Journalist 
Ubiquiti edgerouter x site to site vpn is possible and straightforward with IPsec on EdgeRouter X. In this guide, you’ll learn how to set up a robust site-to-site IPsec VPN between an EdgeRouter X and a remote gateway, whether that gateway is another ERX, a Fortinet device, a Cisco ASA, or any VPN-capable router. I’ll break down the prerequisites, the exact steps with friendly explanations, common pitfalls, and best practices so you can get your network securely talking to a branch office or home lab. Think of this as your practical, no-fluff walkthrough that covers planning, config, testing, and maintenance. And if you’re looking for extra privacy on top of your site-to-site work, NordVPN often has promos you can take advantage of—here’s a quick promo you might consider:
Useful URLs and Resources:
- Ubiquiti Networks official EdgeRouter X product page – ubnt.com/products/edgerouter-x
- EdgeRouter X Quick Start Guide – help.ubnt.com
- Ubiquiti EdgeOS IPsec VPN documentation – help.ubnt.com/hc/en-us/articles/204965310-IPsec-VPN
- Site-to-site VPN concepts and best practices – en.wikipedia.org/wiki/Virtual_private_network
- General firewall and VPN testing tips – smallnetbuilder.com
Introduction wrap-up: this guide is designed to be practical for real-world networks, not just theory. You’ll find a step-by-step approach you can follow on a home lab, a small business, or a multi-site WAN. I’ll cover the two most common scenarios: 1 ERX at one site connecting to another EdgeRouter-based site, and 2 ERX connecting to a non-ERX device like a Fortinet or Cisco ASA. By the end, you’ll be able to implement a secure IPsec tunnel, route traffic across it, and validate the tunnel’s health.
Why site-to-site VPN with Ubiquiti EdgeRouter X matters
Site-to-site VPN gives you a secure tunnel between geographically separated networks. For small businesses or remote teams, it replaces risky, unsecured public-internet access with encrypted paths for all inter-site traffic. Here’s why this setup is popular with the EdgeRouter X:
- Cost-effective performance: EdgeRouter X punches above its price range for VPN chores, offering solid IPsec functionality without a pricey appliance.
- Flexible routing: You can route specific subnets through the VPN or use it as a default path for inter-site traffic.
- Compatibility: IPsec is a standard, so you can connect ERX to many remote gateways other ERXs, Fortinet, Cisco, Palo Alto, etc. without proprietary lock-in.
- Security-conscious defaults: AES-256, SHA-256, and PFS groups are standard options you can enable to harden the tunnel.
If you’re new to EdgeRouter X, think of it as a small but capable platform running EdgeOS. You’ll manage VPNs with the EdgeOS command line CLI or the graphical user interface GUI. In practice, a lot of the work happens in the CLI, but you’ll hear about the GUI options as well.
Prerequisites and planning: getting your ducks in a row
Before you jump into the config, gather these essentials and map your network:
- Public IP addresses or dynamic DNS for both gateways: You’ll need the remote gateway’s public IP or a resolvable hostname if dynamic. If you have a dynamic IP on either end, plan for Dynamic DNS DDNS updates so the tunnel can re-establish when IPs change.
- Local network subnets: Decide which subnets will be reachable across the VPN. For example, your ERX might be 192.168.1.0/24 on-site and 10.20.0.0/24 on the remote site.
- Remote network subnets: The subnets on the other end that you want to reach.
- VPN credentials: A pre-shared key PSK is the simplest option. If you’re in a more advanced environment, you can use certificates, but PSK is the most approachable starting point.
- Encryption and IKE policy: AES-256 or AES-128 if you need to conserve CPU cycles, SHA-256 hash, perfect forward secrecy PFS group e.g., 14 or 24, and IKEv2 for stability if possible. EdgeRouter supports IKEv2, which is generally preferred for modern networks.
- Firewall readiness: Ensure your firewall rules allow IPsec UDP 500 for IKE, UDP 4500 for NAT-T, and IPsec ESP where applicable and that traffic can traverse the tunnel.
- Backups: Take a quick backup of your current EdgeRouter X config you’ll thank yourself if you need to revert.
Tip: If you’re new to VPNs, keep a simple test tunnel first one subnet pair to verify basic connectivity, then extend to additional networks.
