Ubiquiti Edgerouter X VPN Site to Site: a practical guide to connecting two networks securely, with simple steps, real-world tips, and troubleshooting so you can get things up and running fast.

A quick fact: Ubiquiti Edgerouter X VPN Site to Site connections create a secure, encrypted tunnel between two remote networks, allowing devices on either side to communicate as if they were on the same LAN. This guide covers practical setup, common gotchas, and tips to keep your tunnel stable.

What you’ll learn

How to configure a site-to-site VPN on the Edgerouter X
Differences between IPsec and other VPN types and when to use them
How to verify a tunnel, test connectivity, and troubleshoot
Security considerations and best practices
Real-world tips to minimize downtime and simplify maintenance

Useful resources unclickable text
Ubiquiti official docs – ubnt.com
Edgerouter X product page – ui.com
IPsec basics – en.wikipedia.org/wiki/IPsec
VPN troubleshooting guide – example.com/vpn-troubleshooting
Network security best practices – csoonline.com

Table of Contents

Overview of Site-to-Site VPN on the Edgerouter X

The Edgerouter X is a compact, affordable router that supports IPsec site-to-site VPNs.
Typical use cases: connecting a branch office to headquarters, linking data centers, or creating a backup route for critical services.
Protocols: IPsec IKEv1/IKev2, ESP, and optional XAUTH for remote access scenarios.

Key terms you’ll see

VPN peers: the two endpoints in the tunnel your Edgerouter X and the remote device.
Phase 1 IKE: negotiates the tunnel’s security parameters.
Phase 2 IPsec SA: negotiates how traffic is encrypted.
Pre-shared key PSK or certificates: how peers authenticate.

Prerequisites

Two Edgerouter X devices, one at each site, or one Edgerouter X and a compatible device at the other site.
Public, reachable IP addresses for both ends static is easiest; dynamic you’ll handle with dynamic DNS if needed.
A clear subnet plan for both sites to avoid overlapping ranges.
Admin access to both routers SSH or web UI.

Network planning checklist

Subnet A: 192.168.10.0/24 Site A
Subnet B: 192.168.20.0/24 Site B
VPN subnet optional but common: 10.10.10.0/24
Ensure no NAT between the VPN peers on the tunnel itself NAT-T is automatically handled by IPsec in most cases.

Step-by-Step: Setting Up a Site-to-Site VPN on the Edgerouter X

Note: This guide uses the EdgeOS CLI style commands. If you prefer the GUI, you can translate these steps into the Web UI equivalents.

Step 1: Prepare the network and gather details

Site A Public IP: a.b.c.d
Site B Public IP: w.x.y.z
Shared secret or certificate for IKE authentication
Subnets: Site A 192.168.10.0/24, Site B 192.168.20.0/24
If using PSK, pick a strong, unique key.

Step 2: Create the VPN on Site A Edgerouter X

Access Site A’s Edgerouter X via SSH or console.
Enter configuration mode and configure IPsec.

Example using CLI adjust to your specifics:

config
set vpn ipsec ipsec-interfaces interface eth0
set vpn ipsec site-to-site peer w.x.y.z authentication mode pre-shared-secret
set vpn ipsec site-to-site peer w.x.y.z authentication pre-shared-secret ‘YourStrongPSK’
set vpn ipsec site-to-site peer w.x.y.z default-esp-group hmac-sha1-96
set vpn ipsec site-to-site peer w.x.y.z ike-group ike-1
set vpn ipsec site-to-site peer w.x.y.z tunnel 1 local prefix 192.168.10.0/24
set vpn ipsec site-to-site peer w.x.y.z tunnel 1 remote prefix 192.168.20.0/24
set vpn ipsec ike-group ike-1 proposal 1 encryption aes128
set vpn ipsec ike-group ike-1 proposal 1 hash sha1
set vpn ipsec ike-group ike-1 proposal 1 dh-group 2
commit
save

Explain: The exact names ike-group, esp proposals, and tunnel numbers can vary. The important parts are the local/remote subnets and the shared secret.

Step 3: Allow the VPN through the firewall

Ensure the firewall on Site A allows IPsec traffic UDP 500, UDP 4500 for NAT-T, and IP protocol 50 ESP.
Example:
set firewall name WAN-IN rule 30 action accept
set firewall name WAN-IN rule 30 protocol esp
set firewall name WAN-IN rule 30 destination port 500
set firewall name WAN-IN rule 30 destination port 4500
commit
save

Step 4: Create the VPN on Site B

Mirror the configuration on Site B with the other side’s public IP and the correct local/remote subnets.
If using the same PSK, keep it consistent.

Step 5: Verify the tunnel

Check IPsec status:
show vpn ipsec status
or look at the GUI under VPN > IPsec Status
You should see a up tunnel with a stable SA Security Association and data being tunneled.

