Journalist 
Edgerouter x site to site vpn setup: comprehensive guide to configuring IPsec site-to-site VPN on EdgeRouter X for secure inter-site connectivity
Yes, Edgerouter x site to site vpn setup is achieved by configuring an IPsec site-to-site VPN between two EdgeRouter X devices and exchanging routes.
In this guide, you’ll get a practical, end-to-end walkthrough from planning your networks to testing the tunnel, with real-world tips, sample configurations, and troubleshooting steps. You’ll also see a step-by-step CLI setup for EdgeRouter X and a quick comparison of common topologies so you can tailor the setup to your environment. If you’re looking to add an extra layer of protection while you test or manage devices over the internet, consider NordVPN with this deal: . It’s a handy option for securing remote access and remote management during initial testing and learning.
Useful resources you might want to keep handy while you read:
- EdgeRouter X official docs – help.ui.com/hc/en-us/articles/204939480-EdgeRouter-Setup
- IPsec site-to-site VPN basics for EdgeRouter – help.ui.com/hc/en-us/articles/204939480-IPsec
- EdgeRouter product page – ubnt.com/products/edge-router
- General IPsec site-to-site concepts – en.wikipedia.org/wiki/IPsec
- Community-driven EdgeRouter guides and examples – reddit.com/r/homenetworking
What you’ll learn in this guide
- How to plan a safe, scalable site-to-site topology using EdgeRouter X
- The exact IPsec and IKE settings that work well for most two-site deployments
- How to map subnets and specify local and remote networks
- How to create tunnel peers, configure IKE and IPsec, and apply firewall rules
- How to test connectivity, verify the tunnel, and perform basic troubleshooting
- Common mistakes and how to avoid them
prerequisites and assumptions
- You’re using two EdgeRouter X devices, each with EdgeOS the classic UI/CLI
- Two distinct networks you want to connect securely, e.g., Site A: 192.168.1.0/24 and Site B: 192.168.2.0/24
- Public IPs assigned to each site static preferred. if dynamic, plan for dynamic DNS
- Basic familiarity with SSH or local console access to EdgeRouter X
- Administrative credentials for both EdgeRouter X devices
- Optional but recommended: a simple firewall policy that blocks everything except required traffic until VPN is established
Topology examples and planning
Before you touch the router, sketch the network diagram. A typical two-site IPsec site-to-site VPN looks like this:
- Site A: LAN 192.168.1.0/24
- EdgeRouter X – WAN: public IP A
- Site B: LAN 192.168.2.0/24
- EdgeRouter X – WAN: public IP B
Key planning decisions:
- Which subnets should reach each other across the VPN?
- Do you need two tunnels for redundancy two VPN peers or a single tunnel is enough?
- How will you handle access from remote management networks?
Decide on the VPN IP addressing approach. Most sites use a tunnel interface with a specific IPsec internal network, e.g., 10.10.10.0/24 for the tunnel network, but you can keep it simple with a 0.0.0.0/0 vpn tunnel if you want broader reach not typical for most SMBs.
Step-by-step setup EdgeRouter X
Note: Replace the example IPs with your real public IPs and private networks. This guide uses a single tunnel configuration example for Site A 192.168.1.0/24 and Site B 192.168.2.0/24.
Step 1: Prepare both EdgeRouter X devices Vpn in microsoft edge
- Ensure both devices are on the latest stable EdgeOS version.
- Confirm your WAN interfaces e.g., eth0 on both devices have public IPs.
- Reserve internal IP ranges for VPN tunnels if you’re not using the default 0/24.
Step 2: Define IKE Phase 1 and ESP Phase 2 proposals
- On both devices, set a matching IKE group and ESP group. This ensures compatibility between peers.
Commands on Site A, adjust as needed for Site B:
set vpn ipsec ike-group IKE-PROPOSAL0 proposal 1 encryption aes256
set vpn ipsec ike-group IKE-PROPOSAL0 proposal 1 hash sha256
set vpn ipsec ike-group IKE-PROPOSAL0 lifetime seconds 3600
set vpn ipsec esp-group ESP-PROPOSAL0 proposal 1 encryption aes256
set vpn ipsec esp-group ESP-PROPOSAL0 proposal 1 hash sha256
set vpn ipsec esp-group ESP-PROPOSAL0 lifetime seconds 3600
set vpn ipsec ike-group IKE-PROPOSAL0 key-exchange-method ikev2
Step 3: Configure the VPN tunnel peer IPsec site-to-site
- Site A public IP: 203.0.113.1
- Site B public IP: 198.51.100.1
- Local network Site A: 192.168.1.0/24
- Remote network Site B: 192.168.2.0/24
- Pre-shared key: MySecretPSK
Commands Site A:
set vpn ipsec site-to-site peer 198.51.100.1 authentication mode pre-shared-secret
set vpn ipsec site-to-site peer 198.51.100.1 authentication pre-shared-secret MySecretPSK
set vpn ipsec site-to-site peer 198.51.100.1 ike-group IKE-PROPOSAL0
set vpn ipsec site-to-site peer 198.51.100.1 default-esp-group ESP-PROPOSAL0
set vpn ipsec site-to-site peer 198.51.100.1 local-address 203.0.113.1
set vpn ipsec site-to-site peer 198.51.100.1 tunnel 1 local prefix 192.168.1.0/24
set vpn ipsec site-to-site peer 198.51.100.1 tunnel 1 remote prefix 192.168.2.0/24
set vpn ipsec site-to-site peer 198.51.100.1 tunnel 1 allow-nat-networks disable
Step 4: Enable the VPN interface for routing Surf vpn chrome extension: installation, configuration, features, security, and tips for Google Chrome in 2025
- EdgeRouter X creates a virtual VPN interface for IPsec tunnels often named tun0 or something similar depending on the EdgeOS version.
