Ubiquiti edgerouter x vpn site to site: A fast, reliable way to connect remote networks securely over the internet. Quick fact: site-to-site VPNs create an encrypted tunnel between two or more networks so devices on each network can talk as if they’re on the same LAN. In this guide, you’ll get a practical, step-by-step approach to configuring a site-to-site VPN using the EdgeRouter X, plus real-world tips, common pitfalls, and troubleshooting steps. We’ll cover: prerequisites, basic and advanced configurations, security considerations, monitoring, and optimization. Whether you’re linking a small office, a home lab, or multiple branches, this post aims to be your go-to resource.

Useful URLs and Resources text only

Ubiquiti Official Documentation – ubnt.com
EdgeRouter X User Guide – help.ui.com
VPN Site-to-Site Concepts – en.wikipedia.org/wiki/Virtual_private_network
Ubiquiti Community Forums – community.ui.com
OpenVPN Documentation – openvpn.net
IKEv2 and IPSec Basics – en.wikipedia.org/wiki/IPsec

Table of Contents

Understanding the Basics of Ubiquiti EdgeRouter X VPN Site to Site

A site-to-site VPN also called gateway-to-gateway connects two networks so devices on either side can communicate securely.
EdgeRouter X is a cost-effective, compact router that supports IPSec VPNs, among other features.
Common protocols: IPSec with IKEv2 for modern devices; IPSec with IKEv1 for broader compatibility.
Typical topology: EdgeRouter X at your primary site Site A and another router or firewall at the remote site Site B forming an encrypted tunnel.

Why choose EdgeRouter X for site-to-site VPN?

Low cost with solid performance for small to medium office networks.
Flexible firewall and routing rules, plus CLI for repeatable configs.
Easy to update and maintain with Ubiquiti’s ecosystem.

Basic prerequisites

Two networks with public IPs or dynamic DNS if your IPs change.
A plan for the VPN subnets that won’t collide with internal LANs for example, 192.168.50.0/24 on Site A and 192.168.60.0/24 on Site B.
Shared VPN parameters: pre-shared key PSK or certificates, and the exact IPs of peers.
Access to the EdgeRouter X with admin privileges and a backup of current configuration.

Quick Start: A Step-by-Step Guide to Setting Up Site-to-Site VPN

Note: This is a practical walkthrough. If you prefer, you can follow along in the EdgeOS GUI, but I’ll also note CLI commands for reproducibility.

Prepare your networks

Decide on VPN subnet ranges that don’t conflict with LANs.
Confirm the public IPs or DNS names for both sites.
Pick authentication method: PSK is easiest for two sites; certificates are stronger but more complex.

Create a basic firewall and NAT rules

Ensure LAN-to-WAN rules allow outbound traffic to the VPN endpoints.
Create a rule to drop VPN traffic unless it matches the tunnel optional but improves security.

Configure the IPSec VPN on Site A EdgeRouter X

Define Phase 1 IKE parameters: encryption, hash, DH group, lifetime.
Define Phase 2 IPSec parameters: ESP transform, PFS, lifetime.
Add the tunnel peer with the peer’s public IP and PSK or certificate.
Create a local network definition and a remote network definition for the tunnel.

Configure the IPSec VPN on Site B

Mirror the settings used on Site A IKE v2, same encryption, same PSK or certificates.
Define the remote subnet to the opposite LAN.

Create a route to push traffic through the VPN tunnel

On both sites, add static routes for the remote LAN via the VPN tunnel interface.
Ensure the firewall allows traffic across the tunnel.

Bring the tunnel up and test

Check status on both devices, verify SAs are established, and ping a host across the tunnel.
Verify DNS resolution across sites if necessary.

Monitor and tune

Watch log messages for negotiation issues or dropped packets.
Adjust lifetimes,Perfect Forward Secrecy PFS settings, or MTU if you hit fragmentation.