Step 6: Test connectivity

From Site A, ping devices on Site B e.g., 192.168.20.10.
From Site B, ping devices on Site A e.g., 192.168.10.10.
If you can ping across the tunnel, the site-to-site VPN is functioning.

Step 7: Optional: DNS and name resolution across sites

If you want to access resources by hostname across sites, ensure DNS resolution works across both networks or set up a shared DNS server reachable from both sides.

Common Scenarios and Variations

Static vs dynamic IPs

Static IPs are simplest; with dynamic IPs, use dynamic DNS on both ends and consider a dynamic VPN setup that can handle IP changes gracefully.

Using certificates instead of PSK

Certificates provide stronger authentication and easier key management at scale. This requires a PKI setup and proper certificate handling on both Edgerouter X devices.

Multihoming and redundancy

If you have multiple WAN paths, you can configure VPN failover so the tunnel uses a secondary path if the primary link drops.
Consider setting up VPN load balancing if you have more than one site to connect.

NAT traversal

NAT-T NAT Traversal is typically enabled by default. If one side sits behind a strict NAT, ensure NAT-T is active and that the firewall rules permit UDP 4500 in addition to 500.

Performance considerations

Edgerouter X hardware is solid for small to mid-size sites, but keep expectations realistic: you’ll see best performance with AES128 and SHA1 or SHA256, and you may hit CPU limits with high traffic and complex encryption.

Security considerations and best practices

Use a strong pre-shared key or use certificates for authentication.
Change defaults and pick unique subnets that don’t collide with LANs.
Regularly monitor VPN health using logs and status pages.
Keep firmware up to date to patch security vulnerabilities.
Use firewall rules that minimize exposure; only allow necessary traffic over the VPN.
Segment VPN traffic if you can; don’t route everything through the tunnel unless needed.

Troubleshooting tips

If the tunnel won’t come up:
- Double-check IP addresses, PSK, and subnet definitions on both ends.
- Verify that the public IPs are reachable from the other site.
- Check firewall rules on both sites to ensure IPsec traffic is allowed.
- Review system logs for IPsec negotiation errors.
If pings fail across the tunnel:
- Ensure subnets don’t overlap and that routes exist on both sides.
- Confirm that the tunnel interface is up and has the correct security association.
If performance is poor:
- Check CPU load on the Edgerouter X.
- Consider reducing encryption overhead e.g., switch to AES-GCM if supported or lowering the tunnel MTU.
If dynamic IPs are involved:
- Ensure dynamic DNS is correctly configured and updated on both ends.
- Use a robust IPsec profile that tolerates IP changes.

Advanced configurations optional

VPN tunnel backup: configure a second tunnel to a different remote site or different ISP path for redundancy.
VPN split tunneling: route only specific subnets over the VPN, while keeping internet traffic on the local ISP.
Route-based VPN policy routing: create firewall rules that route traffic from a specific LAN segment into the VPN tunnel.

Performance and monitoring tools

Real-time status: view IPsec tunnel status in the Edgerouter X GUI or via CLI.
Logs: inspect system logs for VPN negotiation events; filter for “ipsec” or “ike” messages.
Ping tests and traceroute: verify path connectivity across sites and check latency.

Best practices for maintenance

Document all VPN settings, including peer IPs, PSKs, and subnets.
Schedule periodic reviews of the VPN configuration and security keys.
Use a monitoring system to alert you if the VPN goes down or if latency spikes occur.
Test failover scenarios in a controlled environment to ensure you’re prepared for outages.

Real-world tips from experience

Keep a spare PSK and rotate it securely on a periodic basis.
When you’re behind consumer-grade ISPs with dynamic IPs, use dynamic DNS and keep a small automation to update the peers if IP changes.
If you see intermittent VPN drops, check for ISP throttling or consumer-grade router reboots.

Data-backed insights

IPsec remains the go-to for site-to-site VPNs due to compatibility and security.
AES-128 with SHA-256 typically gives a strong balance of speed and security on small business networks.
Regular firmware updates are tied to better stability and security posture for EdgeOS devices.

Quick reference table

VPN Type: IPsec Site-to-Site
Protocols: IKEv1/IKEv2, ESP
Authentication: PSK or Certificates
Common ports: UDP 500, UDP 4500, ESP
Typical subnets: Site A 192.168.10.0/24, Site B 192.168.20.0/24
Encryption examples: AES-128, AES-256
Hash examples: SHA-1, SHA-256

Troubleshooting checklist condensed

Public IPs reachable from opposite site
Subnets do not overlap
PSK/certificates configured identically
IPsec firewall rules allow necessary traffic
Tunnel status shows SA established
Cross-site pings succeed
Logs show no critical errors

Frequently Asked Questions

How do I set up a site-to-site VPN on the Edgerouter X?

The process involves configuring IPsec with the correct peer IPs, authentication method PSK or certificates, and defining local/remote subnets, followed by firewall adjustments and verification with tests.