- Ensure the EdgeRouter X knows to route traffic between the tunnel endpoint subnets.
set interfaces tunnel tun0 address 10.10.10.1/30
set protocols static route 192.168.2.0/24 next-hop 10.10.10.2
Site B would mirror with its own local/remote addresses:
set vpn ipsec site-to-site peer 203.0.113.1 authentication mode pre-shared-secret
set vpn ipsec site-to-site peer 203.0.113.1 authentication pre-shared-secret MySecretPSK
set vpn ipsec site-to-site peer 203.0.113.1 ike-group IKE-PROPOSAL0
set vpn ipsec site-to-site peer 203.0.113.1 default-esp-group ESP-PROPOSAL0
set vpn ipsec site-to-site peer 203.0.113.1 local-address 198.51.100.1
set vpn ipsec site-to-site peer 203.0.113.1 tunnel 1 local prefix 192.168.2.0/24
set vpn ipsec site-to-site peer 203.0.113.1 tunnel 1 remote prefix 192.168.1.0/24
set interfaces tunnel tun0 address 10.10.10.2/30
set protocols static route 192.168.1.0/24 next-hop 10.10.10.1
Step 5: NAT and firewall considerations
- If you’re heavily protecting your networks, you may want to exclude VPN traffic from NAT on both ends.
- Create firewall rules that allow VPN-related traffic and deny anything else until the tunnel is up.
Site A example firewall:
set firewall name VPN-ALLOW rule 10 action accept
set firewall name VPN-ALLOW rule 10 description “IPsec tunnel traffic”
set firewall name VPN-ALLOW rule 10 protocol all
set firewall name LAN-IN rule 40 action drop
set vpn ipsec site-to-site peer 198.51.100.1 tunnel 1 allow-escalation disable
Step 6: Apply, save, and test What type of vpn is hotspot shield and how it works, features, security, pricing, and a comparison guide
- Save the configuration on both devices and reboot if necessary.
- Use ping and traceroute across the tunnel to confirm connectivity:
- From Site A: ping 192.168.2.1 or a specific host on Site B
- From Site B: ping 192.168.1.1 or a specific host on Site A
Common checks if the tunnel doesn’t come up
- Ensure both peers’ public IPs are reachable from each other no NAT or ISP blocking the IPsec ports
- Confirm that IKE and IPsec proposals match on both sides encryption, hash, and lifetime
- Verify PSK accuracy on both sides
- Check the EdgeRouter X system logs for VPN-related messages usually found in the web UI under System or via CLI with show log
Step-by-step CLI snippet to confirm VPN status
- Check IKE daemons and IPsec peers
show vpn ipsec sa
show vpn ipsec ike-group
show vpn ipsec ipsec-interfaces - Check routing for the VPN tunnel
show ip route - Confirm tunnel health
show vpn ipsec status
If you want more robust redundancy, you can set up a second peer on a different public IP and configure a second tunnel in a failover arrangement. This is especially useful in environments with dynamic IPs or less reliable internet connections.
Real-world tips and best practices
- Use strong pre-shared keys and rotate them periodically. Don’t reuse PSKs across multiple connections.
- Consider using IKEv2 rather than IKEv1 for better reliability and faster reconnects when networks change IKE-PROPOSAL0 in our example is set to IKEv2 as a default in many EdgeRouter configurations.
- For remote access or management, restrict VPN access to specific management subnets to reduce your attack surface.
- Keep firmware up to date on both EdgeRouter X devices. VPN bugs and performance improvements are common in firmware updates.
- If your sites have dynamic public IPs, plan for a dynamic DNS solution or use a VPN with DNS features to keep the tunnel up even when IPs change.
- Document all changes with a simple network diagram and a config backup. This helps when you or your teammates troubleshoot later.
Troubleshooting common issues
-
Tunnel never comes up
- Verify that the public IPs are reachable and that there’s no firewall blocking UDP ports 500 and 4500 for IPsec and ESP 50/50-ESP.
