Edgerouter vpn site to site: complete setup guide, best practices, and troubleshooting for IPsec Site-to-Site on EdgeOS

Edgerouter vpn site to site is a method to securely connect two separate networks over the internet using IPsec on EdgeRouter devices. In this guide, you’ll get a practical, down-to-earth walkthrough covering planning, configuration GUI and CLI, verification, and real-world tips to keep your tunnels reliable. If you want extra protection during setup, consider NordVPN for additional layers of security—. Whether you’re linking a small branch office to your data center or connecting two remote sites, this post breaks down the process step by step and shares relatable troubleshooting tips. Useful resources are listed at the end of this introduction in plain text for quick reference.

Useful URLs and Resources:
EdgeRouter documentation – docs.ubiquiti.com
EdgeOS IPsec site-to-site guide – help.ubiquiti.com
IPsec overview – en.wikipedia.org/wiki/IPsec
IKE and IPsec concepts – en.wikipedia.org/wiki/Internet_Key_Exchange
NAT traversal basics – en.wikipedia.org/wiki/Network_Address_Translation
EdgeRouter community discussions – reddit.com/r/Ubiquiti
Official EdgeRouter firmware notes – help.ubiquiti.com
Open-source VPN concepts – openvpn.net

Body

Table of Contents

Understanding Edgerouter Site-to-Site VPN anatomy

A site-to-site VPN on an EdgeRouter uses IPsec to create a secure tunnel between two networks over the public internet. Think of it as a private highway that connects two private networks without exposing traffic to the outside world. The core pieces you’ll configure are:

The peers: two endpoints, each with a public IP static or dynamic with DDNS and the local networks behind them.
Phase 1 IKE settings: authentication method, encryption, and key exchange parameters for establishing the tunnel.
Phase 2 IPsec settings: how the tunnel’s data will be protected, including encryption and hashing algorithms and PFS perfect forward secrecy settings.
Traffic selectors: the local and remote subnets that will ride the tunnel.
Firewall and NAT rules: to allow ESP/IKE traffic and to avoid double NAT on the protected subnets.

Key data you’ll need before you start:

Public IP addresses of both sites or dynamic DNS names if you don’t have static IPs.
Local network LAN and remote network subnets.
A pre-shared key PSK or, ideally, certificate-based authentication if you’re scaling up.
Any intermediate devices or firewalls that sit between your EdgeRouter and the internet so you can allow IKE, ESP, and NAT-T traffic.

The value of site-to-site VPN grows as businesses expand, with more teams collaborating remotely and more devices touching corporate networks. A practical approach is to start with a single tunnel, verify connectivity, and then scale to multiple tunnels or redundancy dual WAN, backup peers, etc.. Industry trends show VPN usage remains a cornerstone of remote connectivity and internal network segmentation, with IPsec remaining the most widely deployed standard for site-to-site deployments.

Prerequisites and planning for Edgerouter site-to-site VPN

Before you flip the switch, take a few minutes to map out your topology and ensure you have:

EdgeRouter running EdgeOS with a supported firmware version.
Publicly reachable IP addresses for both ends or a dynamic DNS setup if IPs change.
Diagram or note of LAN subnets at both sites, for example:
- Site A: 192.168.1.0/24
- Site B: 10.0.0.0/24
A chosen IPsec policy that both sides can agree on AES-256, SHA-256, DH group 14, lifetime 3600 seconds is a common, solid starting point.
Firewall rules that permit the VPN traffic IKE UDP port 500, NAT-T UDP port 4500, and ESP if needed.

If you’re new to-IPsec, I recommend starting with a simple, symmetric setup same IKE group, same ESP group and then tuning for performance and compatibility. Also consider whether you want to use a dynamic IP approach on the remote end. some setups use a DDNS hostname on the remote peer to handle IP changes automatically. F5 vpn client version

Choosing between GUI EdgeOS and CLI for EdgeRouter

EdgeRouter supports two primary ways to configure IPsec site-to-site:

Graphical User Interface GUI/EdgeOS Web UI: Quick, visual, great for smaller deployments or single tunnels. It’s usually faster to get a tunnel up for a first-time setup.
Command-Line Interface CLI: More precise control, repeatable configurations, and better for automation or scripting, especially when you’re deploying multiple tunnels or documenting change history.