What’s the difference between a site-to-site VPN and a remote access VPN on EdgeRouter X?

Site-to-site VPN connects two networks; remote access VPN lets individual users connect to a network. This guide focuses on site-to-site. Tuxler vpn review 2026: rotating proxy VPN explained, features, pricing, setup, privacy, performance, and alternatives

Can I use dynamic IPs for the remote site?

Yes, but you’ll typically need dynamic DNS on the remote end and a VPN setup that tolerates IP changes. Static IPs are simpler.

Which encryption should I choose?

AES-128 or AES-256 with SHA-256/SHA-1 are common. AES-GCM can offer performance benefits on capable hardware.

How do I test a VPN tunnel is working?

Ping hosts across the tunnel, check IPsec status/status logs, and verify routes on both sides.

How can I ensure tunnel reliability?

Use redundant paths, monitor VPN health, and schedule automatic reboots or failover tests during maintenance windows.

What firewall rules are needed for IPsec?

Allow UDP 500 and UDP 4500, and ensure ESP protocol 50 is allowed through the firewall for IPsec traffic. Ubiquiti edgerouter x vpn setup guide for OpenVPN, IPsec, and site-to-site configurations on EdgeRouter X 2026

How do I switch from PSK to certificates?

You’ll need to set up a PKI, issue and install certificates on both ends, and adjust the IPsec peers to authenticate with certificates instead of a PSK.

How do I handle NAT on one side?

NAT-T typically handles NAT; ensure UDP 4500 is open and that the tunnel is configured to support NAT traversal.

How do I diagnose slow VPN performance?

Check CPU load, encryption settings, MTU size, and network congestion. Consider changing encryption or reducing tunnel traffic.

Are there compatibility concerns with different router brands?

Most IPsec configurations are compatible, but the exact CLI/GUI commands differ. Use standard IKE/IPsec parameters and align them on both ends.

Ubiquiti edgerouter x vpn site to site: you’ll learn how to securely connect two networks over the internet using the EdgeRouter X. Quick facts: site-to-site VPNs let you extend a LAN across locations, keep traffic private, and reduce exposure to the public internet. In this guide you’ll get a practical, step-by-step approach with real-world tips, including troubleshooting, common mistakes, and performance considerations. Setup vpn on edgemax router guide: how to configure OpenVPN, IPsec, and WireGuard on EdgeMax for secure remote access 2026

Quick setup steps: plan, configure WAN, set up VPN tunnel, apply firewall rules, test connectivity.
Common protocols: IPsec is the go-to for site-to-site VPNs; you’ll see both IKEv1 and IKEv2 options depending on firmware.
Performance notes: EdgeRouter X is compact but powerful; expect solid throughput on typical home/branch setups with proper tuning.
Troubleshooting at a glance: verify tunnel status, check phase 1/2 negotiations, confirm phase-2 selectors, and review firewall/NAT rules.

Useful URLs and Resources text only
https://www.ui.com/products/network/edgerouter/x/
https://help.ui.com/hc/en-us/articles/204108380-EdgeRouter-Getting-Started
https://www.cisco.com/c/en/us/support/docs/security-vpn-site-to-site-vpn/118978-configure-ipsec-vpn-for-site-to-site.html
https://en.wikipedia.org/wiki/Virtual_private_network
https://community.ui.com/forums/
https://github.com/yl2x/edgeos-quickstart
https://edgeos.readthedocs.io/en/latest/

Why use Ubiquiti EdgeRouter X for VPN site to site

Small form factor, low power, and affordable hardware that still delivers enough routes and VPN throughput for small offices or home labs.
EdgeOS, the underlying OS, gives you a familiar, Linux-like environment with a web UI and CLI access.
Strong community and official docs provide example configurations for various topologies.

Key benefits

Private tunnel between two or more sites
Centralized access control with firewall rules
Reduced exposure by not routing traffic through public networks unnecessarily
Flexibility to handle dynamic WANs with routers behind CGNAT using VPN keepalives and stable IKE settings

Planning your site-to-site VPN

Identify networks: define the LAN ranges at Site A and Site B for example 192.168.1.0/24 and 192.168.2.0/24.
Decide on authentication: pre-shared key PSK is common for simple setups; certificates add push-button revocation and scalability but are more complex.
Choose IPsec mode: main mode vs. quick mode often quick mode for site-to-site with modern devices.
Establish MTU and fragmentation considerations: typical Ethernet MTU is 1500; sometimes you need to adjust to avoid packet drops.

Data points to consider

Latency tolerance: VPN adds overhead; for real-time traffic consider QoS or alternative paths.
Encryption strength: AES-128 is common, AES-256 for stronger security; ensure both sides match.
NAT traversal: if either side sits behind a NAT, you’ll need to enable NAT-T NAT Traversal.

