A quick fact: Ubiquiti Edgerouter site to site VPN is a reliable way to connect multiple networks securely over the internet without exposing internal resources. This guide walks you through setting up a site-to-site VPN on an EdgeRouter, with actionable steps, real-world tips, and troubleshooting help.

Why you might need a site-to-site VPN
Prerequisites and gear you’ll need
Step-by-step setup
Common pitfalls and quick fixes
Performance considerations and security tips
Real-world use cases and examples

Useful URLs and Resources text only
Apple Website – apple.com
Artificial Intelligence Wikipedia – en.wikipedia.org/wiki/Artificial_intelligence
Ubiquiti Networks – help.ubnt.com
EdgeRouter EdgeOS Documentation – help.ui.com
VPN Basics – cisco.com/pressroom/press-releases
Google Cloud VPN Overview – cloud.google.com/products/networking/vpn
OpenVPN Community – openvpn.net
NIST Cybersecurity Framework – nist.gov/cyberframework

Table of Contents

What is a site-to-site VPN and why EdgeRouter?

A site-to-site VPN creates an encrypted tunnel between two networks, so devices on one side can talk to devices on the other as if they’re on the same LAN. With Ubiquiti Edgerouter, you’re using EdgeOS to configure IPsec or other VPN protocols. It’s a cost-effective, scalable solution for small businesses or home offices that want to securely connect multiple sites.

Key stats and considerations:

IPsec is the most common choice for site-to-site VPNs due to strong encryption AES-256, SHA-2.
EdgeRouter models like ER-X, ER-4, ER-6 offer robust performance for typical home and small-office loads.
Typical throughput for EdgeRouter devices ranges from hundreds of Mbps to a few Gbps depending on model and VPN load check your exact model specs.

Planning before you configure

Network map and addressing

Draw a simple schematic of both sites: Site A and Site B.
Decide which subnets will be reachable across the VPN, e.g., Site A 192.168.1.0/24 and Site B 192.168.2.0/24.
Make sure there are no overlapping IP ranges; if there are, plan non-overlapping subnets or use NAT exemptions.

Public IPs and routing

Each EdgeRouter will have a public IP static is ideal; dynamic can work with a DDNS service.
Decide on a routing method: static routes or dynamic routing eBGP/OSPF if you’re comfortable with it.

VPN type and encryption

IPsec is the standard choice for site-to-site.
Decide on phase 1/2 algorithms e.g., AES-256, SHA-256 and the PFS group.
Enable Perfect Forward Secrecy PFS for added security.

Step-by-step: How to configure Ubiquiti Edgerouter site to site VPN IPsec

Note: Exact menu names may vary slightly based on EdgeOS version, but the workflow stays consistent.

Prepare Site A EdgeRouter

Access EdgeOS Web UI: https://
Navigate to: VPN > IPsec > Tunnels
Add a new tunnel:
- Remote Peer: Site B public IP
- Local WAN Address: Site A public IP
- Shared Secret: a strong, random key
- Encryption: AES-256, Integrity: SHA-256
- DH Group: 14 2048-bit or similar
- PFSG: Enable PFS
- IPsec Profile: create or select a profile with these params
Local Subnets: 192.168.1.0/24
Remote Subnets: 192.168.2.0/24
Save and apply

Step-by-step: Configure static routes

Still in Site A, go to Routing or Static Routes
Add a route: Destination 192.168.2.0/24 via VPN tunnel interface usually p2p0 or similar
Save and apply

Step-by-step: Firewall rules

Go to Firewall/NAT settings
Create a VPN firewall rule to allow IPsec traffic UDP 500, UDP 4500, ESP 50 if needed
Ensure existing LAN-to-LAN traffic is permitted across the VPN
If using NAT, ensure NAT exemptions for traffic between Site A and Site B

Step-by-step: Verify connectivity

From a host on Site A 192.168.1.x, ping a host on Site B 192.168.2.x.
Check VPN status: EdgeOS logs or VPN status page should show Tunnel up.
Use traceroute/tracert to confirm traffic path goes through the VPN.

