Journalist 
Ubiquiti edgerouter x site to site vpn: a comprehensive, user-friendly guide to setting up IPsec tunnels, routing, and troubleshooting
Ubiquiti edgerouter x site to site vpn is a method to securely connect two or more networks over the internet using IPsec on the EdgeRouter X. In this guide, you’ll learn how to plan, configure, and maintain a reliable site-to-site VPN using EdgeRouter X, including GUI and CLI steps, performance tweaks, and real-world troubleshooting. This post breaks down the setup into digestible sections, with practical tips you can apply today. If you’re looking for extra privacy on remote devices, NordVPN can be a handy companion for end-user devices—check out the promotion we’ve linked here to see if it fits your needs:
Useful resources you might want to note un clickable in-text list:
- Ubiquiti EdgeRouter X official documentation – help.ubnt.com
- IPsec site-to-site VPN concepts – en.wikipedia.org/wiki/IPsec
- EdgeOS CLI reference – help.ubnt.com/hc/en-us/articles/204401410
- StrongSwan official documentation – strongswan.org
- Ubiquiti Community forums – community.ui.com
Introduction: quick summary and what you’ll get
- Yes, you can set up a stable site-to-site VPN on a modest device like the EdgeRouter X, and you don’t need to be a network wizard to do it.
- I’ll walk you through:
- Understanding the basics of EdgeRouter X and IPsec site-to-site VPN
- Prerequisites and network planning
- Two main setup paths: GUI-based and CLI-based
- Firewall rules, NAT, and routing considerations
- Common issues and how to troubleshoot them
- Real-world examples to help you adapt the steps to your network
- By the end, you’ll have a working site-to-site VPN and a checklist for maintenance.
Body
What is the Ubiquiti edgerouter x site to site vpn and why it matters
EdgeRouter X is a compact router that runs EdgeOS, a Linux-based operating system with a familiar CLI and a robust GUI. When you configure a site-to-site VPN, you’re creating a permanent, encrypted tunnel between two networks over the internet. That tunnel lets devices on one side reach devices on the other side as if they were on the same local network, without exposing sensitive data to the public internet.
Key reasons people choose this approach:
- Cost-effective: EdgeRouter X gives you enterprise-like VPN capabilities without a big investment.
- Flexible: IPsec tunnels can be configured for multiple remote sites, with precise control over encryption, hashing, and lifetimes.
- Performance-conscious: EdgeRouter X isn’t the fastest device on the market, but with proper tuning it handles typical small-to-medium sites well.
- Centralized control: You can manage multiple VPN tunnels and firewall rules from a single interface.
In practice, most users run a single tunnel between two sites home and office, or a main site and a remote branch. Some scale up to multiple tunnels for a hub-and-spoke configuration. The important thing is planning IP addressing, routing, and security policies before you start.
Prerequisites and planning your network
Before you touch the EdgeRouter X, sketch out a simple diagram of your networks. A little planning goes a long way and saves you from rework later.
- Compare two networks to connect: Network A e.g., 192.168.1.0/24 and Network B e.g., 192.168.2.0/24. If you have a VPN terminator device on the other end, you’ll need its public IP address and the remote LAN subnet.
- Decide on IP addressing for the tunnel: Since you’re using IPsec, you’ll typically keep the tunnel endpoints as the EdgeRouter X public IPs and map local subnets to remote subnets.
- Choose the authentication method: Pre-shared keys PSK are simple and common for small sites. certificates are more scalable if you manage many sites.
- Plan firewall zones: You’ll usually create separate interfaces or VLANs for LAN, VPN, and WAN. You’ll then define rules to allow traffic between VPN and local networks as needed.
- Decide on routing approach: Will you route all traffic through the VPN full-tunnel or only specific subnets? This affects performance and policy complexity.
- MTU considerations: The IPsec tunnel can introduce extra overhead. Start with a typical 1400–1492 MTU and adjust if you see fragmentation.
- Documentation: Keep a small sheet with tunnel IDs, PSKs, remote IPs, and the local/remote subnets. It makes future maintenance easier.
If you’re new to EdgeRouter X, you’ll likely need to enable the VPN feature and then configure the general network settings on the WAN and LAN sides. The EdgeRouter X supports multiple IPsec tunnels, so you can plan for future expansion. Microsoft edge vpn kostenlos
Step-by-step: GUI-based setup EdgeOS
This path is friendly if you prefer point-and-click. Here’s a straightforward sequence to create a typical site-to-site IPsec VPN.
