Table of Contents

Edgerouter site-to-site vpn: a practical, step-by-step guide to configuring IPsec tunnels between EdgeRouter devices for remote networks

Edgerouter site-to-site vpn is a way to securely connect two or more remote networks over the internet using EdgeRouter devices. In this guide, you’ll get a clear, step-by-step path from planning to verification, with real-world tips, common gotchas, and optimization ideas. If you’re managing multiple sites, an IPsec-based Edgerouter site-to-site VPN can be a simple, cost-effective solution that keeps traffic private and predictable. For extra protection during setup and day-to-day remote access, consider adding a consumer VPN service like NordVPN. Check this banner for a limited-time offer:

Introduction: what you’ll learn in this guide

A clear explanation of why EdgeRouter site-to-site VPNs are a solid choice for small offices, branch offices, and home labs.
How IPsec site-to-site tunnels work in EdgeRouter’s EdgeOS, including PSK and certificate-based authentication options.
A practical, vendor-friendly step-by-step setup for typical topologies hub-and-spoke and full-mesh.
How to plan addresses, prefixes, and routing so traffic between sites flows smoothly.
Troubleshooting steps, common pitfalls, and performance tips to squeeze the most out of your hardware.
A thorough FAQ with practical answers to frequently asked questions.

Useful resources unclickable text
Edgerouter official documentation – ubnt.com
EdgeOS VPN configuration guide – help.ubnt.com
IPsec basics and best practices – en.wikipedia.org/wiki/IPsec
strongSwan site-to-site VPN guides – or https://www.strongswan.org
RFC 4301 IPsec overview – ietf.org
Network addressing and subnet planning basics – cisco.com

The outline you’ll see here is designed for real-world use. You’ll find concrete commands, concrete examples, and a focus on practical outcomes rather than theory alone. Let’s dive in.

Body

Overview of Edgerouter IPSec Site-to-Site VPN

Edgerouter site-to-site VPN uses IPsec to create an encrypted tunnel between two EdgeRouter devices, each connected to the internet with a public IP. Traffic destined for the remote network is encapsulated in IPsec and routed across the tunnel, so private subnets for example, 192.168.10.0/24 at Site A and 192.168.20.0/24 at Site B can talk as if they were on a single LAN.

Key points to remember:

EdgeRouter devices support IPsec site-to-site tunnels via EdgeOS, typically using pre-shared keys PSK or certificates for authentication, andIKE/IPsec phase 1 and phase 2 negotiation.
Common topologies include hub-and-spoke a central site communicates with multiple remote sites and full-mesh every site connects directly to every other site.
The tunnel relies on a pair of prefixes: local-prefix your LAN and remote-prefix the other site’s LAN. Correctly configuring these prevents routing loops and ensures traffic is sent to the tunnel when it should be.

Some quick numbers to keep in mind:

Global VPN usage has grown steadily. small businesses often cite cost, control, and privacy as top reasons to deploy IPsec VPNs rather than relying solely on SaaS-based VPNs.
EdgeRouter devices are popular for home labs and small offices due to price-per-port, performance, and flexible CLI/GUI options.
A well-sized EdgeRouter even midrange models can handle multiple IPsec tunnels with 100–300 Mbps sustained throughput on modern firmware, provided you route and firewall rules are optimized.

Prerequisites and planning

Before you start clicking, map out your network and plan the tunnel:

Identify site networks. Example: Site A 192.168.10.0/24, Site B 192.168.20.0/24.
Decide on addressing for remote networks you’ll reach. If you have more sites, map a hub-and-spoke topology or a full mesh depending on traffic patterns.
Public IPs. You’ll need the public IP address or dynamic DNS name of each EdgeRouter’s WAN interface.
Authentication method. PSK is simplest. certificate-based authentication is more scalable but requires a PKI setup.
Encryption and integrity requirements. AES-256 with SHA-256 is a common, strong default. you can adjust to AES-128/SHA-1 if you need compatibility with older gear—though SHA-1 is not recommended.
Firewall and NAT planning. Ensure IPsec traffic can reach the tunnel endpoints UDP 500/4500 for NAT-T, ESP, etc. and that LAN traffic to the remote network is allowed through the VPN.

