Securing Wazuh with UniFi: Network Configuration for SIEM Deployment

This article was written with the help of Sonnet 4.5 on Claude.ai. All outputs were reviewed for accuracy and confirmed working on UniFi OS 5.0.12.

Overview

This guide focuses exclusively on configuring UniFi OS 5.0.12 to support a Wazuh SIEM deployment. It assumes you already have a Wazuh server installed and running, and covers the network configuration needed to enable both internal and external agent connectivity while maintaining security through VLAN isolation and controlled firewall policies.

Prerequisites:

• Wazuh server already installed and configured
• Wazuh dashboard configured on port 8443
• DuckDNS subdomain registered and pointing to your public IP
• Cloud Gateway Ultra running UniFi OS 5.0.12
• Static IP assigned to Wazuh server

What This Guide Covers:

• Port forwarding for external agent connectivity
• Firewall policies for internal agent access
• Teleport VPN access for secure dashboard access
• Network isolation best practices

What This Guide Does NOT Cover:

• Wazuh server installation
• Wazuh configuration
• Agent installation and deployment

Understanding the Network Requirements

Wazuh Communication Ports

Agent Communication:

• Port 1514 (TCP): Agent log transmission and communication
• Port 1515 (TCP): Agent enrollment and authentication

Dashboard Access:

• Port 8443 (HTTPS): Wazuh web interface (changed from default 443 to avoid conflict with UniFi OS)

Network Access Patterns

External Agents:

• Laptops, mobile devices outside your network
• Connect via DuckDNS hostname (e.g., yourdomain.duckdns.org)
• Route through port forwarding on ports 1514 and 1515

Internal Agents:

• Workstations, servers on your local VLANs
• Can use DuckDNS hostname (hairpin NAT) or local IP
• Require firewall policies to reach Wazuh VLAN

Dashboard Access:

• Never exposed directly to internet
• Access via Teleport VPN for security
• Requires port 8443 access through firewall

Why This Configuration?

Single Agent Configuration: Using DuckDNS for all agents means laptops work seamlessly whether at home or traveling. No need to maintain separate configurations or reconfigure when location changes.

Security Through Isolation: Wazuh server on dedicated VLAN with controlled access prevents unauthorized systems from reaching sensitive security infrastructure.

Secure Remote Access: Dashboard access through Teleport VPN eliminates internet exposure while enabling administration from anywhere.

Part 1: Prerequisites and Preparation

Verify Wazuh Server Configuration

Before configuring UniFi, confirm:

1. Wazuh server is accessible locally at its static IP on port 8443
2. Static IP is assigned to Wazuh server in UniFi
3. Wazuh is on isolated VLAN (typically security or monitoring VLAN)
4. DuckDNS is configured and resolving to your public IP

Verify UniFi Teleport VPN

Ensure Teleport VPN is enabled and functioning:

1. Navigate to Settings → Teleport & VPN
2. Verify Teleport VPN shows as “Active”
3. Test connection from WiFiman app or Teleport client

Create Teleport VPN Network List

You’ll need a network list for Teleport VPN clients to use in firewall policies:

1. Navigate to Settings → Profiles → Network Lists
2. Click Add New
3. Configure:

• Name: Teleport VPN Clients
• Type: IPv4
• Address/Subnet: Your Teleport subnet (verify by connecting to Teleport and checking assigned IP)

4. Click Save

Finding Your Teleport Subnet:

1. Connect to Teleport VPN via WiFiman app
2. Check your assigned IP address
3. Use the first three octets with .0/24 (e.g., if assigned 192.168.13.5, subnet is 192.168.13.0/24)

Part 2: Port Forwarding Configuration

Port forwarding enables external agents to connect to your Wazuh server from anywhere using your DuckDNS hostname.

