Table of Contents

Edgerouter x site to site vpn setup guide: configure EdgeRouter X for site-to-site VPN, IPsec tunnels, NAT, and remote networks

Edgerouter x site to site vpn setup. Yes, this guide will walk you through a practical, step-by-step approach to setting up a site-to-site IPsec VPN between two EdgeRouter X devices, including UI and CLI configurations, firewall rules, and testing tips. In this guide you’ll find:

– A quick prerequisites checklist
– Step-by-step UI-based configuration for a smooth start
– CLI-based commands for more control and automation
– Firewall rules and NAT adjustments to keep traffic secure
– Testing methods to verify a healthy tunnel
– Troubleshooting tips and common gotchas
– Security best practices to keep your VPN rock solid

For extra protection on your network edge, check out this deal:

NordVPN deal for extra protection – nordvpn.com

Useful URLs and Resources unClickable list
EdgeRouter X official docs – ubnt.com
EdgeOS User Guide – help.ubnt.com
IPsec overview – cisco.com
Wikipedia IPsec – en.wikipedia.org/wiki/IPsec
WireGuard overview – wireguard.com
OpenVPN overview – openvpn.net
EdgeRouter X community forums – forum.ubnt.com
Configuring VPNs on EdgeRouter – reddit.com/r/homenetworking
Small business VPN best practices – techrepublic.com
Home lab networking guides – arstechnica.com

What you’ll build and why

If you’ve got two sites, each with an EdgeRouter X, you can connect them with a secure, encrypted IPsec tunnel. This lets devices on Site A reach devices on Site B as if they were on the same local network, without exposing sensitive traffic to the internet. You’ll typically see:

Transparent inter-site routing: remote subnets become visible to each other
Centralized encryption: traffic between sites is encrypted end-to-end
Flexibility: use static IPs or dynamic DNS if you don’t have fixed public addresses
Manageable firewall rules: only the traffic you allow passes across the tunnel

EdgeRouter X is a compact, affordable device with enough horsepower for small-site VPNs. In real-world setups, you can expect solid throughput for typical office workloads, usually in the hundreds of Mbps range, depending on encryption enabled and the CPU load. If you’re planning multi-site VPNs or heavier traffic think VOIP, video conferencing, large file transfers, plan for potential throughput limits and consider a network topology that preserves headroom for VPN processing.

Prerequisites you can’t skip

Before you start wiring up the tunnel, make sure you have:

Two EdgeRouter X devices one at each site with internet access and public IPs, or at least a way to reach each site via dynamic DNS
Two private LANs you want to connect for example, Site A: 192.168.1.0/24, Site B: 192.168.2.0/24
A shared pre-shared key PSK for IPsec, strong enough at least 16+ characters, random
Administrative access to both EdgeRouter X devices SSH or EdgeOS UI
Optional: static routes or a plan for how routes will reach across the tunnel static routes are common for simple setups

If you’re dealing with dynamic public IPs, set up a dynamic DNS service on each site so the tunnel can re-establish when an IP changes. You’ll point each EdgeRouter X to the other site’s public endpoint, even if it’s a dynamic hostname.

Quick start: UI-based site-to-site IPsec VPN EdgeOS

This section gives you a straightforward, click-by-click path using the EdgeRouter X web interface. It’s great for beginners and for quick deployments. Disable edge secure network

Access the EdgeRouter X UI

Define local and remote networks

Local network Site A: 192.168.1.0/24
Remote network Site B: 192.168.2.0/24

Create the IKE IKEv1/v2 group

Go to VPN > IPsec > IKE Groups
Add a new group with:
- Encryption: AES256
- Hash: SHA1
- DH Group: 2 1024-bit or 14 2048-bit if available
- Lifetime: 64800 seconds 18 hours

Create the IPsec ESP group

ESP Group
Encryption: AES256
Hash: SHA1
Lifetime: 3600 seconds 1 hour

Add the IPsec peer

Peer address:
Authentication: Pre-Shared Secret enter your PSK
IKE Group: IKE Group you created earlier
ESP Group: ESP Group you created earlier
Enable: Yes

Define the site-to-site tunnel

Tunnel 0
Local prefix: 192.168.1.0/24
Remote prefix: 192.168.2.0/24

Firewall and NAT

Create a firewall rule that allows IPsec traffic ESP, AH, IKE
Ensure NAT-T NAT Traversal is enabled if you’re behind NAT
Add a firewall rule to permit traffic from the tunnel to the local network and vice versa