A quick topology note: Secure service edge vs sase

Hub-and-spoke: Site A hub talks to Site B1, Site B2, etc. You typically configure a single tunnel per spoke.
Full-mesh: Each site maintains a tunnel to every other site. This increases the number of tunnels and config but reduces single points of failure for traffic paths.

Topology examples: hub-and-spoke vs full mesh

Hub-and-spoke

Hub: Site A 192.168.10.0/24
Spokes: Site B 192.168.20.0/24, Site C 192.168.30.0/24
Pros: Fewer tunnels. easier to manage. centralizes routing decisions.
Cons: If traffic between Site B and Site C is frequent, it must pass through Site A.

Full mesh

Sites A, B, and C each connect to every other site
Pros: Direct site-to-site traffic. lower latency for remote-site-to-remote-site communications.
Cons: More tunnels to configure and maintain.

Step-by-step: IPsec site-to-site on EdgeRouter PSK method

This walkthrough uses PSK pre-shared key authentication and a typical AES-256/SHA-256 suite. Adjust as needed for your hardware and policies.

Define the IKE phase 1 and ESP phase 2 groups

You’ll set an IKE group with encryption, hash, and DH parameters.
You’ll set an ESP group for the actual tunnel encryption.

Example CLI adjust names and values to your policy:

set vpn ipsec ike-group IKE-GROUP proposals 1 encryption aes256
set vpn ipsec ike-group IKE-GROUP proposals 1 hash sha256
set vpn ipsec ike-group IKE-GROUP proposals 1 dh-group 14
set vpn ipsec ike-group IKE-GROUP lifetime 3600
set vpn ipsec esp-group ESP-GROUP proposals 1 encryption aes256
set vpn ipsec esp-group ESP-GROUP proposals 1 hash sha256
set vpn ipsec esp-group ESP-GROUP lifetime 3600

Create the site-to-site peer the remote EdgeRouter

You’ll specify the remote endpoint’s public IP, the local and remote prefixes, and how the tunnel should use your security groups.

Example: Vpn gratis para edge: a practical, up-to-date guide to free VPNs for Microsoft Edge in 2025

set vpn ipsec site-to-site peer 203.0.113.2 authentication mode pre-shared-secret
set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret your_psk_here
set vpn ipsec site-to-site peer 203.0.113.2 ike-group IKE-GROUP
set vpn ipsec site-to-site peer 203.0.113.2 default-esp-group ESP-GROUP
set vpn ipsec site-to-site peer 203.0.113.2 local-address 203.0.113.1
set vpn ipsec site-to-site peer 203.0.113.2 remote-address 203.0.113.2
set vpn ipsec site-to-site peer 203.0.113.2 tunnel 1 local prefix 192.168.10.0/24
set vpn ipsec site-to-site peer 203.0.113.2 tunnel 1 remote-prefix 192.168.20.0/24

Allow VPN traffic through the firewall

You’ll generally need rules that permit IPsec traffic ESP and UDP 500/4500 from WAN to the VPN endpoints, plus allow traffic from the VPN tunnel into the LAN.
Example: create a WAN_LOCAL rule that accepts ESP 50 and UDP ports 500 and 4500, and a VPN-IPSec rule to permit tunnel traffic.

Example firewall thought process not full ruleset:

set firewall name WAN_LOCAL rule 10 action accept
set firewall name WAN_LOCAL rule 10 protocol esp
set firewall name WAN_LOCAL rule 20 action accept
set firewall name WAN_LOCAL rule 20 protocol udp
set firewall name WAN_LOCAL rule 20 destination port 500
set firewall name WAN_LOCAL rule 30 action accept
set firewall name WAN_LOCAL rule 30 destination port 4500
Attach WAN_LOCAL to the appropriate interfaces.

Apply routing so traffic uses the tunnel

You’ll need static routes on each site to send traffic destined for the remote LAN through the VPN tunnel.
Example: On Site A, route 192.168.20.0/24 via the VPN tunnel to Site B.

Save and commit

Save your configuration and verify the tunnel status.

Verify the tunnel

Use the EdgeRouter status commands to check IKE and IPsec status.

