Ubiquiti Unifi Site Magic - better than site-to-site VPN for "multi-site, single core"?

Just saw that Unifi now allows you to set up a pretty seamless SD-WAN in a pretty idiot-proof way. I haven’t tried it yet, because my “second home” has an older USG3 as the gateway which doesn’t support the functionality.

But has anyone tried it? If you eyeball the announcement and documentation, should it allow me to use a single Roon core across two homes, with endpoints in each home “out of the box”?



Thanks, looks promising. Currently I have a couple of UDM sites connected with Tailscale, about to add a 3rd one, but no subnet sharing, so I have separate Roon server subscriptions for them. Since they are lifetime, I don’t have a strong incentive to explore this, but it would be a fun project when I have time to tinker. Which won’t happen until Thanksgiving, looks like.

Have not tried it as I don’t have access to multiple sites. Would be interesting.

I have briefly played around with their Teleport VPN, which did allow me to use the regular Roon app (not ARC) on my iPhone from the office. I did no extensive testing though.

Pure speculation from my part, but I would think that the two have some common characteristics, so there’s a good chance that the use case you have in mind would work.

Yeah, the real question is not whether you can use a “controller which is also an endpoint itself” on another network connected by vpn, but rather whether you can have a “controller on network A” and a separate “endpoint on network A” and a “core on network B” if “network A and B are part of an SD-WAN”. And that will all come down to whether an SD-WAN passes UDM packets across transparently. I know a few concepts in networking, but not enough to know if that’s plausible.

If anyone tries, please let me know - I’d buy a second UDM-Pro, a purchase I’ve been deferring, just to get this functionality.

Site Magic is built on WireGuard. WireGuard routes UDP packets, so there’s hope that this will work for you.

I bet if you asked on the thread you posted above, someone would have a more definitive answer. This would certainly be easier than standing up Tailscale…

Oooh. Thanks [as always!]. Now the question is who’s close enough to know whether it’s worth blowing the $500 on a new UDM Pro (or maybe getting an old UDR) for the experiment’s sake :slight_smile:


I have a spare UDR - I’d forgotten about it. I haven’t had it plugged in for a couple of years.

I’m game for a quick experiment to see if this works. The Site Magic docs say:

As long as one gateway has a public IP, even gateways behind NAT or on LTE/5G service can participate.

so I might be able to get it to work with the UDR sitting on the UDM Pro’s network.

Playing with it now but it’s taking a bit of effort to resuscitate the UDR.

My UDR is seriously out of date. I’m up to the 4th console update - a couple are within the same major version but the updates from 1.x to 2.x and 2.x to 3.x are each taking about 20 mins.

…and I am running out the door for work-related stuff and won’t be back home until at least six hours from now. This experiment is going to have to wait. I will give it a shot - I’m sure there are multiple people here who would be interested in the results.

I know someone that looked into this with Unifi. The challenge appears to be that mDNS doesn’t broadcast across, which prevents core and endpoint from discovering each other.

@gTunes as always, full of appreciation. I’m kinda glad that your UDR console was out of date, cause it’s old school kit at this point. But if I can replace my USG with one and make this work with a magic out of the box bit of magic, I will be very psyched. Thank you thank you.

I don’t have good news.

Took a while to get the UDR onto current OS and network releases. Once I did that, it became visible as a participant in Site Magic.

The UDR is behind my UDM Pro. I might be able to put a switch or hub in front of both routers and let them try to pick up routable IPs from Xfinity, but after the testing I’ve done, I don’t think that would change anything.

I’m going to skip most of the details around what I did. The short version of the story is that it doesn’t work. In the end, this was my setup:

  1. UDR on my “IoT” subnet. I have four subnets - main, roon, iot, guest with complex firewall rules in place. If I put the UDR on the main subnet, devices behind the UDR can access main and stuff on main has full access to stuff on roon. Similar issue with putting it on roon. Putting it on Guest didn’t allow Site Magic to work. IoT is the sweet spot - no access to main or roon, works fine with Site Magic.

  2. A Site Magic group created that includes the “roon” subnet on my UDM Pro and the Default subnet on my UDR. This works.

  3. If I connect my iPhone to the UDR without the Site Magic group set up, I can’t see my roon core. If I set up the Site Magic group, I can see the roon core and I can control devices on my existing network but I can’t enable the iPhone as an Audio zone. That’s an indication that UDP packets aren’t getting routed.

  4. If I connect a Roon Ready device to the UDR with Site Magic on, the core does not see the device. This is predictable given what I saw with the iPhone.

So…Site Magic is super easy to set up and did provide me with access to stuff on the bridged network however it doesn’t enable the scenario where a core is on one network and a target audio device is on another. It does enable the scenario where a controller is on a different physical network than the core, but that’s not the problem @Johnny_Ooooops is trying to solve.

Sorry I don’t have better news.


Hi @gTunes – I assume nothing has changed since you posted this in Sept to make endpoints in remote networks visible from the Roon server network?

It would seem that Roon Server would need to scan for remotes using the IP ranges of both networks for this to work. I suppose we could post that as a feature request to the Roon team.

Hi. I’m not aware of any changes, but I haven’t looked into this again since that last post.

1 Like

This is the deal killer. I’ve tried everything to make it work. If you use a traditional Site to Site VPN that does allow mDNS it does work assuming you have enough bandwidth/low enough latency.

Is there a list of those that do allow mDNS? Or does anyone know an example?

I used the standard Unifi UDM Site to Site VPN (I don’t have a static IP address so that would require DynDNS or manually updating as needed), same thing with Sonicwall. When I had it working previously I didn’t have enough bandwidth and the Squeezebox endpoint I was using would occasionally stop playing. It would be great if Site Magic could work - which gets around the lack of a Static IP. I’m certain there are others on here that do networking for a living that will have better suggestions. I spent a lot of time with Site Magic before I discovered it didnt support mDNS…

1 Like