Table of Contents

Ubiquiti edgerouter site to site vpn: setup, troubleshooting, and best practices for IPsec tunnels between EdgeRouter devices

Ubiquiti edgerouter site to site vpn is a secure connection that links two or more networks over the Internet using IPsec tunnels on EdgeRouter devices. In this guide, you’ll learn how to plan, configure, test, and optimize a site-to-site VPN with EdgeRouter hardware, plus common gotchas and real-world tips to keep things running smoothly. This is a practical, hands-on walkthrough that covers both UI-based and command-line approaches, plus troubleshooting and security considerations.

What you’ll learn in this guide:
- How IPsec site-to-site VPNs work on EdgeRouter
- Prerequisites and planning for two-site or hub-and-spoke topologies
- Step-by-step setup using the EdgeRouter web UI
- Step-by-step setup using the EdgeOS CLI when you prefer command-line
- How to verify a tunnel is up and routing traffic correctly
- Common issues and practical troubleshooting steps
- Security best practices, including PSKs, IKE groups, and firewall rules
- Performance considerations and scaling tips
- Real-world caveats and maintenance tips

Useful URLs and Resources text only, not clickable

Ubiquiti official EdgeRouter documentation – ubnt.com
EdgeRouter IPsec site-to-site guide – help.ubnt.com
Ubiquiti Community forums – community.ui.com
NordVPN official site – nordvpn.com
NordVPN deal page affiliate – dpbolvw.net/click-101152913-13795051?sid=070326

If you’re looking for extra protection for endpoints while your site-to-site VPN keeps the two networks connected, you can consider a personal VPN service. This is especially useful for remote workers or temporary access to the main office network. For readers who want a good deal, this NordVPN option is worth a look— affiliate link via the banner image above.

What is Ubiquiti EdgeRouter site-to-site VPN?

EdgeRouter devices support IPsec site-to-site VPNs that allow two networks to exchange traffic securely over the Internet. This is different from remote-access VPNs, which connect individual devices. site-to-site creates a dedicated tunnel between routers so entire subnets can communicate as if they were on the same local network. Key concepts include:

Local subnet: the network behind your EdgeRouter that will be reachable through the VPN
Remote subnet: the network behind the peer EdgeRouter
Pre-shared key PSK: a shared secret used for authenticating the VPN peers
IKE and ESP: the cryptographic suites that govern how the tunnel is established and how data is encrypted
NAT-T NAT Traversal: helps IPsec work when either side sits behind a NAT

Common topologies:

Hub-and-spoke: a central site connects to multiple remote sites through separate tunnels
Full mesh: each site connects to every other site used in smaller networks but can get complex

EdgeRouter’s IPsec implementation is tightly integrated with EdgeOS, so you can configure the tunnels via the web UI or via the CLI. In practice, most networks start with a simple two-site tunnel and then expand to more sites or add redundancy with multiple tunnels.

Prerequisites and planning

Before you configure anything, collect and confirm:

Public IPs of both sites static is ideal. dynamic IPs can work with dynamic DNS, but it adds management overhead
Local subnets at each site e.g., Site A: 192.168.10.0/24, Site B: 192.168.20.0/24
Desired remote subnets to reach across the VPN
A secure pre-shared key PSK for IPsec authentication
EdgeRouter devices with current firmware EdgeOS
Firewall rules that allow IPsec traffic UDP 500/4500 and ESP protocol 50 typically
A plan for static routes so traffic destined for the remote subnet actually uses the VPN tunnel

Security tip: keep the PSK long and unique, rotate it periodically, and restrict access to the EdgeRouter admin interfaces. Best edge vpn extension free options for browser safety, speed, privacy, and streaming

When you’re ready, you can start with a two-site example and then scale up. If you’re looking for extra protection for endpoints outside the VPN, you might pair this with a personal VPN for individual devices, which is where the NordVPN deal in the introduction can come into play.

Step-by-step setup: EdgeRouter UI web UI

This approach is easiest if you’re more comfortable with point-and-click configuration.

Open the EdgeRouter web UI
Go to the VPN tab, then select IPsec, and choose Site-to-Site

Add a new peer the remote site

Remote peer IP: the public IP address of the other site
Authentication: set to Pre-Shared Secret
PSK: enter the shared secret you generated
Local subnet: the LAN behind your EdgeRouter e.g., 192.168.10.0/24
Remote subnet: the LAN behind the peer e.g., 192.168.20.0/24
IKE group / ESP / encryption settings: pick a pair that both sites support common choices include AES-256 for encryption and SHA-256 for integrity
Enable the tunnel

Define the tunnel specifics

Local and remote subnets are defined as part of the tunnel configuration
Attach the tunnel to an IPsec interface if the UI requires it some versions expose a separate “tunnel” or “connection” object

Firewall rules

Ensure you allow VPN traffic on the EdgeRouter’s WAN interface and any NAT or firewall zones
Create rules to allow traffic from the local subnet to the remote subnet via the VPN interface
If you’re using NAT between subnets, disable NAT for VPN traffic on the relevant rules