Architecture and Configuration Details

IPSec parameters that work well in practice

IKE/Phase 1: IKEv2, AES-256, SHA-256, DH Group 14 2048-bit or Group 19/20 for modern devices.
IPSec/Phase 2: AES-256, SHA-256, PFS Group 2 or 14.
Lifetime: 28800 seconds IKE, 3600 seconds IPSec is a common balance; adjust if you see frequent rekeys.
NAT-T: Enable if either site sits behind NAT.

Example topology

Site A LAN: 192.168.1.0/24
Site B LAN: 192.168.2.0/24
VPN subnet: 10.10.10.0/24 used for the tunnel itself or as a shared channel

Basic EdgeRouter X CLI template simplified

This is a high-level outline; adapt to your exact network, IPs, and PSK.
Configure
Set vpn ipsec ipsec-0 ike-group IKE-1 proposal 1
Set vpn ipsec ipsec-0 esp-group ESP-1 proposal 1 Touch vpn edge extension 2026
Set vpn ipsec ipsec-0 peer PEER_IP address 12.34.56.78
Set vpn ipsec ipsec-0 peer PEER_IP authentication pre-shared-secret ‘yourPSK’
Set vpn ipsec ipsec-0 local-id yourSiteA
Set vpn ipsec ipsec-0 tunnel 0 local-ip 10.1.1.1
Set vpn ipsec ipsec-0 tunnel 0 remote-ip 10.2.2.2 Tunnelbear vpn rating and comprehensive guide 2026: features, performance, privacy, pricing, and comparisons
Set vpn ipsec ipsec-0 tunnel 0 local-subnet 192.168.1.0/24
Set vpn ipsec ipsec-0 tunnel 0 remote-subnet 192.168.2.0/24
Commit; save

Firewall and NAT tips

Use a dedicated VPN zone or interface if your device supports it, separating VPN traffic from the LAN.
Create explicit allow rules for VPN traffic between the two subnets.
Avoid NAT on the VPN tunnel unless strictly necessary; if NAT is required, implement it carefully to avoid double NAT issues.

Advanced Tips and Common Pitfalls

Dynamic IPs and DDNS

If your public IPs aren’t static, set up Dynamic DNS on both sites and use the DDNS hostname in your EdgeRouter configurations.
Some ISPs change public IPs frequently; a stale IP on the tunnel peer will break the VPN.

Certificates vs PSK

PSK is simpler but less scalable. If you’re managing more sites or rotating keys, consider a certificate-based solution with a PKI.
For certificate-based IPSec, you’ll typically use IKEv2 with RSA certificates and a trusted CA on both ends.

MTU and Fragmentation

VPN tunnels can cause MTU issues. If you see intermittent drops or fragmented packets, try lowering MTU on the tunnel or enabling DF bit tuning.

Performance tuning

EdgeRouter X is capable, but heavy traffic with multiple tunnels can saturate CPU. Monitor CPU usage and consider offloading to a more powerful device if needed.
Enable fast-path routing for VPN traffic if your model supports it to reduce latency.

Security hardening

Disable unused services on EdgeRouter X to minimize attack surface.
Regularly update firmware to patch known vulnerabilities.
Use strong PSKs, rotate them periodically, and document rotation procedures.

Monitoring, Logging, and Verification

Use the EdgeOS dashboard to view VPN status and SA Security Association counters.
Run from your client network: ping hosts across the VPN, traceroute to verify path, and test application connectivity.
Check logs for negotiation issues, mismatched proposals, or authentication failures.

Quick verification commands

Show IPSec status and SAs: show vpn ipsec sa
View tunnel status: show vpn ipsec status
Check firewall rules affecting VPN traffic: show firewall name VPN-TO-LAN
Verify routing table entries: show ip route

Real-World Scenarios and Examples

Small office to remote office: Site A at home office with 192.168.1.0/24, Site B at a satellite office with 192.168.2.0/24, VPN subnet 10.10.10.0/24.
Home lab to test: Use a virtual lab in one site and connect to a physical EdgeRouter X in another, testing access to a shared service like a NAS.
Multi-site setup: Add a second EdgeRouter or a compatible device at Site C and extend the VPN with a hub-and-spoke topology.