Step-by-step setup guide EdgeRouter X

1 Prepare your hardware and firmware

Ensure you’re running a recent EdgeOS version on the EdgeRouter X.
Back up current configuration before making changes.
Have WAN IPs or dynamic DNS names ready for both sites.

2 Create LAN and WAN interfaces if not already

Verify which interface is connected to your ISP usually eth0 or eth1 on EdgeRouter X.
Confirm LAN interface often eth2 or eth3 is serving the internal network.

3 Configure the VPN gateway on Site A

Define the public IP of Site B or its dynamic DNS name.
Choose IPsec with IKEv2 for modern compatibility when available.
Set a pre-shared key or install certificates if you’re using them.

4 Configure the VPN tunnel phase 1 and phase 2

Phase 1 IKE:
- Key exchange: IKEv2 recommended
- Encryption: AES-256
- Hash: SHA-256
- DH Group: 14 2048-bit or similar
- Lifetime: 86400 seconds 1 day
- Authentication: Pre-shared Key
Phase 2 IPsec:
- Protocol: ESP
- Encryption: AES-256
- Integrity: SHA-256
- PFS: enabled with a suitable group e.g., 14
- Lifetime: 3600 seconds 1 hour
Traffic selectors:
- Local network: Site A LAN e.g., 192.168.1.0/24
- Remote network: Site B LAN e.g., 192.168.2.0/24

5 Set up firewall rules and NAT policies

Allow IPsec traffic ESP, AH, UDP 500, UDP 4500 for NAT-T in the firewall.
Create a VPN-specific zone or rules to permit traffic from the LAN to the VPN tunnel.
Do not overexpose your LAN to the internet; restrict what traverses the tunnel.

6 Apply and test

Save the configuration and apply changes.
Start the VPN and confirm status on both sides.
Run connectivity tests:
- Ping from Site A to a device on Site B
- Traceroute to verify the VPN tunnel path
Monitor tunnel uptime and log entries for negotiation errors.

7 Troubleshooting common issues

Tunnel not starting: verify PSK matches on both sides, ensure clocks are synchronized for IKE, and check for NAT-T if behind NAT.
Phase 1 negotiation failures: confirm encryption, hash, and DH group settings match on both sides.
Phase 2 failures: ensure correct local/remote subnet definitions and firewall allowances.
Intermittent drops: check MTU, fragmentation, and keepalive DPD settings; consider lowering MTU if you see fragmentation issues.

8 Performance and optimization tips

Use IKEv2 when possible for faster negotiation and better resilience to NAT.
Align encryption and integrity settings across both sides to avoid mismatches.
If you’re hitting throughput limits, consider reducing the VPN’s encryption strength or enabling only what’s necessary for sensitive traffic.
Enable PFS Perfect Forward Secrecy to improve security for each tunnel refresh.

9 Security best practices

Use distinct PSKs for different VPN tunnels or a certificate-based system if you scale beyond two sites.
Regularly rotate keys and keep firmware updated.
Audit firewall rules periodically to ensure no unnecessary open ports exist.
Use DNS filtering or network-level protections to complement site-to-site security.

10 Advanced configurations optional

Redundant tunnels: If you have multiple ISPs on either site, configure a secondary VPN tunnel for failover.
Split-tunneling: Route only specific traffic through the VPN to reduce bandwidth use; keep management traffic on the VPN for remote sites.
VPN monitoring: Use EdgeOS monitoring features or external tools to get alerts when the tunnel goes down.

Real-world example: two offices with EdgeRouter X

Site A: 192.168.1.0/24, WAN IP: 203.0.113.10
Site B: 192.168.2.0/24, WAN IP: 198.51.100.25
IPsec: IKEv2, AES-256, SHA-256, PFS Group 14
PSK: a strong shared secret example removed for security
Firewall: allow ESP, UDP ports 500 and 4500, plus VPN traffic between subnets

Steps you’d perform:

Configure Site A with a VPN peer pointing to 198.51.100.25 and matching IKEv2/IPsec settings.
Configure Site B to point back to 203.0.113.10 with the same credentials and selectors.
Create firewall rules to permit traffic from 192.168.1.0/24 to 192.168.2.0/24 and vice versa.
Test by pinging devices across subnets and confirm traffic is using the VPN tunnel.

Monitoring and maintenance

Regularly check tunnel status on both EdgeRouter X devices.
Review logs for negotiation errors or dropped packets.
Schedule firmware updates during low-usage periods.
Keep a small changelog of configuration updates to track changes across sites.

Common mistakes to avoid

Using incompatible PSKs or mismatched IKE parameters between sites.
Forgetting to allow VPN traffic in the firewall on both sides.
Misconfiguring the local/remote LAN subnets, which can lead to routing loops or traffic not traversing the tunnel.
Not testing failover scenarios if you have a dual-homed Internet connection.

