78 openlast updated

HomeNovember 2026 patch cycleUniFi Network 11.0.99: site-to-site VPN breaks

HoldEnterpriseHomelab

UniFi Network 11.0.99: site-to-site VPN breaks

Part of November 2026 patch cycle

Vendor
Ubiquiti
Products
UniFi Network Application 11.0.99, UniFi OS 6.0.17 consoles and gateways (UDM Pro / Pro Max / SE, UCG Ultra / Max / Fiber, UDR, EFG, and UXG Fiber)
Published
Status
Open

Call: Hold. If you run site-to-site VPN, VPN clients or policy-based routing on UniFi, hold Network 11.0.99. Turn off auto-update for the Network app until Ubiquiti says something. This is reported, not confirmed: we count at least six separate admins across the release thread and three community threads opened Nov 11. Ubiquiti staff are asking for support files and haven’t acknowledged a bug. The posters who rolled back to 10.6.109 say that fixed it.

What breaks:

  • Site-to-site VPN stops passing traffic. One admin says auto-update took his company’s sites to 11.0.99 overnight and the tunnel wouldn’t pass packets until he rolled back to 10.6.109. Another says the same thing happened on “dozens of sites,” Fabric SD-WAN tunnels included. A third, on an EFG, sees every tunnel shown as down while traffic still flows.
  • Firewall migration side effects. 11.x moves every site to the zone-based firewall. One thread reports that the migration turns WAN_OUT drop rules into Internal-to-External blocks that also catch VPN-client traffic.
  • VPN kill switch leaks. On a UCG-Fiber, a policy route that used to cut a machine off when its OpenVPN client dropped now lets the traffic go out the main WAN.
  • Other reports in the release thread: the Network app hanging at “Starting” and never coming up on a UDR, a UDM Pro Max stuck in a “Gateway Configuration Failed” loop with wired devices flapping, and CyberSecure block logging stopping every night after the reputation list update (blocking itself still works).

Plenty of people in the same thread upgraded without trouble. The common thread in the bad reports is VPN and firewall rules that the zone-based migration has to translate.

Who’s hit: UniFi gateways on UniFi OS 6.0.17 that run VPN, coming from Network 10.6.109. It’s a gradual rollout, so some consoles on the Official channel haven’t been offered it yet, and auto-update is how most people got it. Note that the 11.x upgrade also clears statistics history in the PostgreSQL migration, so write down anything you care about first.

Workaround: Roll the Network app back to 10.6.109. The admin with the configuration loop says he also had to reboot the console, twice, before the config applied cleanly. If you’re already on 11.0.99 and staying there, check your VPN-related firewall policies after the migration, and test that your kill switch actually stops traffic.

We’ll update this when Ubiquiti acknowledges it or ships a fix.

Sources: UniFi Network 11.0.99 release thread, Site-to-site VPN thread, Firewall migration thread, 11.0.99 Breaks VPN thread, Denver Techie UniFi Watch, Nov 11.

Sources

More from November 2026 patch cycle