Table of Contents

Ubiquiti edgerouter x vpn site to site setup guide: how to configure IPsec site-to-site VPN on EdgeRouter X for secure inter-site links

Yes, Ubiquiti EdgeRouter X supports site-to-site VPN using IPsec. In this guide, I’ll walk you through planning a robust site-to-site setup, configuring EdgeRouter X at both ends via CLI and GUI, and testing the tunnel to ensure your remote networks talk securely. You’ll get practical steps, common pitfalls, and real-world tips so you can get a stable, maintainable connection without headaches. Plus, if you’re testing VPNs and want extra privacy while you experiment, check out this NordVPN deal: . It’s a solid option to add privacy to your lab environment.

Useful resources you might want to keep handy unlinked here for readability:

EdgeRouter X official docs: edge-router-documentation-url
EdgeOS CLI reference: edgeos-cli-reference-url
IPsec overview: en.wikipedia.org/wiki/IPsec
Ubiquiti Community forums: community.ubnt.com
Basic networking concepts for subnet planning: en.wikipedia.org/wiki/Subnetting

What you’ll learn in this article

How IPsec site-to-site VPN works on the EdgeRouter X
How to plan your topology and subnet design to avoid conflicts
Step-by-step CLI configuration with a template you can copy-paste
Step-by-step GUI configuration EdgeRouter UI
How to verify and troubleshoot the tunnel
Security considerations and best practices
Common mistakes and how to fix them
Real-world numbers on EdgeRouter X performance and VPN throughput

EdgeRouter X and IPsec site-to-site VPN: quick overview

The EdgeRouter X is a compact, budget-friendly router with five Gigabit ports and a capable EdgeOS layer that supports IPsec site-to-site VPNs. For small remote sites or branch offices, IPsec tunnels let you connect two networks as if they were on the same LAN, while keeping traffic encrypted across the internet. The VPN works best when both sides share a stable public IP address, compatible subnets, and a strong pre-shared key PSK or, in some setups, certificates.

Key takeaways:

IPsec site-to-site provides encrypted tunnels between two networks.
You’ll typically define: local subnets, remote subnets, the peer’s public IP, and an authentication method PSK or certificate.
EdgeRouter X can handle one or more site-to-site tunnels, depending on your CPU load and how you route traffic between networks.

Performance notes:

The EdgeRouter X is a budget router with solid routing capabilities. Real-world VPN throughput varies: expect hundreds of Mbps with AES-128 or AES-256, depending on cipher choices, tunnel count, and device loads. If you’re running multiple tunnels or heavy NAT, performance can dip, so plan accordingly.
Always reserve headroom for other tasks on the router QoS, firewall rules, and NAT processing.

prerequisites and planning

Before you dive into the config, do some planning:

Public IPs: Each site needs a static or reliably resolvable public IP. If you have dynamic IPs, consider a dynamic DNS option on each side.
Subnets: Use non-overlapping subnets for local networks e.g., 192.168.1.0/24 at Site A and 192.168.2.0/24 at Site B to avoid routing confusion.
PSK or certificates: For simplicity and quick lab setups, a long, random PSK is fine. For larger deployments, certificate-based authentication is safer but more complex.
Firewall and NAT: Plan to allow VPN traffic through the EdgeRouter’s firewall and ensure that traffic destined for the remote subnet isn’t NATed in a way that breaks the tunnel NAT-T can help in some scenarios, but it adds complexity.
Encryption and integrity: AES-256 with SHA-256 is a common, solid choice. keep DH group in line with your security requirements e.g., modp-2048 or higher for perfect forward secrecy, if supported by both ends.

step-by-step: CLI configuration EdgeOS

Below is a reliable, copy-friendly template you can adapt for your sites. Replace the placeholders with your actual values: LOCAL_SUBNET, REMOTE_SUBNET, LOCAL_PUBLIC_IP, REMOTE_PUBLIC_IP, and PSK. Unifi edgerouter-x vpn setup guide for site-to-site and remote access IPsec VPN on UniFi EdgeRouter X

Local site Site A
Remote site Site B
Replace values in square brackets with your details.

