Journalist 
Yes, you can configure a site-to-site VPN on the Ubiquiti EdgeRouter X.
If you’re here, you likely want a reliable, low-cost way to connect two or more offices or locations over a secure tunnel. This guide walks you through planning, configuring, and validating a site-to-site IPsec VPN on the EdgeRouter X using EdgeOS. You’ll learn the steps to create a dependable tunnel between your local LAN and a remote site, plus practical tips to keep it secure and stable. Think of this as a hands-on, friendly walkthrough that you can follow step by step, with real-world examples, troubleshooting tips, and a few pro tweaks at the end. And if you’re evaluating extra protection while you experiment, consider NordVPN’s current deal via the banner below.
What you’ll get in this guide
- A clear plan for subnet addressing and gateway setup
- Step-by-step instructions to configure IPsec site-to-site VPN on EdgeRouter X
- Firewall and NAT considerations that won’t break your tunnels
- How to verify the tunnel is up and remains healthy
- Troubleshooting tips for common hiccups
- Extra tips for scaling to more sites and long-term maintenance
- Practical security considerations for small-to-medium networks
Introduction: a quick summary of what you’re about to read
If you want to connect two networks securely over the public internet, a site-to-site VPN on the EdgeRouter X is a solid, affordable choice. This guide covers planning, configuration, validation, and maintenance of an IPsec tunnel between your EdgeRouter X at the primary site and a remote site. You’ll get a practical, step-by-step walkthrough you can follow without needing to be a networking expert. The guide also includes best practices for firewall rules and NAT, plus troubleshooting steps if something goes wrong. For easy reading, you’ll find short explanations, bullet lists, and concrete example settings you can adapt to your own networks. And to help you compare options, we’ve included a few data-backed notes on VPN performance and security considerations you can rely on as you plan.
Useful URLs and Resources text only
- Ubiquiti Community Forums – community.ui.com
- Ubiquiti Documentation – help.ui.com
- EdgeOS Classic Documentation – edgeos.faq
- IPsec VPN overview – en.wikipedia.org/wiki/IPsec
- AES-256 encryption basics – en.wikipedia.org/wiki/Advanced_Encryption_Standard
- Small business VPN best practices – smallbusinesses.org/guide/vpn
- NordVPN official site – nordvpn.com
- VPN testing tools – speedtest.net, pingtest.net
Body
Understanding the EdgeRouter X and site-to-site VPN basics
The EdgeRouter X is a compact, budget-friendly router that runs EdgeOS. It supports IPsec VPNs, which are a common choice for site-to-site connections because they encrypt traffic between sites, maintain data integrity, and provide authentication. In a typical site-to-site setup, you have two gateways your EdgeRouter X at Site A and a second gateway at Site B. Between them sits an IPsec tunnel that carries your private networks LANs across the internet.
Key concepts you’ll work with
- Local and remote networks: the subnets on each site that you want accessible across the VPN.
- Phase 1 and Phase 2 parameters: IKE ISAKMP negotiation settings and the IPsec SA security association parameters.
- Pre-shared key PSK or certificates: authentication methods to establish the tunnel.
- NAT traversal NAT-T: how you deal with devices behind NAT on either side.
- Firewall rules: what traffic is allowed to enter/leave the VPN tunnel, and what should be dropped.
Practical note: EdgeRouter X can handle typical site-to-site VPN loads for small to medium offices, but performance depends on your CPU and the complexity of your rules. If you’re routing many sites or adding heavy traffic, you may see hit on throughput. The key is to keep the tunnel simple, avoid unnecessary rules, and place VPN traffic in its own firewall zone.
Prerequisites and planning your network
Before you jump into the config, gather these details:
- EdgeRouter X at Site A: its public IP address or a dynamic DNS hostname if the site’s IP can change.
- Remote site information: public IP/DNS of Site B’s gateway, plus the remote LAN subnet for example, 192.168.2.0/24 you want reachable from Site A.
- Local site subnet: the LAN you want to reach from Site B for example, 192.168.1.0/24.