Static routes

Add static routes on each site so traffic for the remote subnet uses the IPsec VPN as the next hop
In many setups, the VPN tunnel itself creates the route, but you may still need to add a static route for the remote subnet if it isn’t automatically learned

Test the tunnel

From a host in Site A, ping a host in Site B workstation in 192.168.20.10, for example
Check VPN status in the UI: look for “up” or a green light on the tunnel
Verify the peer is reachable and that traffic is traversing the tunnel you can check on the EdgeRouter’s status page or firewall logs

Monitoring and adjustments

Monitor tunnel uptime and traffic via the EdgeRouter dashboards
If you see dropped packets or a flapping tunnel, adjust IKE/ESP proposals or enable dead-peer detection if supported

Step-by-step setup: EdgeOS CLI command line

If you prefer the command line, here’s a general outline you can adapt to your version of EdgeOS. Exact syntax can vary by firmware, so refer to the latest EdgeRouter documentation for exact commands.

Define IKE and ESP settings

Create an IKE group and ESP phase 2 settings that match the remote site’s configuration

Add a site-to-site peer

Configure the remote peer IP, PSK, and tunnel properties local-subnet and remote-subnet. Tie the tunnel to a specific ESP group and IKE group.

Attach the tunnel to the interface

Ensure the VPN interface is associated with your WAN interface to carry IPsec traffic

Configure static routes

Add a route for the remote subnet via the VPN tunnel interface

Save and apply

Write the changes and apply the configuration
Confirm that the tunnel shows as up and that traffic routes correctly

Notes:

In EdgeOS CLI, you’ll often see commands like set vpn ipsec site-to-site peer … and set vpn ipsec ipsec-interfaces interface eth0, followed by tunnel and local/remote subnet definitions.
If you’re using dynamic IPs on either side, you’ll want to plan for dynamic DNS or a fallback mechanism to re-establish the tunnel when IPs change.

Verification: how to confirm the VPN is working

Use the EdgeRouter status page to verify tunnel state up/down
Ping tests across subnets Site A 192.168.10.10 -> Site B 192.168.20.10
Check firewall logs for dropped VPN traffic or blocked subnets, and adjust rules accordingly
Confirm that routes show the remote subnet as reachable through the VPN interface
If the tunnel doesn’t come up, review:
- PSK mismatch
- Mismatched local/remote subnets
- Incompatible IKE/ESP proposals
- NAT-T issues ensure NAT traversal is enabled if either side is behind NAT

Common issues and troubleshooting tips

PSK mismatch: Double-check the pre-shared key on both sides. Even a single character mismatch will prevent the tunnel from establishing.
Subnet overlap: Ensure the two networks don’t overlap or conflict. Overlapping subnets cause traffic to be misrouted or dropped.
Firewall rules: Make sure the firewall allows IPsec traffic and the VPN tunnel’s traffic. It’s common to block the ESP protocol if you don’t have explicit rules.
NAT complications: If one side sits behind a NAT, verify NAT-T is enabled and that external ports 500/4500 are allowed through firewalls to reach the EdgeRouter.
Mismatched IKE/ESP proposals: Align encryption, integrity, and DH group settings on both sides.
Dynamic IPs: If either site has a dynamic public IP, you’ll need a solution like dynamic DNS and a mechanism to detect IP changes and re-establish the tunnel.
Routing problems: If you can ping the gateway but not the remote subnets, add or adjust static routes so traffic for the remote subnet uses the VPN and not the default gateway.

Security considerations and best practices

Use strong PSKs and rotate them periodically. Store them securely.
Keep EdgeRouter firmware up to date to benefit from security patches and improved VPN handling.
Limit VPN exposure: only allow IPsec traffic from known remote IPs and restrict what remote subnets can access in your firewall rules.
Consider monitoring VPN health with alerting for tunnel down events, high packet loss, or unusual traffic patterns.
For small businesses with sensitive data, pair IPsec site-to-site VPN with additional measures like endpoint protection and regular security audits.

Performance and scaling

Throughput depends on model, CPU, and encryption settings. EdgeRouter devices typically handle typical small-to-medium site-to-site VPNs well, but performance will drop if you enable heavy encryption or route large amounts of traffic through the tunnel.
If you need higher performance, consider models with more CPU power or even a dedicated VPN appliance for critical sites.
For hub-and-spoke designs, plan capacity for the sum of all tunnels exiting a central site, especially if multiple remote sites simultaneously use the VPN.

Real-world tips and examples

Start with a simple two-site tunnel to validate the setup, then gradually add more sites or spokes.
Use clearly named subnets and document which EdgeRouter interface is handling which tunnel to avoid misconfigurations when you scale.
Periodically test failover and re-keying to ensure resilience in the event of a PSK compromise or device failure.
If IPv6 is in use, verify that IPv6 traffic can traverse the VPN if required, and ensure firewall rules cover IPv6 as well as IPv4.