Enter configuration mode
configure
Define IKE and ESP parameters IKE group and ESP group
set vpn ipsec ike-group IKE-_DEFAULT proposal 1 encryption aes256
set vpn ipsec ike-group IKE-_DEFAULT proposal 1 hash sha256
set vpn ipsec ike-group IKE-DEFAULT proposal 1 dh-group 14
set vpn ipsec esp-group ESP-DEFAULT proposal 1 encryption aes256
set vpn ipsec esp-group ESP-DEFAULT proposal 1 hash sha256
commit
save
Configure the IPsec site-to-site peer Remote side
set vpn ipsec site-to-site peer REMOTE_PUBLIC_IP
set vpn ipsec site-to-site peer REMOTE_PUBLIC_IP authentication mode pre-shared-secret
set vpn ipsec site-to-site peer REMOTE_PUBLIC_IP authentication pre-shared-secret ‘YOUR_PSK_HERE’
set vpn ipsec site-to-site peer REMOTE_PUBLIC_IP ike-group IKE-DEFAULT
set vpn ipsec site-to-site peer REMOTE_PUBLIC_IP esp-group ESP-DEFAULT
set vpn ipsec site-to-site peer REMOTE_PUBLIC_IP local-address LOCAL_PUBLIC_IP
set vpn ipsec site-to-site peer REMOTE_PUBLIC_IP local-subnet LOCAL_SUBNET
set vpn ipsec site-to-site peer REMOTE_PUBLIC_IP remote-subnet REMOTE_SUBNET
set vpn ipsec site-to-site peer REMOTE_PUBLIC_IP install-policy
set vpn ipsec site-to-site peer REMOTE_PUBLIC_IP tunnel 1
Ensure IPsec interface is active and routing is in place
set vpn ipsec enable
set vpn ipsec interface eth0
Optional Add a firewall rule to allow VPN traffic if you haven’t already
set firewall name VPN-TRAFFIC rule 10 action accept
set firewall name VPN-TRAFFIC rule 10 protocol all L2tp vpn edgerouter
Exit configuration mode
exit

Notes:

The exact peer label REMOTE_PUBLIC_IP is a placeholder. Use the actual IP of the remote site.
You can create multiple peers if you’re linking more than two sites. copy the block and adjust IPs and subnets.
If your devices use different encryption preferences, adapt the IKE and ESP groups accordingly.

step-by-step: GUI configuration EdgeRouter UI

If you’re more comfortable with a UI, here’s how to set it up in the EdgeRouter web interface:

Log in to the EdgeRouter UI at the local IP usually https:///.
Go to the VPN section and choose IPsec. Free browser vpn edge
Add a new peer Remote Peer:

Remote Peer IP: the public IP of the remote site
Local Address: your site’s public IP
Local Subnet: your LAN subnet e.g., 192.168.1.0/24
Remote Subnet: the remote LAN subnet e.g., 192.168.2.0/24
Authentication: Pre-shared secret
PSK: your strong PSK

Choose IKE group and ESP group:

IKE group: AES256, SHA256, DH group 14 or your preferred settings
ESP group: AES256, SHA256

Save the peer, then make sure you select to enable the tunnel and set appropriate lifetime and rekey settings if your environment requires them.
Add a firewall rule if needed to allow IPsec traffic UDP 500, UDP 4500 for NAT-T, and IPsec ESP as required by your setup.
Apply and test connectivity:

From Site A, try pinging a host on Site B’s LAN e.g., ping 192.168.2.10.
Check the VPN status page for tunnel status.

testing, verification, and troubleshooting

Verification steps: How to use tunnelbear vpn on windows

CLI: show vpn ipsec sa
GUI: VPN status page should show “connected” or similar
Ping tests across subnets: Site A host to Site B host should respond
Check that routes on both sides know about the remote subnet

Common issues and fixes:

Mismatched subnets: double-check LOCAL_SUBNET and REMOTE_SUBNET on both ends.
PSK mismatch: re-enter the pre-shared secret on both sides.
NAT or firewall blocks: ensure UDP 500 and 4500 are allowed if NAT-T is used. ensure ESP traffic is permitted by firewall rules.
Dynamic IPs: if either side uses dynamic IP, you’ll need a dynamic DNS setup and possibly a firewall hole punching approach or frequent rekeying.
DNS leaks and testing: while site-to-site VPN is about traffic between sites, DNS queries might reveal internal domains. consider DNS over VPN to avoid leakage.

Performance and optimization tips:

Use AES-256 with SHA-256 if you want strong security, but be aware of potential performance trade-offs on the EdgeRouter X. AES-128 might offer better throughput with minimal risk for most home or small office setups.
Keep the number of tunnels to a minimum on a budget device. more tunnels mean more CPU load.
If you’re running additional services firewall, NAT, QoS, measure baseline performance before adding VPN tunnels.

Security considerations:

Always use a strong PSK randomly generated, at least 16-24 characters.
Rotate keys periodically and use longer lifetimes for newly created tunnels only if your environment demands it.
Disable unused services and ensure administrative access is secured strong password, SSH keys if possible, and consider disabling WAN access to the UI from the internet.

testing multiple tunnels and scaling multi-site networks

If you’re connecting more than two sites:

Each site-to-site tunnel is independent. you can add more peers with their own local/remote subnets and PSK.
Plan an outward-directed routing strategy: use static routes or dynamic routing protocols if you anticipate complex paths.
Ensure you have enough CPU headroom on the EdgeRouter X. for many tunnels, you might consider a higher-end EdgeRouter model or a dedicated VPN appliance for throughput reliability.