Performance considerations for small offices

Throughput: EdgeRouter X can handle typical small office VPN workloads, but real-world speeds depend on CPU usage, encryption, and traffic patterns.
Latency: VPN adds overhead; expect a small increase in latency, especially for remote locations far away.
QoS: If you have critical apps, consider QoS rules to prioritize VPN traffic or business-critical applications.

Tips for beginners

Start with a simple PSK-based IPsec tunnel and verify basic connectivity before moving to certificate-based or more advanced options.
Use the EdgeRouter X’s built-in command line or GUI to compare settings side-by-side on both sites.
Keep a backup of each site’s working configuration before making changes.
Document the VPN’s parameters, including peer IPs, PSK, and subnets, so you can replicate them if needed.

Quick reference checklist

Determine LAN subnets for Site A and Site B
Decide on IPsec parameters IKEv2, AES-256, SHA-256, PFS
Choose authentication method PSK vs certificates
Configure gateways and tunnel on both sites
Set up firewall rules for VPN traffic
Enable NAT-T if behind NAT
Test connectivity and adjust MTU if necessary
Enable monitoring and backups

Frequently Asked Questions

How do I enable IPsec site-to-site VPN on EdgeRouter X?

Configure the VPN peer on each EdgeRouter X, set IKE phase 1 and phase 2 parameters, define local and remote subnets, and ensure firewall rules allow VPN traffic. Verify using ping and check tunnel status in EdgeOS.

Can I use a pre-shared key for site-to-site VPN?

Yes, PSK is common and simple for two sites. For more security and scalability, consider certificates, but that adds complexity.

What’s the difference between IKEv1 and IKEv2 for EdgeRouter X?

IKEv2 is newer, faster, and generally more reliable, especially across NAT. IKEv1 is older and may be more compatible with legacy gear. Use IKEv2 if possible. Rail edge vpn: comprehensive guide to edge computing, secure tunnels, remote access, and performance for railway networks 2026

Do I need NAT-T for VPNs between two offices?

If either side is behind a NAT device, NAT-T is typically required to ensure VPN traffic passes correctly.

How do I test if my VPN tunnel is up?

Check the EdgeRouter X VPN status page, review logs for phase 1/2 negotiations, and ping devices across subnets. Traceroute can help verify the path.

What ports are used by IPsec VPNs?

Common ports include UDP 500 IKE, UDP 4500 NAT-T, and ESP for the IPsec payload. Some setups use AH, but ESP is more common.

How can I improve VPN performance?

Use strong, efficient ciphers AES-256, enable IKEv2, reduce unnecessary traffic over the VPN, and ensure CPU isn’t overloaded. Consider splitting traffic using split-tunnel settings if supported.

How do I rotate VPN keys safely?

Create a new PSK or certificate, update both sides, test connectivity, and then remove the old credentials. Do this during a maintenance window if possible. Proton vpn microsoft edge extension: complete guide to install, configure, and use Proton VPN on Microsoft Edge 2026

Can I have multiple VPN tunnels on EdgeRouter X?

Yes, EdgeRouter X supports multiple VPN tunnels, but you’ll want to segment firewall rules and ensure each tunnel has its own set of policies and subnets.

What if my edge devices are behind CGNAT?

IKEv2 with NAT-T is often compatible, but you may need to configure dynamic DNS on the peer side and ensure keepalives are enabled to maintain connectivity through CGNAT.

Ubiquiti edgerouter x vpn site to site: complete guide to configuring site-to-site VPN on EdgeRouter X for secure branch connectivity

Yes, you can configure a site-to-site VPN using a Ubiquiti EdgeRouter X. In this guide, you’ll get a clear, practical path to setting up an IPsec site-to-site tunnel between an EdgeRouter X and a remote gateway, plus tips to troubleshoot, optimize, and monitor your VPN. Expect step-by-step commands, UI options, real-world tips, and a quick test plan to verify everything is working. This article uses a friendly, hands-on tone so you can follow along like you’re chatting with a tech-savvy friend.

Before we dive in, a quick note: if you want extra security for your site-to-site VPN traffic, consider NordVPN for business-grade protection. Check out this banner for a great deal, and see how VPNs can complement your network security.

Useful resources and references un clickable text: Microsoft edge vs chrome reddit 2026

EdgeRouter X official documentation – ubnt.com
EdgeOS documentation – help.ubiquiti.com
Ubiquiti Community forums – community.ubiquiti.com
IPsec basics – en.wikipedia.org/wiki/IPsec
VPN concepts for small offices – en.wikipedia.org/wiki/Virtual_private_network
NordVPN for business – nordvpn.com/business
VPN troubleshooting guide – help.ubiquiti.com
How to configure VPNs in EdgeRouter X video guides – youtube.com
Network security best practices – nist.gov
Quick-start guide for EdgeRouter X – ubnt.com/products/edgerouter-x

Introduction

Overview and what you’ll achieve

Ubiquiti edgerouter x vpn site to site: complete guide to configuring site-to-site VPN on EdgeRouter X for secure branch connectivity

What you’ll learn: how to set up a reliable IPsec site-to-site VPN, including selecting networks, choosing authentication, configuring IKE and ESP proposals, defining tunnel subnets, and locking down firewall rules.
Why it matters: a site-to-site VPN lets you securely connect two or more office networks over the internet, enabling safe file sharing, centralized backups, and remote workforce access without exposing internal resources publicly.
Real-world plan: assess your local and remote networks, prepare keys and addresses, configure the EdgeRouter X, apply precise firewall rules, test connectivity, and monitor performance.