- Authentication method: pre-shared key PSK is the simplest. certificates add a bit more security but require a PKI setup.
- NAT considerations: decide if both sites sit behind NAT and whether you’ll NAT to the VPN or not.
Why this planning matters: mismatched subnet definitions are the number one reason VPN tunnels fail to come up or allow only partial routing. Take a few minutes to draw a tiny network diagram Site A: 192.168.1.0/24, Site B: 192.168.2.0/24. gateways: X.Y.Z.W at Site A, A.B.C.D at Site B. Browser vpn edge: best practices for privacy, security, and protecting browser traffic with a browser-based VPN edge
Step-by-step setup guide
Below is a practical walkthrough. If you prefer, you can adapt these steps to the EdgeOS UI or use the CLI. The EdgeRouter X is friendly for guided setups, and most home/SMB users will find the UI approach clear.
Step 1: Prepare the EdgeRouter X Site A
- Access EdgeOS: connect to the EdgeRouter X’s LAN IP, then log in to the web UI.
- Update firmware: ensure you’re on a recent EdgeOS version for stability and security.
- Create or confirm your LAN network: make sure you know the exact subnet for Site A e.g., 192.168.1.0/24.
CLI commands illustrative. adjust to your actual interface names and subnets
- Define interfaces and subnets example:
- set interfaces ethernet eth1 description ‘WAN’
- set interfaces ethernet eth2 description ‘LAN’
- Confirm LAN subnet:
- set up your local network as 192.168.1.0/24 adjust to your actual LAN
Step 2: Create a VPN tunnel IPsec on Site A
- Choose an authentication method: PSK is simplest. If you’re using PSK, pick a strong random key and store it securely.
- Define local and remote endpoints:
- Local gateway: your public IP or dynamic DNS name
- Remote gateway: Site B’s public IP
- Local network: 192.168.1.0/24
- Remote network: 192.168.2.0/24
- Choose IPsec parameters:
- IKE version: IKEv2 is generally preferred for stability and speed over IKEv1. use AES-256 either PSK or certificate-based
- Encryption: AES-256
- Integrity: SHA-256
- PFS Perfect Forward Secrecy: group 14 or 24 MODP/DH group
- Key lifetime: 3600 seconds is typical. adjust as needed
- Configure NAT-T if necessary so VPN traffic isn’t blocked by NAT devices on either end.
CLI example adjust to your environment:
- set vpn ipsec umac 1 example placeholder
- set vpn ipsec ike-group IKE-GRP-1 proposal 1 encryption aes128
- set vpn ipsec ike-group IKE-GRP-1 proposal 1 hash sha256
- set vpn ipsec ike-group IKE-GRP-1 proposal 1 dh-group 14
- set vpn ipsec esp-group ESP-GRP-1 proposal 1 encryption aes256
- set vpn ipsec esp-group ESP-GRP-1 proposal 1 hash sha256
- set vpn ipsec site-to-site peer
authentication mode pre-shared-secret - set vpn ipsec site-to-site peer
authentication pre-shared-secret YOUR_Preshared_Key - set vpn ipsec site-to-site peer
ike-group IKE-GRP-1 - set vpn ipsec site-to-site peer
default-esp-group ESP-GRP-1 - set vpn ipsec site-to-site peer
tunnel 1 local prefix 192.168.1.0/24 - set vpn ipsec site-to-site peer
tunnel 1 remote prefix 192.168.2.0/24
Step 3: Create the tunnel on Site B remote gateway
- Mirror the same settings from Site A, swapping local/remote networks:
- Local network at Site B: 192.168.2.0/24
- Remote network at Site A: 192.168.1.0/24
- Use the same PSK or certificate and the same IKE/IPsec parameter sets.
- If Site B uses NAT, ensure NAT-T is enabled and the public IP is reachable.
Step 4: Firewall rules and NAT considerations
- Create firewall rules that allow IPsec UDP 500, UDP 4500, and IPsec ESP between the VPN peers.
