Edgerouter site-to-site vpn setup guide for IPsec connections between branches and data centers

Edgerouter site-to-site vpn is a method to securely connect two or more networks over the public internet using an IPsec tunnel. In this guide, I’ll walk you through a practical, battle-tested approach to setting up an IPsec site-to-site VPN on EdgeRouter devices, including CLI and GUI steps, security best practices, common pitfalls, and verification tips. If you’re evaluating VPNs for a multi-site setup, you’ll come away with a solid blueprint you can adapt to your own networks. And if you want extra privacy while testing remote access, consider this NordVPN deal shown here:

Useful resources you may want to skim as you read:
Edgerouter official documentation – ubnt.com, IPsec overview – ubnt Wiki, StrongSwan IPsec concepts – strongswan.org, Network planning best practices – infosec guides, EdgeRouter forum discussions – community.ubnt.com

Introduction overview

• What you’ll learn: how IPsec site-to-site VPN works with EdgeRouter, how to plan subnets, configure both ends GUI or CLI, verify tunnels, and handle common issues.
• What you’ll build: a reliable, encrypted tunnel between two sites branch to branch or data center to branch with proper phase 1/2 negotiations, firewall rules, and traffic selectors.
• What you’ll troubleshoot: tunnel not coming up, mismatched proposals, NAT issues, routing errors, and ping/traceroute diagnostics.

Body

What is a site-to-site VPN on Edgerouter and why use IPsec

Site-to-site VPN on EdgeRouter connects two private networks across the internet by encrypting traffic that travels between them. IPsec is the industry-standard protocol for this use case and is well-supported by EdgeOS. Key benefits:

• Private communication between sites without exposing internal subnets to the internet
• Centralized policy control for encryption algorithms, lifetimes, and authentication
• Scalable to multiple sites by adding more peers and network prefixes
• StrongSwan-based implementation on EdgeRouter ensures robust security and compatibility with many vendors

Typical deployment scenarios:

• A small office connects securely to a main office or data center
• A regional office connects to a headquarters with a dedicated IPsec tunnel
• A data center links to disaster recovery sites for routine replication

Industry data to keep in mind:

• IPsec remains the most widely deployed site-to-site VPN protocol in enterprise networks due to its reliability and interoperability across hardware vendors.
• For many SMBs, IPsec VPNs provide predictable performance with mature security options and straightforward management via EdgeRouter’s UI or CLI.

Prerequisites and planning

Before you start, gather these:

• Two EdgeRouter devices one at each site or a mix of EdgeRouter and other IPsec-capable devices that support standard IKEv2/ESP configurations
• Public IP addresses for each EdgeRouter or dynamic DNS set up if you don’t have static IPs
• Subnet plans for both sites for example, Site A 192.168.11.0/24 and Site B 192.168.22.0/24
• A pre-shared key PSK or certificate-based authentication PSK is common for small deployments
• A basic firewall rule plan to allow IPsec control traffic IKE/ISAKMP port 500, NAT-T 4500, ESP protocol 50 and to permit traffic between the defined subnets

Network planning tips: Vpn to change location: How to Use a VPN to Change Your Geographic Location for Streaming, Privacy, and Access

• Pick non-overlapping subnets for the two sites to avoid routing conflicts.
• Decide which side will be the “local” network for the VPN and which will be “remote” in the EdgeRouter config.
• Decide if you’ll support dynamic DNS on either side and how you’ll reach each site if IPs change.

Security best practice quick wins:

• Use strong PSK values random, long, unique per site.
• Prefer AES-256 and SHA-256/SHA-384 for encryption and integrity.
• Use an appropriate Diffie-Hellman group e.g., 14 or higher for PFS Perfect Forward Secrecy.
• Keep firmware up to date and monitor VPN logs for anomalies.

Core IPsec concepts you’ll see in EdgeRouter

• IKE Internet Key Exchange phase 1: authenticates peers and sets up a secure channel IKE-group, lifetime, encryption/hash, DH group.
• IPsec ESP phase 2: negotiates the actual tunnel ESP-group, lifetime, encryption/hash, PFS.
• Local-prefix and remote-prefix: define the subnets to be tunneled across the VPN.
• NAT-T: keeps connections working when one or both sites are behind NAT.
• Tunnel vs. transport mode: site-to-site uses tunnel mode default for VPNs between sites.

EdgeRouter terms you’ll use:

• ike-group Ike and esp-group ESP definitions
• site-to-site peer: the remote end’s public IP and the shared PSK
• local-address: public IP this EdgeRouter uses for the VPN
• local-prefix and remote-prefix: the networks that will be tunneled

Step-by-step: configuring EdgeRouter via GUI Site-to-Site IPsec

Note: the exact menu names can vary by EdgeOS version, but the flow is similar.