Save and apply changes

Commit and Save
Reboot if necessary

Repeat on Site B

Mirror all settings with local/remote networks swapped

What you should see

A tunnel listed as up on both sides
Traffic between 192.168.1.0/24 and 192.168.2.0/24 routing through the VPN
No leaks: traffic between sites should stay inside the tunnel

CLI-based site-to-site IPsec VPN for power users

If you’re comfortable with the command line, this is the way to go. It’s more repeatable and easier to script or replicate in multiple sites.

Note: Commands below use the EdgeRouter CLI syntax, which is Vyatta-like.

Enter configuration mode
configure
Define IKE group
set vpn ipsec ike-group IKE-1 proposal 1 encryption ‘aes256’
set vpn ipsec ike-group IKE-1 proposal 1 hash ‘sha1’
set vpn ipsec ike-group IKE-1 proposal 1 dh-group ‘2’
set vpn ipsec ike-group IKE-1 lifetime 64800 Does microsoft have vpn and Windows VPN options for privacy, security, and remote work in 2025
Define ESP IPsec group
set vpn ipsec esp-group ESP-1 proposal 1 encryption ‘aes256’
set vpn ipsec esp-group ESP-1 proposal 1 hash ‘sha1’
set vpn ipsec esp-group ESP-1 lifetime 3600
Configure the IPsec peer Site B
set vpn ipsec site-to-site peer SITE-B-WAN-ADDRESS authentication mode ‘pre-shared-secret’
set vpn ipsec site-to-site peer SITE-B-WAN-ADDRESS authentication pre-shared-secret ‘YOUR_PSK’
set vpn ipsec site-to-site peer SITE-B-WAN-ADDRESS ike-group ‘IKE-1’
set vpn ipsec site-to-site peer SITE-B-WAN-ADDRESS esp-group ‘ESP-1’
set vpn ipsec site-to-site peer SITE-B-WAN-ADDRESS local-address ‘SITE-A_WAN_IP’ # If you have a known local IP
set vpn ipsec site-to-site peer SITE-B-WAN-ADDRESS remote-address ‘SITE-B_WAN_IP’
Configure the tunnel prefixes
set vpn ipsec site-to-site peer SITE-B-WAN-ADDRESS tunnel 0 local prefix ‘192.168.1.0/24’
set vpn ipsec site-to-site peer SITE-B-WAN-ADDRESS tunnel 0 remote prefix ‘192.168.2.0/24’
Firewall and NAT

Allow IPsec traffic in the firewall ESP, ISAKMP/IKE
If you’re behind NAT, enable NAT-Traversal
Create appropriate firewall policies for traffic from 192.168.1.0/24 to 192.168.2.0/24 and back

Commit and save
commit
save X vpn microsoft edge
Repeat on Site B with swapped local/remote networks
set local prefix ‘192.168.2.0/24’
set remote prefix ‘192.168.1.0/24’
set SITE-B_WAN-ADDRESS to Site A’s public IP or hostname
Verify

Check the tunnel status:
show vpn ipsec sa
Ping across tunnels:
ping 192.168.2.1 # from a host on Site A
ping 192.168.1.10 # from a host on Site B

Tips

If the tunnel fails to come up, verify PSK matches on both sides, and double-check the public IPs/hostnames you used.
If you’re using dynamic IPs, consider setting up a dynamic DNS name on both sides and use that in the remote-address field.
If you see NAT traversal errors, ensure NAT-T is enabled and that NAT rules aren’t blocking ESP.

Firewall rules and NAT considerations

The traffic across your site-to-site VPN needs to be explicitly allowed through your EdgeRouter X’ firewall rules. Here are practical guidelines:

Create a dedicated VPN firewall zone or use existing LAN_IN rules to explicitly permit VPN traffic
Allow ESP 50, IKE 22/UDP, and NAT-T 4500 across the tunnel
Permit traffic from Local A to Remote B and vice versa on the tunnel IPs and subnets
Avoid broad WAN-to-LAN NAT rules for security. restrict NAT to its required interfaces
For dynamic IP setups, add a rule to allow tunnel establishment even if the remote IP changes

