Journalist 
Edgerouter x site to site vpn setup guide for EdgeRouter: configure IPsec site-to-site VPN with EdgeOS, NAT, firewall rules, and performance tips
Yes, Edgerouter x site to site vpn can be set up. This guide gives you a practical, step-by-step path to get a reliable IPsec site-to-site tunnel between an EdgeRouter often the EdgeRouter X or similar EdgeOS-powered devices and a remote gateway. You’ll get a clear plan, concrete CLI commands, firewall considerations, troubleshooting tips, and performance notes so you can connect two networks securely and efficiently.
What you’ll get here:
- Prerequisites and planning checklist
- IPsec concepts you should know IKEv1 vs IKEv2, PSK vs certificates
- Step-by-step EdgeOS configuration CLI and UI options
- Subnet planning, routing, and NAT considerations
- Firewall rules and NAT traversal tips
- How to test the tunnel and verify it’s healthy
- Common pitfalls and quick fixes
- Performance optimization tips to maximize throughput while keeping security strong
If you want extra protection while you’re testing VPNs, you can grab NordVPN here:
Useful resources unlinked text for quick reference:
- EdgeRouter IPsec VPN documentation – help.ui.com/hc/en-us/articles/204836010-EdgeRouter-How-to-Configure-IPsec-VPN
- EdgeOS CLI reference – help.ui.com/hc/en-us/articles/204849024-EdgeRouter-CLI-Commands
- Ubiquiti Community forums – community.ui.com
- IPsec overview – en.wikipedia.org/wiki/IPsec
- IKEv2 vs IKEv1 differences – en.wikipedia.org/wiki/Internet_Key_Exchange
- RFC 4301 IPsec Architecture and RFC 5996 IKEv2 overview pages
- General site-to-site VPN best practices – cisco.com/c/en/us/products/security-vpn-endpoints/asa-firepower-series/tech-notes
What is a site-to-site VPN and why use EdgeRouter for it?
A site-to-site VPN connects two separate networks across the internet so devices on one side can reach resources on the other as if they were on the same LAN. With EdgeRouter, you’re leveraging EdgeOS’s built-in IPsec stack, which is efficient and scriptable via the CLI or the web UI. A well-configured site-to-site VPN on EdgeRouter gives you:
- Secure, encrypted traffic between sites
- Fine-grained control over what traffic goes through the tunnel
- The ability to add more tunnels to multiple sites without user-by-user VPN setup
- Better performance when you choose the right cryptographic settings and hardware capabilities
Note: The exact throughput you’ll see depends on your EdgeRouter model, firmware, and the remote gateway’s capabilities. EdgeRouter X is a budget-friendly option that can handle typical small-to-medium office links, but always test in your environment.
Prerequisites and planning
Before you touch the EdgeRouter, map out a few essentials:
- Local network LAN subnets on each edge: e.g., Site A 192.168.1.0/24, Site B 192.168.2.0/24
- Remote network subnets that must be reachable via VPN
- Public IPs for both gateways static is ideal. dynamic IPs require dynamic DNS or a failover plan
- Chosen IPsec parameters IKE group size, encryption, and hashing that both sides support
- Pre-shared key PSK or certificate method you’ll use for authentication
- Firewall posture: identify what traffic needs to traverse the tunnel and where to place allow rules
Pro tip: keep a simple subnet plan to avoid overlapping subnets. Overlapping networks are a common sinkhole for site-to-site VPNs.
IPsec concepts you should know
- IKE Internet Key Exchange phase: IKEv1 is older and sometimes more compatible with older devices. IKEv2 is newer, more secure, and generally easier to negotiate on modern devices.
- Encryption and integrity: AES-128 or AES-256 are common choices. SHA-1 is legacy—prefer SHA-2 SHA-256 for better security.
- PSK vs certificates: PSK is simpler to set up and great for small deployments. certificates are more scalable for larger deployments but require CA management.
- NAT-T NAT Traversal: essential if either gateway sits behind NAT. IPsec typically negotiates over UDP 4500 when NAT-T is in use.