Site B mirror

Repeat the same steps with Site B pointing to Site A, swapping subnets:

Local Subnets: 192.168.2.0/24
Remote Subnets: 192.168.1.0/24
Local WAN Address: Site B public IP
Remote Peer: Site A public IP

Tips for a smoother setup

Use a fixed, strong pre-shared key PSK and rotate it periodically.
Prefer matching encryption/authentication settings on both sides.
If you have dynamic IPs, consider a DDNS service and configure a dynamic update on both EdgeRouters.
Keep firmware up to date to patch security fixes and improve VPN stability.
If you experience flaky tunnels, try disabling aggressive NAT traversal NAT-T or adjusting MTU/MSS values.

Troubleshooting common issues

VPN tunnel shows “down” or “init” forever:
- Double-check that the remote IP, PSK, and phase 1/2 proposals match on both sides.
- Ensure public IPs are reachable from each site ping the remote public IP.
- Confirm firewall allows VPN traffic on both sides UDP 500/4500, ESP.
Traffic not reaching the remote network:
- Verify static routes on both sides point to the VPN interface for the remote subnet.
- Check NAT exemptions so traffic between subnets isn’t NATed unnecessarily.
Intermittent connectivity:
- Investigate MTU issues; try lowering MTU on the VPN interface or enabling Fragmentation.
- Check for ISP-blocked IPsec ports or carrier-grade NAT issues if dynamic IPs are used.

Security considerations

Use strong, unique PSKs and rotate them on a schedule.
Disable unnecessary services on EdgeRouter interfaces exposed to the internet.
Regularly review firewall rules and VPN logs for unusual activity.
Consider enabling logging and alerting for VPN tunnel status changes.

Performance considerations

VPN throughput depends on CPU, encryption, and tunnel count.
If you need higher throughput, consider EdgeRouter models with better crypto performance.
For busy sites, monitor CPU load during peak times to avoid dropped VPN packets.

Real-world use cases and examples

Small business with a remote office and a main office needing secure file sharing and printer access.
Managed service providers linking customer networks to a central hub.
Home labs linking multiple home networks for collaborative projects.

Advanced topics quick overview

Dynamic IPs: Use DDNS and a script to update peers when IPs change.
Multiple tunnels: Create more than one IPsec tunnel for redundancy or for load balancing across ISPs.
VPN with VLANs: Extend VLANs across sites to keep segmentation while enabling cross-site access.
Remote access vs site-to-site: Distinguish between clients connecting remotely and two networks connecting via IPsec.

Performance tips and best practices

Use dedicated hardware or a dedicated EdgeRouter for VPN-heavy setups to avoid contention with other services.
Regularly back up EdgeRouter configurations so you can recover quickly after a misconfiguration or hardware failure.
Enable logging for VPN events, but don’t overdo it; set reasonable log retention to avoid filling the device storage.

Step-by-step quick reference checklist

Define subnets and ensure non-overlap
Gather public IPs for both sites
Choose IPsec with AES-256 and SHA-256
Create IPsec tunnel on Site A and Site B
Add static routes for remote subnets
Configure firewall rules to allow VPN traffic
Test connectivity and monitor VPN status
Implement security and maintenance routines

FAQ Section

How do I know if the EdgeRouter VPN tunnel is up?

You can check the EdgeRouter status page under VPN or EdgeOS CLI with commands like show vpn ipsec sa or similar. Look for a “up” or established state and successful data flow in logs. Turn off vpn chrome: how to disable VPN extensions, disconnect system VPNs, and troubleshoot for safe browsing 2026

Can I use dynamic IP addresses for the sites?

Yes, but you’ll want to configure a dynamic DNS service on both ends and ensure the peers are updated when IPs change. You may also implement a monitoring script to trigger tunnel reset on IP changes.

What if my subnets overlap?

You’ll need to readdress one side’s network to non-overlapping subnets, or use NAT exemptions to isolate traffic. Overlapping subnets commonly cause routing conflicts.

Which EdgeRouter models are best for site-to-site VPN?