Step 1: Forward Agent Communication Port

1. Navigate to Settings → Policy Engine
2. Click Create New Policy
3. Select Port Forwarding
4. Configure:

• Name: Wazuh Agent Communication
• WAN Interface: WAN1 (Default)
• WAN Port: 1514
• From: Any
• Forward IP Address: Your Wazuh server’s static IP (Select Device)
• Forward Port: 1514
• Protocol: TCP

5. Click Add

Step 2: Forward Agent Enrollment Port

1. Navigate to Settings → Policy Engine
2. Click Create New Policy
3. Select Port Forwarding
4. Configure:

• Name: Wazuh Agent Enrollment
• WAN Interface: WAN1 (Default)
• WAN Port: 1515
• From: Any
• Forward IP Address: Your Wazuh server’s static IP (Select Device)
• Forward Port: 1515
• Protocol: TCP

5. Click Add

Understanding Port Forwarding

What Happens:

1. External agent resolves yourdomain.duckdns.org to your public IP
2. Agent connects to public IP on port 1514 or 1515
3. Cloud Gateway forwards traffic to Wazuh server’s internal IP
4. Agent communicates with Wazuh server

Security Note: Only ports 1514 and 1515 are exposed. Dashboard port 8443 is NOT forwarded, keeping it inaccessible from internet.

Part 3: Firewall Policy Configuration

Policy 1: External Access to Wazuh

This policy allows external agents to reach your Wazuh server through port forwarding:

1. Navigate to Settings → Policy Engine
2. Click Create New Policy
3. Select Firewall
4. Configure:

• Name: External to Wazuh
• Source Zone: External
• Source Port: Any
• Action: Allow
• Auto Allow Return Traffic: Checked
• Destination Zone: Internal
• Check box for IP Address
• Destination IP: Your Wazuh server’s static IP
• Destination Port: 1514,1515
• Protocol: TCP

5. Click Add Policy

Policy 2: Internal Access to Wazuh

This policy allows devices on your internal VLANs to reach the Wazuh server:

1. Navigate to Settings → Policy Engine
2. Click Create New Policy
3. Select Firewall
4. Configure:

• Name: Internal to Wazuh
• Source Zone: Internal
• Source Networks: Select all VLANs with agents (workstations, servers, IoT devices, etc.)
• Source Port: Any
• Action: Allow
• Auto Allow Return Traffic: Checked
• Destination Zone: Internal
• Check box for IP Address
• Destination IP: Your Wazuh server’s static IP
• Destination Port: 1514,1515
• Protocol: TCP

5. Click Add Policy

Which VLANs to Include:

• Workstation/laptop VLANs
• Server VLANs
• IoT device VLANs (if monitoring smart home devices)
• Any VLAN with systems you want to monitor

Policy 3: Teleport VPN Access to Dashboard

This policy enables secure remote access to the Wazuh dashboard:

1. Navigate to Settings → Policy Engine
2. Click Create New Policy
3. Select Firewall
4. Configure:

• Name: Teleport to Wazuh
• Source Zone: External
• Source: IP
• Source Type: List
• Source List: Teleport VPN Clients
• Source Port: Any
• Action: Allow
• Auto Allow Return Traffic: Checked
• Destination Zone: Internal
• Check box for IP Address
• Destination IP: Your Wazuh server’s static IP
• Destination Port: 8443
• Protocol: TCP

5. Click Add Policy

Part 4: Understanding Hairpin NAT

What is Hairpin NAT?

When internal agents use your DuckDNS hostname instead of a local IP:

1. Agent resolves yourdomain.duckdns.org to your public IP
2. Traffic routes to your WAN interface
3. Port forwarding sends it back to internal Wazuh server
4. Connection succeeds

This “loopback” behavior is called hairpin NAT or NAT reflection.

Why Use DuckDNS for Internal Agents?

Benefits:

• Single configuration: Laptops that travel use the same config at home and away
• No management overhead: No need to track which agents are internal vs external
• Automatic failover: Agent works regardless of location
• Simplified deployment: One agent configuration for all systems

How It Works:

• At home: Hairpin NAT routes traffic back to internal server
• Away: Standard port forwarding handles external connection
• Agent doesn’t know or care about location

Verifying Hairpin NAT

Test from an internal device:

# Test agent communication port
nc -zv yourdomain.duckdns.org 1514

# Test agent enrollment port  
nc -zv yourdomain.duckdns.org 1515

Both should connect successfully, confirming hairpin NAT is working.