Firewall rule examples CLI-friendly style: Ultrasurf edge: The ultimate guide to Ultrasurf edge, how it works, limitations, and when to choose a VPN alternative

set firewall name VPN-LOCAL rule 10 action accept
set firewall name VPN-LOCAL rule 10 description ‘Allow ESP/IKE for VPN’
set firewall name VPN-LOCAL rule 10 protocol esp
set firewall name VPN-LOCAL rule 20 action accept
set firewall name VPN-LOCAL rule 20 protocol udp
set firewall name VPN-LOCAL rule 20 destination port 4500
set firewall name VPN-LOCAL rule 30 action accept
set firewall name VPN-LOCAL rule 30 protocol udp
set firewall name VPN-LOCAL rule 30 destination port 500

Assign this firewall to the VPN interfaces and ensure the relevant LANs are allowed through to each other.

Performance tip: EdgeRouter X is capable of handling typical small-office VPN loads, but CPU limits can become a bottleneck with very heavy encryption or many concurrent tunnels. If you’re hitting a throughput ceiling, consider tuning ESP lifetimes and IKE rekey intervals, or upgrading to a more powerful device if your network demands grow.

Testing, validation, and troubleshooting steps

Validation is the fun part. Here’s a practical checklist to confirm your tunnel is healthy and traffic flows as intended:

Tunnel status: Check “up” status on both sides
Connectivity tests: From a host on Site A, ping a host on Site B. verify bidirectional pings
Route verification: Ensure the routes for 192.168.2.0/24 on Site A and 192.168.1.0/24 on Site B are present and used through the VPN
Traceroute: Use traceroute to confirm the path goes through the VPN tunnel
NAT behavior: Confirm internal addresses are not leaking to the internet. NAT should be only where required

Common issues and fixes What type of vpn is hotspot shield and how it stacks up for streaming, privacy, speed, and pricing

PSK mismatch: Re-check the pre-shared key on both edges. it’s easy to mistype
Incorrect remote endpoint: If Site B’s public IP changes, update the remote-address or DNS name
Firewall blocking ESP/IKE: Ensure firewall rules allow UDP 500/4500 and ESP protocol 50
Subnet overlap: If Site A and Site B have overlapping private ranges, VPN won’t route correctly. readdress one side’s LAN or implement NAT on the edge
MTU issues: VPN can drop packets if MTU is too large. tune MTU/MSS on tunnels if you see fragmentation

Security posture and best practices

Use strong PSKs and rotate them periodically
When possible, prefer IKEv2 with EAP or certificates. for small setups PSK with AES-256/SHA-1 is common and reliable
Keep EdgeRouter X firmware updated for security and compatibility
Disable unnecessary services on the EdgeRouter X to reduce the attack surface

Use cases: real-world scenarios you’ll actually run into

Small office connecting to a home office: simple two-site IPsec tunnel, shared resources
Multi-site branch network: a hub-and-spoke layout with central routing through VPNs
Temporary sites or pop-up offices: quick deployment with dynamic DNS and short lifespans
Remote access bridging: site-to-site networks that need to appear as a single LAN

Common patterns you’ll see:

Static IPs at both sites: easiest to configure and keep stable
Dynamic IPs via DDNS: slightly more complex but viable for home or small offices
NAT considerations: when one side uses NAT at the edge, NAT-T is usually needed to keep ESP alive

Security considerations you’ll want to bookmark

Always use a strong PSK and rotate it on a schedule you can manage
Consider upgrading to a newer EdgeRouter model if you’re planning more than a single tunnel or you need higher throughput
Monitor tunnel uptime and set up alerting for tunnel drop events
Use separate VLANs for VPN traffic if you’re in a shared environment to avoid collateral exposure
Back up your EdgeRouter X configuration regularly so you can recover quickly after a failed update or hardware issue

The bottom line practical takeaways

Setting up a site-to-site VPN with Edgerouter X is doable for both beginners and pros, using either UI-driven or CLI-driven approaches
Always start with a clear subnet plan and consistent naming conventions for tunnels and peers
Test thoroughly and validate both directions of traffic across the tunnel
Use firewall rules to restrict traffic across the VPN and protect your internal networks
Keep security at the forefront: strong PSKs, firmware updates, and minimal exposed services

Frequently Asked Questions

What is EdgeRouter X?

