Table of Contents

Ubiquiti edge router site to site vpn: complete guide to configuring IPsec site-to-site VPN on EdgeRouter for secure office connectivity, best practices, and troubleshooting

What is a site-to-site VPN and why use it with Ubiquiti EdgeRouter?

A site-to-site VPN is a secure tunnel that connects two separate networks for example, two office LANs over the internet. It lets devices on one network reach devices on the other as if they were on the same local network, without exposing traffic to the public internet. Here’s why EdgeRouter is a solid option for this setup:

Flexibility: EdgeRouter runs EdgeOS, which supports IPsec site-to-site VPNs and lets you tailor tunneling, subnets, and security policies.
Performance: EdgeRouter devices are designed to handle encrypted traffic efficiently, with options to enable hardware offload on compatible models.
Control: You’ll get both GUI and CLI options, so you can follow a beginner-friendly path or dive into advanced tunnel tuning as needed.
Compatibility: IPsec is a standard approach that works well with most enterprise peer devices firewalls, other routers, or dedicated VPN appliances.

In practice, you’ll typically create a tunnel that covers the remote LAN behind the other EdgeRouter, set secure authentication usually a pre-shared key or certificate, pick encryption and hashing algorithms, and then route traffic destined for the remote network through the tunnel.

Common real-world scenarios include:

Office A at 192.168.1.0/24 connecting to Office B at 10.0.0.0/16
A data center connecting to a regional office with multiple branch sites
A home office connecting to a primary office for occasional connectivity

No matter the layout, the core idea is the same: a secured, encrypted path between two WAN endpoints that allows seamless inter-site communication.

Prerequisites for setting up a site-to-site VPN on EdgeRouter

Before you poke at settings, do this quick prep: Ubiquiti edgerouter x site to site vpn setup and tutorial for reliable IPsec site-to-site connections

Determine your topologies: identify each site’s LAN subnets and the public IPs or dynamic DNS names of both EdgeRouters.
Pick a tunnel type: IPsec is the standard for site-to-site VPNs on EdgeRouter. OpenVPN is generally used for remote access, not ideal for site-to-site in most cases.
Subnet planning: ensure there’s no overlapping IP space between the two sites. If overlaps exist, plan NAT or renumbering strategies.
Firmware and hardware: confirm you’re running a supported EdgeRouter model with current EdgeOS firmware to ensure compatibility and security patches.
Firewall rules: plan which ports/protocols must be allowed for IPsec IKE, ESP, NAT-T as needed and for management access to the EdgeRouter.
Dynamic IP considerations: if either site has a dynamic public IP, set up a dynamic DNS DDNS service to keep the tunnel endpoints aligned.
Authentication approach: decide whether you’ll use a pre-shared key PSK for simplicity or certificates for stronger-scaling deployments.
Remote access and monitoring: decide how you’ll test the VPN once set up ping tests, traceroutes, or EdgeOS VPN status pages.

Security note: always use strong, unique PSKs if you go with PSK-based authentication and rotate them regularly. If you can, consider certificate-based authentication for larger deployments.

Network planning and addressing

A smooth site-to-site VPN starts with smart addressing:

Use non-overlapping subnets on each side. This reduces routing surprises and makes it easy to verify traffic flows.
Map specific subnets to specific tunnels if you plan to connect more than two sites in a hub-and-spoke or full mesh.
Plan for future growth. If you expect more sites, design a scalable addressing plan and consider a central hub with spoke connections.
Decide on routing strategy: route-based VPNs often align better with dynamic topologies, while policy-based VPNs are simpler for limited site pairs.

EdgeRouter can handle both simple and more complex topologies. For most pairwise site-to-site deployments, starting with a single tunnel for each site-to-site link is a solid approach. As you grow, you can add more tunnels or expand to multi-site VPN topologies.

Step-by-step guide: configuring site-to-site VPN on EdgeRouter GUI

Below is a practical guide you can follow in the GUI. If you prefer the CLI, scroll down for a quick CLI walkthrough after the GUI steps.

