tl;dr I need WOL over the internet over the USG to work. WOL works already locally. I guess the USG/Switch is the problem.

Hi all

As a newcomer to networking in general and Unifi in particular I am trying to setup Wake-On-Lan for my local machines (±100) from the internet, via the USG Pro. Ultimately I want to be able to power on computers via the WOL feature in TeamViewer. To this end I've done a lot of (suggested) things already, but none seem to work.

I have already read most of the topics about Unifi/WOL in this community and others.

The most promising option — and the one I've currently implemented — is setting up a static ARP entry for the broadcast MAC (FF:FF:FF:FF:FF:FF) with an unused IP and a port forward for port 9 to that unused IP. I think — and please correct me if I'm wrong! — is that when a Magic Packet is sent from the internet on port 9 the USG forwards it to the unused IP, it then looks up its MAC and sees it is the broadcast MAC and thus sends the Magic Package to all clients.

I'm only yet in the part of configuring the network, and not yet using TeamViewer or configuring the computers (NICs and BIOS).

Hereby what I've undertaken and discovered so far:

1) Created a static ARP entry

Created config.gateway.json with the following content and uploaded it to /usr/lib/unifi/data/sites/default on the Cloud Key (Gen 2) via SSH (to make the entry persistant). Then Force Provisioned the USG.

    "protocols": {
        "static": {
            "arp": {
                "": {
                    "hwaddr": "ff:ff:ff:ff:ff:ff"

2) Added Port Forward We use the 'unused' ip we used in step 1

3) Checking if ARP entry is in the USG

SSH'ing into USG, I can see the entry exist with show arp enter image description here

4) Checking if USG receives the package from WAN

Since I do not yet use TeamViewer or have setup my computer (BIOS) I am using the RemoteBoot app on iPhone and Depicus to send a WOL package and Wake On Lan Monitor on the PC to test if it receives a package. We can see in the tcpdump that it receives the packages. enter image description here

5) Checking if it goes trough LAN

The same goes for the packages on the local network. We can see them being routed to the unused IP specified in the port forward and config file. enter image description here

6) Computer receives nothing

When checking the WOL Monitor on the client PC (the one with the MAC address to which the package is sent), nothing comes trough. enter image description here

7) Direct port forward DOES work

For testing purposes I setup another port forward (this time on port 10) directly to the IP of the client computer. This clearly works as we can see in the WOL monitor: enter image description here

I have no clue why it is not working. Do I need to setup something more? Have I made a mistake? Can someone put me in the right direction?


  • 2
    Please, never use an image for text the way you have done with three Putty images. Simply copy the text and paste it into the question using the Preformatted-text option ({}).
    – Ron Maupin
    Oct 19 '19 at 16:04
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Dec 31 '20 at 3:52

Because network broadcasts are blocked by default in routers (directed broadcast), you would need to enable directed broadcast, but that is a very, very bad idea because it opens up your network to broadcasts from anyone on the Internet (as does your idea).

The best solution I have seen for something like this is a host that is always on in your network that performs the WoL after you log into it and tell it which host(s) to wake. This should have security built into it so that others cannot simply control it. Unfortunately, hosts/servers and product or resource recommendations are off-topic here, so you will need to do your own research for a WoL server.


As it seems, the static ARP entry with the broadcast address isn't working - it isn't on some devices. Additionally, I'm not sure if you set the ARP entry on the right device: it must always be on the NAT router itself. You can test the static ARP entry by simply pinging the fake IP from the router. The ICMP echo request should be received by all LAN nodes.

However, you can just as well use any unused MAC address. A switch forwarding that frame and not finding it in the local MAC table will flood it to all interfaces, exactly like a broadcast. I'd use a locally-administered MAC address to be clean (bit 1 of the first octet set to 1).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.