Troubleshooting checklist

Are the peers reachable from each other? Verify public IPs and DNS names resolve, then test basic connectivity.
Are Phase 1 and Phase 2 proposals matching on both sides? Mismatched algorithms or lifetimes cause negotiation failures.
Is the PSK correct on both ends? A mismatch will prevent tunnel establishment.
Are traffic selectors local/remote subnets correctly defined? Incorrect definitions block routes across the tunnel.
Are firewall rules allowing VPN traffic? Ensure inbound/outbound rules aren’t blocking the tunnel.

Performance and Scalable Architectures

For single-site-to-site links with modest bandwidth tens to a few hundred Mbps, EdgeRouter X is sufficient with proper tuning.
If you’re growing to multiple branches, consider a centralized VPN hub or upgrading to a higher-performance router to handle more concurrent tunnels and higher throughput.

Quick Reference: Common Commands EdgeRouter X

Show status: show vpn ipsec status
Show SA details: show vpn ipsec sa
Add a tunnel: set vpn ipsec ipsec-0 tunnel 0 local-subnet 192.168.1.0/24
Remove a tunnel: delete vpn ipsec ipsec-0 tunnel 0
Save changes: commit; save
Reboot: reboot

Security Best Practices for Ubiquiti EdgeRouter X VPN Site to Site

Use strong PSKs or certificates and rotate them periodically.
Keep firmware up to date; patch known vulnerabilities promptly.
Limit VPN access to only what’s necessary and forbid unnecessary inter-site access.
Log VPN activity and monitor for unusual patterns or failed attempts.
Harden the router’s management interface: disable unused services, enforce strong admin credentials, and restrict management access to trusted networks.

Future-Proofing and Upgrades

If you expect growth, plan for a bigger router or a dedicated VPN appliance at each site to handle higher throughput and more tunnels.
Consider IPv6 readiness when planning subnets and firewall rules.
Keep a written change log of VPN configurations, including PSKs, IPs, and revised subnets.

FAQ Section

What is a site-to-site VPN with EdgeRouter X?

A site-to-site VPN creates an encrypted tunnel between two networks so devices on both sides can communicate securely as if they were on the same local network.

Do I need a static IP for EdgeRouter X VPN?

Static IPs simplify configuration, but you can use dynamic IPs with a DDNS service. If you’re frequently changing IPs, DDNS helps keep peers connected. Setup vpn on edgerouter x 2026

Which VPN protocol should I use with EdgeRouter X?

IKEv2/IPSec is common and robust. If you need widest compatibility, IPSec with IKEv1 can work, but IKEv2 is preferred for security and performance.

How do I choose VPN subnets?

Pick non-overlapping subnets for each LAN and a dedicated tunnel subnet if you use one. Avoid conflicting ranges to prevent routing issues.

Can I use PSKs instead of certificates?

Yes, PSKs are easiest to set up for two sites. For more sites or longer-term security, certificates are better.

How do I test the tunnel after setup?

Ping hosts across the tunnel, verify SA status, check routing tables, and look for any dropped packets in logs.

What could cause the VPN tunnel to fail to establish?

Mismatched IKE/ESP proposals, incorrect PSK, unreachable peer, firewall blocks, or misconfigured local/remote subnets. Secure access services edge 2026

How can I secure the VPN beyond basic setup?

Use strong authentication, enable logging, limit management access, rotate keys, and keep firmware updated.

How do I handle dynamic IPs at both sites?

Use a Dynamic DNS service and reference the hostname in the tunnel configuration instead of a static IP.

How can I monitor VPN performance over time?

Track tunnel uptime, MTU fragmentation events, and throughput with periodic pings and bandwidth tests; use the EdgeRouter’s monitoring dashboards for trends.

Is EdgeRouter X enough for a growing network?

For a small to medium office, yes. If you’re heading toward multi-branch sites with heavy traffic, consider upgrading to higher-end hardware or adding a scalable VPN solution.