Useful verification commands:

show vpn ipsec sa
show vpn ipsec status
show vpn ike sa
show log vpn

Basic troubleshooting tips

If the tunnel won’t come up, check:
- Peer IPs and authentication secrets match on both sides.
- Local and remote prefixes don’t overlap with any LAN or other VPNs.
- NAT-T is enabled if either site sits behind NAT.
- Firewall rules permit ESP and UDP 500/4500.
Confirm that both EdgeRouters can ping each other’s WAN IPs.
Confirm that the remote LANs are reachable via the tunnel after the tunnel comes up.

GPU-level optimization tip: If you’re hitting CPU-bound limits on a busy EdgeRouter, consider enabling connection tracking limits or offloading where supported to improve tunnel throughput.

Practical examples: real-world setups

Example 1: Simple hub-and-spoke with two spokes

Hub Site A: 192.168.10.0/24
Spoke 1 Site B: 192.168.20.0/24
Spoke 2 Site C: 192.168.30.0/24
You configure two tunnels on Site A to Site B and Site A to Site C, set up routes from each spoke to the hub, and ensure traffic between Site B and Site C routes via the hub unless you implement full mesh.

Example 2: Full mesh with three sites Vpn add on microsoft edge

Sites A 192.168.10.0/24, B 192.168.20.0/24, C 192.168.30.0/24
Each site has a tunnel to the others.
Pros: Direct site-to-site communication. cons: more tunnels and more configuration.
Management tip: Use a consistent naming convention for peers and tunnels e.g., PEER-A, PEER-B to reduce confusion.

Security considerations and best practices

Use strong authentication: Prefer certificate-based PKI for larger deployments. for smaller networks or lab setups, PSK with a robust secret long, random is acceptable.
Prefer modern ciphers: AES-256, SHA-256, and a DH group with adequate security e.g., DH group 14 or higher. Avoid legacy ciphers like DES or 3DES.
NAT traversal: If either site sits behind NAT, ensure NAT-T UDP 4500 is enabled and tested.
Keep firmware updated: VPN vulnerabilities can be exposed by outdated EdgeRouter firmware. Regular updates reduce risk.
Segment VPN traffic with firewall rules: Don’t blanket-allow VPN traffic on the WAN. Create specific rules that only permit VPN traffic to the remote subnets and from the known tunnel endpoints.
Monitor and alert: Use logs or a simple monitoring solution to alert when tunnels fail or drop.

Performance and optimization tips

CPU headroom matters: IPSec encryption and decryption are CPU-bound. If you have multiple tunnels or high throughput, consider a model with a more capable CPU.
Tune MTU and MSS if you encounter fragmentation in tunnels, especially when you’re traversing multiple networks or VPNs.
Use persistent connections rekey intervals: Align IKE and IPsec lifetimes to minimize drops. A typical setup uses 3600 seconds for IKE and 3600 seconds for ESP lifetime.
IP addressing planning helps reduce NAT traversal complexities and routing conflicts.
Separate management plane and data plane: Don’t mix admin traffic with VPN traffic on the same interface. nest VPN web GUI access behind its own management rules.

Troubleshooting common issues

Tunnel not establishing: Check peer address, pre-shared secret, IKE/ESP group matches, and ensure the remote gateway is reachable.
Traffic not routing through VPN: Verify route tables, local/remote prefixes, and NAT rules. Confirm the tunnel is up and that the policy routes are correct.
Intermittent connectivity: Look for IP conflicts, time drift NTP issues, and keep an eye on MTU issues that cause fragmentation or dropped packets.
Performance dips: Check CPU usage on the EdgeRouter and consider reducing negotiation overhead by tightening the cipher suite or reducing the number of active tunnels.
DNS leaks or split-tunnel issues: Ensure your VPN doesn’t inadvertently route all traffic if you intend to keep some traffic local. Review tunnel prefixes and route policies.

Advanced topics: scaling and management tips

Certificate-based IPsec: For larger deployments, set up a PKI and issue certificates to each EdgeRouter. This reduces the risk associated with PSKs and makes revocation easier.
Dynamic DNS: If you’re dealing with dynamic WAN IPs, use a DDNS service on both sides so the remote site can resolve the current public IP automatically.
Monitoring: Consider external monitoring for tunnel state, latency, and packet loss to proactively catch issues.
Hub-and-spoke with dynamic spokes: If new sites join often, a script-based approach to provisioning can save time and reduce manual errors.