-
Preparation
- Log in to the EdgeRouter X web UI the default is http://192.168.1.1 or whatever you’ve set.
- Confirm you can reach the internet from the LAN side.
- Note the remote network details: remote LAN subnet, remote public IP, and how you want to authenticate PSK or certificates.
-
Create VPN secrets
- Go to VPN > IPSec > IKE Proposals. Reserve a strong, modern combination for example, 3DES is old. prefer AES with 256-bit keys. You can leave the default if you’re unsure, but AES-256 with SHA-256 is a solid baseline.
- IKE Policies: set the Phase 1 IKE parameters to a secure profile e.g., AES256, SHA256, Group 14 or 19 for strong DH.
- IPsec Policies: configure Phase 2 IPsec with AES256, SHA256, and a reasonable PFS Perfect Forward Secrecy group, often Group 14.
-
Define the VPN peer remote endpoint
- VPN > IPSec > Peers
- Add a new peer
- Remote IP: enter the remote public IP address
- Authentication: PSK shared secret or certificate
- Pre-Shared Key: enter a strong random string
- Local subnet your side: e.g., 192.168.1.0/24
- Remote subnet: e.g., 192.168.2.0/24
- Enable: yes
-
Add a tunnel Best VPN for USA Travelling in 2026
- VPN > IPSec > Tunnels
- Add a new tunnel for this peer
- Local subnet: your LAN
- Remote subnet: remote LAN
- Local ID/Remote ID: optional identifiers
-
Firewall and NAT
- Ensure the VPN traffic is allowed through the input and forward chains.
- If you’re using NAT on the LAN side, make sure you don’t NAT traffic that should appear as the remote LAN addresses unless you specifically need it.
- Create firewall rules to permit VPN traffic UDP 500, UDP 4500, and ESP on the WAN interface, or use the built-in VPN interface rules if your EdgeOS version provides them.
- If you’re using a dedicated VPN interface, you might need to allow traffic from VPN to LAN and vice versa in the firewall.
-
Policy routing optional
- If you want only certain traffic to go via the VPN, configure policy routing or static routes that direct specific subnets through the VPN tunnel.
- Example: static route for the remote network via the VPN interface.
-
Apply and test
- Save changes and apply.
- Verify the tunnel state: look for “established” or similar in the VPN page.
- Test connectivity from a host on LAN A to a host on LAN B ping, traceroute, or file transfer.
-
Troubleshooting steps in GUI
- If the tunnel isn’t establishing, verify:
- PSK or certificate match on both ends
- The remote public IP is reachable from your side
- VPN policies IKE and IPsec match on both ends
- Firewall rules allow ESP, UDP 500, and UDP 4500
- Review the VPN logs in EdgeOS for specific errors and adjust the configuration accordingly.
- If the tunnel isn’t establishing, verify:
Step-by-step: CLI-based setup EdgeOS
If you’re comfortable with the command line, CLI setup gives you tight control and can be repeatable via scripts.
-
Access the CLI
- SSH into the EdgeRouter X or use the local console.
- Switch to configuration mode: configure
-
Configure IKE Phase 1
- set vpn ipsec ike-group IKE-GROUP0 proposal 1 encryption aes256
- set vpn ipsec ike-group IKE-GROUP0 proposal 1 hash sha256
- set vpn ipsec ike-group IKE-GROUP0 proposal 1 dh-group 14
- set vpn ipsec ike-group IKE-GROUP0 lifetime 3600
- set vpn ipsec ike-group IKE-GROUP0 enable
-
Configure IPsec Phase 2
- set vpn ipsec esp-group ESP-GROUP0 proposal 1 encryption aes256
- set vpn ipsec esp-group ESP-GROUP0 proposal 1 hash sha256
- set vpn ipsec esp-group ESP-GROUP0 lifetime 3600
-
Define the peer
- set vpn ipsec site-to-site peer REMOTE_IP/32 ike-group IKE-GROUP0
- set vpn ipsec site-to-site peer REMOTE_IP/32 cluster 0
- set vpn ipsec site-to-site peer REMOTE_IP/32 local-address LOCAL_PUBLIC_IP
- set vpn ipsec site-to-site peer REMOTE_IP/32 remote-subnet REMOTE_SUBNET
- set vpn ipsec site-to-site peer REMOTE_IP/32 local-subnet LOCAL_SUBNET
- set vpn ipsec site-to-site peer REMOTE_IP/32 authentication mode pre-shared-key
- set vpn ipsec site-to-site peer REMOTE_IP/32 authentication pre-shared-key “your-psk-here”
-
Firewall/NAT adjustments
- Depending on your setup, you may need to adjust firewall rules to allow IPsec traffic and define VPN zone policies.