Most EdgeRouter models handle IPsec well for small to medium loads ER-X, ER-LITE, ER-4, ER-6, etc.. Check the device’s CPU and VPN throughput specs to match your needs.

How do I add a second site for redundancy?

Create a second IPsec tunnel with a different remote peer and, if possible, a second path e.g., different ISP. Ensure failover logic is in place so traffic moves to the backup tunnel when the primary goes down.

How can I secure VPN traffic besides strong PSKs?

Enable firewall rules, enable IPS/IDS features if available, keep firmware updated, disable unused services, and monitor log alerts for anomalies. Super vpn edge: comprehensive review, features, speeds, pricing, setup, and real-world use cases 2026

What are common causes of VPN instability?

Mismatched phase 1/2 proposals, PSK mismatch, firewall blocking, MTU issues, or dynamic IP changes without proper updates.

Is NAT required for site-to-site VPN?

NAT is not always required. If both networks are private and you want devices to talk directly, you can bypass NAT for VPN traffic. If you must NAT, set up proper exemptions.

How do I test performance after setup?

Run speed tests between devices across sites, ping latency measurements, and monitor VPN throughput under load. Compare before/after to gauge impact.

Can I manage multiple sites from a single EdgeRouter?

Yes, you can configure multiple IPsec tunnels to different remote sites, create routing rules for each, and monitor each tunnel’s status separately.

Ubiquiti edgerouter site to site vpn: setup, troubleshooting, and best practices for IPsec tunnels between EdgeRouter devices

Ubiquiti edgerouter site to site vpn is a secure connection that links two or more networks over the Internet using IPsec tunnels on EdgeRouter devices. In this guide, you’ll learn how to plan, configure, test, and optimize a site-to-site VPN with EdgeRouter hardware, plus common gotchas and real-world tips to keep things running smoothly. This is a practical, hands-on walkthrough that covers both UI-based and command-line approaches, plus troubleshooting and security considerations. Open vpn edge deployment guide for secure remote access, edge servers, and privacy best practices 2026

What you’ll learn in this guide:
- How IPsec site-to-site VPNs work on EdgeRouter
- Prerequisites and planning for two-site or hub-and-spoke topologies
- Step-by-step setup using the EdgeRouter web UI
- Step-by-step setup using the EdgeOS CLI when you prefer command-line
- How to verify a tunnel is up and routing traffic correctly
- Common issues and practical troubleshooting steps
- Security best practices, including PSKs, IKE groups, and firewall rules
- Performance considerations and scaling tips
- Real-world caveats and maintenance tips

Useful URLs and Resources text only, not clickable

Ubiquiti official EdgeRouter documentation – ubnt.com
EdgeRouter IPsec site-to-site guide – help.ubnt.com
Ubiquiti Community forums – community.ui.com
NordVPN official site – nordvpn.com
NordVPN deal page affiliate – dpbolvw.net/click-101152913-13795051?sid=070326

If you’re looking for extra protection for endpoints while your site-to-site VPN keeps the two networks connected, you can consider a personal VPN service. This is especially useful for remote workers or temporary access to the main office network. For readers who want a good deal, this NordVPN option is worth a look— affiliate link via the banner image above.

What is Ubiquiti EdgeRouter site-to-site VPN?

EdgeRouter devices support IPsec site-to-site VPNs that allow two networks to exchange traffic securely over the Internet. This is different from remote-access VPNs, which connect individual devices. site-to-site creates a dedicated tunnel between routers so entire subnets can communicate as if they were on the same local network. Key concepts include:

Local subnet: the network behind your EdgeRouter that will be reachable through the VPN
Remote subnet: the network behind the peer EdgeRouter
Pre-shared key PSK: a shared secret used for authenticating the VPN peers
IKE and ESP: the cryptographic suites that govern how the tunnel is established and how data is encrypted
NAT-T NAT Traversal: helps IPsec work when either side sits behind a NAT

Common topologies:

Hub-and-spoke: a central site connects to multiple remote sites through separate tunnels
Full mesh: each site connects to every other site used in smaller networks but can get complex