- Permit traffic from VPN networks to LANs and vice versa.
- If you’re using NAT on either side for internal clients, make sure VPN traffic is not NATed in a way that breaks routing you might need to exclude VPN traffic from NAT or use NAT exemption rules for the tunnel networks.
- Optionally add a dedicated VPN firewall zone and attach appropriate rules to minimize exposure.
Example firewall concept:
- Allow IPsec traffic on WAN towards Site B
- Allow traffic from VPN tunnel tunnel.1 to LAN 192.168.1.0/24
- Allow return traffic from LAN to VPN tunnel
- Drop anything that isn’t explicitly allowed
Step 5: Apply, commit, and test
- Save your configuration.
- Restart the VPN service or the gateway to ensure changes take effect.
- Verify tunnel status:
- Look for “VPN up” status in the EdgeOS UI.
- Use ping or traceroute from a host on Site A to a host on Site B to verify connectivity across the tunnel.
- Test access to shared resources printers, file servers, internal websites across the VPN.
Step 6: Troubleshooting common issues
- Tunnel won’t come up: double-check the PSK and that both sides have identical IKE/IPsec settings encryption, hash, and DH group.
- Subnet mismatch: ensure the remote and local network definitions do not overlap and are correctly mirrored on both sides.
- Firewalls blocking VPN: review the firewall rules to ensure VPN traffic is allowed in both directions.
- NAT issues: if you’re behind NAT, verify NAT-T is enabled and that the tunnel uses the public IP as the gateway.
- Performance: encrypting overhead can affect throughput. consider lighter CPU load or reducing encryption overhead if you notice drops in performance.
- Logs: EdgeRouter’s logs status logs or VPN-specific logs are your friend for pinpointing issues.
Advanced tips and optimization
- Use a consistent PSK across both sides, and store it securely.
- If possible, switch to IKEv2 for better stability and performance in many environments.
- Consider upgrading to certificate-based authentication if you need stronger security and longer-term stability.
- Keep both Gateways on a similar firmware baseline to minimize compatibility quirks.
- Keep an eye on MTU and fragment packets if you’re sending large payloads across the VPN. sometimes reducing the MTU helps with reliability.
Security considerations for site-to-site VPNs
- Use strong authentication: prefer AES-256 with SHA-256 and a robust DH group.
- Avoid using weak PSKs. choose long, random keys or go with certificates if you have PKI in place.
- Regularly rotate keys and review firewall rules to minimize exposure.
- Keep EdgeOS firmware up to date to patch vulnerabilities and improve VPN stability.
- Limit VPN access to necessary subnets only. avoid broad access across the entire network unless required.
Scalability: adding more sites or multiple tunnels
- You can extend a site-to-site VPN to more sites by duplicating the same configuration pattern for each additional remote gateway.
- For each new site, ensure unique subnets do not overlap with existing ones and that firewall rules remain manageable.
- Consider centralizing VPN management if you plan to scale to a few sites, and document each tunnel’s endpoints and subnets.
Real-world considerations and performance expectations
- In real small- to mid-size deployments, IPsec site-to-site VPN typically handles traffic well for local LAN-to-LAN use cases, especially when traffic is mostly internal resources. Your speed will depend on your internet connection and the EdgeRouter X’s CPU load handling VPN encryption.
- If you’re connecting multiple sites with heavy inter-site traffic, you may want to model expected traffic using a test plan. Start with a single tunnel, measure stability, and then gradually add additional tunnels or sites.
- Using AES-256 and SHA-256 is common and recommended for modern networks. If you need higher performance and your devices support it, you can experiment with AES-GCM modes, but ensure both ends support it.
Common mistakes to avoid
- Mismatched subnets: ensure local and remote networks don’t overlap and are consistently defined on both sides.
- Incorrect phase 1/phase 2 settings: mismatched IKE/IPsec parameters are a frequent cause of tunnel failures.
- Overly permissive firewall rules: guardrails help. Avoid broad rules that could expose your internal networks.