-
Commit and save
- commit
- save
- exit
-
Test and verify
- Check the status: show vpn ipsec sa
- Verify traffic across the tunnel ping tests, traceroute
- If there’s a mismatch, double-check IKE and IPsec proposals, PSK, and remote subnet definitions.
Pro tips for GUI vs CLI
- GUI is great for quick setups and visual validation. CLI is excellent for automation, scripting, and reproducibility.
- If you’re managing multiple sites, consider a small script to push identical IKE/IPsec proposals and a templated peer config.
NAT, firewall rules, and routing: getting traffic to flow
VPNs are not just “tunnels” – they’re about what you permit across them.
- Firewall basics
- Allow ESP protocol 50 and UDP ports 500 and 4500 on the WAN interface.
- Create a VPN firewall rule set that permits traffic from VPN_SUBNET to LOCAL_SUBNET and vice versa.
- NAT considerations
- If you need hosts on the remote network to access the internet with local IP visibility, you might need to disable NAT for traffic entering the VPN or create a specific NAT exemption rule for the VPN subnet.
- Routing mode
- Full-tunnel all traffic goes through VPN: requires default route to go through the VPN interface. This can impact latency. monitor performance.
- Split-tunnel only specific subnets use the VPN: more common for performance. ensure static routes route only the remote subnet through the VPN.
- DNS and name resolution
- When devices on the remote network rely on their own DNS, ensure DNS traffic isn’t blocked by VPN firewall rules. You may point clients to local DNS servers or forward queries appropriately.
Performance tuning and security hardening
Small networks benefit from careful tuning to keep latency reasonable and security solid.
- Encryption and handshake
- Use AES-256 and SHA-256 for both Phase 1 and Phase 2, with a strong DH group 14 or higher.
- Dead peer detection and rekey intervals
- Enable DPD and set reasonable SA lifetimes e.g., 3600 seconds to keep tunnels healthy without frequent renegotiation.
- MTU awareness
- Start with an MTU around 1400 and adjust based on ping results and fragmentation indicators.
- Logging and monitoring
- Enable VPN logs during setup to identify bottlenecks or misconfigurations.
- Consider lightweight monitoring up/down status, tunnel up time to catch intermittent drops.
- Security hygiene
- Rotate PSKs periodically or, if you can, move to certificate-based authentication for long-term scale.
- Keep EdgeOS updated to benefit from security patches and improved VPN handling.
- Redundancy and failover
- If uptime is critical, plan for a second VPN path or a backup WAN connection to reduce single-point failures.
Common pitfalls and practical troubleshooting tips
- Mismatched IKE/IPsec proposals
- Ensure both ends use identical encryption, hash, and DH group settings. Even small mismatches cause tunnel failures.
- PSK mismatches
- A single-character difference in PSK breaks authentication. Double-check case sensitivity and spaces.
- Public IPs and NAT
- If the remote site uses a dynamic IP, you’ll need a dynamic DNS solution or a static IP at the remote end. otherwise, tunnels fail when the IP changes.
- Firewall blocking VPN traffic
- ESP and UDP 500/4500 must be allowed on the WAN side. A common mistake is forgetting to allow these in the edge firewall rules.
- Double-NAT situations
- If either end sits behind another NAT device, you’ll want to ensure port forwarding is correct or set up a direct public IP if possible.
- Subnet overlap
- If local and remote subnets overlap, routing becomes problematic. Adjust subnets so there’s no overlap or architect a different addressing scheme.
- Time and date correctness
- Crypto and certificate validation can fail if system clocks drift too far apart. verify NTP on both devices.
Real-world scenarios and tips
- Small office to home office
- A single site-to-site IPsec VPN is often enough. Use PSK-based authentication for simplicity. enable a small, well-defined set of traffic through the tunnel e.g., shared printers, file servers, and key databases.
- Branch-to-branch
- You may run multiple tunnels to different branches with a hub-and-spoke model. Use clear naming conventions and a documented manifest for each tunnel.
- Cloud-integrated site
- If one side is in a cloud environment like a VPS with a public IP, ensure security posture on the cloud side matches your on-prem security policies, including allowed subnets and route tables.
