Ubiquiti edgerouter x vpn site to site: comprehensive guide to configuring IPsec site-to-site VPN on EdgeRouter X for home and small business

Yes, Ubiquiti edgerouter x vpn site to site is possible. In this guide, you’ll learn how to set up a solid IPsec site-to-site VPN between two EdgeRouter X devices, including GUI and CLI steps, best practices, common pitfalls, and realistic expectations for throughput and reliability. We’ll cover why you’d want a site-to-site VPN, what to configure on each end, how to test the tunnel, and how to keep everything secure over time. If you prefer a quick setup with an extra layer of protection for remote access, you’ll also find a quick note on pairing EdgeRouter VPNs with a trusted consumer VPN like NordVPN, which you can check out using this deal image:

What you’ll get in this guide

• A complete end-to-end workflow to configure IPsec site-to-site VPN on EdgeRouter X
• GUI-based and CLI-based setup so you can choose what you’re comfortable with
• How to plan networks, choose encryption settings, and avoid common mistakes
• How to test the tunnel, verify traffic, and troubleshoot issues
• Practical tips for security, routing, and long-term maintenance
• A handy FAQ with at least 10 questions to cover common scenarios

Introduction: what is a site-to-site VPN and why EdgeRouter X?
A site-to-site VPN creates an encrypted tunnel between two on-prem networks, letting devices reach resources on the other side as if they were local to your network. On EdgeRouter X, you’ll typically use IPsec for a secure, standards-based tunnel that works across the internet. Why EdgeRouter X for this? It’s a budget-friendly, capable router that supports robust IPsec configurations, a flexible EdgeOS interface, and the ability to handle small office or home office SOHO VPN needs without buying an enterprise-grade appliance.

This guide assumes you have two EdgeRouter X devices one at each site, each with a public IP address or a dynamic DNS setup, and two private LANs you want to connect. If one side has a dynamic IP, you’ll want to pair this with a dynamic DNS service so the tunnel can re-establish when the IP changes. The goal is a stable tunnel that routes traffic between the two subnets without NAT getting in the way.

Notes on security and performance

• IPsec AES-256 with SHA-256 is a strong, widely supported baseline. If your devices support it, you can also explore AES-128 for speed, but AES-256 is the common default for site-to-site VPNs.
• Use a strong pre-shared key PSK and rotate it periodically.
• If you’re using dynamic IPs, enable a reliable dynamic DNS provider and configure a keep-alive or rekey policy so the tunnel reestablishes automatically.
• Throughput depends on your Internet connection and the EdgeRouter X’s CPU. Expect solid performance for typical home or small office uses, but don’t expect multi-gigabit VPN throughput unless you’re on a higher-end device with a faster CPU.

Prerequisites and planning

• EdgeRouter X devices with EdgeOS firmware up to date.
• Two networks you want to connect, e.g., Site A: 192.168.1.0/24 and Site B: 192.168.2.0/24.
• Public IP addresses for both sites or dynamic IP with a dynamic DNS setup.
• A strong pre-shared key for IPsec at both ends.
• Access to the EdgeRouter X GUI https:// or SSH/CLI access for advanced configuration.
• Optional: a static route plan or routing protocol OSPF/BGP if you have more complex routing needs.

In this guide, we’ll walk you through both GUI and CLI methods, plus how to verify that the tunnel is up and traffic is flowing correctly.

Step-by-step: GUI setup for EdgeRouter X

1. Prepare the networks

• Site A LAN: 192.168.1.0/24
• Site B LAN: 192.168.2.0/24
• Decide which side will own the “local” subnets in the IPsec terms and which will be the “remote” subnets. You’ll enter these during the VPN setup.

2. Access the EdgeRouter X UI

• Open a browser and go to https://.
• Log in with admin credentials.

3. Create the IPsec site-to-site tunnel Site A perspective

• Navigate to VPN > IPsec.
• Create a new IPsec tunnel Site-to-Site Peer.
• Peer IP: enter the remote site’s public IP address or dynamic DNS hostname if you’re using dynamic IPs.
• Local IP: use your site’s public IP or interface that’s facing the Internet.
• Authentication: Pre-Shared Key enter the PSK you chose on Site B as well.
• Local Subnet: 192.168.1.0/24
• Remote Subnet: 192.168.2.0/24
• IKE Phase 1 settings: set encryption to AES-256, hash to SHA-256, DH group to 14 2048-bit as a strong default.
• IPsec Phase 2 settings: set encryption to AES-256, hash to SHA-256, PFS to on, group to 14 if your UI exposes this option.
• Save and Apply.

4. Create the IPsec site-to-site tunnel Site B perspective

• Repeat the same steps from Site B’s EdgeRouter X UI, swapping the Local Subnet and Remote Subnet:
  • Local Subnet: 192.168.2.0/24
  • Remote Subnet: 192.168.1.0/24
• Ensure the PSK matches exactly between the two sides.

