Journalist
Ubiquiti edgerouter x site to site vpn setup guide: how to configure IPsec site-to-site VPN between EdgeRouter X appliances for secure multi-site networks
Ubiquiti edgerouter x site to site vpn is a way to securely connect two networks over the internet using the EdgeRouter X with IPsec tunnels. In this guide, you’ll get a practical, step-by-step walkthrough to set up a reliable site-to-site VPN between two EdgeRouter X devices. You’ll learn what you need before you start, how to configure both ends, how to verify the tunnel, and what to watch out for so your remote offices stay connected without headaches. Along the way, you’ll see real-world tips, troubleshooting tricks, and best practices to keep things fast and secure. If you want a quick boost to your security stack, I’ve included a quick note about a well-known VPN deal you may want to consider. you’ll find it in the introduction. Finally, I’ve compiled a helpful list of resources so you can dive deeper later.
In this guide, you’ll find:
- A clear overview of IPsec site-to-site VPN on EdgeRouter X
- Prerequisites and planning tips to avoid common misconfigurations
- A detailed, ordered configuration flow for a two-site VPN
- Common pitfalls, performance tips, and security best practices
- Real-world use cases to help you decide when a site-to-site VPN makes sense
- An FAQ section with practical answers to frequent questions
NordVPN deal note: If you’re considering adding an extra layer of protection for devices behind VPN tunnels or for remote access, check out this deal — http://get.affiliatescn.net/aff_c?offer_id=153&aff_id=132441&url_id=754&aff_sub=070326. Image link appears below for easy recognition in the intro.
Useful resources un clickable text:
- Ubiquiti EdgeRouter X product page: ubnt.com/products/edgerouter-x
- EdgeRouter X user guide and EdgeOS documentation: help.ubnt.com/hc/en-us/categories/200
- IPsec and VPN topics on EdgeOS: help.ubnt.com/hc/en-us/articles/204033704-IPsec
- StrongSwan documentation IPsec backend: wiki.strongswan.org
- OpenVPN and WireGuard basics for routers: openvpn.net, www.wireguard.com
- General networking concepts for VPNs: en.wikipedia.org/wiki/VPN
Overview of Ubiquiti EdgeRouter X Site-to-Site VPN
Site-to-site VPNs connect two or more separate networks so devices on one side can reach devices on the other side as if they were on the same local network. With the EdgeRouter X, this typically means creating an IPsec tunnel between two EdgeRouter X devices or between an EdgeRouter X and another IPsec-enabled device. The EdgeRouter X runs EdgeOS, which includes a robust IPsec implementation strongSwan, a firewall, and static routing features that make the tunnel feel native to your LAN.
Here’s what makes this setup compelling:
- Security by default: IPsec uses strong encryption to protect traffic across the public internet.
- Fine-grained access: You can specify which subnets traverse the tunnel and which traffic is allowed to pass.
- Centralized management: You control both ends, so you can enforce consistent policies across sites.
- Reliability: You can leverage multiple tunnels or backup routes if you’re dealing with mission-critical apps.
Key terms you’ll see throughout the guide:
- IKE Phase 1 IKEv1 or IKEv2: How the two endpoints establish a secure channel.
- IPsec Phase 2 ESP/AH: How the actual data payload is protected.
- Crypto proposal: The combination of algorithms for encryption, integrity, and key exchange.
- NAT-T: NAT traversal for IPsec when devices sit behind NAT.
- VPN tunnel/interface: The logical device that carries traffic through the IPsec tunnel.
- Local/Remote networks: The subnets on each side that you want to connect.
Prerequisites and planning
Before you touch any settings, lock down a solid plan:
- Public IPs or reachable endpoints: Each EdgeRouter X must be reachable from the other side. If your public IPs are dynamic, set up Dynamic DNS on both ends.
- Subnet planning: Ensure your local networks do not overlap. For example, Site A uses 192.168.10.0/24 and Site B uses 192.168.20.0/24. Overlapping subnets break routing through the tunnel.
- Firewall readiness: You’ll open IPsec ports on both sides usually UDP 500 and 4500 for NAT-T, plus ESP traffic. Make sure your firewall rules won’t block the VPN traffic.
