https://community.ui.com/questions/DNS-over-IPSec-site-to-site-vpn/99ee6930-804e-4e6f-84b2-15e8d38a89e1#answer/f047ea34-b553-4868-8e88-bbb00055522f

I did some troubleshooting and did notice something peculiar - when I manually create a Wireguard VPN server on my UCG-Max the assigned port is not open. The connectivity is allowed through the firewall and I can create an OpenVPN server on the same site which works fine.

It looks like the wireguard server is not listening to connections on the UCG-Max and I believe site magic uses Wireguard, hence I suspect that is the cause site magic is unsuccessful.

Any suggestions on a remedy? I have previously attempted the below:

• Removed any custom firewall rules, NAT, static routes, port forwarding etc. and attempted to delete and create
• Rebooted the UCG-Max and UCG-Ultra
• Tried different port numbers for wireguard

First issue, for some reason, download speeds on my UDMP are incredibly slow, this has been on the last few stable and EA Unifi OS versions, as well as the last few Unifi Controller versions. I've used my UDMP as my main firewall before, and I have an 8 gigabit symmetrical WAN, and have been able to get around 7.5Gbps in both directions with it. But for some reason, now, I can't get more than about 500Mbps download, upload is still in the 7 gigabit range though. Other firewalls I have don't have this issue, for example my Netgate 6100 can hit around 3.5 gigabit in both directions right now (that's the fastest it can route real world). I've tried everything I can think of other than fully factory resetting, might do that though if I can't find another solution.

Second, and this is in some ways the bigger issue because I do believe the above will be fixed by factory resetting, packet captures just flat out don't work on my UDMP anymore. They did when they were first introduced, but now whenever I try to run a pcap on any interface, it just times out. I get a little notification in the top right that says "packet capture timed out" with no additional info. I use pcaps for troubleshooting and other stuff all the time, so this has to work.

I have comcast internet coming into the pfSense and the LAN from that going into an RJ45 port of a USW-Pro-24 switch. For numerous home lab reasons I have DHCP handled by the pfSense router, but DNS handled by pihole and Windows Server forwarding for the domain. 

Once I moved to Ubiquiti access points I added a USW-Pro-24-POE to the mix. 

In an effort to add 10Gb connectivity to my network for a VMware vSAN cluster among other things I added the USW-Aggregation which I then connected the PoE and Pro-24 up to via SFP+ DAC. No issues. Works great.

A small TPLink switch was also connected to the aggregation switch via 10Gtek 1.25/2.5/5/10G-T SFP+ to RJ45 CAT.6a Copper Transceiver set to 1Gb and worked without issue. 

My understanding was that my router should also be going through the aggregation switch rather than hanging off the side of one of the switches so I got another SFP+ to RJ45 transceiver to go about making this change. 

I shut down the pfSense and connected it to the aggregation switch via transceiver setting the port to switching and 1Gbps FDX. I powered it on and switches in unifi just started disconnecting. The switches were dropping to their default IP of 192.168.1.20 because they couldn’t see the DHCP server which is coming from pfSense. 

I tried restarting the aggregation and PoE switches but still didn’t get a correct IP. 

I tried disconnecting DAC connections between aggregation and other switches and re-connecting but that did nothing.

The second I unplugged the transceiver in port 1 on the aggregation switch it showed the right IP on the front screen and everything popped up in the UI. That transceiver goes to one of the vSAN nodes which has never had an issue with connectivity and after putting everything back the way it was before has been fine since. 

My question is, should the pfSense router be going into the aggregation switch and if so how do I go about getting it moved over without everything failing as it did? 

Thanks

remark: I turned off the wireless meshing feature, because the UXs were not using the wired backbone to the UCG with that turned on. So I am asking for a solution to bring in a wireless access point, which is able to connect to the available wifi that already exists.