Verification and testing checklist

Confirm both tunnels are up with show vpn ipsec sa and show vpn ike sa.
Verify traffic between subnets by pinging hosts on the remote site from a host on the local site.
Check firewall rules to ensure nothing is inadvertently blocking traffic across the tunnel.
Validate that NAT is not altering the IP addresses of traffic destined for the VPN with incorrect NAT rules in place.

Frequently Asked Questions

How do I know if my Edgerouter site-to-site VPN is working?

You’ll see the IPsec tunnel status as up in the EdgeRouter UI or via CLI show vpn ipsec sa/status. Also, testing connectivity between hosts on each side ping, traceroute confirms real data is flowing through the tunnel.

What’s the difference between PSK and certificate-based IPsec on EdgeRouter?

PSK is simpler to set up and great for small networks. Certificate-based IPsec scales better when you have many tunnels and want centralized management of trust. It requires a PKI setup.

Can I run EdgeRouter IPsec VPN with a dynamic public IP?

Yes, with dynamic DNS DDNS configured on each endpoint. The VPN peers use the DDNS hostname to reach the remote site instead of a fixed IP.

Do I need to open firewall ports on my edge routers for IPsec?

Yes. You generally need to allow ESP, UDP 500 ISAKMP, and UDP 4500 NAT-T through the WAN firewall to reach the VPN tunnel. Also ensure routes exist for remote subnets.

How many VPN tunnels can EdgeRouter handle?

This depends on the model and CPU. Small to midrange EdgeRouter devices routinely handle multiple IPsec tunnels at modest throughput. very busy sites may need more capable hardware or load distribution strategies. Vpn add on edge guide: how to use a VPN add-on on Edge browser and other edge devices for privacy, streaming, and security

Should I use a hub-and-spoke or full-mesh topology?

Hub-and-spoke is simpler and easier to manage for 2–5 sites. Full-mesh gives direct site-to-site traffic but requires more tunnels and more configuration. Choose based on your traffic patterns and management capacity.

How do I update EdgeRouter firmware without breaking VPNs?

Back up your configuration before updating, schedule maintenance during low-traffic periods, and verify VPN settings after the update. Most VPN configurations survive firmware upgrades, but it’s always best to confirm.

Can I run IPv6 VPNs with EdgeRouter?

Yes, IPsec supports IPv6 as part of the tunnels, though you’ll configure IPv6 prefixes local-prefix and remote-prefix and ensure firewall rules accommodate IPv6 traffic.

What are common mistakes to avoid with Edgerouter site-to-site VPNs?

Overlapping LAN subnets, misconfigured remote prefixes, mismatched PSKs, and firewall rules that block IPsec traffic are the usual suspects. Also, don’t overlook NAT-T if you’re behind NAT devices.

How do I expand from a single tunnel to multiple sites?

Plan a scalable topology hub-and-spoke vs full-mesh, standardize naming and prefixes, and automate where possible. Start with the core tunnel and add sites incrementally. Vpn to change location: how to use a VPN to switch your virtual location for streaming, privacy, and more

Is it better to use a cloud-based VPN service for site-to-site traffic?

Cloud VPN services are convenient, but for site-to-site between two or more EdgeRouter devices under your control, IPsec on EdgeRouter gives you more control, potentially lower latency, and no external dependencies.

Final tips

Document every change you make. It’s easy to forget a tunnel credential or a prefix once you’ve configured a few sites.
Start simple. Begin with a single tunnel, verify it works, then add more sites or switch to a full-mesh topology as needed.
Keep security in mind. Rotate PSKs regularly if you’re still using PSK, and move toward certificate-based authentication as your network grows.

If you found this Edgerouter site-to-site vpn guide helpful, you can reuse this as a template for other tunnel configurations or alternate topologies. With careful planning, EdgeRouter devices deliver reliable, secure, and scalable site-to-site connectivity for small offices and growing networks alike.

九産大 vpn 全方位攻略：校园网隐私保护、海外访问与内容解锁的实用指南

Hoxx vpn proxy chrome extension: complete guide to setup, features, safety, speed, and alternatives

Edgerouter site-to-site vpn