EdgeRouter’s IPsec implementation is tightly integrated with EdgeOS, so you can configure the tunnels via the web UI or via the CLI. In practice, most networks start with a simple two-site tunnel and then expand to more sites or add redundancy with multiple tunnels. Nord vpn für edge: NordVPN on Microsoft Edge guide for setup, features, performance, and security 2026

Prerequisites and planning

Before you configure anything, collect and confirm:

Public IPs of both sites static is ideal. dynamic IPs can work with dynamic DNS, but it adds management overhead
Local subnets at each site e.g., Site A: 192.168.10.0/24, Site B: 192.168.20.0/24
Desired remote subnets to reach across the VPN
A secure pre-shared key PSK for IPsec authentication
EdgeRouter devices with current firmware EdgeOS
Firewall rules that allow IPsec traffic UDP 500/4500 and ESP protocol 50 typically
A plan for static routes so traffic destined for the remote subnet actually uses the VPN tunnel

Security tip: keep the PSK long and unique, rotate it periodically, and restrict access to the EdgeRouter admin interfaces.

When you’re ready, you can start with a two-site example and then scale up. If you’re looking for extra protection for endpoints outside the VPN, you might pair this with a personal VPN for individual devices, which is where the NordVPN deal in the introduction can come into play.

Step-by-step setup: EdgeRouter UI web UI

This approach is easiest if you’re more comfortable with point-and-click configuration.

Open the EdgeRouter web UI
Go to the VPN tab, then select IPsec, and choose Site-to-Site

Add a new peer the remote site

Remote peer IP: the public IP address of the other site
Authentication: set to Pre-Shared Secret
PSK: enter the shared secret you generated
Local subnet: the LAN behind your EdgeRouter e.g., 192.168.10.0/24
Remote subnet: the LAN behind the peer e.g., 192.168.20.0/24
IKE group / ESP / encryption settings: pick a pair that both sites support common choices include AES-256 for encryption and SHA-256 for integrity
Enable the tunnel

Define the tunnel specifics

Local and remote subnets are defined as part of the tunnel configuration
Attach the tunnel to an IPsec interface if the UI requires it some versions expose a separate “tunnel” or “connection” object

Firewall rules

Ensure you allow VPN traffic on the EdgeRouter’s WAN interface and any NAT or firewall zones
Create rules to allow traffic from the local subnet to the remote subnet via the VPN interface
If you’re using NAT between subnets, disable NAT for VPN traffic on the relevant rules

Static routes

Add static routes on each site so traffic for the remote subnet uses the IPsec VPN as the next hop
In many setups, the VPN tunnel itself creates the route, but you may still need to add a static route for the remote subnet if it isn’t automatically learned

Test the tunnel

From a host in Site A, ping a host in Site B workstation in 192.168.20.10, for example
Check VPN status in the UI: look for “up” or a green light on the tunnel
Verify the peer is reachable and that traffic is traversing the tunnel you can check on the EdgeRouter’s status page or firewall logs

Monitoring and adjustments

Monitor tunnel uptime and traffic via the EdgeRouter dashboards
If you see dropped packets or a flapping tunnel, adjust IKE/ESP proposals or enable dead-peer detection if supported

Step-by-step setup: EdgeOS CLI command line

If you prefer the command line, here’s a general outline you can adapt to your version of EdgeOS. Exact syntax can vary by firmware, so refer to the latest EdgeRouter documentation for exact commands. Nordvpn edgerouter 2026

Define IKE and ESP settings

Create an IKE group and ESP phase 2 settings that match the remote site’s configuration

Add a site-to-site peer

Configure the remote peer IP, PSK, and tunnel properties local-subnet and remote-subnet. Tie the tunnel to a specific ESP group and IKE group.

Attach the tunnel to the interface

Ensure the VPN interface is associated with your WAN interface to carry IPsec traffic

Configure static routes

Add a route for the remote subnet via the VPN tunnel interface

Save and apply

Write the changes and apply the configuration
Confirm that the tunnel shows as up and that traffic routes correctly

Notes:

In EdgeOS CLI, you’ll often see commands like set vpn ipsec site-to-site peer … and set vpn ipsec ipsec-interfaces interface eth0, followed by tunnel and local/remote subnet definitions.
If you’re using dynamic IPs on either side, you’ll want to plan for dynamic DNS or a fallback mechanism to re-establish the tunnel when IPs change.

