Journalist 
Yes, you can set up a site-to-site VPN on a Ubiquiti EdgeRouter X. In this guide I’ll walk you through a practical, step-by-step process to configure IPsec site-to-site VPN between an EdgeRouter X and a remote gateway, cover common pitfalls, provide real-world examples, and share tips to keep the tunnel reliable. If you’re serious about securing all inter-site traffic, this post has you covered—from prerequisites and topology to firewall rules and troubleshooting. And if you’re looking for extra privacy for admin access or off-site management, you might want to check this NordVPN deal: . NordVPN offer: 77% OFF + 3 Months Free.
Useful resources text only, not clickable:
- Ubiquiti EdgeRouter X Official Documentation – docs.ubiquiti.com
- EdgeRouter X User Guide – help.ubiquiti.com
- IPsec Concepts and VPN Best Practices – en.wikipedia.org/wiki/Virtual_private_network
- OpenVPN vs IPsec for site-to-site – searchenginejournal.com
- Networking best practices for small offices – smallbusinesshorizon.org
Introduction: what you’ll learn in this guide Hoxx vpn edge review 2025: features, performance, privacy, price, setup guide, and alternatives
- Yes, you can set up a site-to-site VPN on a Ubiquiti EdgeRouter X.
- This article provides a practical, end-to-end approach: planning, topology, IP addressing, CLI and GUI steps, firewall and NAT rules, routing, testing, and common troubleshooting tips.
- You’ll find two parallel paths: a GUI-based setup for quick deployments and a CLI-based setup for more control and repeatability.
- By the end, you’ll be able to deploy a reliable IPsec tunnel, handle overlapping subnets, ensure NAT exemptions, and monitor the tunnel health.
- Real-world tips: how to avoid common blocking rules, what to do if the peer uses dynamic IPs, and how to optimize for performance.
- If you want extra privacy for remote admin work, consider trusted services like NordVPN via the banner above for secure management sessions.
What is a site-to-site VPN and why EdgeRouter X
- A site-to-site VPN IPsec creates an encrypted tunnel between two networks, letting devices on either side communicate as if they were locally connected.
- EdgeRouter X is a compact, affordable router that supports IPsec and can be configured via EdgeOS CLI or GUI. It’s ideal for small offices and remote sites.
- IPsec offers strong protection for data in transit between sites, with options for AES encryption, SHA-256 hashing, and robust authentication via pre-shared keys or certificates.
- When used correctly, site-to-site VPNs reduce exposure to the public internet, simplify remote access for branch offices, and help you centralize resource sharing.
Prerequisites and network diagram
- Hardware and firmware:
- Ubiquiti EdgeRouter X unified gateway at site A or B
- Latest EdgeOS firmware installed check Ubiquiti’s site for updated builds
- Network basics:
- Public WAN IPs for both sites static preferred. dynamic with a dynamic DNS workaround if needed
- Private LAN subnets at both sites e.g., Site A: 192.168.10.0/24, Site B: 192.168.20.0/24
- VPN tunnel endpoints defined by public IPs
- Security and routing basics:
- Pre-shared key PSK or certificate-based authentication for the IPsec tunnel
- Correct firewall rules to allow VPN traffic ESP, ISAKMP/IKE, UDP 500/4500, etc.
- Static routes or dynamic routing in your network to ensure traffic destined for the remote LAN goes through the VPN
- Common gotchas:
- NAT on the path you’re using for admin access shouldn’t interfere with VPN traffic
- Subnet overlap between sites must be avoided or carefully planned
- If either site sits behind double NAT, you’ll need NAT-T and port-forwarding where applicable
EdgeRouter X basics you should know
- EdgeOS vs GUI vs CLI:
- The EdgeRouter X can be managed via the graphical user interface GUI in EdgeOS or via SSH/console with the CLI. The GUI is friendlier for quick setups, while the CLI provides precise control and repeatability for complex topologies.
- IPsec at a glance:
- You’ll define an IPsec “IKE group” IKE phase 1 settings, an ESP/IPsec “proposal” phase 2 settings, and the “site-to-site peer” the remote gateway to tie everything together.
- Firewall zones and NAT:
- Create firewall rules that explicitly permit IPsec negotiation and tunnel traffic.
- Add NAT exemption so traffic destined for the remote LAN doesn’t get NATed on either side.
- Naming conventions:
- Use clear, consistent names: e.g., IKE-GROUP IKE-2, ESP-GROUP ESP-2, PEER SITE-B, etc. This makes troubleshooting much easier.
Step-by-step guide: configuring a site-to-site VPN on EdgeRouter X
Note: The exact values IP addresses, subnets, keys must be replaced with your real network details. The commands below are representative and should be adapted to your environment.
GUI-based setup quick path Browsec vpn microsoft edge
- Access EdgeRouter X GUI:
- Open a browser and go to the EdgeRouter X’s IP address on your LAN.