5. Adjust firewall rules to allow IPsec traffic

• Ensure that IPsec ESP, ISAKMP, and UDP 500/4500 for NAT-T is allowed through the firewall on both routers.
• If you’re using EdgeRouter’s default firewall zones, add the necessary rules to permit IPsec traffic between WAN and VPN interfaces.
• Common rule: ACCEPT for ipsec-related traffic between wan_zone and vpn_zone.

6. Exclude VPN subnets from NAT if you NAT at the edge

• In many EdgeRouter setups, you NAT traffic going out to the Internet. For site-to-site traffic, you don’t want NAT transforming the IPsec traffic between the tunnels.
• Create a NAT exclusion or firewall-based NAT exemption for traffic between 192.168.1.0/24 and 192.168.2.0/24 across the tunnel interface.
• If your EdgeRouter UI uses NAT rules, add a rule to skip NAT for traffic on the IPsec tunnel tun0 or ipsec0 or for those source/destination subnets. The goal is to avoid double NAT on traffic between sites.

7. Routing: ensure remote networks are reachable

• If you’re using static routes, add routes so that devices on Site A can reach 192.168.2.0/24 via the IPsec tunnel, and vice versa.
• If you’re using a routing protocol OSPF/BGP or dynamic routing, enable it on both sides to propagate the routes automatically.

8. Test the tunnel

• On Site A, attempt to ping a device on Site B e.g., 192.168.2.10.
• Check the EdgeRouter IPsec status page to confirm the tunnel is up Phase 1 and Phase 2 status should show established.
• If you don’t see the tunnel come up, re-check:
  • PSK mismatch
  • Subnet definitions local vs remote
  • Firewall rules allowing IPsec
  • NAT exemptions
  • That both peers can reach each other’s public IPs

9. Advanced tips for stability

• Enable DPD/Keepalive: configure dead peer detection so the tunnel drops and re-establishes gracefully if a peer becomes unreachable.
• Use a well-known IKE in both directions: ensure both sides agree on IKE version and could be IKEv1 or IKEv2 depending on devices.
• Consider a backup tunnel: some setups use a second peer with a different path to improve reliability.

Step-by-step: CLI setup for advanced users
If you prefer the CLI, you’ll typically use EdgeOS commands to define IKE and IPsec proposals, peers, and tunnels. Here’s a high-level outline adapt to your exact EdgeOS version:

1. Define IKE and ESP proposals

• Create an IKE group with AES-256, SHA-256, and DH Group 14
• Create an ESP group with AES-256 and SHA-256

2. Define the IPsec site-to-site peer

• Set the local and remote subnets
• Set the pre-shared key
• Bind the peer to the tunnel interface

3. Enable the tunnel and apply
4. Add static routes for remote subnet if not using dynamic routing
5. Ensure NAT exemptions for traffic between the two sites

What to do if you have a dynamic IP on one or both sides

• Use a dynamic DNS DDNS service to provide a stable hostname for your changing IP.
• In the IPsec peer settings, use the DDNS hostname as the remote IP.
• Ensure the tunnel rekey and keepalives are configured so it can reestablish automatically when the IP changes.

Troubleshooting common issues

• Mismatched PSK or subnets: This is the most common reason for a tunnel not forming. Double-check the pre-shared key on both ends and ensure that the Local Subnet and Remote Subnet definitions are correct.
• Firewall blocks: Ensure UDP 500, UDP 4500 NAT-T if you’re behind NAT, and ESP/ISAKMP are allowed through the firewall on both sides.
• NAT traversal problems: If NAT-T isn’t negotiating correctly, ensure both ends support NAT-T and that NAT is not altering the IPsec traffic in unexpected ways.
• Routing issues: If you can establish the tunnel but can’t reach devices on the remote side, verify static routes or your routing protocol configuration. Without routes, traffic may never be sent to the tunnel.
• DPS/keepalive: If the tunnel flaps, enable dead peer detection and adjust rekey intervals to suit your connection stability.
• Dynamic IP edge cases: If the remote site’s IP changes frequently, rely on a DDNS name, and verify that the EdgeRouter is configured to reconnect automatically when DNS resolves to a new IP.

Security considerations and best practices

• Use strong encryption settings and rotate PSKs periodically.
• Keep EdgeOS firmware up to date to reduce exposure to vulnerabilities.
• Separate your VPN traffic from general WAN traffic with clear firewall rules.
• Monitor VPN logs for unusual activity and set up alerting if your EdgeRouter supports it.
• Consider using a secondary security solution for remote access e.g., MFA on remote management or a separate VPN for management to limit exposure if a device is compromised.

