Ubiquiti edgerouter x vpn site to site setup guide: configure site-to-site VPN between offices with EdgeRouter X

Yes, you can configure a site-to-site VPN on the Ubiquiti EdgeRouter X. This guide walks you through practical, step-by-step methods to establish a reliable IPsec site-to-site tunnel between two EdgeRouter X devices or between EdgeRouter X and another IPsec-capable device, with GUI and CLI options, troubleshooting, and best practices. By the end, you’ll have a secure tunnel that lets office networks talk to each other as if they were on the same LAN. If you’re also looking to add extra protection for remote endpoints, you might want to check out NordVPN—here’s a quick option you can consider affiliate:

What you’ll learn in this guide

How to set up a site-to-site IPsec VPN using EdgeRouter X GUI and CLI
How to define local and remote subnets and secure traffic between offices
How to verify tunnel status and test connectivity across sites
Common pitfalls and troubleshooting steps
Security best practices and performance expectations for EdgeRouter X

Introduction resources uncolored text, plain-text URLs
EdgeRouter X official documentation – help.ubnt.com
IPsec concepts and EdgeOS site-to-site VPN guidance – help.ubnt.com
Ubiquiti community forums – community.ubnt.com
IKEv2 vs IKEv1 overview – en.wikipedia.org/wiki/Internet_Protocol_Security
EdgeOS CLI commands reference – edgeos.readthedocs.io

Table of Contents

What is a site-to-site VPN and why use it with EdgeRouter X

A site-to-site VPN creates a secure, encrypted tunnel between two networks over the internet. Traffic destined for the remote site’s subnets is encapsulated, encrypted, and sent through the tunnel, then decrypted at the far end. This is ideal for connecting two or more offices, disaster recovery sites, or data centers without exposing internal networks to the public internet.

Key benefits

Private inter-site communication: all traffic between sites is protected.
Centralized control: you manage the tunnel from both EdgeRouter X devices.
Scalable topology: add more sites or failover as needed.
Compatibility: IPsec is widely supported, so you can connect EdgeRouter X to other IPsec devices or VPN gateways.

EdgeRouter X basics you’ll leverage

IPsec site-to-site tunnels are typically configured with a peer’s public IP, a pre-shared key, and two subnets local and remote.
You’ll choose an IKE IKEv2 is preferred and ESP transform set encryption and hashing algorithms.
NAT-T support helps when either side is behind NAT.

Statistical context

VPN adoption has continued to grow as more organizations adopt remote work and multi-site networks. It’s common for small offices to rely on budget-friendly devices like EdgeRouter X for IPsec site-to-site tunnels while maintaining security via strong encryption standards.
AES-256 with SHA-256 is a standard baseline for modern IPsec configurations.

prerequisites and planning

Before you start, gather these details: Tunnelbear vpn rating

Public IPs of both sites or one side behind NAT and the other reachable publicly
Local network LAN subnets for both sites, e.g., Site A: 10.0.0.0/24, Site B: 192.168.1.0/24
Remote site’s subnets and how traffic should flow
A strong pre-shared key PSK for authentication
Desired IKE version IKEv2 recommended for stability and performance
Ensure EdgeRouter X firmware is up to date EdgeOS 2.x or later for best IPsec support
If one side has dynamic IPs, plan to use a dynamic DNS service on that side

Network planning tips

Keep your local subnets non-overlapping to avoid routing confusion.
Decide if you’ll route all site traffic through the VPN or only specific subnets.
If you expect a lot of traffic, test throughput and consider simplifying the topology or upgrading hardware if needed.

topology example

Site A EdgeRouter X: Local subnet 10.0.0.0/24
Site B EdgeRouter X or other IPsec gateway: Remote subnet 192.168.1.0/24
Public IPs: Site A public IP A, Site B public IP B
VPN tunnel: IPsec site-to-site tunnel between A and B
Optional: Your firewall rules grant access between subnets, deny everything else by default

GUI configuration: step-by-step

This is the friendly, click-your-way-through method. It’s great if you prefer a visual approach and want to avoid typing long commands.

Access EdgeRouter X GUI

Open a browser and go to the EdgeRouter X’s IP often 192.168.1.1 or 192.168.0.1.
Log in with admin credentials.

Prepare WAN and LAN settings

Confirm the correct WAN interface e.g., eth0 is connected to the internet.
Confirm LAN networks on both sides the subnets you’ll route over VPN.

