VPNs

By Tarquin Quintessenz · March 7, 2026 · 12 min

Yes, EdgeRouter can be configured for VPN, including site-to-site and remote access. If you want a quick VPN setup boost while you’re following along, check out NordVPN with this limited-time offer: . It’s a handy backup for devices that can’t run EdgeRouter VPN directly, and it’s a solid option to keep your connections private on the go. Useful URLs and Resources text only - EdgeRouter official documentation - ubnt.com - Ubiquiti Community forums - community.ui.com - OpenVPN project - openvpn.net - strongSwan IPsec for EdgeOS - docs.strongswan.org - NordVPN homepage - nordvpn.com - Dynamic DNS providers No-IP, DynDNS - noip.com / dyndns.org Introduction: what this guide covers This guide is a practical, step-by-step walkthrough to get a VPN working on an EdgeRouter X. We’ll cover both site-to-site and remote-access options, explain the quickest paths, and show how to troubleshoot common issues. You’ll learn: - How EdgeRouter X handles VPNs with IPsec and OpenVPN-like setups - How to choose between site-to-site vs remote access - How to configure Phase 1 and Phase 2 settings, firewall rules, and routing - How to test the VPN and verify traffic flows securely - Tips to optimize performance and keep things secure What you’ll need before you start - An EdgeRouter X ER-X with EdgeOS firmware up to date - A target remote network or VPN client details - Public IP address or a reliable dynamic DNS setup - Administrative access to the EdgeRouter’s GUI or CLI - Basic familiarity with firewall zones and NAT rules Note: VPN terminology explained - Site-to-site VPN: creates a secure tunnel between two networks your home/office and a remote site - Remote access VPN: lets individual devices connect securely to your network from anywhere - IPsec: a common VPN protocol suite used for site-to-site connections - OpenVPN/other options: sometimes used for remote access or compatibility with non-IPsec clients Body Why you might want VPN on EdgeRouter X VPNs are all about privacy, security, and accessing internal resources remotely. With EdgeRouter X, you get a compact, affordable device that can handle basic VPN duties without needing a more expensive firewall appliance. In 2024-2025, VPN usage continued to rise as more people work remotely and seek privacy online, making a robust home or small-office VPN setup a smart investment. Expect IPsec-based site-to-site VPNs to deliver solid throughput on ER-X, with some caveats around CPU limits and encryption strength. The goal is to balance security with performance, so you can stream, work, and browse with confidence. Understanding EdgeRouter X capabilities and VPN options - EdgeRouter X is designed for small networks and offers solid routing features plus VPN capabilities via EdgeOS the UI around the underlying Vyatta/EdgeOS architecture. - For site-to-site VPN, IPsec is the most reliable built-in option on ER-X. It’s well-supported, relatively straightforward, and works with many router brands. - For remote access, you’ll typically use IPsec-based remote access or a compatible OpenVPN setup. EdgeOS can support these configurations, but some users prefer running a small OpenVPN server on a dedicated device or using a compatible VPN client on end devices. - Performance: the ER-X is budget-friendly, so expect practical VPN throughput to be in the tens to low hundreds of Mbps range depending on encryption, tunnel count, and traffic type. If you’re encrypting multiple tunnels or using heavy ciphers, you’ll see lower throughput. Step-by-step: set up IPsec site-to-site VPN on EdgeRouter X This section walks you through a typical IPsec site-to-site VPN setup. We’ll use a peer-to-peer model your ER-X at home and a remote gateway at the partner site. # Prerequisites - Public IP or dynamic DNS for both sites - Remote network address range e.g., 192.168.2.0/24 - Shared IPsec pre-shared key PSK for both ends - Administrative access to EdgeRouter X GUI or CLI # Step 1: Back up and prepare - Create a backup of your current EdgeRouter configuration. - Note current firewall rules and NAT settings in case you need to revert. # Step 2: Basic network sanity - Ensure the ER-X has a stable Internet connection and your LAN subnet doesn’t overlap with the remote network. - Confirm DNS is working on the router so you can fetch remote resources during troubleshooting. # Step 3: Create the IPsec secret and peer - In the EdgeRouter GUI, open the VPN section and select IPsec. - Add a new VPN peer with: - Local identifier and remote identifier often the IPs - Peer IP remote public IP - Pre-shared key PSK - Choose a Phase 1 algorithm IKEv1 or IKEv2 and set a mode main or aggressive, recommended: IKEv2 with main mode - Configure key lifetime e.g., 28800 seconds and encryption options AES-256, SHA-256 # Step 4: Phase 2 / IPSec transform set - Define the Phase 2 proposal with the correct local and remote subnets LANs behind each site - Pick a PFS group e.g., 14 for 2048-bit and the same AES-256/SHA-256 as for Phase 1 - Set the lifetime e.g., 3600 seconds # Step 5: Firewall and NAT - Create firewall rules to allow VPN traffic IKE, IPsec ESP, etc. - If you’re using NAT, set up a policy to disable NAT for the VPN subnet or use a special NAT exemption rule so traffic between subnets doesn’t double-NAT - Create a rule to allow traffic from the VPN tunnel to your LAN and back # Step 6: Routing - Add static routes or use dynamic routing to route the remote network traffic through the VPN tunnel - Ensure