Real-world scenario: home office with two sites

• Site A remote office LAN: 192.168.10.0/24
• Site B home office LAN: 192.168.20.0/24
• Public IPs: Site A uses a static public IP. Site B uses a dynamic IP with DDNS myhomeoffice.ddns.net
• VPN settings: AES-256, SHA-256, DH group 14. PSK: a strong, unique string
• Routing: static routes inform devices on either side how to reach the other side’s LAN
• Result: you can access file shares, printers, and internal web apps at either site as if they were on the same LAN, with encrypted traffic traversing the public internet

Performance expectations and real-world throughput

• EdgeRouter X is a budget router. In VPN scenarios, performance depends on the encryption settings, CPU load, and network traffic.
• Real-world VPN throughput on EdgeRouter X typically ranges from tens to a few hundred Mbps, depending on the chosen ciphers and the level of traffic. AES-256 with SHA-256 and a strong PSK will consume more CPU cycles than lighter settings.
• If you need higher throughput or more tunnel stability, consider upgrading to a more powerful device or enabling split-tunneling so only necessary traffic goes through the VPN to reduce load on the router.

Tips for maintenance and future-proofing

• Document every detail: on both ends, capture WAN IPs, remote LAN subnets, PSK, and IKE/ESP settings. This saves time if you need to reconfigure later.
• Schedule firmware checks and backups: keep a local backup of your EdgeRouter configuration and a plan for firmware updates.
• Consider a small SRE-style backup plan: if one site loses Internet, your VPN tunnel will fail. keep a contingency such as local copies of essential data or an alternative remote access method.
• Regularly test the tunnel: a quick monthly check ping across sites will catch potential issues before they disrupt operations.

Useful resources and references plain-text, unlinked

• EdgeRouter X official documentation and user guides
• EdgeOS CLI reference and examples
• Ubiquiti community forums and user-contributed configurations
• IPsec best practices for small offices and home offices
• Basic networking concepts: IP addressing, subnets, routing, NAT, and firewall rules
• Dynamic DNS providers and dynamic IP considerations

Frequently Asked Questions

How do I verify IPsec is up on EdgeRouter X?

Check the IPsec status in the EdgeRouter UI under VPN > IPsec. Look for Phase 1 and Phase 2 status showing as established. Logs can also reveal negotiation issues if something isn’t right.

What is IPsec site-to-site VPN?

IPsec site-to-site VPN creates an encrypted tunnel between two separate networks, allowing devices on one network to communicate with devices on the other as if they were on the same LAN, with traffic protected as it traverses the internet.

Can EdgeRouter X handle site-to-site VPN traffic well?

EdgeRouter X handles typical small office VPN needs, especially with reasonable LAN subnets. Throughput depends on your encryption settings and WAN bandwidth. Plan for tens to a few hundred Mbps in practical use, depending on your setup.

Should I use IKEv1 or IKEv2 for the tunnel?

IKEv2 is generally preferred for its stability and speed, but many EdgeRouter setups still use IKEv1. Ensure both sides support the same IKE version and configure the same proposals.

How do I choose encryption and hash settings?

AES-256 with SHA-256 is a solid default. You can adjust to AES-128 for slightly better throughput if security requirements permit, but AES-256 is the common baseline for robust protection. Edge vpn for laptop

Do I need to disable NAT between sites?

Typically yes. You want to avoid NAT transforming traffic between your two internal subnets across the VPN. Create NAT exemptions or adjust firewall rules so that traffic between 192.168.1.0/24 and 192.168.2.0/24 or your chosen subnets goes through the tunnel unmodified.

How can I use dynamic IPs on one or both sides?

Use a dynamic DNS service to provide a stable hostname for the changing IP address. In IPsec settings, reference the DDNS hostname instead of a fixed IP, and ensure the tunnel can re-establish if the IP changes.

What if the tunnel doesn’t come up?

Double-check:

• PSK matches exactly on both sides
• Local/Remote subnets are correctly defined
• IPsec firewall rules allow necessary traffic
• NAT exemptions for the VPN traffic are in place
• If one side uses dynamic DNS, verify that DNS resolves to current IP

How can I test the VPN after setup?

From Site A, ping a known host on Site B and vice versa. Use traceroute to verify the path is via the VPN tunnel. Check IPsec status and logs for any negotiation errors.

Can I run additional routing protocols over the VPN?

Yes. If your network is complex, you can enable OSPF or BGP between sites to automatically learn routes. Otherwise static routes are perfectly fine for small setups. Unifi edgerouter-x vpn: Complete Guide to UniFi EdgeRouter X VPN Setup, Configuration, Security, and Performance

If you want to add a consumer VPN alongside your site-to-site IPsec for remote access, you can use NordVPN, especially when you’re on the road or want a separate layer of protection. See the introduction for the NordVPN banner and ensure the link remains accessible as you explore privacy and security options.

微博更改ip属地完整指南：通过VPN实现地区切换、隐私保护与合规使用