Access the EdgeRouter Web UI

Open a browser and connect to https://.
Log in with your admin credentials.

Prepare IKE and ESP groups

In the GUI, locate VPN settings. You’ll typically manage IKE Phase 1 and ESP Phase 2 groups.
Create or select an IKE group with secure options for example, encryption AES-256, integrity SHA-256, Diffie-Hellman group 14 or higher.
Create or select an ESP group with encryption and integrity settings for example, AES-256 and SHA-256, with an appropriate lifetime.

Add a site-to-site peer

Choose the option to add a new IPsec site-to-site peer.
Enter the remote peer’s public IP address or dynamic DNS name if applicable.
Enter the authentication method pre-shared key or certificate-based.
Enter the pre-shared key if you’re using PSK.

Configure tunnel specifics

Local network/subnet: the LAN behind this EdgeRouter for example, 192.168.1.0/24.
Remote network/subnet: the LAN behind the remote EdgeRouter for example, 10.0.0.0/16.
IKE group: select the IKE Group you prepared.
ESP group: select the ESP Group you prepared.
Local and remote endpoints: ensure the correct public IPs or DDNS names are set for both sides.

Enable NAT-T and modify firewall rules

If you’re behind NAT or using NAT-T, verify that NAT-T is enabled for IPsec so ESP packets can traverse NAT devices.
Create firewall rules that allow IPsec UDP/500 for IKE, UDP/4500 for NAT-T if used, and ESP protocol 50. Also ensure traffic between the internal subnets can flow through the tunnel.

Static routes or policy routing

Add a static route on each EdgeRouter for the remote subnet, pointing to the VPN tunnel as the next hop or enable policy-based routing if your setup uses it.
If you’re using multi-site routing, define route rules so traffic destined for the remote network goes through the tunnel.

Apply and test

Save and apply your changes.
Test from a host on Site A to a host on Site B: ping across the tunnel e.g., from 192.168.1.100 to 10.0.0.10. If ping fails, check VPN status, tunnel bindings, and routing.
Use the EdgeRouter VPN status page to verify tunnel state up/down and traffic counters.

Documentation and backup

Document the configuration, including the PSK, remote subnets, and the exact tunnel names. Keep a secure backup of the configuration in case you need to restore.

Note: In many EdgeOS builds, you’ll see a dedicated “Site-to-Site VPN” section. The precise UI labels can vary slightly by firmware version, but the core steps stay the same: define the remote peer, choose IKE/ESP groups, specify the local/remote subnets, and ensure the firewall and routing align. Browser vpn edge: Comprehensive Guide to Browser-Level VPN Edge Extensions, Privacy, and Performance

Step-by-step guide: configuring site-to-site VPN on EdgeRouter CLI

If you’re comfortable with the command line, here’s a concise CLI flow you can adapt. Replace placeholder values with your actual addresses and keys.

Enter configuration mode:
configure
Enable IPsec on a specific interface usually the WAN interface:
set vpn ipsec ipsec-interfaces interface eth0
Define IKE group example values. customize as needed:
set vpn ipsec ike-group IKE-PROFILE encryption ‘aes256’
set vpn ipsec ike-group IKE-PROFILE integrity ‘sha256’
set vpn ipsec ike-group IKE-PROFILE lifetime 3600
Define ESP group:
set vpn ipsec esp-group ESP-PROFILE encryption ‘aes256’
set vpn ipsec esp-group ESP-PROFILE integrity ‘sha256’
set vpn ipsec esp-group ESP-PROFILE lifetime 3600 Does microsoft edge have a firewall
Configure the IPsec site-to-site peer remote site. replace with real IPs and subnet info:
set vpn ipsec site-to-site peer 203.0.113.2 authentication mode ‘pre-shared-secret’
set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret ‘YourStrongPSK’
set vpn ipsec site-to-site peer 203.0.113.2 ike-group ‘IKE-PROFILE’
set vpn ipsec site-to-site peer 203.0.113.2 default-esp-group ‘ESP-PROFILE’
set vpn ipsec site-to-site peer 203.0.113.2 local-address ‘1.2.3.4’ # this EdgeRouter’s public IP
set vpn ipsec site-to-site peer 203.0.113.2 remote-address ‘203.0.113.2’ # remote EdgeRouter’s public IP
Define tunnels local and remote subnets:
set vpn ipsec site-to-site peer 203.0.113.2 tunnel 1 local-subnet 192.168.1.0/24
set vpn ipsec site-to-site peer 203.0.113.2 tunnel 1 remote-subnet 10.0.0.0/16
Allow NAT-T if needed:
set vpn ipsec options interface ‘eth0’ # depends on your setup
Commit and save:
commit
save
Exit:
exit Microsoft edge vpn kostenlos
Verify:
show vpn ipsec sa
show vpn ipsec peers