Create IPsec peer remote site

Navigate to VPN > IPsec > Site-to-Site
Click Add or Create new peer
Peer address: remote site’s public IP or hostname if you’ve set DDNS
Local address: your edge router’s public IP or use the interface if detected automatically
Authentication: set to Pre-Shared Secret, and enter a strong secret
IKE version: choose IKEv2 recommended

Define the tunnel local and remote subnets

Local Subnet: your Site A LAN e.g., 10.0.0.0/24
Remote Subnet: Site B LAN e.g., 192.168.1.0/24

Encryption and authentication settings

IKE Group: IKEv2 with a modern group e.g., 14 or 19
Phase 2 ESP: AES-256, SHA-256. enable PFS perfect forward secrecy with a suitable DH group
Enable NAT-T if either side is behind NAT

Apply and save

Click Save or Apply Changes, then Commit and Save
EdgeRouter X will attempt to bring the tunnel up. check status in the same IPsec page

Firewall and routing rules

Ensure there’s a firewall rule allowing IPsec traffic UDP 500, 4500, and ESP
Add a static route or ensure policy-based routing allows traffic from Site A LAN to Site B LAN, and vice versa
If you’re using NAT on the LAN, you may need to exempt site-to-site traffic from NAT to prevent double NAT issues

Verification

Use the GUI’s IPsec status page to confirm the tunnel is up
Ping from a host in Site A 10.0.0.5 to a host in Site B 192.168.1.10
If ping fails, verify firewall rules, subnets, and PSK accuracy

Notes

Some EdgeRouter X firmwares present the VPN page with slightly different labels. the core steps remain the same.
If your remote site uses dynamic IP or a hostname to connect, consider enabling Dynamic DNS on the remote side and update the peer address as needed.

CLI configuration: step-by-step

If you’re comfortable with terminal commands, the CLI method gives precise control and repeatability. Start by connecting to EdgeRouter X via SSH or through the console.

Enter configuration mode
configure Vpn for edge reddit
Ensure IPsec interfaces are active
set vpn ipsec ipsec-interfaces interface eth0
Define IKE parameters IKEv2 and modern ciphers
set vpn ipsec ike-group IKE-2 lifetime 3600
set vpn ipsec ike-group IKE-2 proposal 1 encryption aes256
set vpn ipsec ike-group IKE-2 proposal 1 group 14
set vpn ipsec ike-group IKE-2 proposal 1 integrity sha256
set vpn ipsec ike-group IKE-2 proposal 1 dh-group 14
Define ESP IPsec tunnel parameters
set vpn ipsec esp-group ESP-2 lifetime 3600
set vpn ipsec esp-group ESP-2 proposal 1 encryption aes256
set vpn ipsec esp-group ESP-2 proposal 1 integrity sha256
Configure the site-to-site peer remote site
set vpn ipsec site-to-site peer 203.0.113.2 authentication mode pre-shared-secret
set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret ‘yourStrongPSk’
set vpn ipsec site-to-site peer 203.0.113.2 ike-group IKE-2
set vpn ipsec site-to-site peer 203.0.113.2 default-esp-group ESP-2
set vpn ipsec site-to-site peer 203.0.113.2 local-subnet 10.0.0.0/24
set vpn ipsec site-to-site peer 203.0.113.2 remote-subnet 192.168.1.0/24
set vpn ipsec site-to-site peer 203.0.113.2 keyingtries 3
Set local address and peer address
set vpn ipsec site-to-site peer 203.0.113.2 address 203.0.113.2
set vpn ipsec site-to-site peer 203.0.113.2 local-address 203.0.113.1 Microsoft edge vpn settings
Commit and save
commit
save
Exit configuration mode
exit
Verify status
show vpn ipsec sa
show vpn ipsec site-to-site peer

Tips

If your remote site uses a dynamic IP, you can use a dynamic DNS hostname on the peer address or update the peer address whenever it changes.
Ensure firewall rules permit the IPsec traffic ESP, ISAKMP, NAT-T.

Testing and validation

After the tunnel is up, test connectivity from Site A to Site B:
- Ping a known host on Site B from a host on Site A
- Run traceroute to confirm the traffic follows the VPN path
Check the IPsec SA Security Association status to confirm the tunnel is established
Look for mismatched subnets, PSKs, or IKE settings if the tunnel does not come up

Sample verification commands CLI Best free vpn microsoft edge

show vpn ipsec sa
show vpn ipsec site-to-site peer
traceroute 192.168.1.10
ping 192.168.1.10

Security considerations and best practices

Use strong authentication: a long, random pre-shared secret PSK or, if you’re in a larger environment, a certificate-based setup.
Prefer IKEv2 for stability and resilience, with AES-256 and SHA-256 for encryption and integrity.
Enable Perfect Forward Secrecy PFS for Phase 2 with a modern DH group e.g., group 14.
Limit portal exposure: keep the EdgeRouter X GUI accessible only from trusted networks, or disable remote GUI access if not needed.
Keep firmware updated to protect against known IPsec-related vulnerabilities.
Consider using separate firewall rules for VPN traffic and internal traffic to minimize risk in case of a breach.
For dynamic IP setups, use Dynamic DNS and automatic updates to the peer address to avoid tunnel drops.