What you’ll get in this post:

A practical, step-by-step setup guide you can follow with real commands and UI steps
Clear explanations of key decisions IKE groups, ESP groups, pre-shared keys, network ranges
Troubleshooting tips and common gotchas
Performance notes and how to optimize for latency and reliability
Links to useful resources if you want to dig deeper

If you’re new to EdgeRouter X or IPsec VPNs, don’t worry—this guide starts with prerequisites and gradually builds to a tested, working tunnel. Also, if your organization has more complex needs multiple tunnels, dynamic DNS, or failover, I’ll point out where to scale from a basic two-site setup to a more robust architecture.

Prerequisites and quick planning Microsoft edge vpn built in 2026

EdgeRouter X device with current EdgeOS firmware
Remote gateway another EdgeRouter X, a firewall device, or a compatible VPN-capable router with a static public IP
Local network details LAN subnet, e.g., 192.168.1.0/24
Remote network details remote LAN subnet, e.g., 10.1.0.0/24
A shared pre-shared key PSK for IPsec authentication
Administrative access to EdgeRouter X GUI or SSH
Firewall rules to allow VPN traffic and necessary NAT exemptions

Performance and data notes

VPN throughput on any device depends on CPU load, tunnel count, and encryption. Real-world results on budget hardware like EdgeRouter X typically show a range from roughly 100 Mbps up to 300 Mbps for a single IPsec tunnel with AES-128, with encryption and multi-tunnel configurations reducing available headroom.
For sites with heavy traffic, consider reducing the number of active tunnels or upgrading to a more capable device if you’re pushing toward gigabit-level VPN throughput.
AES-256 improves security, but you may see a small drop in raw VPN throughput due to stronger cryptography. If you’re optimizing for performance, AES-128 is a common choice while maintaining strong security.

Step-by-step guide: site-to-site IPsec setup on EdgeRouter X

Step 1: Gather and document network details

Local LAN subnet e.g., 192.168.1.0/24
Remote LAN subnet e.g., 10.1.0.0/24
Remote peer IP address public IP of the other gateway
Pre-shared key for IPsec
Optional: if you have more than two sites, plan tunnel priorities and unique IPsec identifiers for each site

Step 2: Access EdgeRouter X

You can use the Web UI or SSH. In the Web UI, navigate to the VPN section often under the IPsec or VPN page. If you prefer CLI, SSH into the EdgeRouter X and run commands as shown in the next steps.

Step 3: Define IKE IKEv1/IKEv2 and ESP groups Hoxx vpn microsoft edge setup guide, features, security, and troubleshooting for Windows, Mac, Android, and iOS 2026

You’ll specify how phase 1 IKE negotiations occur and how phase 2 IPsec ESP data is protected.
Example high level. exact commands can vary by firmware:
- IKEGroup: set vpn ipsec ike-group IKE-GROUP proposal 1 encryption aes128
- IKEGroup: set vpn ipsec ike-group IKE-GROUP proposal 1 hash sha1
- IKEGroup: set vpn ipsec ike-group IKE-GROUP lifetime 3600
- ESPGroup: set vpn ipsec esp-group ESP-GROUP proposal 1 encryption aes128
- ESPGroup: set vpn ipsec esp-group ESP-GROUP proposal 1 hash sha1
- ESPGroup: set vpn ipsec esp-group ESP-GROUP lifetime 3600

Step 4: Create the IPsec peer remote gateway

Define the peer with its public IP, authentication method, and associated IKE group.
Example conceptual:
- set vpn ipsec peer REMOTE-WG address 203.0.113.1
- set vpn ipsec peer REMOTE-WG ike-group IKE-GROUP
- set vpn ipsec peer REMOTE-WG ikev2-reauth no
- set vpn ipsec peer REMOTE-WG pre-shared-secret
- set vpn ipsec peer REMOTE-WG local-id 203.0.113.2
- set vpn ipsec peer REMOTE-WG remote-id 203.0.113.1

Step 5: Define the site-to-site tunnel

Create a tunnel that maps your local LAN to the remote LAN, plus specify how traffic is matched to the tunnel.
- set vpn ipsec site-to-site peer REMOTE-WG tunnel 1 local-subnet 192.168.1.0/24
- set vpn ipsec site-to-site peer REMOTE-WG tunnel 1 remote-subnet 10.1.0.0/24
- set vpn ipsec site-to-site peer REMOTE-WG tunnel 1 esp-group ESP-GROUP