If Tests Fail:

• Verify port forwarding is configured correctly
• Check that “Internal to Wazuh” firewall policy includes the testing device’s VLAN
• Ensure DuckDNS is resolving to your current public IP

Part 5: Accessing Wazuh Dashboard

Remote Access via Teleport VPN

From Mobile Device:

1. Open WiFiman app
2. Tap Teleport icon
3. Connect to your home network
4. Open browser
5. Navigate to [https://wazuh-server-ip:8443](https://wazuh-server-ip:8443)
6. Login with Wazuh credentials

From Computer:

1. Install UniFi Teleport app or use WiFiman
2. Connect to Teleport VPN
3. Open browser
4. Navigate to https://wazuh-server-ip:8443 or https://wazuh.local:8443 (if local DNS configured)
5. Accept security certificate warning (self-signed)
6. Login with Wazuh credentials

Local Access (On Internal Network)

From any device on VLANs with access to the Wazuh server:

1. Navigate to [https://wazuh-server-ip:8443](https://wazuh-server-ip:8443)
2. Accept certificate warning
3. Login with credentials

Why Not Expose Dashboard to Internet?

Security Risks of Direct Exposure:

• Dashboard provides complete visibility into your network security
• Contains sensitive security event data
• Exposed interfaces are prime targets for attacks
• Additional attack surface for credential stuffing

Benefits of Teleport VPN Access:

• Dashboard never exposed to internet
• VPN provides encryption and authentication
• Can access entire home network securely
• No additional ports to manage or secure

Part 6: Testing and Verification

Test External Agent Connectivity

From outside your network (cellular data):

# Test agent ports
nc -zv yourdomain.duckdns.org 1514
nc -zv yourdomain.duckdns.org 1515

Both should show successful connection.

Test Internal Agent Connectivity

From device on internal VLAN:

# Using DuckDNS (tests hairpin NAT)
nc -zv yourdomain.duckdns.org 1514
nc -zv yourdomain.duckdns.org 1515

# Using local IP (tests internal policy)
nc -zv wazuh-server-ip 1514
nc -zv wazuh-server-ip 1515

All tests should succeed.

Test Dashboard Access

Via Teleport:

1. Connect to Teleport VPN
2. Access [https://wazuh-server-ip:8443](https://wazuh-server-ip:8443)
3. Should load dashboard login

Without VPN (should fail):

1. Disconnect from Teleport
2. Try accessing [https://yourdomain.duckdns.org:8443](https://yourdomain.duckdns.org:8443)
3. Should timeout (port not forwarded)

Verify in UniFi Analytics

Check Port Forwarding:

1. Navigate to Insights → Traffic
2. Filter by destination IP (Wazuh server)
3. Should see connections on ports 1514 and 1515

Check Policy Usage:

1. View firewall policies in Policy Engine
2. Policies should show traffic counters
3. Confirms policies are active and being used

Part 7: Security Best Practices

Network-Level Security

1. Isolate Wazuh Server:

• Keep on dedicated VLAN
• Separate from production workloads
• Apply principle of least privilege for access

2. Review Firewall Policies Regularly:

• Quarterly review which VLANs have access
• Remove access for decommissioned networks
• Verify policies match current infrastructure

3. Monitor External Connections:

• Use UniFi traffic analytics
• Alert on unusual connection patterns
• Review connection sources regularly

4. Limit Dashboard Exposure:

• NEVER forward port 8443 to internet
• Always use Teleport VPN for remote access
• Consider IP whitelisting for additional security

Port Forwarding Security

1. Only Forward Required Ports:

• Ports 1514 and 1515 only
• Dashboard port 8443 stays internal
• No unnecessary exposure

2. Monitor Port Forwarding Rules:

• Document all forwarding rules
• Review annually or when infrastructure changes
• Remove unused rules promptly

3. DuckDNS Security:

• Keep token secure
• Update IP addresses automatically
• Monitor for unauthorized changes

Teleport VPN Security

1. Strong Ubiquiti Account:

• Use complex password
• Enable two-factor authentication
• Don’t share credentials

2. Monitor VPN Access:

• Review Teleport connection logs
• Alert on connections from unexpected locations
• Disable if not actively used