Troubleshooting common issues

Tunnel won’t come up
- Verify PSK matches on both sides
- Verify public IPs and reachability ping the remote gateway
- Confirm IKE and ESP proposals match on both sides
- Check NAT-T settings if either side is behind NAT
Tunnel up but traffic doesn’t pass
- Check local and remote subnets for overlaps or misconfigurations
- Confirm firewall rules allow IPsec and related traffic
- Ensure routing points to the VPN tunnel when sending inter-site traffic
- Verify that the internal hosts have correct gateway settings
Intermittent connectivity
- Check for dynamic IP updates if using dynamic DNS. verify the peer address is current
- Ensure keepalive settings are appropriate and not forcing frequent re-authentications
Performance issues
- EdgeRouter X isn’t a high-end VPN device. expect lower throughput than enterprise-grade gear
- Encrypting with AES-256 and SHA-256 adds CPU load. if you need higher throughput, consider upgrading hardware or simplifying the tunnel e.g., fewer tunnels, smaller subnets

Advanced tips and caveats

Multi-site setups: you can run multiple IPsec site-to-site tunnels from a single EdgeRouter X, but you’ll need to carefully plan subnets and firewall rules to avoid routing loops or subnet overlap.
Redundancy: for critical sites, consider a secondary VPN path or a failover plan manual or automatic to minimize downtime.
Remote connectivity vs. site-to-site: EdgeRouter X also supports site-to-site VPN with other gateways and client VPNs. keep separation in mind to avoid conflicts.
NAT and VPNs: if you have a NAT environment on either side, ensure NAT-T is enabled. otherwise, the tunnel may fail to establish.
Monitoring: use syslog alerts or a network monitoring tool to track VPN uptime and performance metrics.

Performance expectations for EdgeRouter X

EdgeRouter X is a budget router and does not have hardware-accelerated encryption. Expect VPN throughput in the tens of Mbps range depending on cipher choices, traffic mix, and router load.
For small-to-medium sites with light traffic, EdgeRouter X can handle reliable IPsec site-to-site VPNs without issue.
If you’re moving large files or streaming between sites, you may notice ceiling effects. plan for short-term performance tests and consider a higher-end router if your needs grow.

FAQ: Frequently Asked Questions

How do I know if my EdgeRouter X supports IPsec site-to-site?

IPsec site-to-site VPN is a native feature of EdgeRouter X’s EdgeOS. You configure it from the GUI under VPN > IPsec or via the CLI in the vpn ipsec namespace. If you’re running a recent EdgeOS version, you’ll have robust site-to-site options. Intune per app vpn ios setup and full guide for iOS App VPN in Intune

Which VPN protocol should I use for site-to-site with EdgeRouter X?

IPsec with IKEv2 is the recommended baseline. It offers good security and stability. Use AES-256 for encryption and SHA-256 for integrity, with PFS enabled for Phase 2.

Can EdgeRouter X handle two sites with a single device?

Yes. You can configure a site-to-site tunnel to a single remote site or multiple tunnels to multiple partners, depending on your network’s topology and routing rules. Each tunnel will have its own peer configuration.

Do I need to open any ports on the firewall to make IPsec work?

Yes. You’ll need to allow IPsec-related traffic ISAKMP UDP 500, NAT-T UDP 4500, and ESP. Your firewall rules should permit traffic between the local and remote subnets over the VPN.

What if my remote site has a dynamic IP address?

Use Dynamic DNS on the remote site and configure the peer address to a hostname if your EdgeRouter X firmware supports that, or update the remote peer IP manually when it changes. The important thing is that both sides can reach each other’s public IPs.

How do I verify that the tunnel is up?

In the GUI, you’ll see the IPsec status on the Site-to-Site page. In the CLI, run show vpn ipsec sa and show vpn ipsec site-to-site peer to confirm tunnel state and SA details. Ping tests between the subnets are also very useful. Как установить vpn на айфон

Can I run multiple VPNs on one EdgeRouter X?

Yes, you can configure multiple IPsec site-to-site tunnels, but you’ll need to ensure there’s no subnet overlap and that firewall rules and routing handle the multi-tunnel setup properly.

What’s the difference between site-to-site and remote access VPN on EdgeRouter X?