- Bandwidth expectations: EdgeRouter X is capable, but performance depends on the CPU load and the complexity of your firewall rules. Plan for the encryption overhead. you’ll typically see a small decrease in raw throughput on VPN traffic.
- Firmware compatibility: Ensure both devices run a recent EdgeOS version with IPsec support and bug fixes. If you’re centralizing management, note versions that play nicely together for IPsec.
- Dynamic DNS and port forwarding: If devices are behind consumer-grade routers, configure DDNS and forward necessary ports to your EdgeRouter X so the other side can reach it reliably.
- Security posture: Use strong crypto proposals AES-256, SHA-256 and enforce updated firmware. Consider disabling older, weaker ciphers where possible.
Step-by-step configuration two-site setup
This section gives a practical, ordered flow you can follow. We’ll outline a typical site-to-site VPN between Site A and Site B, both using EdgeRouter X devices. You’ll want to perform similar steps on both sides, swapping the local/remote terms accordingly. Is edge vpn good reddit
Step 1: Gather network details
- Site A:
- Local LAN: 192.168.10.0/24
- Public IP: x.y.z.a
- Site B:
- Local LAN: 192.168.20.0/24
- Public IP: w.x.y.z
Document these clearly. You’ll configure matching Phase 1 and Phase 2 settings on both ends with the appropriate local/remote networks.
Step 2: Configure IPsec on Site A EdgeRouter X
- Access EdgeOS: use the web UI or SSH.
- Create Phase 1 IKE proposal: choose IKEv2 if supported. otherwise IKEv1, with a secure encryption AES-256, integrity SHA-256, and a reasonable DH group e.g., 2 or 14.
- Create Phase 2 ESP proposal: AES-256, SHA-256, and PFS Perfect Forward Secrecy enabled.
- Define a tunnel: set the remote peer to Site B’s public IP, set local subnet to 192.168.10.0/24, and remote subnet to 192.168.20.0/24.
- NAT-T: enable NAT traversal if either side sits behind NAT.
- Key lifetimes: typical values are 3600 seconds for IKE and 3600 seconds for IPsec NL. adjust to match the other side if you’re coordinating with a partner device.
Step 3: Configure IPsec on Site B EdgeRouter X
Mirror the settings from Site A. The remote/local networks swap:
- Local LAN: 192.168.20.0/24
- Remote LAN: 192.168.10.0/24
- Remote peer: Site A’s public IP
- Phase 1 and Phase 2 proposals should match Site A
- Enable NAT-T if needed and lock in the same lifetimes
Step 4: Create VPN tunnel interfaces and routing
- On each EdgeRouter X, create a VPN tunnel interface often named something like ipsec0 or vpn0.
- Bind the tunnel to the corresponding logical network interfaces so traffic destined for the remote subnet is routed through the tunnel.
- Add static routes on each side:
- Route 192.168.20.0/24 from Site A to vpn0
- Route 192.168.10.0/24 from Site B to vpn0
- Ensure that firewall rules permit traffic across the tunnel:
- Allow IPsec control traffic IKe, ISAKMP on the WAN interface
- Permit ESP protocol 50 and AH protocol 51 if used
- Allow traffic from 192.168.10.0/24 to 192.168.20.0/24 and vice versa through the VPN
Step 5: NAT and firewall exceptions
- If you’re using NAT on your EdgeRouter X, add NAT exemption rules so return traffic from the remote LAN isn’t translated again.
- Example: exempt traffic between 192.168.10.0/24 and 192.168.20.0/24 from NAT.
- Confirm firewall rules on both sides allow VPN traffic and inter-LAN traffic across the tunnel.
Step 6: Test the tunnel
- Check VPN status on both sides. you should see the tunnel up with a secure channel.
- Ping devices across sites e.g., from 192.168.10.10 to 192.168.20.10.
- Test both directions and verify latency doesn’t spike unusually.
- Capture and review logs if the tunnel doesn’t come up. look for mismatched policies, IP mismatches, or NAT issues.
Step 7: Verification and tweaking
- Verify that internal devices can reach resources across sites.
- If you experience packet loss or instability, re-check MTU settings, NAT traversal status, and crypto proposals for mismatches.