1. Open EdgeRouter GUI
2. Navigate to the VPN section
3. Create a new Site-to-Site IPsec VPN
   • Peer IP or hostname: remote site’s public IP
   • Authentication: Pre-Shared Key enter your PSK
   • Local Address: your EdgeRouter’s public IP
   • Local Prefix: your local network e.g., 192.168.11.0/24
   • Remote Prefix: remote network e.g., 192.168.22.0/24
   • IKE Group: choose a secure option e.g., IKEv2 with AES256/SHA256
   • ESP Group: choose matching encryption e.g., AES256/SHA256 and PFS group
   • Enable NAT-T if needed usually yes
4. Save/Apply the configuration
5. Add firewall rules if needed to allow IPsec control traffic UDP 500, 4500, and ESP if your firewall enforces it

GUI verification:

• Check the VPN status panel for “up” or “established”
• Verify that the tunnel shows the expected local/remote prefixes
• Watch logs for ISAKMP/IKE and IPsec events

CLI equivalent quick guide copy-paste style Wireguard vpn edgerouter x setup and optimization guide for EdgeRouter X

• Enter configuration mode
  configure
• Define IKE and ESP groups
  set vpn ipsec ike-group IKE-1 proposal 1 encryption aes256
  set vpn ipsec ike-group IKE-1 proposal 1 hash sha256
  set vpn ipsec ike-group IKE-1 lifetime 28800
  set vpn ipsec esp-group ESP-1 proposal 1 encryption aes256
  set vpn ipsec esp-group ESP-1 proposal 1 hash sha256
  set vpn ipsec esp-group ESP-1 lifetime 3600
• Define the peer
  set vpn ipsec site-to-site peer 203.0.113.2 authentication mode pre-shared-secret
  set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret YourPSKHere
  set vpn ipsec site-to-site peer 203.0.113.2 ike-group IKE-1
  set vpn ipsec site-to-site peer 203.0.113.2 esp-group ESP-1
  set vpn ipsec site-to-site peer 203.0.113.2 local-address 203.0.113.1
  set vpn ipsec site-to-site peer 203.0.113.2 local-prefix 192.168.11.0/24
  set vpn ipsec site-to-site peer 203.0.113.2 remote-prefix 192.168.22.0/24
• Commit and save
  commit
  save

Test and verification GUI and CLI

• From a host in Site A 192.168.11.0/24 ping a host in Site B 192.168.22.0/24
• Use traceroute to confirm path goes through the VPN tunnel
• Check EdgeRouter VPN status page for tunnel state
• Inspect logs at System > Logs or run show log for IPsec/IKE events
• If you don’t see traffic, verify routing: ensure the devices know how to reach the remote subnets via the tunnel

Step-by-step: configuring EdgeRouter via CLI fun hands-on

Example with concrete values adjust to your actual networks

• Variables:
  Local site A: 192.168.11.0/24
  Remote site B: 192.168.22.0/24
  Local public IP A: 203.0.113.1
  Remote public IP B: 198.51.100.2
  PSK: YourStrongPSKHere

Configuration flow:
configure
set vpn ipsec ike-group IKE-1 proposal 1 encryption aes256
set vpn ipsec ike-group IKE-1 proposal 1 hash sha256
set vpn ipsec ike-group IKE-1 lifetime 28800
set vpn ipsec esp-group ESP-1 proposal 1 encryption aes256
set vpn ipsec esp-group ESP-1 proposal 1 hash sha256
set vpn ipsec esp-group ESP-1 lifetime 3600
set vpn ipsec site-to-site peer 198.51.100.2 authentication mode pre-shared-secret
set vpn ipsec site-to-site peer 198.51.100.2 authentication pre-shared-secret YourStrongPSKHere
set vpn ipsec site-to-site peer 198.51.100.2 ike-group IKE-1
set vpn ipsec site-to-site peer 198.51.100.2 esp-group ESP-1
set vpn ipsec site-to-site peer 198.51.100.2 local-address 203.0.113.1
set vpn ipsec site-to-site peer 198.51.100.2 local-prefix 192.168.11.0/24
set vpn ipsec site-to-site peer 198.51.100.2 remote-prefix 192.168.22.0/24
commit
save

If you’re behind NAT or you plan to connect to more sites later, you can add NAT-T settings and additional peers using the same pattern.

Testing steps after CLI/GUI setup Vpn gratis para edge: free VPN extensions for Microsoft Edge, how to use them, safety tips, and best free options

• Use ping from a host on Site A to a host on Site B
• If hosts don’t respond, confirm:
  • Subnets don’t overlap
  • The tunnel is up in the VPN status
  • Firewall rules allow traffic between the two subnets
  • Routing points to the VPN tunnel not direct internet
• Check for NAT issues. If sites are behind separate NAT devices, NAT-T should be enabled by default.