- Dead Peer Detection DPD and re-authentication: helps keep tunnels up and detect dead peers quickly.
Hardware, firmware, and compatibility
- EdgeRouter models including EdgeRouter X run EdgeOS and support IPsec site-to-site VPNs with standard IKE/IPsec configurations.
- Ensure your firmware is up to date to avoid known bugs and to get the latest security defaults.
- If your remote gateway is a different vendor, make sure you align phases, groups, and subnets to avoid mismatches.
IPsec configuration overview
You’ll configure: What is k edge in VPNs: understanding k-edge computing, edge security, latency, and deployment strategies
- An IKE IKE-group with encryption and hash settings
- An ESP IPsec group with encryption and hash settings
- A site-to-site peer with a remote public IP, local-interface, and tunnel definitions
- Local and remote subnets for the tunnel
- Security associations SAs and dead peer detection if supported
EdgeRouter provides both CLI and Web UI options. The CLI tends to be quicker for complex deployments, while the UI is more visual.
Step-by-step EdgeRouter IPsec site-to-site configuration CLI
Note: Replace placeholders in angle brackets with your actual values.
-
Access the EdgeRouter via SSH or console, then enter configuration mode
configure -
Tell IPsec which interface will carry VPN traffic usually the WAN interface
set vpn ipsec ipsec-interfaces interface eth0 -
Create an IKE group IKE-GROUP with your preferred parameters
set vpn ipsec ike-group IKE-GROUP proposal 1 encryption aes128
set vpn ipsec ike-group IKE-GROUP proposal 1 hash sha256
set vpn ipsec ike-group IKE-GROUP keylife 3600
set vpn ipsec ike-group IKE-GROUP dh-group 2 Download edge vpn mod apk: risks, legality, safety tips, and legitimate VPN alternatives for Edge VPN users -
Create an ESP group ESP-GROUP for tunnel encryption
set vpn ipsec esp-group ESP-GROUP proposal 1 encryption aes256
set vpn ipsec esp-group ESP-GROUP proposal 1 hash sha256
set vpn ipsec esp-group ESP-GROUP lifetime 3600 -
Define the remote site peer with local and remote settings
set vpn ipsec site-to-site peer REMOTE-PEER authentication mode pre-shared-secret
set vpn ipsec site-to-site peer REMOTE-PEER authentication pre-shared-secret ‘YourSecretPSK’
set vpn ipsec site-to-site peer REMOTE-PEER ike-group IKE-GROUP
set vpn ipsec site-to-site peer REMOTE-PEER default-esp-group ESP-GROUP
set vpn ipsec site-to-site peer REMOTE-PEER local-address
set vpn ipsec site-to-site peer REMOTE-PEER tunnel 0 local-subnet 192.168.1.0/24
set vpn ipsec site-to-site peer REMOTE-PEER tunnel 0 remote-subnet 10.0.0.0/24 -
Optional: enable and configure NAT traversal NAT-T if either gateway sits behind NAT
set vpn ipsec nat-t enable -
Commit and save
commit
save -
Add static routes to direct traffic toward the remote subnet via the VPN tunnel
set protocols static route 10.0.0.0/24 next-hop 192.168.1.1 distance 1 Proton vpn edge extension -
Firewall considerations
- Allow VPN traffic IPsec on the WAN interface
- Allow traffic from the remote subnet toward your local LAN and vice versa
- If you’re using the EdgeRouter’s firewall groups, define a VPN-TABLE or use policy-based routing to ensure traffic takes the tunnel
- Exit and apply
exit
Quick UI alternative if you prefer GUI:
- Navigate to VPN > IPsec
- Create a new Site-to-Site peer
- Enter remote gateway IP, PSK, and select IKE group and ESP group
- Define local and remote subnet pairs
- Apply and test
Testing the VPN
- Use show vpn ipsec sa to verify security associations are established
- Ping devices across sites e.g., from Site A LAN to Site B LAN to test reachability
- Use traceroute to confirm path is through the VPN tunnel
- If you see no SA, recheck PSK matches, subnet definitions, and firewall rules
- For NAT traversal issues, verify UDP ports 500 and 4500 are not blocked by firewall anywhere along the path
Troubleshooting common issues
- Subnet overlap: If local or remote subnets overlap, the tunnel won’t form. Adjust one side’s subnet or introduce a NATed segment if needed but NATing VPN traffic can complicate routing.