CLI commands can vary slightly by EdgeOS version, so adapt as needed. If you run into issues, check the EdgeRouter’s system log for IPsec-related messages often available under System or Logs in the GUI.

Testing, verification, and common issues

Once you’ve configured the tunnel, test thoroughly:

Check tunnel status: Look for “up” status on both peers. On the CLI, use show vpn ipsec sa or show vpn ipsec peers.
Basic connectivity: From a host in Site A 192.168.1.0/24, ping a host in Site B 10.0.0.0/16. If you don’t get a reply, verify:
- Remote-subnet definitions are correct
- Static routes point traffic to the VPN
- Firewalls allow ICMP across the tunnel
- IKE/ESP group settings match on both sides
Packet tracing: Use ping or traceroute to ensure traffic is actually going through the tunnel and not hitting a default gateway path.
NAT issues: If one side sits behind NAT, ensure NAT-T is enabled so IPsec encapsulated packets can traverse NAT devices.
PSK considerations: If the tunnel won’t form, recheck the pre-shared key on both sides and ensure there’s no extra whitespace or hidden characters.
Dynamic IP updates: If either end uses dynamic IPs, verify your DDNS configuration and update the remote peer if IPs change.

Performance notes:

EdgeRouter models with hardware offload can significantly improve VPN throughput. Make sure you enable hardware offload if your model supports it and you’re not using features that disable it.
Encryption strength affects CPU load. AES-256 with SHA-256 provides strong security, but if performance is an issue and your devices support it, you can test AES-128 as a compromise—though you should weigh risk and compliance requirements.
Traffic type matters. If you’re routing a lot of large file transfers or video streams across the tunnel, consider tuning MTU/MSS to minimize fragmentation.

Security reminders: Hoxx vpn edge review: everything you need to know about Hoxx vpn edge, features, performance, privacy, and setup

Use strong PSKs and rotate them periodically.
Keep EdgeRouter firmware up to date to mitigate known vulnerabilities.
Limit administrative access to the EdgeRouter and rely on secure management practices.
Consider certificate-based authentication for larger, more scalable deployments.

Performance, reliability, and maintenance

A robust site-to-site VPN isn’t a “set it and forget it” thing. Here are practical tips to keep things humming:

Regularly review tunnel health: Check for dropped packets, online/offline status, and tunnel re-establishment times after network changes.
Schedule firmware updates: EdgeRouter firmware updates often include security fixes and improved VPN performance.
Monitor remote networks: If either side changes subnets, internet paths, or firewall rules, you’ll need to re-tune the VPN settings.
Plan upgrades as you scale: When you add more sites, think about hub-and-spoke topologies or mesh VPN designs to simplify routing and management.
Backups matter: Keep a recent backup of the EdgeRouter configuration, including VPN settings, so you can recover quickly if a device fails.

Troubleshooting quick tips:

If the tunnel won’t establish, verify both sides’ IKE and ESP group settings match exactly, and confirm PSKs are identical.
If you see phase 1 IKE but not phase 2 IPsec, the problem is often mismatched ESP settings or a misconfigured remote-subnet.
If you can ping the remote gateway but not hosts behind it, check static routes and firewall rules to ensure traffic is allowed to traverse the tunnel.