- Double-check the IKE and IPsec proposals are identical on both sides encryption, hash, lifetime.
- Confirm the local and remote networks are correctly defined and do not overlap with internal networks.
-
Tunnel up but no traffic Vpn on edgerouter x: how to configure a VPN on EdgeRouter X for home networks, OpenVPN, IPsec, and WireGuard options
- Ensure static routes on both sides point toward the tunnel IP rather than the default gateway.
- Check NAT exemptions. traffic from the VPN endpoints may be NATed if not configured to bypass NAT.
- Verify firewall rules permit traffic from tunnel networks to remote subnets.
-
Intermittent connectivity
- Dynamic IPs can cause flapping. If you’re not using static IPs, ensure a robust dynamic DNS setup, and consider a backup VPN path or a retry policy.
- Check logs for authentication failures wrong PSK or mismatched credentials.
-
Performance concerns
- IPsec throughput will depend heavily on the CPU and encryption settings. AES-256 with SHA-256 is secure but may be slower on some EdgeRouter X units. If you hit ceiling performance, consider reducing encryption complexity or upgrading hardware.
Example configurations quick reference
Here’s a compact, ready-to-edit snippet you can adapt for Site A. Mirror the values on Site B with the corresponding remote/local networks and IPs.
Core IKE/ESP
Peer and tunnels Edge vpn download for pc
Interface and routes
Firewall and NAT optional
Save and apply
commit
save
Site B would mirror the same structure with the appropriate IPs and networks swapped.
Performance expectations and data points
- IPsec site-to-site VPNs on EdgeRouter X typically deliver reliable performance for small-to-medium branch setups. Expect throughput in line with the device’s CPU and encryption workload. real-world VPN throughput is often substantially lower than pure routing performance, especially with AES-256 and SHA-256.
- IPsec remains the standard for site-to-site VPNs due to broad support across devices and vendors. If you plan to interconnect multiple sites or need high-availability, designing with redundancy and proper failover in mind pays off.
Frequently asked questions
1. What is Edgerouter X?
EdgeRouter X is a small, affordable router from Ubiquiti that runs EdgeOS. It’s designed for home offices and small businesses, offering advanced routing, firewall, and VPN features in a compact form factor. Does microsoft have vpn built-in Windows 11 and Windows 10 and how to set it up for privacy, security, and remote access
2. What is a site-to-site VPN?
A site-to-site VPN connects two or more separate networks over the public internet, encrypting traffic between them so devices on each network can talk as if they’re on the same local network.
3. Do I need model-specific settings for different EdgeRouter X units?
The basic IPsec configuration is consistent, but you may need to adapt IP addressing, interface names, and some firewall rules to fit your network topology.
4. Can I use dynamic IP addresses on either end?
Yes, but you’ll want a dynamic DNS solution or a secondary failover strategy to ensure the VPN can reconnect if the public IP changes.
5. Should I use IKEv1 or IKEv2?
IKEv2 is generally preferred for reliability and faster tunnel reconnections with fewer configuration quirks. If your devices support IKEv2, stick with it.
6. How do I test if the VPN tunnel is up?
Check the IPsec SA status via the EdgeRouter X CLI or UI. Ping hosts on the remote LAN from the local LAN and verify routing paths. Disable edge secure network
7. Why isn’t traffic routing through the VPN?
Common causes include incorrect static routes, NAT rules not bypassing VPN traffic, or misconfigured tunnel prefixes. Verify both sides’ local/remote prefixes and routes.
8. What about firewall rules?
VPN traffic should be allowed by the VPN firewall rules and not inadvertently blocked by LAN or WAN firewall policies. Start with lenient rules and tighten gradually.
9. How can I secure the VPN management interface?
Limit management access to trusted networks or VPN tunnel networks, disable unnecessary remote management services, and use strong credentials.
10. Can I have multiple VPN tunnels on EdgeRouter X?
Yes, you can configure multiple IPsec site-to-site tunnels with different peers. Each tunnel is typically defined as its own peer with its own local/remote networks.
11. What’s a good troubleshooting checklist for IPsec tunnels?
- Verify public IP reachability between sites
- Confirm matching IKE/IPsec proposals and PSK
- Check interface and routing for correct tunnel prefixes
- Review firewall rules and NAT exemptions
- Read log messages in EdgeRouter X for VPN-specific errors
12. How often should I rotate the PSK?
Rotating PSKs every 6–12 months is a good security practice, especially if you’ve had any suspicion of a potential credential exposure. Edge vpn iphone setup and best practices for securing your iPhone with Edge vpn iphone
If you want more hands-on help or a deeper dive into a specific topology like hub-and-spoke or multi-site mesh, tell me about your network layout and I’ll tailor the configuration and recommendations for your environment. This guide aims to be a practical, plug-and-play starting point for Edgerouter x site to site vpn setup, with emphasis on clear steps, sensible defaults, and a solid troubleshooting path.