Step 6: Firewall and NAT considerations

Allow IPsec traffic IKe and ESP through the EdgeRouter X firewall.
Create appropriate firewall rules to permit traffic from the VPN to the internal networks and vice versa.
If you’re behind NAT on one side, you may need NAT exemptions for VPN traffic so IPsec packets aren’t translated.
Example concepts:
- Allow UDP 500 IKE and UDP 4500 NAT-T if you’re using NAT-T
- Allow ESP and Ah if using AH, though most deployments use ESP only
- Add a rule to permit traffic from 192.168.1.0/24 to 10.1.0.0/24 through the VPN

Step 7: Apply and test connectivity

Save your configuration.
Bring the VPN up if it isn’t automatically started by the EdgeRouter X after you finish the steps.
Test: ping from a host on the local network 192.168.1.x to a host on the remote network 10.1.0.x. You can also use traceroute to confirm the path goes through the VPN.

Step 8: Monitoring and troubleshooting How to turn off vpn on edge 2026

Check VPN status in the EdgeRouter X UI under VPN/IPsec to see tunnel state, uptime, and data flow.
Look for common issues:
- Mismatched PSK between ends
- Incorrect/local/remote subnet definitions
- Firewalls dropping IPsec or IKE packets
- NAT issues if one side isn’t handling NAT-T properly
If a tunnel isn’t forming, verify the IKE phase 1 parameters encryption, hash, lifetime match on both ends, and confirm the remote peer IP is reachable from your EdgeRouter X.

Sample configuration blocks you can adapt for reference

IKE group
set vpn ipsec ike-group IKE-GROUP proposal 1 encryption aes128
set vpn ipsec ike-group IKE-GROUP proposal 1 hash sha1
set vpn ipsec ike-group IKE-GROUP lifetime 3600
ESP group
set vpn ipsec esp-group ESP-GROUP proposal 1 encryption aes128
set vpn ipsec esp-group ESP-GROUP proposal 1 hash sha1
set vpn ipsec esp-group ESP-GROUP lifetime 3600
IPsec peer remote gateway
set vpn ipsec peer REMOTE-WG address 203.0.113.1
set vpn ipsec peer REMOTE-WG ike-group IKE-GROUP
set vpn ipsec peer REMOTE-WG default-esp-group ESP-GROUP
set vpn ipsec peer REMOTE-WG pre-shared-secret
set vpn ipsec peer REMOTE-WG local-id 203.0.113.2
set vpn ipsec peer REMOTE-WG remote-id 203.0.113.1
Site-to-site tunnel
set vpn ipsec site-to-site peer REMOTE-WG tunnel 1 local-subnet 192.168.1.0/24
set vpn ipsec site-to-site peer REMOTE-WG tunnel 1 remote-subnet 10.1.0.0/24
set vpn ipsec site-to-site peer REMOTE-WG tunnel 1 esp-group ESP-GROUP How to open vpn in microsoft edge with built-in secure network and browser extensions 2026
Firewall/NAT considerations conceptual
set firewall name VPN-INPUT allow
set firewall name VPN-INPUT rule 10 action accept
set firewall name VPN-INPUT rule 10 state new
set firewall name VPN-INPUT rule 10 protocol esp
set firewall name VPN-INPUT rule 20 protocol udp
set firewall name VPN-INPUT rule 20 destination-port 500
set firewall name VPN-INPUT rule 20 description “IKE”

Tips to optimize and scale

Use a stable and consistent IKE/IPsec configuration across all sites to avoid negotiation hiccups.
If you have multiple remote sites, you can create separate IKE groups and ESP groups per tunnel or define all tunnels under a single policy with distinct subnets. Keep your naming clear so you don’t mix up tunnels.
For security, keep PSKs long and unique. consider transitioning to certificate-based authentication for larger deployments, if supported by your gear.
Maintain a predictable firewall policy: explicitly allow VPN traffic and ensure NAT exemptions align with your tunnel design. This reduces the chance of accidental policy blocking.
Regularly back up EdgeRouter X configurations after changing VPN settings so you can quickly recover in case of a misconfiguration.

Common mistakes to avoid

Mismatched remote-subnet definitions between sites
Using overly aggressive firewall rules that block legit tunnel traffic
Forgetting NAT-T for VPNs behind NAT routers
Not updating the EdgeRouter X firmware before starting a multi-site deployment
Keeping PSKs unchanged for long periods. rotate them periodically per security policy

Real-world scenarios and tips

Small branch to HQ: two-site tunnel with one local network and one remote network. Simple and reliable. Start here to learn the ropes.
Multi-branch network: scale by adding additional tunnel definitions, ensuring each has unique identifiers and appropriate routing entries.
Remote access addition: if you also need client-to-site VPN for remote workers, you’ll want a separate VPN solution not covered in-depth here to avoid overloading the site-to-site tunnel.