Step-by-step guide: configure EdgeRouter X for site-to-site IPsec
Below is a practical, high-detail workflow you can adapt to your actual hardware and partner gateway. The commands assume you’re using the EdgeRouter X via SSH or the console. If you prefer the GUI, many of these settings map to the same concepts. Does microsoft edge have a firewall
Note: Replace placeholders such as
- Prepare IPsec-related groups and defaults
-
Create a generic IKE IKEv2 group with strong encryption and a reasonable lifetime.
- set vpn ipsec ike-group IKE-GROUP proposal 1 encryption aes256
- set vpn ipsec ike-group IKE-GROUP proposal 1 hash sha256
- set vpn ipsec ike-group IKE-GROUP lifetime 3600
-
Create an ESP IPsec group with strong encryption for the tunnel payload:
- set vpn ipsec esp-group ESP-GROUP proposal 1 encryption aes256
- set vpn ipsec esp-group ESP-GROUP proposal 1 hash sha256
- set vpn ipsec esp-group ESP-GROUP lifetime 3600
- Bind IPsec to your interface
- Specify which network interface’s traffic should be protected by IPsec often eth0 or eth1, depending on your setup.
- set vpn ipsec ipsec-interfaces interface eth0
- Define the site-to-site peer your remote gateway
-
Replace
with the public IP address or hostname of the remote gateway. -
Replace
with your pre-shared key. Browser vpn edge: Comprehensive Guide to Browser-Level VPN Edge Extensions, Privacy, and Performance -
Configure the IKE and ESP groups you created.
- set vpn ipsec site-to-site peer
authentication mode pre-shared-secret - set vpn ipsec site-to-site peer
authentication pre-shared-secret - set vpn ipsec site-to-site peer
ike-group IKE-GROUP - set vpn ipsec site-to-site peer
esp-group ESP-GROUP - set vpn ipsec site-to-site peer
local-subnet - set vpn ipsec site-to-site peer
remote-subnet
- set vpn ipsec site-to-site peer
-
If your remote gateway uses IKEv2 only, ensure both ends are configured for IKEv2. Some devices default to IKEv1. make sure IKEv2 is enabled on both sides if possible.
- Optional: enable NAT-T for NAT traversal
- If either gateway is behind NAT, NAT-T helps negotiate the tunnel through NAT devices.
- set vpn ipsec nat-t enable
- Even if not behind NAT, NAT-T typically remains harmless and compatible.
- Fine-tune additional settings optional but recommended
-
Dead Peer Detection DPD to keep the tunnel healthy and re-establish quickly:
- set vpn ipsec dpd-interval 10
- set vpn ipsec dpd-timeout 30
-
PFS perfect forward secrecy can be enforced in the ESP or IKE groups. if you want to explicitly require PFS, configure the PFS group at the IKE level.
-
Local and remote IDs for some devices, mutual ID verification helps avoid mismatches: Microsoft edge vpn kostenlos
- set vpn ipsec site-to-site peer
local-id - set vpn ipsec site-to-site peer
remote-id
- set vpn ipsec site-to-site peer
- Add firewall rules to allow VPN traffic and tunnel traffic
- Create or adjust firewall rules to permit IPsec traffic:
- allow in support for UDP 500 IKE
- allow in support for UDP 4500 NAT-T
- allow ESP protocol 50 if needed
- Ensure inter-site traffic is allowed to flow across the tunnel and reach remote subnets.
- Define routing: ensure remote networks are reachable
- Add routes so traffic destined for the remote subnet goes through the IPsec tunnel:
- set protocols static route
next-hop prohibited - or use policy routing to route specific traffic through the VPN
- set protocols static route
- Commit, save, and apply
- commit
- save
- restart or re-establish the VPN to ensure the new configuration takes effect
- Verify the tunnel status and connectivity
- Use the EdgeRouter’s CLI or GUI to verify:
- show vpn ipsec sa to view active security associations
- show vpn ipsec status
- show interfaces detail for tunnel status
- Test connectivity:
- ping a host on the remote subnet from a host on the local subnet
- traceroute to a remote host to confirm traffic routing
- If you don’t see a tunnel, double-check:
- PSK matches on both sides
- local/remote subnets are correct
- firewall rules aren’t blocking IPsec or tunnel traffic
- both gateways actually have matching IKE/ESP proposals
- Post-setup hardening and best practices
- Use AES-256 and SHA-256 as the base for both IKE and ESP, whenever possible.
- Enable Perfect Forward Secrecy with a reasonable group e.g., ECDH group 14 or higher to ensure session keys aren’t derived from a single point.
- If you expect dynamic IPs, configure a reliable DDNS on the remote gateway and ensure your EdgeRouter X is set up to chase that hostname or IP.