I’ll cover both paths so you can pick what fits your workflow best.

Step-by-step setup: EdgeRouter GUI EdgeOS Web UI

Follow these steps to configure a site-to-site IPsec VPN using the EdgeOS GUI. Adjust values to your own networks and peers.

Basic network plan

Confirm both sites’ LAN subnets and the public IPs or DDNS names.
Decide which interface will carry the WAN traffic usually eth0 or eth2 on EdgeRouter.

Create a new VPN: IPsec

Navigate to the VPN or IPsec section in EdgeRouter’s GUI.
Create a new site-to-site peer entry.
Peer address: enter the remote site’s public IP or hostname.
Local network: specify the local LAN you’re protecting e.g., 192.168.1.0/24.
Remote network: specify the remote LAN e.g., 10.0.0.0/24.
Authentication: set the pre-shared secret PSK or certificate if you’re using cert-based auth.
IKE Phase 1 settings: choose a robust IKE group for example, IKE 2 with AES-256 and SHA-256 and a reasonable lifetime e.g., 3600 seconds.
IPsec Phase 2 settings: select ESP encryption AES-256 and integrity SHA-256. enable PFS and select a DH group e.g., 14 consistent with your peer.
Local and remote IDs if applicable: some setups require specifying identifiers to prevent man-in-the-middle issues.
Save and apply.

Define firewall and NAT behavior

Add a firewall rule to allow IKE UDP 500, NAT-T UDP 4500, and ESP. If you’re behind NAT, you’ll need to ensure NAT traversal is enabled.
Create a NAT exemption rule so traffic destined for the remote LAN doesn’t get NATed on either side this preserves end-to-end IPs across the tunnel.

Test and verify

At the remote site, ensure its tunnel is configured similarly.
On EdgeRouter, verify the tunnel status in the VPN/IPsec section.
You should see an “ESTABLISHED” or similar state for the Phase 1 and Phase 2 tunnels.
Send test traffic e.g., ping from Site A to a host on Site B and check for successful latency and packet loss.

Troubleshooting tips in GUI

If the tunnel doesn’t come up, re-check PSK on both sides, confirm networks match local/remote subnets, and ensure both ends agree on the IKE and ESP proposals.
Verify firewall rules permit ESP and IKE traffic on both ends.
Check for NAT issues if one side is behind a strict NAT or firewall.

Step-by-step setup: EdgeRouter CLI EdgeOS – a precise, repeatable approach

For those who prefer the command line, here’s a conceptual outline you can adapt. Replace placeholders with your actual values.

Access the device

SSH into the EdgeRouter or use the local console.
Enter configuration mode:
configure

Define IKE Phase 1 settings

Example adapt to your policy:
set vpn ipsec ike-group IKE-1 proposal 1 encryption aes128
set vpn ipsec ike-group IKE-1 proposal 1 hash sha256
set vpn ipsec ike-group IKE-1 proposal 1 dh-group 14
set vpn ipsec ike-group IKE-1 lifetime 3600

Define IPsec Phase 2 settings

Example ESP Phase 2 group:
set vpn ipsec esp-group ESP-1 proposal 1 encryption aes256
set vpn ipsec esp-group ESP-1 proposal 1 hash sha256
set vpn ipsec esp-group ESP-1 pfs enable
set vpn ipsec esp-group ESP-1 lifetime 3600

Create the site-to-site peer

Replace with your remote peer IP and networks:
set vpn ipsec site-to-site peer 203.0.113.1 authentication mode pre-shared-secret
set vpn ipsec site-to-site peer 203.0.113.1 authentication pre-shared-secret ‘your-psk’
set vpn ipsec site-to-site peer 203.0.113.1 ike-group IKE-1
set vpn ipsec site-to-site peer 203.0.113.1 esp-group ESP-1
set vpn ipsec site-to-site peer 203.0.113.1 local-address YOUR_LOCAL_WAN_IP
set vpn ipsec site-to-site peer 203.0.113.1 tunnel 1 local-prefix 192.168.1.0/24
set vpn ipsec site-to-site peer 203.0.113.1 tunnel 1 remote-prefix 10.0.0.0/24