Advanced topics you might explore later Ghost vpn extension edge 2026

Dynamic DNS integration for remote endpoints that don’t use static IPs
Redundancy and failover: configuring a backup tunnel or an alternate path
VLAN-aware VPN: combining VPN with internal segmentation for more secure environments
Monitoring VPN throughput and health with SNMP or a centralized network monitoring system

Frequently Asked Questions

How do I know if my EdgeRouter X supports site-to-site VPN?

Site-to-site IPsec VPN is supported on EdgeRouter X through EdgeOS. You’ll configure IKE/IPsec groups, a peer, and a tunnel. The exact steps can vary slightly by firmware version, but the concept remains the same: create IKE/ESP groups, define the remote peer, set up the tunnel, and configure firewall/NAT rules.

Do I need a static public IP on both ends?

Having a static public IP simplifies configuration and reliability, but you can work with dynamic IPs using dynamic DNS on at least one side. Keep in mind that dynamic IPs require updating the remote peer with each IP change or using a VPN endpoint that supports dynamic addressing.

Which encryption should I use for the site-to-site VPN?

AES-128 is a common balance of security and performance. If you require stronger security, AES-256 is an option, but you may see a slight decrease in VPN throughput. For most small-to-medium deployments, AES-128 with SHA-1 or SHA-256 is a good starting point.

Should I use IKEv1 or IKEv2?

IKEv2 is generally preferred for better stability, faster reconnects, and improved reliability over unstable networks. If your EdgeRouter X firmware supports IKEv2, use it. otherwise, IKEv1 remains widely supported. How to disable proxy settings in microsoft edge 2026

How do I test the VPN tunnel after setup?

From a host on the local network e.g., 192.168.1.2, ping a host on the remote network e.g., 10.1.0.2. If ping fails, verify PSK, tunnel definitions, and firewall rules. Use traceroute or path ping to confirm the route is going through the VPN.

What if the tunnel won’t come up?

Double-check the following:

PSK is identical on both sides
Local and remote subnets do not overlap
IKE and ESP groups match on both ends
The remote peer is reachable routing and NAT-T are functioning
Firewall rules allow IKE UDP 500, NAT-T UDP 4500, and ESP

Can I run multiple site-to-site tunnels on EdgeRouter X?

Yes, you can configure multiple IPsec tunnels, each with its own tunnel and remote subnet. Just keep the identifiers and firewall rules organized and avoid overlapping local/remote subnets.

How do I enable dynamic DNS for a site-to-site VPN?

If you’re using dynamic IPs on one end, configure a dynamic DNS hostname and use that in the VPN peer address rather than a static IP. Some setups also use a DDNS service for quick updates to the remote gateway.

How can I monitor VPN health and uptime?

Use the EdgeRouter X UI’s VPN/IPsec status page to monitor tunnel uptime, data throughput, and error counters. For broader visibility, integrate SNMP traps or a network monitoring solution that tracks VPN interfaces and traffic stats. Does hotspot go through vpn and how to maximize privacy when sharing data over mobile hotspots 2026

Will enabling a site-to-site VPN impact local LAN performance?

A site-to-site VPN does add CPU load to the EdgeRouter X. With AES encryption and IPsec processing, you may see some impact on throughput if you push the device toward its limits. If you’re hitting performance ceilings, consider reducing tunnel count, optimizing firewall rules, or upgrading to a more capable router for high-throughput needs.

Is there a risk of exposing internal networks to the internet with a VPN?

A properly configured IPsec site-to-site VPN keeps the traffic between sites encrypted and isolated from the public internet. However, misconfigurations can lead to exposure of internal networks. Always verify firewall rules, NAT exemptions, and tunnel definitions to ensure only intended traffic passes through the VPN.

Are there recommended best practices for securing a site-to-site VPN?

Use strong PSKs or, if supported, certificate-based authentication
Keep firmware up to date and back up configurations
Separate VPN traffic from regular LAN traffic with clear firewall rules
Monitor VPN health and review logs regularly
Consider a dedicated management network or VLAN for VPN controllers

Conclusion note

This guide provides a practical approach to setting up a site-to-site VPN between EdgeRouter X devices, including a CLI-focused setup path and UI-friendly overview. If you encounter issues beyond this guide, the EdgeRouter X community and official docs are excellent resources for firmware-specific quirks and advanced configurations.

If you want extra security for your site-to-site VPN traffic, consider NordVPN for business-grade protection. Check out this banner for a great deal, and see how VPNs can complement your network security.

Net vpn – unlimited vpn proxy mod: 全面解读、使用指南与风险评估 Edge vpn change country guide: how to switch regions in Edge with extensions, Windows VPN, and privacy tips 2026