- Regularly monitor tunnel health and log activity to detect potential issues early.
- Consider enabling a secondary VPN path a backup VPN or multiple subnets if your network requires high availability.
Common scenarios: ERX talking to different kinds of gateways
EdgeRouter X-to-EdgeRouter X
- This is the most common home-office setup. Use symmetrical local/remote subnets, same encryption preferences, and PSK on both sides. The workflow is basically identical on both devices. you only need to mirror the config.
ERX to Fortinet FortiGate
- Fortinet devices typically support IPsec with strong defaults. Ensure you align IKEv2, AES-256, SHA-256, and a PFS group. On the FortiGate side, you may create a VPN Tunnel with a matching remote gateway IP, PSK, and the same local/remote subnets. On ERX, the peer is the FortiGate’s public IP and its remote-subnet must mirror what the FortiGate expects.
ERX to Cisco ASA
- ASA VPNs can be a bit finicky about IDs and Phase 2 settings. Ensure the Phase 1 IKE and Phase 2 IPsec proposals align exactly. If the ASA uses a certificate-based setup, you’ll have to switch from PSK to a cert-based arrangement, which EdgeRouter also supports though IKEv2 with certificates is a more involved configuration.
ERX with dynamic DNS at either end
- If one or both ends have dynamic public IPs, set up a DDNS hostname on the gateway that changes, and use that hostname for the peer configuration. Ensure that the remote gateway can resolve your DDNS hostname to the current IP.
Failover and redundancy tips Hoxx vpn edge review: everything you need to know about Hoxx vpn edge, features, performance, privacy, and setup
- If you need high availability, consider building two VPN tunnels with two remote gateways or two separate internet connections and use policy-based routing to prefer one tunnel, with automatic failover to the second when the first is down.
- Periodically test failover by simulating a gateway outage to ensure traffic routes correctly through the remaining tunnel.
Security best practices and quick optimization tips
- Encryption and integrity: AES-256 with SHA-256 is a solid baseline. Avoid legacy algorithms like DES or MD5.
- PFS: Always enable PFS for Phase 2 the ESP group. Use a modern ECDH group like group 14 or higher if your devices support it.
- Key management: Use strong PSKs. If you can implement certificate-based authentication, that’s even better for rotation and management.
- Firmware updates: Keep EdgeOS updated to benefit from security fixes and improved VPN behavior.
- Network segmentation: Don’t route everything through the VPN by default unless necessary. If you don’t need the entire site’s traffic across the tunnel, limit routing to specific subnets to reduce load and potential exposure.
- Logging and monitoring: Enable VPN logs and set up alerts for tunnel down events. Regularly review connection history to catch anomalies.
Real-world tips to speed up deployment and avoid headaches
- Start small: Test with a single pair of subnets, confirm the tunnel comes up and traffic passes, then expand to additional subnets.
- Use consistent subnet planning: Avoid overlapping IP ranges between local and remote networks.
- Keep a clear naming convention: Name your VPN tunnels clearly in the EdgeRouter config e.g., VPN_SITE_A_TO_SITE_B to avoid confusion as you scale.
- Document your settings: Save your final working configuration and write down the exact PSK, remote IP, and subnet mappings so you don’t forget later.
Troubleshooting quick-start checklist
- Tunnel status: Check show vpn ipsec status and show vpn ipsec sa for active security associations.
- Phase 1 vs Phase 2: If Phase 1 fails, verify PSK, IKE group, and remote identity. If Phase 2 fails, verify ESP group, local/remote subnets, and firewall rules.
- NAT-T: If you’re behind NAT and the tunnel isn’t forming, ensure NAT-T is enabled and UDP ports 500 and 4500 are open to the remote gateway.
- Firewall: Confirm that on both sides, firewall rules permit IKE and IPsec ESP traffic and that inter-site traffic is allowed through the tunnel.
- Subnet overlap: Ensure there are no overlapping IP ranges that would cause routing conflicts when traffic crosses the VPN.
Real-world use cases and success stories
- Small business branch connect: A two-site setup where an ERX at headquarters connects to a partner office via IPsec VPN, enabling secure printing, file sharing, and centralized backups across the tunnels.
- Home lab and remote work: A home office with an ERX Terraforming to a lab environment on another site, allowing testing of VPN failover and remote management without exposing traffic to the open internet.
- Multi-site expansion: As your network grows, you can add more ERX gateways, create spare tunnels for redundancy, and build out a scalable hub-and-spoke model with consistent encryption standards.