inter-subnet routing works without exposing your LAN to unintended networks # Step 7: Apply and test - Save and apply changes - Use a test device on the remote network to ping devices on your LAN - Check VPN status in the EdgeRouter interface and the remote gateway’s status - Validate the tunnel is up and traffic is flowing as expected # Step 8: Monitoring and maintenance - Monitor the VPN for drops or flaps and adjust Phase 1/Phase 2 lifetimes if needed - Keep firmware updated to benefit from security patches and performance improvements Step-by-step: remote-access VPN on EdgeRouter X IPsec approach If your goal is remote access for individual devices laptops, phones rather than a full site-to-site link, you can use IPsec remote-access configurations or OpenVPN-style approaches. IPsec remote access is commonly done with a VPN server behind EdgeRouter X. - Public IP or dynamic DNS - VPN client devices with IPsec support - A user authentication mechanism PSK or certificate-based, depending on your setup - EdgeRouter X with updated firmware # Quick remote-access outline - Create a VPN server instance on EdgeRouter X IPsec with a user pool - Configure Phase 1/Phase 2 for remote clients - Set client IP assignment range and DNS - Add firewall rules to permit VPN traffic and restrict access to necessary subnets - Install VPN clients on devices and verify connection - Test by pinging internal devices or accessing internal resources Note: If EdgeRouter X’s built-in remote-access options feel limited, consider pairing it with a dedicated VPN server on a separate device or running a lightweight OpenVPN server in a virtual environment or connected appliance. OpenVPN and EdgeRouter X: what to know OpenVPN isn’t always a native feature in every EdgeOS version, and support can vary by firmware. If you specifically need OpenVPN remote access: - Check your EdgeRouter OS version for OpenVPN server capability - If native support is limited, the alternative is to deploy a separate OpenVPN server on a Raspberry Pi, NAS, or a small PC and route traffic from the EdgeRouter to that server - Ensure you create appropriate firewall rules to protect your network Why you might choose IPsec over OpenVPN on ER-X - IPsec tends to be faster on devices like ER-X due to hardware-accelerated cryptographic support - IPsec struggles less with NAT and firewall configurations across diverse clients - OpenVPN can be more flexible for some clients but may require extra resources if you host it on a separate device Performance considerations and optimization - Encryption choice matters. AES-256 with SHA-256 is secure but heavier than AES-128 with SHA-1. If you can, use AES-128 with SHA-256 for a good balance. - Tunnel count impacts throughput. Each VPN tunnel adds CPU load. fewer tunnels generally means higher throughput on a budget router like ER-X. - CPU and memory limits: ER-X is a budget device, so don’t expect Intel-level performance. For heavy use, consider a higher-end EdgeRouter or a dedicated VPN appliance. - Traffic shaping: If you’re streaming or gaming while VPN is enabled, consider QoS rules to reserve bandwidth for essential services. - Dynamic DNS: If you’re on a consumer ISP with a changing public IP, an up-to-date dynamic DNS setup keeps your remote connections functional. Troubleshooting common VPN issues on EdgeRouter X - VPN tunnel shows up but no traffic: verify firewall rules and ensure NAT exemption is correctly configured for traffic between subnets. - Phase 1 or Phase 2 keep failing: double-check PSK, remote endpoints, and matching algorithms. ensure time synchronization on both ends. - Connection drops: check for IPsec SA rekey mismatches. adjust lifetimes to match across peers. - Client can connect but cannot reach LAN devices: verify router routes and ensure the VPN client is assigned a valid IP in the VPN subnet. confirm that the VPN tunnel is marked as “up” and that firewall policies permit internal traffic. - Performance bottlenecks: test with a single tunnel. temporarily disable other services to isolate the issue. consider reducing encryption level if security requirements allow. Remote access VPN on EdgeRouter X vs. dedicated VPN hardware - Remote access on ER-X is viable for small setups or temporary needs. for larger teams or higher throughput, a dedicated VPN appliance or a faster router may be preferable. - If you’re running multiple VPN endpoints or you have a high number of remote users, consider distributing load across devices or upgrading to a more capable EdgeRouter model. Security best practices for EdgeRouter X VPNs - Use strong, unique pre-shared keys or certificates if supported for IPsec peers - Keep EdgeOS firmware up to date to patch vulnerabilities - Limit VPN access to only the resources necessary for work or remote access - Regularly audit VPN user accounts and revoke access for departed users - Use DNS filtering or a VPN-friendly DNS setup to prevent DNS leaks - Consider split-tunnel vs full-tunnel decisions: full-tunnel routes all traffic via VPN privacy but increases load. split-tunnel only routes specific subnets via VPN better performance Tips for getting the most out of your EdgeRouter X VPN - Plan your IP address plan to avoid subnet overlaps and simplify routing - Document firewall rules and VPN settings so you can reproduce or audit configurations - Use consistent naming conventions for VPN peers and policies to reduce confusion - If you’re new to EdgeOS, practice changes in a controlled environment or on a spare router before deploying