Journalist
Yes, you can set up a site-to-site VPN using a Ubiquiti EdgeRouter. In this guide I’ll walk you through a practical, battle-tested workflow to connect two networks securely over the public internet. You’ll get a clear step-by-step setup, real-world tips, common pitfalls to avoid, monitoring pointers, and a solid FAQ so you can get your tunnels up fast. If you’re after extra privacy while you work, you can check this NordVPN deal and save a ton on protection for your devices and data:
Useful resources you might find handy as you go unlinked here, just text:
– Ubiquiti EdgeRouter official documentation – help.ui.com/docs
– EdgeOS CLI reference – help.ubiquiti.com
– Ubiquiti Community – edgerouter forum posts and setups
– IPsec basics and best practices from en.wikipedia.org/wiki/IPsec
– Practical home networking tutorials – reddit.com/r/HomeNetworking
What is a Ubiquiti edgerouter site to site vpn?
A site-to-site VPN creates an encrypted tunnel between two networks, letting devices on one network reach devices on the other as if they were on the same LAN. With a Ubiquiti EdgeRouter, you configure IPsec tunnels that secure traffic between two EdgeRouter devices or between an EdgeRouter and another IPsec-capable device. This is ideal for connecting a remote office, a data center, or even a lab network to your home or another office without exposing traffic to the internet.
Why EdgeRouter for this job? It’s cost-effective, rock-solid for routing, and gives you granular control over how traffic moves between sites. It supports multiple tunnel configurations, dynamic DNS for remote sites, and a robust firewall to keep traffic in check. In practical terms, you’ll define:
- Phase 1 IKE settings: how the two peers authenticate and agree on a secure channel.
- Phase 2 IPsec settings: the actual encryption and what traffic goes through the tunnel.
- Tunnel endpoints: which subnets at each site are allowed to flow across the VPN.
- Routing and firewall rules to ensure remote networks reach the right destinations.
Prerequisites
Before you start, line up these essentials:
- Two EdgeRouter devices EdgeRouter X, 4, 6, 6P, or similar with current EdgeOS firmware.
- Public IP addresses on both ends or a public IP and a reliable dynamic DNS setup if you don’t have static IPs.
- Each site’s LAN subnets that you want reachable across the VPN for example, 192.168.1.0/24 atSite A and 192.168.2.0/24 atSite B.
- A strong pre-shared key PSK for IPsec, or a certificate-based approach if you’re set up for it.
- A firewall rule to allow IPsec traffic UDP ports 500 and 4500, and ESP.
Tips:
- If you have dynamic IPs on either end, pair the EdgeRouter with a reliable dynamic DNS service to keep the tunnel from breaking when the public IP changes.
- Plan for redundancy: consider two tunnels or a backup site in case one link goes down.
Topology and planning
Think through how you want traffic to flow: Youtube vpn chrome
- Hub-and-spoke: one central site hub connects to multiple remote sites spokes.
- Fully meshed: every site connects to every other site more complex, but very flexible.
- One-way vs two-way traffic: decide if only certain subnets need access or if all traffic should cross the VPN.
Key planning questions:
- Which subnets at each site should be reachable via IPsec?
- Do you need split-tunneling only specific subnets cross the VPN or full-tunneling all traffic goes through the VPN?
- Should you enable NAT on the VPN path or keep internal subnets private and avoid NAT for VPN traffic?
- Will you use dynamic DNS for the remote site, and how will you keep the peer configuration in sync if the remote IP changes?
Step-by-step setup guide
Note: The commands below are representative for EdgeOS-based EdgeRouter devices. Adjust IP addresses and names to suit your network.
- Gather your network details
- Site A HQ: Local subnet 192.168.1.0/24, public IP 203.0.113.10
- Site B Remote: Local subnet 192.168.2.0/24, public IP 198.51.100.20
- Remote site public IP: 198.51.100.20 Site B
- Remote site subnet: 192.168.2.0/24
- Create IKE Phase 1 group and ESP Phase 2 group
- This defines how the two sides authenticate and what cryptography they use.