Security best practices for site-to-site VPNs

Use certificates when possible: Certificates scale better for larger deployments and reduce the risk of PSK exposure.
Rotate keys regularly: Establish a schedule for PSK or certificate rotation, and document the changes.
Harden management access: Disable unused services on EdgeRouter. use strong admin passwords. enable two-factor authentication if supported by your management interface.
Audit firewall rules: Regularly review firewall rules around IPsec, especially if you modify router interfaces or add new networks.
Segment management networks: Keep management interfaces separate from user networks to reduce exposure if either side is compromised.

Multi-site considerations and scaling

As you grow from two sites to a multi-site network, you’ll want to design for scalability:

Central hub model: A central EdgeRouter hub connects to multiple spokes. This reduces stress on each individual box and simplifies routing.
Mesh VPN: For a small number of sites, you can create direct tunnels between every pair, but this scales poorly as you add more sites.
Centralized monitoring: Use a unified dashboard either through the EdgeRouter’s built-in tools or a third-party network monitoring system to observe tunnel health across sites.
Subnet planning re-emergence: Revisit subnets if you add sites to avoid future overlaps.
Redundancy: Consider dual WAN connections and failover for critical sites to ensure VPN availability.

Frequently Asked Questions

Can a Ubiquiti EdgeRouter handle a site-to-site VPN between two offices?

Yes. EdgeRouter devices support IPsec site-to-site VPNs, allowing you to securely link two office networks over the internet.

What is the difference between a site-to-site VPN and remote access VPN on EdgeRouter?

A site-to-site VPN connects two networks two offices, while a remote access VPN lets individual users connect securely from remote locations to a single network. Windscribe edge review 2025: Windscribe Edge features, performance, pricing, privacy, and setup guide

Which authentication method should I use for IPsec on EdgeRouter?

Pre-shared keys are simple and effective for small deployments. For larger deployments, certificates public key infrastructure provide stronger security and easier management.

Should I use AES-256 or AES-128 for encryption?

AES-256 offers stronger security. If performance is a concern on an older EdgeRouter model, you could test AES-128, but weigh the security requirements of your organization.

How do I verify that the VPN tunnel is up?

In EdgeOS, check the VPN status page or run commands like show vpn ipsec sa and show vpn ipsec peers in the CLI. The GUI also shows tunnel status and statistics.

What if the tunnel keeps dropping?

Check for IP address changes dynamic IPs, mismatched IKE/ESP settings, routing issues, or firewall blocks. Ensure NAT-T is enabled if behind NAT, and verify that both sides’ subnets are correctly defined.

Can I have more than one site-to-site tunnel on the same EdgeRouter?

Yes, you can configure multiple IPsec site-to-site peers, each with its own local/remote subnets. Just keep track of the mappings and ensure routing is correct. Is edge vpn good reddit and how edge VPN concepts, performance, and reviews shape the best edge-optimized VPN choices

How do I handle dynamic IPs at one site?

Use a dynamic DNS service on the remote site and configure the EdgeRouter to use the DDNS hostname for the peer’s remote address. Update routes accordingly when IPs change.

Do I need to change firewall rules when I add a VPN?

Yes. You’ll typically need to allow IPsec’s IKE and ESP traffic, plus any traffic between the local and remote subnets. If you add new subnets, extend firewall rules to cover them.

What maintenance tasks should I perform regularly for a site-to-site VPN?

Regularly review tunnel health, rotate credentials, update firmware, verify routing, and back up configurations. Test failover scenarios and document any changes.

Please note: this guide focuses on practical steps to configure, test, and maintain a site-to-site VPN between Ubiquiti EdgeRouter devices. If you want to explore more advanced topologies, such as hub-and-spoke architectures or full mesh VPNs across several sites, we can tailor the setup and provide model-specific tweaks for optimal results.

Super vpn extension edge Browsec vpn microsoft edge

Ubiquiti edge router site to site vpn