on your main network Real-world examples and scenarios - Small remote office connecting to home lab: a site-to-site IPsec VPN ties the networks together so lab devices can be accessed as if they’re on the same LAN. - Remote worker with intermittent connectivity: a robust remote-access IPsec setup gives secure access when needed, without exposing the whole home network. - Multi-tenant hobby network: segment VPNs for different users, apply precise firewall rules to keep traffic isolated, and avoid cross-access across tenants. Performance and model considerations beyond ER-X - If your VPN needs grow, consider upgrading to a higher-end EdgeRouter model with better CPU and more RAM to maintain throughput under load. - Alternatively, you can place a dedicated VPN appliance in front of ER-X or run VPN services on a separate device and route VPN traffic through ER-X to the internal network. Common mistakes to avoid - Overlapping subnets between your LAN and the remote VPN networks - Forgetting to disable or adjust NAT rules for VPN traffic - Not syncing clocks between peers, which causes phase negotiation failures - Using weak PSKs or unrelated encryption settings across peers Quick-start checklist - Confirm firmware is up to date - Prepare remote subnet and PSK or certificates - Create IPsec peer and Phase 1/Phase 2 proposals - Configure NAT exemptions or firewall rules for VPN traffic - Configure routing to ensure VPN-subnet traffic reaches the right destinations - Test tunnel status and verify traffic flow - Implement monitoring and maintenance plan Frequently Asked Questions # What is EdgeRouter X? EdgeRouter X is a compact, budget-friendly router from Ubiquiti designed for small networks. It runs EdgeOS, offering robust routing, firewall, and VPN capabilities suitable for home labs and small offices. # Can EdgeRouter X run OpenVPN natively? OpenVPN support on EdgeRouter X depends on your EdgeOS version. Some versions include built-in OpenVPN server support, while others require a separate OpenVPN server on another device. If native OpenVPN isn’t available, you can run a dedicated OpenVPN server and route traffic through the EdgeRouter. # How do I set up IPsec on EdgeRouter X? You configure IPsec by creating a VPN peer, selecting Phase 1 and Phase 2 algorithms, specifying subnets, and applying firewall and NAT rules. You’ll also configure routing to ensure traffic flows over the VPN tunnel between sites. # What’s the difference between site-to-site and remote access on EdgeRouter X? Site-to-site VPN connects two entire networks, useful for linking a home network and a remote office. Remote access VPN lets individual devices connect securely to your home/office network from anywhere. # Is IPsec faster than OpenVPN on EdgeRouter X? In most cases, IPsec offers better performance on budget hardware like ER-X due to hardware acceleration and efficient cipher suites. OpenVPN can be more flexible but may require more CPU resources. # How do I test my VPN setup on EdgeRouter X? Test by sending pings between subnets across the VPN, accessing internal resources, and checking the VPN status in the EdgeRouter interface. Use traceroute or pathping to verify the route path. # What encryption settings should I use for a good balance of security and performance? AES-128 or AES-256 with SHA-256 are common, secure choices. If you’re optimizing for speed and your threat model allows it, AES-128 with SHA-256 can provide a strong balance. # How can I troubleshoot VPN failures on EdgeRouter X? Check tunnel status in the GUI, verify IP addresses and subnets, confirm PSK/credentials, review firewall/NAT rules, and ensure time synchronization. Look for replay or negotiation errors in the log. # Can I run multiple VPNs on EdgeRouter X? Yes, you can host multiple VPN peers site-to-site or remote access but remember that each tunnel adds CPU load. Plan your topology and firewall rules accordingly. # What about WireGuard on EdgeRouter X? WireGuard support varies by firmware. If native WireGuard isn’t available on your EdgeOS version, consider a separate device or upgrade to a firmware version that includes WireGuard, or use IPsec/OpenVPN as your primary method. # How do I secure VPN access for remote users? Use strong authentication, enforce unique credentials, enable client certificate-based authentication if supported, apply segmenting firewall rules, and monitor connections regularly. Keep firmware updated to reduce vulnerabilities. # What’s the best practice for dynamic IPs on the remote site? Use a dynamic DNS service at the remote site to ensure the EdgeRouter X can always reach the remote peer even if the public IP changes. # Do I need a static IP on my EdgeRouter X for VPNs? A static IP simplifies configuration and reliability, but dynamic DNS plus a DDNS update mechanism can work well for home setups with changing IPs. # How can I improve VPN stability on a busy network? Implement proper MTU/MSS settings, avoid overly aggressive rekey intervals, limit the number of active tunnels, and use QoS to prioritize VPN traffic during peak usage times.

If you’re looking for a practical, well-supported VPN setup that keeps your network private without breaking the bank, this EdgeRouter X VPN guide gives you the essentials and actionable steps to get up and running. And if you want a simple, off-device backup for devices that can’t be VPN-enabled on the ER-X itself, the NordVPN offer embedded in the intro is a handy option to consider.

Tonvpn 完整指南：Tonvpn VPN 设置、隐私保护、跨地域访问、速度与稳定性对比