Ensure interfaces for VPN traffic

If your EdgeRouter uses a specific WAN interface, bind the VPN to that interface:
set vpn ipsec site-to-site peer 203.0.113.1 interface eth0

Firewall and NAT

Add rules to permit ESP, AH if needed, and IKE traffic on the WAN.
Add NAT exemptions for traffic between the local and remote networks:
set firewall name WAN_LOCAL rule 30 action accept
set firewall name WAN_LOCAL rule 30 protocol esp
set firewall name WAN_LOCAL rule 30 description “Allow IPsec ESP”
Create NAT exemption for the tunnel:
set nat rule 1000 match source address 192.168.1.0/24 destination address 10.0.0.0/24
set nat rule 1000 type disable-nat

Commit and save

exit
commit
save

Verify

Check the status:
show vpn ipsec sa
show vpn ipsec security-association
If down, review logs:
show log
show vpn sessiondb

Note: CLI syntax can vary slightly by EdgeOS version. If you’re deploying multiple tunnels or complex topologies, mirroring the exact settings on both ends is critical. Use the EdgeOS documentation as your reference point, and keep a configuration sheet for your peer devices. How to turn off vpn on edge

Security best practices for Edgerouter site-to-site VPN

Favor IKEv2 with AES-256 and SHA-256, and enable PFS Group 14 or higher. IKEv2 tends to be faster and more stable across fluctuating networks.
Use strong, unique PSKs or, better yet, certificate-based authentication if you scale beyond a simple two-site setup.
Limit tunnel exposure with precise firewall rules: only allow traffic between the defined subnets. avoid broad access across all networks.
Separate VPN subnets from your main LAN when possible to reduce the blast radius if a tunnel is compromised.
Regularly rotate keys and monitor tunnel health. Automated monitoring can alert you to stale SAs or dropped tunnels.
Keep EdgeRouter firmware up to date to benefit from security patches and improvements.
Plan for redundancy: if possible, implement a second tunnel using a different ISP or a different public IP to prevent a single point of failure.

Testing, monitoring, and troubleshooting tips

Always test from both sides: initiate traffic from Site A to a host on Site B, and vice versa.
Use ping and traceroute to verify connectivity and latency characteristics across the tunnel.
Check phase 1 and phase 2 statuses separately. a common issue is mismatched proposal settings between peers.
If the tunnel fails to establish, verify:
- PSK or certificate authentication matches on both ends
- Local and remote subnets are correctly defined and non-overlapping
- IKE and ESP proposals are identical on both sides
- Firewall rules on both ends permit IKE, NAT-T, and ESP
For EdgeRouter CLI, you can view live status with commands like:
- show vpn ipsec sa
- show vpn ipsec status
show log | include ipsec
If you’re behind a restrictive ISP or double NAT, consider enabling NAT-T NAT Traversal and ensure port forwarding doesn’t interfere with VPN traffic.

Common pitfalls and how to avoid them

Overlapping subnets: If you pick LAN subnets that overlap with the remote site’s subnets, the tunnel will fail to route traffic correctly. Always ensure non-overlapping ranges.
Dynamic IPs without DDNS: If the remote peer uses a dynamic IP, you must implement a reliable DDNS approach or a dynamic peer update mechanism on both ends.
Mismatched IKE/ESP proposals: Keep the exact encryption, hashing, and DH group values aligned at both ends. Small differences cause tunnel negotiation to fail.
NAT issues: If you don’t exempt the VPN traffic from NAT, traffic may not reach the other side as intended. Add precise NAT rules for the tunnel traffic.
Performance bottlenecks: If the EdgeRouter hardware is underpowered for your throughput needs, scale up hardware or tune encryption settings e.g., move from AES-128 to AES-256 only if necessary.