3. Keep Teleport Updated:

• Update UniFi OS regularly
• Review Teleport release notes
• Test after major updates

Part 8: Troubleshooting Common Issues

External Agents Can’t Connect

Symptoms:

• Agent shows disconnected in Wazuh dashboard
• Connection timeouts on ports 1514/1515
• Agent logs show connection failures

Solutions:

1. Verify DuckDNS resolves to correct public IP
2. Check port forwarding rules are active
3. Confirm “External to Wazuh” firewall policy is enabled
4. Test ports from external network: nc -zv yourdomain.duckdns.org 1514
5. Check UniFi logs for blocked connections

Internal Agents Can’t Connect

Symptoms:

• Hardwired agents work but WiFi agents fail
• Agents on some VLANs work, others don’t
• Hairpin NAT test fails

Solutions:

1. Verify agent’s VLAN is in “Internal to Wazuh” policy’s Source Networks
2. Check that VLAN has isolation enabled (if isolated, needs explicit policy)
3. Confirm Wazuh server’s static IP hasn’t changed
4. Test connection: nc -zv wazuh-server-ip 1514
5. Review firewall logs for blocked traffic

Can’t Access Dashboard via Teleport

Symptoms:

• Connection timeout to dashboard
• Certificate errors
• “This site can’t be reached”

Solutions:

1. Verify Teleport VPN connection is active (green in WiFiman)
2. Confirm “Teleport to Wazuh” policy is enabled
3. Check Teleport network list includes correct subnet
4. Verify Wazuh dashboard is running: sudo systemctl status wazuh-dashboard
5. Test local access first (from device on internal VLAN)

Hairpin NAT Not Working

Symptoms:

• Internal agents using DuckDNS can’t connect
• External connection works, internal doesn’t
• Port tests fail from internal network

Solutions:

1. Verify Cloud Gateway Ultra supports hairpin NAT (it should)
2. Check “Internal to Wazuh” firewall policy includes testing device’s VLAN
3. Confirm port forwarding rules are correct
4. Test using local IP instead: nc -zv wazuh-server-ip 1514
5. If local IP works but DuckDNS doesn’t, hairpin NAT may be disabled

Conclusion

Proper UniFi network configuration is essential for secure and functional Wazuh SIEM deployment. By implementing port forwarding for external agents, targeted firewall policies for internal access, and Teleport VPN for dashboard administration, you’ve created a network architecture that balances security with operational needs.

What You’ve Accomplished:

Secure External Access: Traveling laptops and remote devices can connect to your Wazuh server from anywhere while maintaining security through controlled port forwarding and firewall policies.

Internal Network Isolation: Wazuh server operates on an isolated VLAN, accessible only through explicit firewall policies. Even compromised systems on other VLANs cannot reach your security infrastructure without authorization.

Unified Agent Configuration: Using DuckDNS for all agents provides seamless connectivity whether devices are at home or traveling. Hairpin NAT ensures the same configuration works in both scenarios without manual intervention.

Protected Dashboard Access: The Wazuh dashboard is never exposed to the internet. Remote access requires Teleport VPN connection, adding authentication and encryption layers while enabling secure administration from anywhere.

Enterprise-Grade Network Security: The techniques demonstrated — VLAN isolation, IP-based firewall targeting, controlled port forwarding, and VPN-secured administration — implement best practices used in enterprise environments.

This network configuration provides the foundation for comprehensive security monitoring across your entire infrastructure. Whether monitoring 5 systems or 500, the architecture scales seamlessly by adding VLANs to firewall policies and deploying agents with consistent configuration.

The combination of UniFi’s robust networking capabilities and Wazuh’s powerful security monitoring creates a professional-grade security operations center that protects your infrastructure while maintaining the flexibility needed for modern remote work environments.

References and Resources

• UniFi Documentation: https://help.ui.com/
• UniFi Teleport VPN Guide: https://help.ui.com/hc/en-us/articles/115005445768
• DuckDNS: https://www.duckdns.org/
• Wazuh Documentation: https://documentation.wazuh.com/
• Network Segmentation Best Practices: NIST Special Publication 800–125B