- Consider enabling dead-peer-detection DPD and keep-alive settings to maintain tunnel stability in case of short internet outages.
Step 8: Documentation and maintenance
- Document the final configuration, including:
- Public IPs, local/remote subnets
- Phase 1 and Phase 2 proposals
- NAT exemptions and firewall rules
- Any dynamic DNS configurations
- Schedule periodic reviews to ensure firmware stays up to date and crypto policies reflect current security standards.
Common pitfalls and troubleshooting
- Subnet overlap: If both sites use overlapping IP ranges, routing won’t know where to deliver traffic. Change one side’s LAN or use a different internal network plan.
- Mismatched crypto proposals: If Phase 1 or Phase 2 selections don’t match exactly on both sides encryption, integrity, DH group, the tunnel won’t form.
- NAT issues: If one side is behind NAT and NAT-T isn’t working, the tunnel may fail to establish. Ensure NAT-T is enabled and ports are reachable.
- Firewall blocks: Firewalls at either end can block IPsec negotiation UDP 500/4500 or ESP. Double-check both ends.
- Dynamic IPs without DDNS: If the remote site uses dynamic IPs, make sure dynamic DNS is set up and the IP you point to is current.
- Remote networks not reachable: Make sure the remote LAN devices actually exist on the remote subnet and aren’t blocked by a separate firewall.
- MTU and fragmentation: VPNs can cause fragmentation, which hurts performance. If you see odd latency or drops, consider lowering the MTU on VPN interfaces or enabling MSS clamping on the tunnel.
Performance and security best practices
- Use strong crypto: AES-256 for encryption and SHA-256 or better for integrity. Prefer IKEv2 where possible for efficiency and reliability.
- Firmware updates: Keep EdgeOS up to date to benefit from security fixes and bug patches related to IPsec.
- Audit firewall rules: Minimize rules to only what’s necessary for the VPN and LAN access. A lean firewall is easier to maintain and less error-prone.
- Separate management from data traffic: Avoid mixing management access with VPN traffic. use separate interfaces or VLANs if possible.
- Redundancy: If uptime is critical, consider a backup tunnel or secondary path e.g., a second VPN peer or another remote site as a backup.
- Monitoring: Enable logging for IPsec events and set up alerts when the tunnel goes down. Regular checks help catch issues early.
Real-world use cases
- Branch office to main office: A medium-sized business with two or more offices uses a site-to-site VPN to keep file servers, printers, and internal apps accessible across sites without exposing everything to the internet.
- Remote data centers: If you have a small data center or a colocated server at a different location, a site-to-site VPN makes it easy to treat remote servers as part of the same network.
- Hybrid cloud access: You can connect an on-prem EdgeRouter X site to a cloud environment like a private subnet in a public cloud over IPsec, providing a secure bridge between on-prem devices and cloud workloads.
- Small-business resilience: A VPN link between primary and backup sites can help keep critical services reachable if a link goes down, provided you have proper failover logic in place.
Alternatives and complementary options
- OpenVPN: EdgeRouter X supports OpenVPN as an alternative in EdgeOS. If you want per-user remote access or a different level of control, OpenVPN can be a good fit.
- WireGuard: Some users opt for WireGuard for its simplicity and performance. It’s supported in various environments, but confirm compatibility with EdgeOS and your hardware.
- Cloud VPN services: For severals sites or cloud-connected networks, you might pair IPsec with cloud-provider VPN options if you’re extending beyond two locations.
Maintenance and monitoring
- Regular health checks: Schedule periodic checks of tunnel status, uptime, and throughput. Keep logs and track any changes in VPN behavior.
- Firmware management: Plan firmware upgrades during maintenance windows to minimize disruption.
- Change control: When adjusting subnets, crypto proposals, or firewall rules, document changes and test them in a staging environment if possible.
Frequently Asked Questions
What is a site-to-site VPN on EdgeRouter X?
A site-to-site VPN on EdgeRouter X is a secure IPsec tunnel that links two separate local networks over the internet. It allows devices on one LAN to communicate with devices on the other LAN as if they were on the same network, with traffic protected by encryption.
Do I need IPsec or OpenVPN for a site-to-site VPN?
