Evaluating the capabilities of the [**UniFi Dream Machine Pro**](https://store.ui.com/collections/unifi-network-routing-switching/products/udm-pro) all-in-one enterprise security gateway & network appliance (**UDM Pro**), I was wondering whether this site-to-site setup is possible:

[![Site-to-site setup](https://i.stack.imgur.com/QtTjf.png)](https://i.stack.imgur.com/QtTjf.png)

### Setup context

* Router on site 1: [Ubiquiti EdgeRouter ERPro-8](https://www.ui.com/edgemax/edgerouter/) (ERPro-8)
* Router on site 2: [Ubiquiti UniFi Dream Machine Pro](https://store.ui.com/collections/unifi-network-routing-switching/products/udm-pro) (UDM Pro)
* Router on site 3: [Ubiquiti UniFi Security Gateway](https://store.ui.com/collections/unifi-network-routing-switching/products/unifi-security-gateway) (USG)
* All three routers are behind ISP routers, which do support port-forwarding to the ubiquiti routers, but might not support bridge mode.
* All three sites have dynamic IPs, referenced by dynamic DNS.

### Setup goals

* The three networks behind the Ubiquiti routers should be connected via site-to-site VPN, e.g. IPSec.
* All UniFi devices, i.e. the Access Points (APs), the UDM Pro, and the USG, should be controlled by the UniFi controller on the UDM Pro.

### Some observations

* IPSec between several EdgeRouters only (without ISP routers, without UniFi routers) does work, but the UDM Pro interface did not allow to enter dynamic DNS names as IPSec peers.
* When adding the ISP routers with port forwarding (UDP 500 and 4500), I think I would need to tell the EdgeRouters to use their dynamic public IPs when establishing IPSec for authentication, but I'm not sure if I can do this in the GUI.
* From what I've seen, the USG and the UDM Pro would support dynamic DNS when using OpenVPN rather than IPSec, but the EdgeRouter does not support OpenVPN from the GUI.
* The most uncertain thing to me is whether I can use the UDM's UniFi controller through the tunnel, especially because the UDM Pro is an appliance and I'm unsure whether it would support controlling multiple sites, or be controlled by an external UniFi controller.