advanced topics you might consider

Dynamic DNS for remote peers: If you don’t have static public IPs, configure dynamic DNS on both sites and update the EdgeRouter settings accordingly.
Certificate-based authentication: For larger deployments, moving from PSK to certificates improves security. you’ll need a PKI setup and proper certificate exchange on both ends.
Site-to-site with different IKEv2 settings: If the other end supports IKEv2 with certificates, that can improve reliability and performance. ensure both sides agree on SA lifetimes and transform sets.
Split-tunnel vs full-tunnel: Decide whether all traffic should go through the VPN or only traffic destined for the remote subnet. This affects routing, latency, and CPU usage on the EdgeRouter X.

performance and real-world numbers

Routing throughput: EdgeRouter X commonly provides up to around 1 Gbps of routing throughput under ideal conditions. real-world performance often sits below that depending on features enabled.
IPsec VPN throughput: Expect a few hundred Mbps on AES-256 with optimal conditions. with multiple tunnels or heavier firewall rules, the VPN performance can drop noticeably.
Real-world testing examples show that a single IPsec tunnel on EdgeRouter X often stays in the 150–300 Mbps range for AES-256, depending on traffic mix and CPU load.

frequently asked questions

Can EdgeRouter X do site-to-site VPN?

Yes. EdgeRouter X supports IPsec site-to-site VPNs, allowing you to connect two remote networks over the internet. Can youtube detect vpn and how it works for YouTube privacy, streaming, and geo-restriction workarounds

What do I need to configure a site-to-site VPN?

You need two things: 1 public IPs at both sites or reliable dynamic DNS if IPs change, 2 non-overlapping subnets for both local networks, and 3 an authentication secret PSK or certificates plus compatible IKE/ESP settings.

Should I use PSK or certificates for authentication?

For small setups and quick lab work, a strong pre-shared key PSK is fine. For larger deployments, certificates provide better security and easier key management.

How do I verify that the tunnel is up?

On EdgeRouter X, you can use the CLI command show vpn ipsec sa or check the VPN status page in the GUI. You should see an active tunnel and a tunnel association SA listed.

Why isn’t traffic routing over the VPN?

Common culprits include mismatched local/remote subnets, firewall rules blocking VPN traffic, NAT causing issues with remote subnets, or the tunnel being down due to PSK or IKE/ESP group mismatches.

How can I test cross-site connectivity quickly?

Ping an address in the remote subnet from a host on the local subnet. If ping works, routing and VPN configuration are likely correct. Tunnelbear vpn rating and comprehensive guide: performance, security, pricing, and user reviews

Can I run more than one VPN tunnel on EdgeRouter X?

Yes, you can configure multiple IPsec site-to-site tunnels, but each tunnel consumes CPU resources. Validate performance with real traffic to ensure you don’t overload the device.

What’s the difference between a site-to-site VPN and a remote-access VPN?

Site-to-site VPN connects two fixed networks to share resources. remote-access VPN lets individual devices connect to a central network as clients. This guide focuses on site-to-site VPN.

How do I troubleshoot intermittently dropping VPN connections?

Check: 1 PSK consistency, 2 SA lifetimes and rekey settings on both sides, 3 firewall rules and NAT, 4 public IP reachability, and 5 device CPU load during VPN activity.

Can I use EdgeRouter X for multi-site routing with dynamic routing protocols?

EdgeRouter X can route traffic between subnets and supports static routes and basic routing configurations. you can extend it with routing configurations, but very large meshes might benefit from more powerful devices or dedicated VPN appliances.

What if the other end uses a different VPN device Cisco, Juniper, etc.?

IPsec is standardized, but you’ll want to ensure SA proposals match encryption, hash, DH group, and lifetimes. Align your IKE and ESP settings on both sides and test with a basic tunnel before expanding to additional sites. Vpn for edge reddit: The Ultimate Guide to Using a VPN with Edge Browser for Reddit Privacy, Access, and Security

How often should I rotate my PSK?

A good practice is to rotate PSKs every 6–12 months, or sooner if you suspect a compromise. Use strong, random keys and document changes carefully.

Is site-to-site VPN secure enough for sensitive data?

When properly configured strong encryption, correct subnet planning, updated firmware, and secure PSKs or certificates, IPsec site-to-site VPN is a robust and widely used solution for inter-site connectivity.

useful URLs and resources for quick reference

EdgeRouter X official documentation: https://help.ui.com/hc/en-us/articles/204244326-EdgeRouter
EdgeRouter EdgeOS CLI reference: https://help.ui.com/hc/en-us/articles/20420872-EdgeRouter-EdgeOS-CLI-Reference
IPsec overview: https://en.wikipedia.org/wiki/IPsec
Ubiquiti Community forums: https://community.ubnt.com/
General VPN concepts and best practices: https://www.cisco.com/c/en/us/support/docs/ipsec-vpn/ipsec-vpn-connectivity/13837-3.html

Intune per app vpn edge setup guide for securing per-app VPN connections across Windows, Mac, iOS, and Android

Best free vpn microsoft edge

Ubiquiti edgerouter x vpn site to site