Performance considerations: what to realistically expect
- EdgeRouter X is a budget-friendly device. Don’t expect enterprise-class throughput, but you can expect solid performance for typical small-office workloads, including multiple VPN tunnels, basic firewalling, and general routing.
- VPN performance depends on several factors:
- Encryption and integrity algorithms AES-256 and SHA-256 are more demanding than AES-128 and SHA-1
- Hardware capabilities of the ERX CPU, memory
- The amount of traffic and the size of the remote networks
- The quality and speed of your internet connections on both ends
- Practical takeaway: plan for hundreds of Mbps of VPN throughput under typical loads, not multi-gigabit speeds. If you need higher throughput, you might consider a higher-end EdgeRouter model or a dedicated VPN appliance.
Frequently Asked Questions
What is Ubiquiti EdgeRouter X best used for?
EdgeRouter X is a compact, affordable router suitable for small offices, home labs, and networks needing reliable routing and VPN capabilities without breaking the bank.
Can EdgeRouter X do site-to-site VPN with IPsec?
Yes. EdgeRouter X supports IPsec site-to-site VPNs, including IKEv2, which makes it a flexible choice for connecting to other ERX devices or third-party gateways.
Which VPN type should I use on ERX?
IKEv2 with IPsec is generally recommended for reliability and performance. It’s widely supported across various vendors and tends to be more stable than IKEv1.
How do I connect ERX to a Fortinet FortiGate?
You’ll configure a matching IPsec site-to-site tunnel on both sides. Align IKEv2 settings, encryption AES-256, hash SHA-256, and the same local/remote subnets. Double-check the PSK on both ends.
What if my IP address changes?
If you have dynamic IPs, use a Dynamic DNS DDNS setup on at least one gateway and configure the other side to point to the hostname. This helps the tunnel reestablish automatically when IPs change. Windscribe edge review 2025: Windscribe Edge features, performance, pricing, privacy, and setup guide
How do I test the VPN tunnel?
Ping a host on the remote subnet from a host on your local subnet, check the VPN status in EdgeOS, and inspect the security associations with show vpn ipsec sa. Look for tunnels that are up and traffic flows across the tunnel.
Can I use certificate-based authentication with ERX?
Yes, EdgeRouter X can be configured to use certificates for IPsec authentication, though it’s more involved than PSK. It’s a good option if you’re managing many tunnels or require stronger key management.
How do I troubleshoot a tunnel that won’t come up?
Verify PSK matches, confirm the remote gateway’s IP address is reachable, ensure the subnets don’t overlap, check firewall rules, and review logs for Phase 1 or Phase 2 negotiation errors. Rebooting one side and re-confirming the config can help, but avoid rebooting during critical business hours if possible.
Do I need to open additional ports on my firewall for IPsec?
Yes, you typically need UDP 500 IKE and UDP 4500 NAT-T open, and ESP IP protocol 50 allowed through if your firewall requires it. Some setups can work with NAT-T, but it’s safer to allow these ports.
Should I prefer ERX for a multi-site VPN?
ERX is a solid choice for small to mid-sized deployments needing reliable IPsec tunnels at a low cost. If you’re expanding to multiple sites with high throughput demands, you might look at higher-end EdgeRouter models or dedicated VPN appliances for better performance. Is edge vpn good reddit and how edge VPN concepts, performance, and reviews shape the best edge-optimized VPN choices
Can I run more than one VPN tunnel from a single ERX?
Absolutely. ERX can manage multiple VPN tunnels, each with its own peer, local/remote subnets, and policies. Just be mindful of CPU load and ensure your config stays organized to avoid conflicts.
How often should I back up EdgeRouter X configurations?
As often as you make changes to VPNs, firewall rules, or routing. A quick backup after a successful VPN deployment is a good habit, and quarterly backups are a sensible minimum.
Final notes: keep it simple, secure, and scalable
Setting up a site-to-site VPN with Ubiquiti EdgeRouter X is very doable, even for beginners who are comfortable with the command line. The key is to plan, mirror settings on both ends, and test thoroughly. Start simple, then scale up as your network grows. With the right configuration, you’ll have a reliable, secure tunnel that keeps your inter-site traffic private without adding complexity to your everyday network management.
If you’re looking to add a layer of privacy for additional online activity beyond the VPN itself or want to experiment with secure remote access, consider the NordVPN promo linked above. It’s a straightforward way to protect endpoints outside of your VPN tunnel and can be a great complement to a well-planned site-to-site VPN strategy.