IPsec is the most common choice for site-to-site connections due to efficiency and native support in EdgeOS. OpenVPN is often used for remote access or when you need a different client experience, but IPsec is typically preferred for site-to-site tunnels.
Can I connect two EdgeRouter X devices from different networks?
Yes. As long as both devices have reachable public IPs or DDNS where applicable and you configure matching Phase 1/Phase 2 settings for non-overlapping subnets, the tunnel should form successfully. Hoxx vpn edge review and guide: features, performance, privacy, setup, pricing, and alternatives
What if my public IPs change?
Set up Dynamic DNS on both sides so the other side can always reach the correct IP. If you have a static IP, you can skip DDNS entirely.
How do I verify the VPN tunnel is up?
Check the EdgeRouter X VPN status in the EdgeOS UI or via SSH. Look for an “up” or “connected” state on the tunnel, confirm LED indicators if present, and test cross-site ping or traffic flows.
Why isn’t traffic crossing the VPN?
Common causes include mismatched Phase 1/2 proposals, MTU issues, NAT-T problems, incorrect routing, or firewall blocks. Review the crypto settings on both sides and ensure the tunnel interface is properly bound to the correct routes.
How do I handle NAT on VPN traffic?
Enable NAT exemption for traffic between the two subnets so it doesn’t get translated when it travels across the tunnel. Ensure ESP protocol 50 is allowed in the firewall for encrypted traffic.
Should I use IKEv2 or IKEv1?
IKEv2 is generally preferred for its stability and speed. If your devices support it, configure Phase 1 as IKEv2. If you’re using older EdgeOS versions, IKEv1 is still workable but less efficient. Is mullvad a good vpn
How can I secure a site-to-site VPN?
- Use AES-256 encryption and SHA-256 or better for integrity
- Use a strong Diffie-Hellman group e.g., Group 2 or higher for IKE
- Keep firmware up to date
- Limit tunnel traffic with precise routing and firewall rules
- Disable weak ciphers and old protocols
Can I have more than one VPN tunnel between sites?
Yes. You can set up multiple IPsec tunnels for redundancy or to route different subnets. Just ensure the routing tables and firewall rules are configured to avoid conflicts and to support load balancing if needed.
What monitoring options exist for IPsec on EdgeRouter X?
EdgeOS logs IPsec events, and you can route VPN status to a syslog server. You can also use SNMP or third-party monitoring tools to watch tunnel status, latency, and throughput.
Is it okay to mix EdgeRouter X with other vendors’ devices?
As long as you configure matching Phase 1/Phase 2 settings, proper NAT handling, and correct subnets, inter-vendor IPsec site-to-site VPNs work. Double-check compatibility and test the tunnel carefully.
Do I need a public-facing DNS name for my EdgeRouter X?
A DNS name helps if you have dynamic IPs or want a friendly hostname for the remote peer. It’s not strictly required if you’re using static IPs, but it makes maintenance easier.
How do I upgrade EdgeRouter X firmware without breaking my VPN?
Backup your configuration, perform the upgrade during a maintenance window, and re-verify all VPN settings afterward. If possible, test in a staging environment before applying changes to production. Ubiquiti er-x vpn on EdgeRouter X comprehensive guide to IPsec, OpenVPN, L2TP and site-to-site remote access
Final notes
Setting up a site-to-site VPN with Ubiquiti EdgeRouter X is very doable with careful planning and a methodical approach. The keys to success are non-overlapping networks, matching crypto proposals, explicit NAT handling, and thorough testing. With these steps, you’ll have a stable, secure link between sites that keeps your data protected while your team stays productive.
If you want to dive deeper into any subsection, I’ve laid out the core steps and considerations so you can follow along on your own. And if you’re exploring extra protection for devices or remote access, don’t forget to check out the NordVPN offer I mentioned at the top of the article. The deal link is included above, and you’ll find it a natural companion to securing traffic flowing through your VPN tunnels.
Would you like me to tailor this guide to a specific pair of sites for example, a branch office and a home office or to a particular EdgeRouter OS version you’re running? I can adjust the steps to fit your exact setup and provide a ready-made, copy-paste configuration you can apply.