Alternatives and considerations for larger deployments
- Certificates vs PSK
- For larger deployments, certificates scale better and reduce manual PSK management. Consider a PKI and an internal CA to deploy to all peers.
- Other VPN approaches
- OpenVPN or WireGuard can be alternatives with different performance and management characteristics. EdgeRouter X is optimized for IPsec, but you can evaluate other options if you have complex requirements.
- Centralized management
- For many sites, a centralized management approach e.g., a firewall management platform can help you keep consistent VPN policies across devices.
Frequently Asked Questions
Q1: What is a site-to-site VPN on Ubiquiti EdgeRouter X?
Site-to-site VPN on EdgeRouter X creates an encrypted tunnel between two networks, allowing devices on one side to reach devices on the other as if they were on the same LAN.
Q2: Which VPN protocol does EdgeRouter X use for site-to-site VPN?
EdgeRouter X uses IPsec for site-to-site VPNs, typically with IKEv2 or IKEv1 negotiation and ESP for the data channel.
Q3: Can I have more than one site-to-site VPN on EdgeRouter X?
Yes, EdgeRouter X supports multiple IPsec tunnels, so you can connect to several remote sites simultaneously.
Q4: Should I use PSK or certificates for authentication?
PSK is simpler and fine for small setups. Certificates are better for larger deployments since they simplify key management and scale more securely.
Q5: How do I verify that the VPN tunnel is up?
Check the EdgeRouter X VPN status page GUI or run show vpn ipsec sa CLI. You should see the tunnel state as established.
Q6: How do I route traffic through the VPN?
Configure static routes or policy-based routing so traffic destined for the remote subnet is sent through the VPN tunnel. Decide between full-tunnel or split-tunnel based on your needs.
Q7: What if the VPN tunnel drops?
Check the tunnel logs, verify IP addresses and PSKs, ensure firewall rules allow ESP and UDP 500/4500, and confirm remote endpoint reachability. DPD and keepalive settings can help prevent drops.
Q8: How do I handle dynamic IPs on the remote end?
If the remote end uses a dynamic IP, you’ll need a dynamic DNS service or a different arrangement e.g., a dedicated static IP for the VPN device to avoid tunnel renegotiation failures.
Q9: Can I use EdgeRouter X with a cloud-hosted remote network?
Yes, you can connect EdgeRouter X to a remote cloud network that supports IPsec, but ensure the cloud network’s firewall rules allow IPsec traffic and that the addressing doesn’t collide with your local network.
Q10: How do I maintain security over time?
Rotate pre-shared keys periodically, enable robust IKE/IPsec proposals, keep firmware up to date, monitor VPN logs for unusual activity, and consider certificate-based authentication for long-term scalability.
Q11: Can I use my VPN to route all internet traffic through the remote network?
Yes, you can configure the VPN as a full-tunnel so all traffic from the local site goes through the remote network. This can increase latency, so test performance and adjust settings if needed.
Q12: What are common mistakes beginners make with EdgeRouter X site-to-site VPN?
Common mistakes include mismatched PSKs or proposals, forgetting to allow VPN-related traffic in the firewall, misconfigured subnets that overlap, and not testing connectivity from multiple devices on the LAN.
Q13: How do I back up or export VPN configuration?
Use the EdgeRouter X configuration export feature to back up the vpn settings, and consider versioning backups to track changes over time.
Q14: Can I implement multi-homed VPN with two WAN connections?
Yes, you can configure VPN failover or load balancing for resilience, but you’ll need careful routing rules and possibly a secondary VPN tunnel to the same or a different remote site.
Q15: Are there performance tips for EdgeRouter X VPN setups?
Yes. Use strong encryption without over-optimizing for speed, ensure MTU tuning to prevent fragmentation, minimize NAT overhead, and disable unnecessary services on the router to free CPU cycles for encryption.
FAQ end.
Resources and final notes
- EdgeRouter X official docs and help articles
- IPsec site-to-site VPN fundamentals
- EdgeOS CLI reference and examples
- StrongSwan for deeper IPsec understanding
- Ubiquiti community discussions and user-driven guides
If you found this guide helpful and you’re looking to add extra privacy for end devices, don’t forget to explore the NordVPN offer we mentioned at the top of the post. It could be a nice companion for remote users or personal devices while you’re dealing with site-to-site VPNs.
Would you like me to tailor this setup to a specific topology two sites with a single tunnel, hub-and-spoke with multiple satellites, or a cloud-based remote site? I can customize the IP ranges, PSK, and step-by-step commands for your exact network layout.