- Mismatched IKE/ESP settings: Ensure that both sides agree on encryption, hash, and DH groups.
- PSK mismatch: Re-enter PSK on both sides and verify there are no stray spaces.
- Firewall rules blocking VPN traffic: Add explicit allow rules for IPsec and ESP if your firewall blocks non-standard protocols, you’ll need to permit ESP 50 and IKE 500/4500 from the remote gateway.
- Dynamic IPs: If you don’t have a static IP, set up a dynamic DNS on the EdgeRouter and configure the remote gateway to track your DNS name.
Advanced tips Does edge have its own vpn built-in in microsoft edge and how to use it vs edge vpn extensions for privacy and streaming
- Use IKEv2 whenever possible for better reliability and faster renegotiation
- Prefer AES-256 if you have the hardware headroom. it’s more secure, though it can be slightly slower on lower-end hardware
- Consider splitting tunnels by internal subnets if you have multiple remote subnets to minimize routing complexity
- For mobile users or non-site-to-site VPN scenarios, keep a separate remote access VPN, but this guide focuses on site-to-site
Performance considerations and real-world expectations
- Real-world VPN throughput on EdgeRouter X is influenced by CPU, memory, and encryption load. AES-128 with SHA-256 on typical EdgeRouter devices can handle hundreds of Mbps under the right conditions, but expect lower figures if you’re routing heavily and using AES-256 or SHA-2 with complex rules.
- Keep the tunnel’s MTU/MOV Path MTU Discovery in check to avoid fragmentation, which can degrade performance. You can test MTU with ping -s payload -M do -c 5
. - If you’re seeing instability, try a smaller IKE group size e.g., DH group 2 and a lighter ESP profile. You’ll trade a bit of security for stability in some older hardware scenarios.
- Keep firmware up to date. vendor fixes can improve IPsec reliability and performance.
NAT, routing, and firewall best practices
- Don’t double-NAT the VPN traffic if possible. place the VPN on your WAN IP directly or ensure proper NAT rules so encrypted traffic is not re-NATed in a way that breaks the tunnel.
- Use firewall rules to explicitly permit VPN traffic rather than allowing everything. this reduces exposure and potential misconfigurations.
- For multiple sites, centralizing routing with static routes is simpler but ensure you don’t create routing loops. Confirm each site has route entries that point to the appropriate VPN tunnel.
EdgeRouter maintenance and monitoring
- Regularly monitor VPN status with show vpn ipsec sa and show vpn ipsec status to catch dropped tunnels early.
- Keep logs enabled for IPsec and firewall to diagnose intermittent issues. check for recent rekey events or failed authentications.
Example scenarios and quick-start checklists
Scenario A: Simple two-site lab
- Site A: 192.168.1.0/24
- Site B: 10.10.0.0/24
- Remote gateway: static IP 198.51.100.2
- Local EdgeRouter: 203.0.113.1
Checklist: Vpn add on edge free: how to install, compare, and secure your browser with Edge VPN extensions
- Pick IKE group with AES-128/SHA-256
- Set PSK to shared secret
- Local-subnet 192.168.1.0/24, remote-subnet 10.10.0.0/24
- Test connectivity with ping across sites
- Add necessary static routes on both sides
Scenario B: Redundant site with dynamic IP
- Use dynamic DNS on edge devices
- Configure remote gateway to track dynamic DNS name
- Same IKE/ESP settings. ensure the remote site knows to refresh the IP on mismatch or use a DDNS service
Scenario C: Multi-site network
- Create multiple IPsec peers REMOTE-PEER-1, REMOTE-PEER-2… for each site
- Route tables must point each site’s traffic to its corresponding VPN tunnel
- Keep subnets strictly defined to minimize overlap
Frequently Asked Questions
How do I begin setting up Edgerouter x site to site vpn?