Verification: how to confirm the VPN is working

Use the EdgeRouter status page to verify tunnel state up/down
Ping tests across subnets Site A 192.168.10.10 -> Site B 192.168.20.10
Check firewall logs for dropped VPN traffic or blocked subnets, and adjust rules accordingly
Confirm that routes show the remote subnet as reachable through the VPN interface
If the tunnel doesn’t come up, review:
- PSK mismatch
- Mismatched local/remote subnets
- Incompatible IKE/ESP proposals
- NAT-T issues ensure NAT traversal is enabled if either side is behind NAT

Common issues and troubleshooting tips

PSK mismatch: Double-check the pre-shared key on both sides. Even a single character mismatch will prevent the tunnel from establishing.
Subnet overlap: Ensure the two networks don’t overlap or conflict. Overlapping subnets cause traffic to be misrouted or dropped.
Firewall rules: Make sure the firewall allows IPsec traffic and the VPN tunnel’s traffic. It’s common to block the ESP protocol if you don’t have explicit rules.
NAT complications: If one side sits behind a NAT, verify NAT-T is enabled and that external ports 500/4500 are allowed through firewalls to reach the EdgeRouter.
Mismatched IKE/ESP proposals: Align encryption, integrity, and DH group settings on both sides.
Dynamic IPs: If either site has a dynamic public IP, you’ll need a solution like dynamic DNS and a mechanism to detect IP changes and re-establish the tunnel.
Routing problems: If you can ping the gateway but not the remote subnets, add or adjust static routes so traffic for the remote subnet uses the VPN and not the default gateway.

Security considerations and best practices

Use strong PSKs and rotate them periodically. Store them securely.
Keep EdgeRouter firmware up to date to benefit from security patches and improved VPN handling.
Limit VPN exposure: only allow IPsec traffic from known remote IPs and restrict what remote subnets can access in your firewall rules.
Consider monitoring VPN health with alerting for tunnel down events, high packet loss, or unusual traffic patterns.
For small businesses with sensitive data, pair IPsec site-to-site VPN with additional measures like endpoint protection and regular security audits.

Performance and scaling

Throughput depends on model, CPU, and encryption settings. EdgeRouter devices typically handle typical small-to-medium site-to-site VPNs well, but performance will drop if you enable heavy encryption or route large amounts of traffic through the tunnel.
If you need higher performance, consider models with more CPU power or even a dedicated VPN appliance for critical sites.
For hub-and-spoke designs, plan capacity for the sum of all tunnels exiting a central site, especially if multiple remote sites simultaneously use the VPN.

Real-world tips and examples

Start with a simple two-site tunnel to validate the setup, then gradually add more sites or spokes.
Use clearly named subnets and document which EdgeRouter interface is handling which tunnel to avoid misconfigurations when you scale.
Periodically test failover and re-keying to ensure resilience in the event of a PSK compromise or device failure.
If IPv6 is in use, verify that IPv6 traffic can traverse the VPN if required, and ensure firewall rules cover IPv6 as well as IPv4.

Use cases and deployment patterns

Office-to-office connectivity: two or more offices can share resources securely without exposing subnets to the Internet.
Remote workforce access to central resources: a site-to-site VPN can complement remote-access solutions, enabling secure site connectivity while allowing remote users to connect to central services through the VPN.
Branch office expansion: scale by adding new site-to-site tunnels as you open new locations, maintaining consistent security policies across sites.

Additional resources and reading

Official EdgeRouter IPsec site-to-site guides and FAQs
Community-driven troubleshooting threads and best-practice discussions
General IPsec concepts and VPN design patterns for small businesses

Frequently Asked Questions

What exactly is a site-to-site VPN on Ubiquiti EdgeRouter?