Troubleshooting common issues

• Tunnel won’t establish: check PSK mismatch, ensure both sides use matching IKE/ESP proposals, confirm local and remote prefixes match, verify public IPs are reachable.
• Tunnel is up but traffic fails: verify routing tables, ensure host firewall rules allow ICMP/traffic across subnets, confirm no overlapping subnets, check NAT rules if you’re using NAT on either side.
• Phase 1 or Phase 2 re-key problems: increase lifetimes or change to more conservative settings. look for log entries indicating negotiation failures.
• DNS or hostnames: if you rely on dynamic IPs, consider optional dynamic DNS and update peers accordingly.
• Performance slowdowns: ensure hardware can handle the encryption load, enable only necessary encryption suites, check MTU/Jumbo frames if you’re pushing large payloads.

Security best practices for EdgeRouter site-to-site VPNs

• Use strong authentication: long, random pre-shared keys or certificates if supported
• Prefer IKEv2 with AES-256 and SHA-256 for robust security across both ends
• Turn on dead peer detection DPD to quickly detect failed peers and re-establish tunnels
• Regularly review firewall rules. restrict VPN traffic to your subnets only
• Keep EdgeRouter firmware up to date and monitor release notes for security fixes
• Consider split-tunneling only if you understand the security implications. otherwise route all traffic through the VPN
• Use unique tunnel IDs and naming for multiple site connections to avoid cross-traffic misconfigurations

Performance and maintenance considerations

• Encryption overhead: AES-256 with SHA-256 adds CPU load. ensure your EdgeRouter model has enough horsepower
• MTU considerations: VPN encapsulation can add overhead. if you experience fragmentation, adjust MTU and MSS
• High availability: for critical sites, consider redundant peers or multiple VPN tunnels for failover
• Logging and monitoring: enable logging for VPN events. set alarms for tunnel down events
• Documentation: maintain a simple diagram of site IPs, prefixes, and tunnel configurations for future changes

Real-world use cases and examples

• Branch-to-branch corporate connectivity: small offices connecting to HQ with single or multiple tunnels
• Data center replication: secure links between primary storage networks and DR sites
• Hybrid cloud edges: extend private networks to cloud environments via IPsec tunnels to on-prem EdgeRouters

Advanced tweaks you can consider

• Use IKEv2 rather than IKEv1 for better reliability and speed on newer hardware
• Fine-tune PFS and rekey intervals based on your traffic profile and security needs
• If you have multiple remote networks, implement multiple site-to-site peers with distinct local/remote prefixes
• Consider split-horizon DNS integration if you rely on internal hostname resolution across sites
• For very dynamic environments, pair IPsec with dynamic DNS to keep endpoints reachable

Alternatives and related approaches

• OpenVPN on EdgeRouter: some admins prefer OpenVPN for client access. EdgeRouter does support OpenVPN server features in certain EdgeOS builds
• WireGuard: some newer setups use WireGuard for simpler and faster VPNs, though support on EdgeRouter devices can vary by model and firmware version
• Cloud VPN services: if you’re connecting to public cloud environments, many cloud providers offer their own VPN gateways. you can bridge or route between those and your on-prem EdgeRouter

Frequently Asked Questions

Frequently Asked Questions

What is Edgerouter site-to-site vpn?

Edgerouter site-to-site vpn is a secure IPsec tunnel that connects two private networks over the internet, allowing devices on each network to communicate as if they were on the same LAN.

Do I need static IPs on both sites for IPsec site-to-site VPN?

Static IPs are common and simplify configuration, but you can use dynamic DNS with careful monitoring. If one side changes IPs frequently, you’ll need automation to update the peer on the other side.

What authentication method should I use for IPsec on EdgeRouter?

Pre-shared keys PSK are the simplest method for small deployments. If you can, consider certificate-based authentication or an integrated PKI for higher security in larger environments.

Which encryption and hashing should I choose?

AES-256 for encryption and SHA-256 or better for hashing are solid defaults. Dh-group 14 or higher for PFS is recommended for stronger forward secrecy. Vpn add on edge

How do I verify the VPN tunnel is up?

From the EdgeRouter GUI, check the VPN status panel. from the CLI, run show vpn ipsec sa or review the log for ISAKMP/IPsec events. Then ping hosts across the tunnel.

Can I run VPN traffic through both sites in a hub-and-spoke layout?

Yes. You can configure multiple site-to-site tunnels and route traffic between spokes via a central hub, but ensure firewall and routing policies are correctly set.

What if the tunnel keeps dropping?

Check for routing mismatches, PSK mismatches, IP conflicts, or mismatched IKE/ESP proposals. Ensure DPd is enabled and there’s enough CPU headroom for encryption.

Does EdgeRouter support dynamic DNS for IPsec peers?

It can, but you’ll need to ensure the dynamic DNS name resolves to the correct public IP and update the peer configuration as needed. This is often easier with static IPs.

How do I handle NAT on one side of the VPN?

If NAT is present, enable NAT-T NAT-Traversal and ensure the tunnel endpoints are reachable through the NAT devices. You may also need to define NAT rules that don’t intercept VPN traffic. Vpn add on microsoft edge

What if I need more than two sites?

You can add additional site-to-site peers and define separate local/remote prefixes for each tunnel. Just keep your routing and firewall rules organized to avoid conflicts.

Zenmate free vpn microsoft edge