Start with a clear subnet plan, ensure both gateways have public IPs or DDNS in place, choose IKE/ESP settings that both sides support, input a PSK, and configure the tunnel on both sides. Verify with ping and status commands.
What is the difference between IKEv1 and IKEv2 for EdgeRouter VPNs?
IKEv2 is newer, typically more secure and efficient, and handles NAT traversal more gracefully. If both ends support IKEv2, prefer it. otherwise, fall back to IKEv1 with compatible parameters.
Should I use PSK or certificates for authentication?
PSK is simpler and works well for small deployments. Certificates are better for larger, scalable environments but require a PKI setup. Expressvpn browser extension edge: How to install, optimize, and get the most out of ExpressVPN on Microsoft Edge
How do I test if the VPN tunnel is up?
Check the SA status with show vpn ipsec sa, ping remote subnet devices, and trace route to confirm traffic goes through the tunnel.
How can I fix a tunnel that keeps dropping?
Check PSK mismatch, ensure IKE/ESP settings match on both sides, verify firewall rules allow IPsec and NAT-T, confirm that subnets do not overlap, and ensure there’s no intermediate device dropping VPN traffic.
Can I run multiple VPN tunnels with EdgeRouter X?
Yes, you can set up multiple site-to-site tunnels if you have the necessary hardware capacity and distinct remote subnets. Each tunnel gets its own peer and local/remote subnet definitions.
How do I handle dynamic IP addresses on one side?
Use DDNS on the gateway with the dynamic IP and configure the remote gateway to resolve the domain name for the remote peer. Ensure keepalive and rekey intervals accommodate changes.
What are common firewall pitfalls with IPsec?
Blocking ESP protocol 50 or AH protocol 51 can break IPsec. ensure IPsec traffic and UDP ports 500 and 4500 are allowed and that your rules don’t inadvertently block tunnel traffic. Do vpns work on crunchyroll and how to watch anime abroad with VPNs, smart DNS, and streaming tips
How do I optimize performance on EdgeRouter X for VPN?
Use AES-128 or AES-256 with SHA-256, reduce unnecessary rules in the VPN path, enable NAT-T if needed, and keep the device cool and firmware current. Test with real traffic to measure throughput.
Do I need to configure static routes for VPN traffic?
Yes. Each site should have routes that point remote network subnets through the VPN tunnel. Without proper routing, traffic may attempt to go through the Internet directly.
What if the tunnel is established but traffic doesn’t pass?
Recheck firewall rules, ensure NAT is not re-mapping VPN traffic in a way that breaks encryption, confirm that the tunnel’s local-subnet and remote-subnet definitions are accurate, and verify routing paths.
Can I combine site-to-site VPN with a remote access VPN on the same EdgeRouter?
Yes, you can run both, but keep them logically separated to avoid conflicts. Reserve VPN interfaces and firewall zones so that remote access traffic doesn’t accidentally route through the site-to-site tunnel.
How often should I rekey IPsec SAs?
Rekey intervals are typically set to 3600 seconds 1 hour or longer, depending on security policy and performance needs. If you notice instability, you can extend or shorten the lifetime after testing. Ubiquiti router vpn client setup guide for UniFi OS, EdgeRouter, OpenVPN, WireGuard, and IPsec
What are best practices for remote gateway configuration?
Use matching IKE/ESP settings, avoid overlapping subnets, enable NAT-T if NAT exists on either side, maintain strong PSKs or certificates, and monitor tunnel health regularly.
Final notes
Setting up Edgerouter x site to site vpn is a manageable, repeatable process once you have your subnet plan and authentication method in place. This guide gives you a practical path from prerequisites to verification and optimization. If you want more hands-on help or a quick-assistance option, you can refer to the official EdgeRouter documentation and community forums for updates and real-world tips.
Remember: test in a controlled environment before rolling out to production, document your configuration, and keep a change log so you can revert quickly if something goes wrong.