- Example IKE Group and ESP Group names can be whatever you like:
set vpn ipsec ike-group IKE-GRP-1 proposal 1 encryption aes256
set vpn ipsec ike-group IKE-GRP-1 proposal 1 hash sha256
set vpn ipsec ike-group IKE-GRP-1 proposal 1 dh-group 14
set vpn ipsec ike-group IKE-GRP-1 lifetime 3600
set vpn ipsec esp-group ESP-GRP-1 proposal 1 encryption aes256
set vpn ipsec esp-group ESP-GRP-1 proposal 1 hash sha256
set vpn ipsec esp-group ESP-GRP-1 lifetime 3600
set vpn ipsec esp-group ESP-GRP-1 pfs enable
- Create the IPsec site-to-site peer Site A and Site B
-
At Site A HQ you’ll point to Site B’s public IP and vice versa. Edgerouter x vpn passthrough and OpenVPN/IPsec/L2TP Traffic Pass-Through Guide for EdgeRouter X
-
HQ config Site A:
set vpn ipsec site-to-site peer 198.51.100.20 authentication mode pre-shared-secret
set vpn ipsec site-to-site peer 198.51.100.20 authentication pre-shared-secret S3cureP$K
set vpn ipsec site-to-site peer 198.51.100.20 ike-group IKE-GRP-1
set vpn ipsec site-to-site peer 198.51.100.20 esp-group ESP-GRP-1
set vpn ipsec site-to-site peer 198.51.100.20 tunnel 1 local-subnet 192.168.1.0/24
set vpn ipsec site-to-site peer 198.51.100.20 tunnel 1 remote-subnet 192.168.2.0/24
set vpn ipsec site-to-site peer 198.51.100.20 local-address 203.0.113.10
set vpn ipsec site-to-site peer 198.51.100.20 remote-address 198.51.100.20 -
Remote config Site B mirror:
set vpn ipsec site-to-site peer 203.0.113.10 authentication mode pre-shared-secret
set vpn ipsec site-to-site peer 203.0.113.10 authentication pre-shared-secret S3cureP$K
set vpn ipsec site-to-site peer 203.0.113.10 ike-group IKE-GRP-1
set vpn ipsec site-to-site peer 203.0.113.10 esp-group ESP-GRP-1
set vpn ipsec site-to-site peer 203.0.113.10 tunnel 1 local-subnet 192.168.2.0/24
set vpn ipsec site-to-site peer 203.0.113.10 tunnel 1 remote-subnet 192.168.1.0/24
set vpn ipsec site-to-site peer 203.0.113.10 local-address 198.51.100.20
set vpn ipsec site-to-site peer 203.0.113.10 remote-address 203.0.113.10
- Allow VPN traffic through the WAN firewall
- You want the IPsec control traffic ISAKMP UDP 500, NAT-T UDP 4500, and ESP to reach the IPsec software:
set firewall name WAN_LOCAL rule 10 action accept
set firewall name WAN_LOCAL rule 10 protocol udp
set firewall name WAN_LOCAL rule 10 destination port 500,4500
set firewall name WAN_LOCAL rule 20 action accept
set firewall name WAN_LOCAL rule 20 protocol 50 # ESP
- Apply the firewall to the WAN interface:
set interfaces ethernet eth0 firewall in WAN_LOCAL
If you have another WAN interface, apply similarly.
- Ensure the tunnel comes up and traffic routes through it
- After applying the above, bring the tunnel up and verify:
show vpn ipsec sa
show vpn ipsec status - Then add static routes so traffic to the remote subnet goes through the VPN tunnel:
set protocols static route 192.168.2.0/24 next-hop
set protocols static route 192.168.2.0/24 distance 110 - If your EdgeRouter supports it, you may point the route at the tunnel interface, e.g., tun0, instead of a next-hop IP. Check your device’s routing table to pick the right option.
- Test connectivity
- From a host on Site A, ping a host on Site B e.g., 192.168.2.10.
- From Site B to Site A e.g., 192.168.1.10.
- If pings fail, check:
- Phase 1 and Phase 2 negotiation in the VPN status
- Firewall rules both at the EdgeRouter and on host endpoints
- Subnet overlap or routing issues
- Optional: dynamic DNS and backup
- If you’re using dynamic public IPs, add a Dynamic DNS entry and update the remote peer with the current IP when it changes.
- Consider a secondary VPN tunnel tunnel 2 for redundancy:
set vpn ipsec site-to-site peer 198.51.100.21 ike-group IKE-GRP-1
set vpn ipsec site-to-site peer 198.51.100.21 esp-group ESP-GRP-1
set vpn ipsec site-to-site peer 198.51.100.21 tunnel 2 local-subnet 192.168.1.0/24
set vpn ipsec site-to-site peer 198.51.100.21 tunnel 2 remote-subnet 192.168.2.0/24
- Monitoring and ongoing maintenance
-
Regularly check: Turn off vpn chrome
- VPN SA Security Association status and uptime
- Logs for negotiation errors and dropped packets
- Firewall hit counts to ensure legitimate VPN traffic isn’t blocked
-
Schedule periodic tests to ensure the tunnel remains healthy and traffic routes correctly.
-
If you’re seeing Phase 1 failures, verify time synchronization on both devices. A skewed clock can cause IKE negotiations to fail.
-
If you see Phase 2 failures, re-check ESP proposals and ensure the same encryption, hash, and PFS settings are on both sides.
Common pitfalls and troubleshooting
- Mismatched IKE/ESP settings: Always ensure both sides use the same encryption, hash, and DH groups.
- Subnet overlap: If two sites have overlapping networks, traffic may never route cleanly across the tunnel. Rework the addressing or use NAT to separate traffic.
- Dynamic IPs without DDNS: Without a reliable dynamic DNS setup, the tunnel can drop whenever the remote IP changes.