A site-to-site VPN on EdgeRouter creates a secure tunnel between two networks over the Internet, letting devices on each network communicate as if they were on the same LAN. It uses IPsec to encrypt traffic and can be set up with a pair of EdgeRouters or EdgeRouter and another VPN-capable device.

Do I need a static IP on both ends to use IPsec site-to-site VPN?

Static IPs simplify setup because peers can reliably connect to each other. Dynamic IPs can work with dynamic DNS and frequent tunnel maintenance, but it adds complexity and the potential for intermittent connections.

Which EdgeRouter models support IPsec site-to-site VPN?

Most EdgeRouter models with EdgeOS including EdgeRouter X, X SFP, 4/6/8/16-series support IPsec site-to-site VPN. Always check the latest release notes for any model-specific limitations.

What VPN protocols are used in EdgeRouter site-to-site VPN?

IPsec is the core protocol, using IKE for tunnel establishment IKEv1 or IKEv2 depending on the firmware and ESP for encryption. NAT-T is commonly used when one side is behind NAT. K e electric locations 2026

How do I verify that my VPN tunnel is up?

Check the EdgeRouter’s VPN/IPsec status page for tunnel health, look for an “up” status, and test end-to-end by pinging a host on the remote network. Logging and firewall rules can help diagnose issues.

How can I troubleshoot a tunnel that won’t come up?

Confirm PSK matches at both ends, verify local/remote subnet definitions, ensure firewall rules allow VPN traffic, check for misconfigured IKE/ESP proposals, and verify NAT-T if NAT is involved. Review system logs for IPsec negotiation errors.

Should I use UI or CLI to configure EdgeRouter IPsec?

Both work well. The UI is typically faster for straightforward two-site setups, while the CLI provides precision and repeatability for complex topologies or automated deployments.

Can I have more than one site-to-site VPN tunnel on EdgeRouter?

Yes. You can configure multiple tunnels to different remote sites or create a hub-and-spoke layout with multiple point-to-point tunnels. Plan your subnets and routing to avoid conflicts and ensure performance.

How do I handle routing for the remote subnet?

Add static routes on each site so traffic destined for remote subnets uses the VPN tunnel as the next hop. In many cases, the VPN setup creates required routes automatically, but manual routing ensures reliability. Is edge vpn safe for privacy, security, and performance in edge computing and enterprise deployments 2026

What about VPN performance and encryption options?

Performance depends on your hardware and the chosen encryption methods. AES-256 with SHA-256 is common, but you can adjust to balance security and speed. If you need higher throughput, consider stronger hardware or optimizing tunnel settings.

Can I combine EdgeRouter IPsec with a personal VPN service?

You can run a personal VPN on endpoints or devices alongside the site-to-site VPN for additional protection, especially for remote workers. Use caution to avoid double-NAT or routing conflicts, and test the setup for conflicts.

Are there best practices for securing EdgeRouter VPNs?

Yes. Use strong PSKs, keep firmware updated, limit admin access, segment firewall rules to allow only necessary traffic, monitor tunnel health, and rotate credentials periodically. Document topology for easier audits and changes.

How do I recover if a site goes offline and I can’t reach the remote site?

Check physical connectivity, verify Internet access at both sites, re-establish the tunnel by reloading IPsec services, verify PSKs, and review logs. Having a backup plan for routing and access can help minimize downtime.

Is there a difference between policy-based and route-based VPN on EdgeRouter?

IPsec VPNs on EdgeRouter are typically configured with policy-based methods focusing on specific subnets. Route-based VPNs are common in other platforms, but EdgeRouter relies on tunnel definitions, local/remote subnets, and static routes to steer traffic. Is edge vpn secure: edge vpn security, privacy, performance, and practical tips for 2026

Can I monitor VPN health automatically?

Yes. Use EdgeRouter’s built-in monitoring dashboards, enable IPsec statistics, and set up alerts if a tunnel drops or packet loss exceeds a threshold. External monitoring tools can integrate via SNMP or API hooks if available.

When should I consider upgrading firmware?

If you notice bugs, new features, or improved security for IPsec handling, upgrading firmware is a good idea. Always back up your configuration before a firmware upgrade and review release notes for VPN-related changes.