Performance considerations and optimization tips

Right-sized encryption: AES-256 provides strong security but can incur slightly higher CPU load than AES-128 on some devices. If both ends can tolerate it, you can start with AES-256 and test performance. if needed, you can step down to AES-128 while maintaining security.
Enable hardware acceleration if available on the EdgeRouter model to improve throughput for IPsec processing.
Balance tunnel count with hardware capabilities: more tunnels mean more CPU headroom is required, so plan capacity ahead of time.
Regularly review MTU settings to avoid fragmentation on IPsec tunnels, especially if you’re using VPNs for large files or multimedia traffic.

Frequently asked questions

What is Edgerouter vpn site to site?

Edgerouter vpn site to site is a method to securely connect two separate networks over the internet using IPsec on EdgeRouter devices.

Do I need EdgeOS to set up a site-to-site VPN?

Yes, EdgeOS provides built-in IPsec support for site-to-site tunnels, accessible via the GUI or CLI.

What’s the difference between site-to-site and remote access VPN?

Site-to-site connects entire networks. remote access VPN connects individual users or devices to a single network.

Can EdgeRouter handle dynamic IPs at either end?

Yes, with Dynamic DNS on the remote side and a compatible configuration on the EdgeRouter, you can maintain a working tunnel even if the public IP changes.

Which is more secure: PSK or certificates?

Certificates are generally more scalable and secure for larger deployments. PSKs are easier for small, two-site setups but require careful key management. Vpn for edge browser

Should I use IKEv2 or IKEv1?

IKEv2 is preferred for performance, stability, and better NAT traversal support on modern networks.

How can I verify a tunnel is up?

Check the VPN/IPsec status in EdgeRouter’s GUI or run show vpn ipsec sa, show vpn ipsec status in the CLI.

What if my tunnel won’t come up?

Double-check the PSK, subnet definitions, IKE/ESP proposals, firewall rules, and NAT rules. Ensure both sides are aligned and test with basic traffic first.

How do I enable NAT traversal NAT-T?

NAT-T is typically enabled by default for IPsec on EdgeOS, but you can verify in the IPsec settings and ensure ESP is allowed through the firewall.

Can I have multiple site-to-site VPN tunnels on a single EdgeRouter?

Yes, you can configure multiple tunnels, but you’ll need unique peers, subnets, and potentially separate firewall rules for each tunnel. Egypt vpn server guide for secure access, privacy, streaming, and unblocking Egyptian sites

How do I migrate from a remote access VPN to a site-to-site VPN?

Plan your topology to map users and remote endpoints into the two networks behind each site. Then convert users’ connectivity to route traffic through the new site-to-site tunnel where appropriate.

Are there performance tips for small offices?

Keep encryption strong but not overly heavy for your hardware, ensure you have a clean firewall configuration, and consider a hardware upgrade if you’re hitting throughput ceilings.

Real-world considerations: staying flexible and future-proof

Plan for growth: If you anticipate more sites, implement a naming convention for tunnels and maintain a centralized change log.
Redundancy matters: For critical sites, consider dual tunnels with two different ISPs or a backup peer so you don’t rely on a single path.
Documentation is your friend: Record the exact tunnel parameters, subnets, and PSKs/certificates. This makes audits, updates, and troubleshooting much faster.
Security hygiene: Rotate PSKs on a schedule, and consider certificate-based authentication for larger deployments.

Final quick-start recap

Decide on your topology two sites, subnets, and public IPs.
Choose IKE/IPsec proposals that both ends can agree on start with AES-256, SHA-256, DH group 14.
Configure the tunnel on both ends GUI or CLI, including firewall and NAT rules.
Verify by testing bi-directional traffic and checking tunnel status.
Harden your setup with best practices and plan for expansion.

Frequently, the simplest way to get a reliable Edgerouter site-to-site VPN is to start with a single tunnel, verify connectivity, and then progressively add additional tunnels or tweak settings if you hit performance or reliability issues. If you ever need extra peace of mind, a reputable VPN service can complement your setup for specific scenarios, like remote workers needing a separate secure path to the network.

Microsoft edge vpn free

Hola free vpn extension edge