- Log in with admin credentials.
- Create the VPN – IPsec:
- Navigate to VPN > IPsec.
- Create IKE Group IKEv2 recommended. if not available, IKEv1 is fine with compatible peers:
- Name: IKE-GROUP-DEFAULT
- Encryption: aes256
- Hash: sha256
- Lifetime: 28800
- DH Group: 14 2048-bit or optimal for your hardware
- Create ESP Group:
- Name: ESP-GROUP-DEFAULT
- Lifetime: 3600
- Define the remote peer site B:
- Peer IP: remote public IP
- Authentication: Pre-Shared Key
- PSK: your-strong-key
- IKE Group: IKE-GROUP-DEFAULT
- ESP Group: ESP-GROUP-DEFAULT
- Local LAN: 192.168.10.0/24
- Remote LAN: 192.168.20.0/24
- Firewall/NAT exemptions:
- Create a firewall rule to allow ESP 50 and AH 51 traffic, and IKE UDP 500 and NAT-T UDP 4500 as needed.
- Add NAT exemption for traffic destined for 192.168.20.0/24 Site B and 192.168.10.0/24 Site A so VPN traffic isn’t NATed.
- Apply and test:
- Save, apply, and use the “Test” or “Ping” features to test connectivity across the VPN.
CLI-based setup for control and repeatability
The following commands are examples. replace PLACEHOLDER values with your real data subnets, IPs, PSK, etc..
-
Enter configuration mode:
configure -
Define IKE and ESP groups IKE Phase 1 and Phase 2:
set vpn ipsec ike-group IKE-GROUP-DEFAULT proposal 1 encryption aes256
set vpn ipsec ike-group IKE-GROUP-DEFAULT proposal 1 hash sha256
set vpn ipsec ike-group IKE-GROUP-DEFAULT lifetime 28800
set vpn ipsec esp-group ESP-GROUP-DEFAULT proposal 1 encryption aes256
set vpn ipsec esp-group ESP-GROUP-DEFAULT proposal 1 hash sha256
set vpn ipsec esp-group ESP-GROUP-DEFAULT lifetime 3600 -
Define the remote peer and tunnel:
set vpn ipsec site-to-site peer REMOTE-PUBLIC-IP authentication mode pre-shared-secret
set vpn ipsec site-to-site peer REMOTE-PUBLIC-IP authentication pre-shared-secret ‘YOUR_PSKEY’
set vpn ipsec site-to-site peer REMOTE-PUBLIC-IP ike-group IKE-GROUP-DEFAULT
set vpn ipsec site-to-site peer REMOTE-PUBLIC-IP default-esp-group ESP-GROUP-DEFAULT
set vpn ipsec site-to-site peer REMOTE-PUBLIC-IP local-address YOUR-EDGE-HAS-WAN-IP
set vpn ipsec site-to-site peer REMOTE-PUBLIC-IP tunnel 1 local prefix 192.168.10.0/24
set vpn ipsec site-to-site peer REMOTE-PUBLIC-IP tunnel 1 remote prefix 192.168.20.0/24 -
NAT exemption don’t NAT VPN traffic:
set firewall modify NETWORK-ADDRESS-TRANSLATION rule 1000 description ‘NAT exemption for VPN’
set firewall modify NETWORK-ADDRESS-TRANSLATION rule 1000 not line-filter Is edge vpn good reddit for privacy, speed, reliability, and edge computing use casesSet firewall modify NETWORK-ADDRESS-TRANSLATION rule 1000 rule 0 source address 192.168.10.0/24
set firewall modify NETWORK-ADDRESS-TRANSLATION rule 1000 rule 0 destination address 192.168.20.0/24 -
Define the WAN and LAN interfaces if not already:
set interfaces ethernet eth0 description ‘WAN’
set interfaces ethernet eth1 description ‘LAN’
set interfaces ethernet eth0 address ‘YOUR_WAN_IP/24’
set interfaces ethernet eth1 address ‘192.168.10.1/24’ -
Add static route optional if not using dynamic routing:
set protocols static route 192.168.20.0/24 next-hop 0.0.0.0 distance 1 -
Commit and save:
commit
save
exit
Tips for success with EdgeRouter X IPSec VPN Edgerouter x site to site vpn
- Pick a stable topology:
- If possible, keep subnets on each site non-overlapping e.g., 192.168.10.0/24 vs 192.168.20.0/24. If you must overlap, plan a NAT or route-based approach and be prepared to address route leakage.
- Use a strongPSK and rotate it periodically:
- For production, consider certificates if you have webhook or centralized management.
- Optimize for performance:
- AES256 and SHA256 provide a solid balance of security and performance on EdgeRouter X.
- Check the device’s CPU load during VPN negotiation. EdgeRouter X has modest headroom, so avoid overloading it with additional VPN tunnels or heavy routing.