Ubiquiti edgerouter x vpn site to site: comprehensive guide to configuring IPsec site-to-site VPN on EdgeRouter X for two sites

Yes, you can set up a site-to-site VPN on a Ubiquiti EdgeRouter X. In this guide, I’ll walk you through why you’d want a site-to-site VPN with EdgeRouter X, what you need before you start, how to configure it using both the web UI and the CLI, and how to test and troubleshoot so traffic between two offices stays private and reliable. This post covers practical steps, common caveats, and best practices so you can get a solid, production-ready tunnel without surprises. If you’re also looking to protect remote workers or devices, check out NordVPN using the deal below to complement site-to-site security with endpoint protection. Proxy vpn edge: the ultimate guide to using a proxy vpn edge for privacy, security, and bypassing geo-blocks 2026

NordVPN deal: 77% off plus 3 months free — a handy add-on for protecting individual devices or small office laptops outside the tunnel.

Useful resources unlinked for easy copying:

EdgeRouter X official docs – ubnt.com
Ubiquiti Community forums – community.ubnt.com
IPsec site-to-site concepts – en.wikipedia.org/wiki/IPsec
VPN throughput basics – articles and whitepapers from major networking vendors
Dynamic DNS basics – dyndns.org or ddns.net help pages

Introduction short guide

Yes, you can set up a site-to-site VPN on a Ubiquiti EdgeRouter X.
In this step-by-step guide, you’ll learn how to plan networks, configure IPsec in both the UI and CLI, and verify the tunnel with real traffic.
You’ll see practical examples for two sites with different LAN subnets, plus tips for NAT, firewall rules, and routing so traffic flows correctly.
We’ll cover common mistakes, troubleshooting steps, performance expectations, and security best practices to keep your tunnel robust.

Why a site-to-site VPN with EdgeRouter X Planet vpn edge extension 2026

EdgeRouter X is a low-cost, compact device that can run full EdgeOS with IPsec support, making it a solid option for small-to-medium branch sites.
A site-to-site VPN lets two or more separate networks share resources and talk securely as if they were on the same local network.
Encryption choices AES-128/256, SHA-1/256 give you flexibility to balance security and performance.
With the right settings, you can achieve reliable, site-wide routing of internal services, printers, file servers, and VoIP between locations.

Prerequisites and planning

Hardware and firmware: EdgeRouter X at Site A and Site B, both running the latest EdgeOS release you can reasonably run on the device 2.x series. EdgeRouter X is designed for VPN workloads but performance varies depending on cipher and traffic. expect VPN throughput in the range of a few dozen to a few hundred Mbps in typical setups.
Network topology: Two offices with public IP addresses static or dynamic with DDNS. If either side sits behind NAT, you’ll enable NAT traversal NAT-T for IPSec.
LAN subnets: Plan non-overlapping subnets for each site, for example Site A 192.168.1.0/24 and Site B 192.168.2.0/24. If you’re using VLANs or more complex topologies, map those out before configuring the tunnel.
Shared secret: Create a strong pre-shared key PSK for the IPsec tunnel. For production, rotate keys periodically and avoid simple phrases.
DNS and reachability: Ensure both sites’ EdgeRouters can resolve each other if using dynamic DNS, and verify basic reachability over the public IPs before starting VPN setup.

Option 1: Site-to-site VPN using the EdgeRouter X web UI UI method
Step-by-step outline

Access the EdgeRouter UI

Open a browser and log in to the EdgeRouter at https://.
Do the same at the other site for the remote connection.

Prepare VPN details

Local subnet: Site A LAN e.g., 192.168.1.0/24
Remote subnet: Site B LAN e.g., 192.168.2.0/24
Remote public IP: Site B’s router public IP or its DDNS hostname if you’re using dynamic IPs
PSK: A strong shared secret you’ll use on both sides