EdgeRouter X is a compact, affordable router from Ubiquiti that supports advanced routing features, including IPsec VPNs, NAT, firewall rules, and multiple LAN/WAN interfaces. It’s a popular choice for small offices and home labs.

Can I use IPsec site-to-site on EdgeRouter X?

Yes, IPsec site-to-site VPNs are a common and well-supported use case on EdgeRouter X. You can configure it via the UI or the CLI to connect to another EdgeRouter X or compatible IPsec endpoint.

Do I need static IPs for a site-to-site VPN?

Static IPs simplify configuration because the remote endpoint is constant. If you don’t have static IPs, use a dynamic DNS service and configure the remote address to resolve to the current public IP. Vpn in microsoft edge: how to use a VPN extension in Edge, setup tips, performance, and privacy

How should I choose a PSK and encryption settings?

Use a strong, randomly generated PSK for example, 20+ characters with a mix of letters, numbers, and symbols and AES-256 with SHA-1 or SHA-2 for encryption and hashing. If you can, consider upgrading to IKEv2 for better efficiency and security.

How do I test the VPN tunnel?

Test by pinging hosts across sites, checking route tables to ensure traffic is going through the tunnel, and performing traceroutes to confirm path integrity. Use the EdgeRouter’s VPN status page or CLI to verify tunnel uptime.

Can I use dynamic DNS with EdgeRouter X for VPNs?

Yes. If you don’t have static IPs, Dynamic DNS can map a hostname to your changing IP. Use the hostname in your remote-address settings and ensure you keep the DNS records updated.

Can I run multiple VPN tunnels on EdgeRouter X?

Yes, you can run multiple IPsec tunnels, but performance depends on your traffic and encryption load. Ensure you have proper routing and firewall configurations to manage multiple tunnels.

How do I configure firewall rules for VPN traffic?

Create dedicated VPN firewall rules to allow ESP, IKE, and NAT-T UDP 4500 and to permit traffic between the tunnel endpoints and the connected LANs. Restrict access to only the needed subnets to limit exposure. Edge vpn download: The comprehensive guide to downloading, installing, and using Edge VPNs for privacy and security

What’s the difference between IPsec and WireGuard on EdgeRouter X?

IPsec is a tried-and-true standard for site-to-site VPNs and is widely supported across devices. WireGuard is a newer protocol known for simplicity and speed, but EdgeRouter X support for WireGuard may require additional steps or plugins. IPsec remains the most common choice for site-to-site on EdgeRouter X.

How do I troubleshoot a tunnel that won’t come up?

Double-check PSK, endpoints, and DNS names, verify firewall allowances, ensure NAT-T is enabled if behind NAT, and confirm that both sides’ IKE/ESP lifetimes match. Check system logs for VPN-related messages and reinitiate the tunnel if needed.

Should I update EdgeRouter X firmware before configuring VPNs?

Yes. Having the latest firmware improves security and VPN compatibility. Do a quick backup of your current config before updating, and verify the VPN setup after any firmware change.

Can I use EdgeRouter X for corporate-grade VPNs?

EdgeRouter X is ideal for small offices or advanced home networks. For larger deployments or very high throughput requirements, you may want a more capable device or a dedicated VPN appliance.

Is NAT involved in site-to-site VPNs?

Typically, NAT is not needed for the tunnel itself, but you may need NAT rules if one side’s internal hosts are behind NAT or if you need to access internal resources from outside the VPN. Keep NAT minimal and only where necessary. Edge vpn iphone setup and review: how to use Edge VPN on iPhone for privacy, speed, and streaming in 2025

Do I need to know advanced networking to set this up?

A basic understanding of IP addressing, subnets, and routing helps a lot. The UI makes it approachable for beginners, while the CLI provides deeper control for power users.

What if my sites have overlapping subnets?

Overlapping subnets can prevent proper routing across the VPN. In that case, renumber one site’s LAN or implement a NAT strategy that keeps traffic distinct within the VPN path.

Can I automate VPN deployment across many sites?

Yes. With the CLI approach, you can script tunnel creation, PSK provisioning, and firewall rules to quickly roll out consistent site-to-site VPNs across multiple EdgeRouter X devices.

Edge vpn not showing: how to fix Edge browser VPN extension not appearing, troubleshooting steps, and reliable workarounds

Edge vpn download for pc

Edgerouter x site to site vpn setup