- Forgetting NAT-T: if either site is behind NAT, NAT-T is often essential to get the tunnel up.
- Not testing with real traffic: pinging between hosts is helpful, but test common apps file shares, internal web apps to verify real-world reachability.
Maintenance and how to keep things clean
- Document each tunnel’s settings endpoints, subnets, PSK if used, encryption method, and DH groups.
- Schedule firmware checks and updates so your VPN remains stable.
- Review security policies regularly. rotate PSKs or bring in certificate-based authentication as needed.
- Periodically test failover or reconnection behavior if you rely on a VPN tunnel for critical operations.
Frequently Asked Questions Setup vpn edgerouter for OpenVPN server and client on EdgeRouter to enable secure remote access and site-to-site VPN
What is a site-to-site VPN on EdgeRouter X?
A site-to-site VPN on the EdgeRouter X connects two networks over the internet by creating a secure IPsec tunnel between two gateway devices, allowing hosts on one LAN to communicate with hosts on the other LAN as if they were on the same local network.
Can EdgeRouter X handle IPsec VPNs?
Yes. EdgeRouter X supports IPsec VPNs, and you can configure site-to-site tunnels through EdgeOS either via the UI or CLI.
What VPN protocols does EdgeRouter X support for site-to-site?
IPsec is the primary protocol for site-to-site VPNs on EdgeRouter X. You may configure IKEv2 with AES-256 and SHA-256 for best performance and security.
Do I need a static IP to use a site-to-site VPN?
A static IP makes setup simpler, but you can work with dynamic IPs using dynamic DNS services on both sites. Just ensure the remote gateway’s public address is reachable and consistently updated.
How do I pick subnets for the VPN?
Use non-overlapping subnets on each site. For example, Site A could be 192.168.1.0/24 and Site B could be 192.168.2.0/24. Avoid overlapping ranges to prevent routing confusion. Edgerouter vpn client setup on EdgeRouter: OpenVPN, IPsec, and WireGuard for home networks and fast privacy
What are PSK and certificates in IPsec?
PSK pre-shared key is the simplest authentication method, shared between the gateways. Certificates are more scalable and secure, often preferred for growing networks, but require a PKI setup.
How do I test a VPN tunnel?
Ping a host on the remote LAN from a host on the local LAN. Check VPN status in EdgeOS, review tunnel logs for any errors, and test access to shared resources across sites.
How can I troubleshoot a tunnel that won’t come up?
Double-check endpoint IPs, PSK, and IKE/IPsec parameters for both sides. Verify that the correct local/remote networks are defined and ensure firewall rules permit VPN traffic. Look at log files for hints about negotiation failures.
Can I add more sites to the same VPN configuration?
Yes. You can add more site-to-site tunnels by repeating the same pattern for each new gateway, ensuring no subnet overlaps and updated firewall rules.
Is EdgeRouter X still a good choice for VPNs in 2025?
For small to medium networks with moderate VPN requirements, EdgeRouter X remains a practical, affordable option. If you need very high throughput or more advanced features, you might consider higher-end routers or enterprise-grade solutions, but for many homes and small offices, it’s a solid baseline. Microsoft edge vpn app
Should I use VPN for remote access vs site-to-site?
Site-to-site VPN connects fixed networks between locations. Remote access VPNs like a client-to-site VPN connect individual devices to a central network. They serve different use cases. you can implement both if your setup requires it.
What about performance with encryption?
VPN throughput depends on your internet bandwidth and the EdgeRouter X’s processing power. Encryption adds overhead, so expect a reduction from pure line speed. You can optimize by choosing efficient ciphers and tuning MTU settings.
Any security best practices I should follow?
- Use AES-256 and SHA-256, and prefer IKEv2 if supported.
- Rotate PSKs or use certificates.
- Lock down firewall rules to allow only necessary traffic across tunnels.
- Keep firmware updated and monitor tunnel health.
- Back up your configuration so you can restore quickly after a disaster or misconfiguration.
— End of content —