| name | unifi-wireguard |
| description | Check, enable, disable, or diagnose the UniFi WireGuard macOS client; prove tunnel routing before testing Mac Mini SSH or private LAN services. |
UniFi WireGuard
Manage the macOS WireGuard client for a UniFi-hosted home-LAN tunnel. Prove
the route, not just the connection badge.
No arguments: report status and the route to 192.168.1.100 without changing
state.
First Safe Action
scutil --nc list
scutil --nwi
/sbin/route -n get 192.168.1.100 |
grep -E 'destination|gateway|interface'
route_src=$(ifconfig "$(/sbin/route -n get 192.168.1.100 |
awk '/interface:/{print $2}')" 2>/dev/null |
awk '/inet /{print $2; exit}')
printf 'source=%s\n' "$route_src"
Select the one enabled service whose provider is com.wireguard.macos.
- No matching service: blocked. Install or import the WireGuard profile.
- Multiple matching services: ask which profile owns the target LAN.
- Do not hardcode the service UUID; discover it on each machine.
Classify the result:
en0 with a 192.168.1.x source: direct home LAN.utun* with a 192.168.2.x source: UniFi WireGuard.Connected plus an en0 target route while at home: expected LAN bypass.Connected plus an en0 target route while off-site: tunnel routing failed.
Ensure On