Site-to-site VPN connects entire networks at two sites. Remote access VPN allows individual clients laptops, phones to connect to a central network. They’re complementary. you can have both on the same EdgeRouter X if configured carefully.

How can I improve VPN reliability and uptime?

Use stable, strong PSKs and modern IKE/ESP configurations
Regularly monitor the tunnel status and set up alerts for tunnel down events
Ensure firmware is up to date
Plan for redundancy with an alternate gateway or failover path if possible

Is there a performance difference between GUI and CLI configurations?

Functionally no—the tunnel will perform the same. The CLI sometimes makes large deployments easier to reproduce, while the GUI is friendlier for quick setups and ongoing adjustments.

How often should I rotate the pre-shared secret?

Best practice is to rotate PSKs periodically e.g., every 6–12 months or immediately if you suspect it may have been compromised. After rotation, update both sides’ configurations and test connectivity.

Can EdgeRouter X handle IPv6 site-to-site VPN?

IPsec support on EdgeRouter X is primarily IPv4 focused, but newer EdgeOS builds may offer IPv6 capabilities in some contexts. Verify your firmware release notes for IPv6 support and follow the vendor’s guidance if you need IPv6 tunnels. K electric offices: the ultimate guide to securing remote access and data with VPNs for Karachi’s electric utility

Final notes

The EdgeRouter X is a cost-effective option for site-to-site VPNs, especially for small offices or home labs. While it’s not the newest hardware on the market, with careful configuration it delivers solid, secure tunnels for most practical needs.
Start with a simple two-site tunnel to validate connectivity, then expand to multi-site configurations as your network grows.
Always test after changes and keep your firmware updated to benefit from improved IPsec features and security patches.

Useful URLs and resources plain text
EdgeRouter X Official Documentation – help.ubnt.com
IPsec VPN on EdgeRouter X – help.ubnt.com
Ubiquiti Community Forums – community.ubnt.com
IKEv2 overview – en.wikipedia.org/wiki/Internet_Protocol_Security

Frequently Asked Questions additional

Can I use a different device on the other end of the tunnel e.g., a Mikrotik or Cisco?

Yes, IPsec site-to-site tunnels are a standard approach. You’ll need to configure the matching IPsec settings on both sides, including the PSK, IKE version, and the tunnel subnets.

How do I monitor VPN throughput on EdgeRouter X?

Use the built-in status pages or CLI commands to monitor SA and throughput. For more advanced monitoring, pair EdgeRouter X with a network monitoring tool that tracks VPN uptime, latency, and packet loss.

What are common causes of VPN tunnel flaps?

Mismatched IKE/ESP settings, PSK mismatches, routing issues, or dynamic IP changes without proper DDNS updates can cause tunnel flaps. Rechecking those elements is usually enough to stabilize. Is protonvpn legal worldwide: legality, country-by-country rules, privacy, logging, and how to use ProtonVPN safely

Should I disable remote GUI access on EdgeRouter X?

If remote management isn’t required, yes—disable remote GUI access and use a VPN or SSH from trusted networks for management. This reduces exposure to attackers.

Can I combine site-to-site VPN with client VPNs on the same EdgeRouter X?

Often yes, but you’ll need to carefully segment traffic with firewall rules and routing to avoid cross-traffic leakage or tunnels interfering with each other.

How do I recover if I forget the PSK?

If you have another admin account with access to the device, you can reset the PSK in the IPsec settings. If not, you may need to factory reset and reconfigure, which is why keeping a secure backup of configurations is wise.

Do I need a unique PSK for each site-to-site tunnel?

Yes, it’s best practice to use separate PSKs per tunnel for security and easy rotation. This helps isolate a compromisation to a single tunnel rather than affecting all sites.

Are there legal or compliance considerations I should be aware of with VPNs?

Depending on your jurisdiction and industry, you may need to ensure encryption standards meet regulatory requirements e.g., AES-256, SHA-256. Always align VPN configurations with your organization’s security policy. How to turn on vpn on microsoft edge and enable a secure browser VPN extension in Edge for private browsing on Windows

What should I do if the remote site changes its network subnet?

Update the remote-subnet in the EdgeRouter X configuration to reflect the new subnet. Adjust firewall rules and routing as needed, then test the tunnel to confirm traffic flows correctly.

How can I simplify maintenance for multiple sites?

Use a template-driven approach: define a standard IKE/ESP profile, common PSK management, and consistent subnet schemas. CLI scripts or a centralized management plan can simplify ongoing changes.

海鸥vpn破解版风险与替代方案：为何不应使用破解版本以及正规VPN选择指南（2025 更新）

Vpn unlimited extension chrome ultimate guide to installing, using, and optimizing Chrome VPN extensions in 2025