Create the IPsec IKE group and IPSec tunnel

Navigate to VPN > IPsec.
Create an IKE group IKEv1 is widely supported. IKEv2 can be used on newer firmwares.
- Name: IKE-GROUP-SITE-TO-SITE
- Encryption: AES256
- Hash: SHA256
- DH Group: 2 MODP 1024 or 14 MODP 2048 depending on your security requirements
- PFS: enable for Phase 2
- Key lifetime: 28800 seconds 8 hours or as your security policy requires
Set up a new IPsec peer the remote site
- Remote IP: Site B public IP
- Authentication: Pre-Shared Secret
- Shared secret:
- Local subnet: Site A LAN
- Remote subnet: Site B LAN
- IKE group: IKE-GROUP-SITE-TO-SITE
- NAT-T: Enable if either side is behind NAT

Create the IPsec tunnel

Add a tunnel often Tunnel 1 by default
- Local subnet: 192.168.1.0/24
- Remote subnet: 192.168.2.0/24
- Encapsulation: ESP with AES256, SHA256
- Perfect Forward Secrecy PFS: enabled
Save and apply changes

NAT and firewall considerations

Ensure VPN traffic is exempt from NAT on both sides, so packets between subnets aren’t NATed.
Create firewall rules to permit traffic between Site A LAN and Site B LAN through the VPN tunnel. A typical rule allows icmp, tcp, udp between the two subnets.

Routing and VPN status

Verify the tunnel status in the UI VPN > IPsec or the status summary for the tunnel.
Add static routes or enable policy-based routing so traffic to the remote subnet uses the VPN. If you’re using dynamic routing, ensure routes point to the tunnel interface.
Test: from a host in Site A try pinging 192.168.2.10 or a server in Site B. check traceroute to confirm traffic goes through the tunnel.

Troubleshooting tips

If the tunnel doesn’t come up, double-check PSK, remote IP, and LAN subnets on both sides.
Ensure both peers have matching IKE group settings and lifecycle parameters.
Review firewall rules on both sides to confirm VPN traffic isn’t blocked.
Confirm NAT-T is enabled if one side is behind a NAT device.

Security and maintenance

Use a strong PSK and rotate regularly.
Enable DPD Dead Peer Detection and keep-alive features, if available, to keep tunnels healthy.
Log IPsec events and monitor for unusual retry patterns or frequent re-negotiations.

Option 2: Site-to-site VPN using the CLI CLI method
If you prefer to configure via the command line or need automation, here’s a generic CLI approach you can adapt. Adjust IPs, subnets, and keys to your environment.

Example adjust values accordingly

configure
set vpn ipsec ike-group IKE-SITE-TO-SITE proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-SITE-TO-SITE proposal 1 hash 'sha256'
set vpn ipsec ike-group IKE-SITE-TO-SITE proposal 1 dh-group 'weathered'  # choose a DH group supported by your edgeos version
set vpn ipsec ike-group IKE-SITE-TO-SITE proposal 1 lifetime '3600'
set vpn ipsec ipsec-0 ike-group 'IKE-SITE-TO-SITE'
set vpn ipsec ipsec-0 esp-group 'ESP-SITE-TO-SITE'
set vpn ipsec site-to-site peer <REMOTE_PUBLIC_IP> authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer <REMOTE_PUBLIC_IP> authentication pre-shared-secret '<YOUR_PSK>'
set vpn ipsec site-to-site peer <REMOTE_PUBLIC_IP> local-address <LOCAL_PUBLIC_IP>
set vpn ipsec site-to-site peer <REMOTE_PUBLIC_IP> tunnel 1 local-subnet '192.168.1.0/24'
set vpn ipsec site-to-site peer <REMOTE_PUBLIC_IP> tunnel 1 remote-subnet '192.168.2.0/24'
set vpn ipsec site-to-site peer <REMOTE_PUBLIC_IP> ike-group 'IKE-SITE-TO-SITE'
set vpn ipsec site-to-site peer <REMOTE_PUBLIC_IP> tunnel 1 protocol 'esp'
commit
save

Note: The exact syntax can vary slightly by firmware version. If you’re unsure, use the EdgeRouter UI for the initial setup and then refine via CLI as needed.