- NAT traversal and dynamic IPs:
- If the remote site has a dynamic IP, use dynamic DNS or a VPN peer that supports dynamic endpoints. NAT-T helps when the path uses NAT between sites.
- Troubleshooting quick checks:
- Double-check firewall rules: allow UDP 500, UDP 4500, and ESP 50 on both sides.
- Confirm that the remote gateway accepts your PSK and that the IKE and ESP groups match on both sides.
- Look at log messages System > Logging for VPN negotiation errors and fix mismatches promptly.
- Validate routes on both sides to ensure traffic is being routed through the tunnel.
Common pitfalls and troubleshooting tips
- Subnet mismatch:
- If you see no traffic across the tunnel, verify that the local and remote LAN prefixes are correct and that the remote site actually uses those prefixes.
- NAT issues:
- If VPN traffic is getting NATed, ensure NAT exemptions are properly configured so VPN peers see the true endpoints.
- Phase 1/Phase 2 negotiation failures:
- Ensure IKE group and ESP group match exactly on both sides. A single mismatch will halt the tunnel.
- Dynamic IP on either side:
- If one end uses a dynamic IP, you’ll want to rely on a DDNS service or a VPN peer that supports dynamic endpoints with proper keepalive.
- Firewall misconfigurations:
- Avoid overly broad rules that could inadvertently allow traffic that conflicts with VPN security goals. Keep rules specific to VPN traffic.
Security considerations
- Use strong authentication:
- Prefer long, random PSKs. consider certificates if your infrastructure supports it.
- Harden firewall rules:
- Only allow necessary VPN traffic ESP, ISAKMP, UDP ports as required and restrict admin access to trusted networks.
- Monitor VPN health:
- Enable logging for VPN events and periodically check for dropped tunnels or rekey events.
- Regular maintenance:
- Keep EdgeRouter X firmware up to date, review VPN configs after network changes, and rotate keys on a schedule.
Performance considerations
- Encryption overhead:
- AES256 is secure, but AES128 can be faster on some hardware. Test and choose the right balance for your devices and traffic volume.
- Tunnel uptime:
- If you require high uptime, configure dead-peer detection DPD and keepalive settings so the tunnel recovers quickly after a transient outage.
- Traffic shaping:
- If you’re running multiple services through the VPN, consider prioritizing critical business traffic to ensure VPN performance remains stable during peak times.
Frequently Asked Questions
- What is the EdgeRouter X, and can it handle IPsec site-to-site VPN?
- The EdgeRouter X is a versatile, affordable router that supports IPsec site-to-site VPNs, making it suitable for small offices and branch sites.
- How does a site-to-site VPN differ from a remote access VPN on EdgeRouter X?
- A site-to-site VPN connects two networks so devices on either side can communicate as if directly connected. Remote access VPN lets individual users connect securely to a central network from anywhere.
- Can I use the GUI to configure the IPsec VPN, or do I need the CLI?
- Both options work. The GUI is quick and user-friendly for standard setups, while the CLI gives you more control and is great for complex topologies.
- What should I do if the tunnel keeps dropping?
- Check: IPsec SA status, IKE negotiation logs, firewall rules, NAT exemptions, and possible dynamic IP changes on either end. Re-key intervals and DPD settings can also impact stability.
- How do I handle overlapping subnets between sites?
- Overlaps require careful planning. Use non-overlapping subnets where possible, or implement NAT for the VPN path or route-based configurations to differentiate traffic.
- Which encryption and hashing should I choose for the VPN?
- AES256 with SHA-256 is a solid, widely supported choice for EdgeRouter X. If you have performance issues, you can test AES128 with SHA-256 as an alternative.
- Do I need a certificate-based VPN, or is PSK enough?
- PSK is simpler and fine for many small deployments. Certificates add a layer of scalability and automation, especially in larger networks.
- How can I verify that traffic is actually flowing through the VPN tunnel?
- Use ping tests across the remote LAN, check the VPN status in EdgeOS, and review the IPsec SA table to confirm active tunnels and data flow.
- How do I add a second VPN tunnel to another remote site?
- Repeat the IKE/ESP group definitions and create a separate site-to-site peer with its own local/remote networks. Ensure firewall rules and routes reflect the second tunnel.
- What about NAT on the LAN side—will it affect VPNs?
- NAT can degrade VPN reliability if not handled with NAT exemptions for VPN traffic. Ensure VPN traffic is not NATed as it traverses the tunnel.
- How can I monitor VPN health over time?
- Enable logging for VPN events and set up alerts if the tunnel goes down. Periodically review performance metrics and rekey events.
Conclusion note: the guide does not include a separate conclusion section Как включить vpn
- With the steps above, you should be able to configure a robust site-to-site IPsec VPN on EdgeRouter X, handle typical roadblocks, and maintain stable inter-site connectivity.
- If you want extra privacy while managing the network or when connecting off-site, the NordVPN offer in the introduction can be a helpful add-on for secure management sessions.