- NAT-T issues: Some networks require NAT traversal to be enabled. verify if your ISP or firewall modifies traffic in a way that requires NAT-T.
- Firewall misconfigurations: A missing rule permitting IPsec traffic will keep the tunnel from forming. Always verify both the WAN firewall and site-to-site firewall rules.
- Monitoring gaps: If you don’t monitor the tunnel, you might miss failures until users complain. Regular automated checks help catch issues early.
Security best practices
- Use strong PSK or certificate-based authentication. If you can, certificate-based authentication is more scalable for multi-site deployments.
- Enable Perfect Forward Secrecy PFS for IPsec phase 2 to prevent past sessions from being compromised if a key is later exposed.
- Prefer AES-256 over AES-128 and SHA-256 over SHA-1 for stronger cryptographic integrity.
- Keep firmware updated on both EdgeRouters to benefit from the latest security patches and improvements.
- Disable unused services and minimize exposed management interfaces to reduce attack surface.
Performance considerations
- EdgeRouter models vary in throughput. For simple hub-and-spoke setups with modest traffic, an EdgeRouter 4 or 6P handles IPsec with ease. For heavier loads or multiple concurrent tunnels, consider higher-end models or a dedicated VPN hardware option.
- Encryption overhead reduces raw throughput. If you’re pushing gigabit-equivalent speeds, test under real load to confirm you’re meeting expectations.
- Network design matters. Splitting traffic efficiently split-tunneling not only protects bandwidth but also reduces the amount of data that must be encrypted across the tunnel.
Advanced topics
- Redundant tunnels and load balancing: Run multiple IPsec tunnels to the same remote site or to multiple remote sites and use routing policies to balance traffic.
- Multi-site, multi-hub: For a growing network of offices, plan a hub-and-spoke topology with a central site acting as the hub and others as spokes.
- Dynamic DNS for remote sites: If you don’t have static IPs, use a reliable dynamic DNS service and configure the remote peer accordingly to maintain connectivity.
Frequently Asked Questions
1. What is a site-to-site VPN?
A site-to-site VPN creates a secure, encrypted tunnel between two networks over the internet, letting devices on either side talk as if they’re on the same LAN.
2. Can EdgeRouter handle IPsec site-to-site VPNs?
Yes. EdgeRouter devices run EdgeOS, which supports IPsec site-to-site VPNs with flexible IKE/ESP configurations and multiple tunnels. Why does vpn automatically turn on and how to control auto-connect on Windows, macOS, iOS, and Android
3. Do both sites need static IPs?
Not necessarily. If you don’t have static IPs, you can use dynamic DNS on at least one end and configure the other end accordingly. However, static IPs simplify the setup and reliability.
4. Which authentication method should I use?
PSK pre-shared key is the simplest to implement. Certificate-based authentication offers better scalability and security, especially for larger deployments.
5. How do I test if the VPN tunnel is up?
Check the VPN status on the EdgeRouter show vpn ipsec sa or show vpn ipsec status. Ping devices on the remote network and inspect firewall logs to verify traffic is allowed.
6. What should I do if Phase 1 negotiation fails?
Ensure clocks are synchronized, verify the PSK on both sides, and confirm that both ends use identical IKE group settings and keep-alive settings.
7. How can I monitor IPsec performance over time?
Monitor uptime, SA lifetimes, and throughput. Use the EdgeRouter logs to detect renegotiation or tunnel drops and set up alerts if available. Best edge vpn extension free
8. Is NAT required for site-to-site VPNs?
It depends on your network design. NAT is sometimes used on one side if the VPN peers don’t have global addressing compatible with the remote LAN. When possible, avoid NAT on VPN traffic to prevent translation issues.
9. Can I have more than one VPN tunnel between sites?
Yes. You can configure multiple tunnels e.g., to different peer devices or for redundancy. Use separate tunnel indices and appropriate routing rules.
10. How do I handle overlapping subnets?
Avoid overlapping subnets. If you must, readdress one side or implement NAT rules carefully to prevent traffic conflicts. A non-overlapping design is much easier to manage.
11. Do I need to open additional ports on my firewall for IPsec?
The core ports are UDP 500 IKE, UDP 4500 NAT-T, and ESP protocol 50. Ensure these are allowed in your firewall. otherwise, the tunnel will fail to negotiate.
12. Can I switch from IPsec to a newer protocol like WireGuard on EdgeRouter?
EdgeRouter devices traditionally use IPsec. If you’re looking for WireGuard, you’ll want a device or OS support that explicitly includes it, as EdgeOS IPsec remains the standard for most EdgeRouter deployments. Browser vpn vs vpn
If you’re ready to optimize your remote network connectivity with a solid Ubiquiti EdgeRouter site-to-site VPN, you’ve got a practical blueprint here. The steps balance real-world practicality with a focus on security, reliability, and maintainability. And if you’re shopping for extra protection and privacy beyond the tunnel, the NordVPN deal linked above is a quick way to add another layer of security across all your devices.