After getting NordVPN running on my UniFi UDM Pro, the next step was dialing in Policy‑Based Routing (PBR) — the feature that lets me choose exactly which devices or VLANs use the VPN tunnel and which stay on the normal WAN.

This post walks through how I configured PBR on my UDM Pro, why it matters, and how you can use it to build a smarter, more flexible home network.

What Policy‑Based Routing Actually Does

By default, when you enable a VPN client on the UDM Pro, all outbound traffic goes through that VPN tunnel.

PBR lets you override that behavior by creating rules such as:

• “Only send my streaming devices through NordVPN.”
• “Keep my gaming PC on the normal WAN for lower latency.”
• “Route my IoT VLAN through the VPN for privacy.”
• “Send my work laptop through the regular WAN for corporate compliance.”

It’s selective routing — and it’s one of the most powerful features UniFi offers.

Step 1: Decide What You Want to Route Through NordVPN

Before touching UniFi, I made a quick list of what I wanted:

Devices I DO want on NordVPN

• Smart TVs
• Streaming sticks
• Media servers
• IoT devices that phone home

Devices I DO NOT want on NordVPN

• Gaming PC (latency matters)
• Work laptop (corporate VPN conflicts)
• Local servers (need direct WAN access)

This helped me build clean rules later.

Step 2: Create VLANs or Device Groups (Optional but Recommended)

You can apply PBR to:

• Individual devices
• Entire networks
• Entire VLANs
• Device groups

If you haven’t already, consider creating VLANs such as:

• Streaming VLAN
• IoT VLAN
• Work VLAN
• Guest VLAN

This makes routing rules cleaner and easier to maintain.

Step 3: Open UniFi’s Traffic Management Section

On the UDM Pro:

UniFi Network → Settings → Traffic Management → Routing

This is where UniFi exposes the PBR engine.

You’ll see options to create:

• WAN routing rules
• VPN routing rules
• Failover/load‑balance rules (from your other tab)

Step 4: Create a New Routing Rule for NordVPN

Click Create New Rule.

Then configure:

Rule Type:

VPN Client Routing

Source:

Choose one of the following:

• A specific device
• A group of devices
• A network
• A VLAN

Destination:

Any

Use VPN Client:

Select your NordVPN client profile.

Action:

Route

Save the rule.

This tells the UDM Pro:

“When traffic comes from this device/VLAN, send it through NordVPN instead of the normal WAN.”

Step 5: Create Rules for Devices That Should NOT Use NordVPN

If you want certain devices to stay on the normal WAN, create a second rule:

Rule Type:

WAN Routing

Source:

Select the device or VLAN.

Destination:

Any

Use WAN:

Choose your primary WAN interface.

Save.

This ensures those devices bypass the VPN entirely.

Step 6: Order Your Rules Correctly

UniFi processes routing rules top‑to‑bottom.

General guidelines:

1. WAN‑only rules first
2. VPN‑only rules second
3. Catch‑all rules last

This prevents conflicts and ensures the right traffic goes to the right place.

Step 7: Test Your Routing

To verify:

For VPN‑routed devices:

Visit: https://nordvpn.com/ip-lookup/ You should see the NordVPN server location.

For WAN‑routed devices:

Visit: https://whatismyipaddress.com/ You should see your ISP’s IP.

If both behave correctly, your PBR is working.

Advanced Tips

1. Use PBR for Streaming Optimization

Some streaming services block VPNs. Route only the devices that need geo‑routing.

2. Use PBR for IoT Privacy

IoT devices are notorious for phoning home. Routing them through NordVPN adds a privacy layer.

3. Use PBR for Work Compliance

Corporate VPNs often break when behind another VPN. Keep your work laptop on WAN.

4. Use PBR for Gaming

VPNs add latency. Keep gaming devices on WAN for best performance.

Final Thoughts

Policy‑Based Routing is where the UDM Pro really shines. Once NordVPN is installed, PBR lets you sculpt your network into something smarter, faster, and more private — without forcing every device through the same tunnel.