Firewall, NAT, and routing key concepts
- NAT exemption NAT-T rules: VPN traffic between Site A and Site B should bypass NAT to avoid double NATing VPN packets.
- LAN-to-LAN firewall rules: Allow traffic from 192.168.1.0/24 to 192.168.2.0/24 and reverse across the VPN.
- DNS considerations: If you rely on internal hostnames, ensure DNS resolution across sites via internal DNS or VPN-assisted DNS tricks works.
- Routing: If you’re using static routes, point the remote subnet toward the VPN tunnel. If you’re using dynamic routing, enable a suitable protocol and exchange routes over the tunnel.

Performance considerations and data
- EdgeRouter X hardware summary: a compact device designed for small offices or branches. Typical VPN throughput depends on the chosen cipher, the number of concurrent VPN tunnels, and the overall load on the router. Expect VPN throughput in the low hundreds of Mbps at best under ideal circumstances. real-world results depend heavily on traffic patterns and encryption settings.
- Encryption choices: AES-256 and SHA-256 provide strong security but may slightly impact throughput compared to lighter configurations like AES-128/SHA-1. If you need higher throughput and security remains acceptable, you can test AES-128 and SHA-256 first and then move to stronger options if needed.
- IKEv1 vs IKEv2: IKEv1 is widely supported on many EdgeRouter firmwares. If your devices support IKEv2, it can offer faster rekeying and can be more efficient in some scenarios. Check your firmware release notes to confirm which IKE versions you can use.

Security best practices
- Use a long, random pre-shared secret and rotate it periodically.
- Keep EdgeRouter X firmware up to date to benefit from security and stability fixes.
- Enable logging for VPN events to help with troubleshooting and auditing.
- Consider using an additional layer of protection, like endpoint VPN clients for remote workers, a strong password policy, and device-level protections antivirus, updated OS.

Question-focused guide quick take
- Should I use IPsec or OpenVPN for EdgeRouter X? IPsec is the native option on EdgeRouter X and is well-suited for site-to-site tunnels with routers. OpenVPN can be implemented via other devices or software, but IPsec is simpler for a straight two-site setup.
- Can two sites behind NAT establish a VPN tunnel? Yes, with NAT-T enabled on both ends, EdgeRouter X can negotiate IPsec tunnels even when the peers are behind NAT.
- Can I run multiple site-to-site tunnels on EdgeRouter X? Yes, you can configure more tunnels if you have more remote sites ensure the device has enough resources to handle the load.
- How do I verify the tunnel is up? Check the VPN > IPsec status in the UI, review the tunnel state, and ping hosts in the remote LAN from a host on the local LAN to confirm traffic is flowing.

Frequently Asked Questions
- What is a site-to-site VPN in simple words?
- How does IPsec secure traffic between two sites?
- What are the minimum requirements to set up a site-to-site VPN on EdgeRouter X?
- How do I pick IPsec encryption and hashing algorithms?
- What if my remote site has a dynamic IP? Can we still connect?
- How can I confirm traffic is using the VPN tunnel and not the regular WAN path?
- What should I do if the tunnel keeps dropping every few hours?
- How do I add a second remote site to the same EdgeRouter X?
- Are there any performance tweaks I should consider to maximize VPN throughput?
- How can I automate VPN configuration for multiple EdgeRouter X devices?
- Is it possible to use IKEv2 on EdgeRouter X, and if so, how?

Conclusion omitted per instructions
No dedicated conclusion section is included, but with these steps you’re equipped to configure a solid site-to-site VPN between two EdgeRouter X devices. Start with the UI guide to get a working tunnel quickly, then refine with CLI for automation and deeper customization. Remember to secure the tunnel with a strong PSK, keep firmware updated, and test traffic regularly to ensure everything stays private and reliable.

Would you like a sample config tailored to your exact LAN subnets and public IPs? If you share your two site subnets and the remote public IP for Site B, I’ll draft a ready-to-paste UI configuration and a CLI snippet you can deploy.

翼游vpn 全方位评测与使用指南：下载安装、加密协议、隐私保护、流媒体解锁、跨设备设置与性价比

Pia vpn encryption 2026