list when creating a route, and among several VPN connections it is easy to choose the wrong one. - Save and enable the connection.
💡 If the import ends with the message "Invalid DNS in [Interface]", it means the file was altered or truncated along the way — import it exactly as you downloaded it, without editing it in a text editor.
⚠️ Leave the "Device Wizard" and "Content Wizard" switched off. They exist to push your devices' traffic through the VPN connection. Switched on, they would route traffic through our tunnel that we have no wish to see, and a fault on our side would cut those devices off from the internet. They are not needed for archiving recordings.
¶ Step 3. Add a return route
Once the tunnel is up, the gateway knows how to call us, but it does not yet know how to answer what we ask it. The route is exactly that return path.
- In UniFi Network, go to Routing and click Create New Route.
- Route type: Static.
- Interface: choose the VPN connection named CVR (the one you created in step 2).
- Network: enter
10.80.0.0/16— our pool of addresses, the same one that appears in the configuration file. - Save.
Without this route the tunnel will come up and the panel will show contact, but the recordings still will not flow — the gateway simply will not send us its replies.
¶ Step 4. Add a firewall rule
UniFi treats a VPN connection like a piece of the internet, so by default it only lets through traffic the gateway started itself. We come for the recordings on our own initiative, so we need explicit permission — and only we do.
- In UniFi Network, go to Firewall → Internet Local and create a new rule.
- Action:
Accept. - Protocol:
All. - Source IP:
10.80.0.1— the address of our gateway inside the tunnel, and the only address this rule lets in. - Tick "Before Predefined" so that the rule lands above the factory blocking rules. Without that it sits below them and changes nothing.
- Save.
¶ Exactly what you are opening, and what you are not
This is the most common worry about the set-up, so let us spell it out:
| What | State after this set-up |
|---|---|
Access from our gateway (10.80.0.1) to your gateway |
open — downloading the recordings requires it |
| Access from any other address on the internet | closed; the rule names one source address and nothing else |
| Port forwarding on your router | not needed — you set none up |
| Your computers, phones, printers, the shop till | outside the reach of the tunnel; we do not route your devices' traffic to ourselves |
| Your network's DNS traffic | does not pass through us — the configuration points at a public name server |
| Other CVR customers | they cannot see your network and you cannot see theirs; traffic between customers is blocked on our side |
The formal wording of these commitments is in the CVR terms of service (the security clauses) and in the data processing agreement. Both documents are currently available in Polish only.
¶ Step 5. Create a local account for us in Protect
The tunnel is the road, but at the end of that road we still need something to sign in with. We need a local account in the UniFi Protect application — never your Ubiquiti cloud account.
- In the local portal of the UniFi OS device, go to Users.
- Open the Roles → Add Role tab. Name the role something like
webdisk cvrand give it Full Management for the UniFi Protect application. - Open the User → Add User tab. In the Role field choose the role you have just created, and set Account Type to Local Access Only.
- Open the new user, go to the Assignments tab and tick every camera that is to be archived. A camera left unticked here simply will not reach the archive.
- Go back to the CVR panel, add the device in the Recorder section, choose the UniFi Protect protocol and enter the username and password of this account.
💡 Why Full Management rather than view-only? Downloading recording files needs more permissions than watching the live picture. This account stays local to your device, applies only to Protect, and you can delete it at any time — which immediately cuts off our access as well.
When you add the recorder, the panel will also ask where to start: from new recordings only, or from the whole history that Protect still holds. The second option can occupy your line all night and fill the storage straight away — choose it deliberately. How much material stays with us and when it is deleted is described on the Recording retention page.
¶ How to check the tunnel is up
Check in two places — only when both agree can you be sure.
In the CVR panel. Go to the Recorder tab and the UniFi connection section. You will see your address inside the tunnel and, next to it, one of two pieces of information:
- "last contact" with a date and time — the gateway is connecting to us. We refresh the date every few seconds, so after a successful import wait a minute and reload the page.
- "the gateway has not connected yet" — we have had no contact with it at all since this configuration was issued. Move on to the symptom table below.
In UniFi Network. Under Settings → VPN → VPN Client the CVR connection should be marked as active.
The final proof, though, is not the tunnel but the recordings: within a quarter of an hour of adding the recorder, the first files should appear in the archive.
¶ When the tunnel is not up — symptoms and causes
| What you see | Most likely cause | What to do |
|---|---|---|
| The panel stubbornly shows "the gateway has not connected yet", and the connection in UniFi is inactive | An old file was imported — for example, someone loaded the previous one after a new configuration had been issued | Issue the configuration again and import the file you have just downloaded |
| The same, and the file is definitely fresh | An upstream firewall or your provider is blocking outgoing traffic on port 51820 UDP | Check whether there is a second router with its own firewall between the gateway and the internet; outgoing traffic on 51820/UDP has to get through |
| UniFi refuses the import: "Invalid DNS in [Interface]" | The file was altered or truncated while being copied | Download the file again (with a new configuration) and import it without opening it in an editor |
| The panel says the receiving point is not published | This is on our side — there is nowhere to call | Do not configure the gateway; report it to us, as a configuration issued now would point at an address that does not answer anyway |
| "Last contact" stopped several hours ago | The gateway lost internet or power; possibly an outage at your provider | Check the line at the site; once it is back the tunnel comes up on its own and we catch up on the missed recordings |
| The tunnel is up, contact is fresh, but no recordings arrive | The route from step 3 or the firewall rule from step 4 is missing | This is the most common case — check both settings in turn; the tunnel looks healthy and yet nothing flows |
| The tunnel is up, the route and the rule are in place, still nothing | A wrong Protect account password, an account created as a cloud one instead of Local Access Only, or cameras left unticked in Assignments | Go through step 5 again, paying particular attention to point 4 |
| Recordings arrive from only some of the cameras | The missing cameras are not ticked in the Assignments of the account we use | Tick them and save; the following recordings will start to arrive |
| Recordings suddenly stopped arriving after a long period of working | The storage filled up and the overwrite lock will not let space be freed — we then stop accepting data so as not to occupy your line for nothing | Increase the storage capacity in WebDisk Files; the transfer will restart on its own |
| The recorder disappeared from the archive after a new configuration was issued | The new file was not imported on the gateway | Import the new file in UniFi Network (step 2); the route and the firewall rule stay as they are, because the address inside the tunnel has not changed |
¶ When none of the above helped
Write to us using the Report a problem button in the panel, or at support@webdisk.io. To get things moving straight away, include:
- the tunnel address shown in the UniFi connection section,
- what the panel says: the date of last contact, or the note that we have not seen the gateway yet,
- a screenshot of the VPN connection status in UniFi Network,
- the time of your last attempt, and the model of the gateway and the recorder.
In the meantime your recorder keeps recording locally — and we will catch up as soon as the connection is back.