Use cases and deployment patterns

Office-to-office connectivity: two or more offices can share resources securely without exposing subnets to the Internet.
Remote workforce access to central resources: a site-to-site VPN can complement remote-access solutions, enabling secure site connectivity while allowing remote users to connect to central services through the VPN.
Branch office expansion: scale by adding new site-to-site tunnels as you open new locations, maintaining consistent security policies across sites.

Additional resources and reading

Official EdgeRouter IPsec site-to-site guides and FAQs
Community-driven troubleshooting threads and best-practice discussions
General IPsec concepts and VPN design patterns for small businesses

Frequently Asked Questions

What exactly is a site-to-site VPN on Ubiquiti EdgeRouter?

A site-to-site VPN on EdgeRouter creates a secure tunnel between two networks over the Internet, letting devices on each network communicate as if they were on the same LAN. It uses IPsec to encrypt traffic and can be set up with a pair of EdgeRouters or EdgeRouter and another VPN-capable device. Youtube vpn chrome

Do I need a static IP on both ends to use IPsec site-to-site VPN?

Static IPs simplify setup because peers can reliably connect to each other. Dynamic IPs can work with dynamic DNS and frequent tunnel maintenance, but it adds complexity and the potential for intermittent connections.

Which EdgeRouter models support IPsec site-to-site VPN?

Most EdgeRouter models with EdgeOS including EdgeRouter X, X SFP, 4/6/8/16-series support IPsec site-to-site VPN. Always check the latest release notes for any model-specific limitations.

What VPN protocols are used in EdgeRouter site-to-site VPN?

IPsec is the core protocol, using IKE for tunnel establishment IKEv1 or IKEv2 depending on the firmware and ESP for encryption. NAT-T is commonly used when one side is behind NAT.

How do I verify that my VPN tunnel is up?

Check the EdgeRouter’s VPN/IPsec status page for tunnel health, look for an “up” status, and test end-to-end by pinging a host on the remote network. Logging and firewall rules can help diagnose issues.

How can I troubleshoot a tunnel that won’t come up?

Confirm PSK matches at both ends, verify local/remote subnet definitions, ensure firewall rules allow VPN traffic, check for misconfigured IKE/ESP proposals, and verify NAT-T if NAT is involved. Review system logs for IPsec negotiation errors. Why does vpn automatically turn on and how to control auto-connect on Windows macOS iOS and Android

Should I use UI or CLI to configure EdgeRouter IPsec?

Both work well. The UI is typically faster for straightforward two-site setups, while the CLI provides precision and repeatability for complex topologies or automated deployments.

Can I have more than one site-to-site VPN tunnel on EdgeRouter?

Yes. You can configure multiple tunnels to different remote sites or create a hub-and-spoke layout with multiple point-to-point tunnels. Plan your subnets and routing to avoid conflicts and ensure performance.

How do I handle routing for the remote subnet?

Add static routes on each site so traffic destined for remote subnets uses the VPN tunnel as the next hop. In many cases, the VPN setup creates required routes automatically, but manual routing ensures reliability.

What about VPN performance and encryption options?

Performance depends on your hardware and the chosen encryption methods. AES-256 with SHA-256 is common, but you can adjust to balance security and speed. If you need higher throughput, consider stronger hardware or optimizing tunnel settings.

Can I combine EdgeRouter IPsec with a personal VPN service?

You can run a personal VPN on endpoints or devices alongside the site-to-site VPN for additional protection, especially for remote workers. Use caution to avoid double-NAT or routing conflicts, and test the setup for conflicts. Super vpn owner guide: best VPN for privacy, streaming, security, and remote work in 2025

Are there best practices for securing EdgeRouter VPNs?

Yes. Use strong PSKs, keep firmware updated, limit admin access, segment firewall rules to allow only necessary traffic, monitor tunnel health, and rotate credentials periodically. Document topology for easier audits and changes.

How do I recover if a site goes offline and I can’t reach the remote site?

Check physical connectivity, verify Internet access at both sites, re-establish the tunnel by reloading IPsec services, verify PSKs, and review logs. Having a backup plan for routing and access can help minimize downtime.

Is there a difference between policy-based and route-based VPN on EdgeRouter?

IPsec VPNs on EdgeRouter are typically configured with policy-based methods focusing on specific subnets. Route-based VPNs are common in other platforms, but EdgeRouter relies on tunnel definitions, local/remote subnets, and static routes to steer traffic.

Can I monitor VPN health automatically?

Yes. Use EdgeRouter’s built-in monitoring dashboards, enable IPsec statistics, and set up alerts if a tunnel drops or packet loss exceeds a threshold. External monitoring tools can integrate via SNMP or API hooks if available.

When should I consider upgrading firmware?

If you notice bugs, new features, or improved security for IPsec handling, upgrading firmware is a good idea. Always back up your configuration before a firmware upgrade and review release notes for VPN-related changes. Ultrasurf vpn edge: comprehensive guide to features, setup, safety, performance, and alternatives for 2025

Ubiquiti edgerouter site to site vpn