Edgerouter vpn site to site: complete guide for setting up IPsec site-to-site VPNs on EdgeRouter

Yes, you can set up a site-to-site VPN on EdgeRouter. In this guide, you’ll get a practical, end-to-end walkthrough to configure IPsec-based site-to-site VPNs between EdgeRouter devices or between EdgeRouter and other VPN gateways. You’ll find clear, step-by-step CLI instructions, common pitfalls, troubleshooting tips, and real-world patterns you can adapt to your network. If you’re looking for extra privacy and protection while browsing or remote access for colleagues, consider NordVPN with a great discount using the badge below.

What you’ll learn in this guide:

• How IPsec site-to-site works on EdgeRouter and why it’s a solid choice for small to medium networks
• Prerequisites like hardware capabilities, IP addressing plans, and firewall rules
• A reliable, tested step-by-step approach to two common scenarios: EdgeRouter-to-EdgeRouter and EdgeRouter-to-third-party gateways e.g., Cisco, pfSense
• How to verify VPN health, monitor traffic, and troubleshoot typical problems
• Security practices, including proposals, PFS, and rekey timing
• Performance considerations and optimization tips for EdgeRouter devices

Body

What is a site-to-site VPN on EdgeRouter?

A site-to-site VPN creates an encrypted tunnel between two distinct networks, typically over the public Internet. For EdgeRouter, this usually means IPsec tunnels configured with an IKE phase IKEv1 or IKEv2, phase 1/2 proposals, and corresponding policies that determine which traffic to encrypt. The result is a secure bridge between your local network LANs on both ends so devices on one side can reach devices on the other as if they shared a single network.

EdgeRouter devices run EdgeOS, which is based on Vyatta/RouterOS lineage. They leverage strongSwan for IPsec, allowing you to craft flexible tunnels, multiple peers, and granular firewall filtering. A well-designed site-to-site VPN can support multiple subnets on each side, split-tunnel traffic, and dynamic IP addresses if you pair with dynamic DNS.

Prerequisites and planning

Before you configure anything, lay a strong foundation:

• Hardware and firmware

  • EdgeRouter models like ER-4, ER-6P, ER-12, or higher are suitable depending on throughput needs. Ensure your EdgeRouter firmware is up to date to benefit from bug fixes and security patches.
  • If you expect high traffic or have numerous tunnels, consider hardware offload capabilities and CPU performance.

• Network addressing Cyberghost vpn chrome extension download file

  • Plan subnets for each site for example, 192.168.10.0/24 at Site A and 192.168.20.0/24 at Site B.
  • Decide which networks will be reachable across the VPN and which networks should stay private behind their own gateways.

• Public IPs

  • Static IPs on at least one end simplify configuration. If both ends have dynamic IPs, you’ll need Dynamic DNS on both sides to keep peers reachable.

• Security posture

  • Choose IPsec proposals that balance security and compatibility. IKEv2 is preferred for reliability and faster rekeying, but EdgeRouter supports IKEv1 as well when needed for legacy peers.
  • Plan NAT traversal and firewall rules to protect both sides while allowing required traffic.

• Time synchronization

  • Make sure both sides have reasonably accurate clocks. IPsec depends on timestamps for certain rekey operations and security associations.

• Documentation

  • Keep a diagram of your topology, including which subnets are encrypted, which are left in the clear, and the specific peers for each tunnel.

Two common scenarios

We’ll cover two frequent setups: How to turn off vpn on edge and disable vpn connections in Microsoft Edge on Windows, macOS, Android, and iOS

1. EdgeRouter-to-EdgeRouter two EdgeRouter devices on different sites
2. EdgeRouter-to-third-party gateway EdgeRouter to Cisco ASA, pfSense, etc.

Each scenario has a concrete, copy-paste-friendly example you can adapt.

Scenario A: EdgeRouter to EdgeRouter

Assumptions:

• Site A LAN: 192.168.10.0/24
• Site B LAN: 192.168.20.0/24
• Site A public IP: 203.0.113.1
• Site B public IP: 198.51.100.1
• IPsec secret: “StrongSecret123”
• IKEv2 preferred, strongSwan-based on EdgeOS

Step-by-step Site A and Site B have nearly identical configs. differences are in local/remote subnets and public IPs:

1. Basic layout and interfaces

• Ensure your WAN interfaces are properly configured e.g., eth0 or eth1.
• Confirm you can reach the peer via ping and that there are no firewall rules blocking IPsec usually UDP 500/4500 for IPsec NAT-T, plus ESP protocol 50.

2. Create IKE group IKEv2 with strong crypto

On Site A EdgeRouter CLI:

configure
set vpn ipsec ike-group IKEV2-GROUP proposal 1 encryption aes256
set vpn ipsec ike-group IKEV2-GROUP proposal 1 hash sha256
set vpn ipsec ike-group IKEV2-GROUP proposal 1 dh-group 14
set vpn ipsec ike-group IKEV2-GROUP dead-peer-detect 15

3 Define IPsec policy IKEv2 with perfect forward secrecy and child SA

set vpn ipsec ipsec-interfaces interface eth0
set vpn ipsec esp-group ESP-GROUP proposal 1 encryption aes256
set vpn ipsec esp-group ESP-GROUP proposal 1 hash sha256
set vpn ipsec esp-group ESP-GROUP pfs yes

4 Create a peer Site B

set vpn ipsec peer site-b peer 198.51.100.1
set vpn ipsec peer site-b authenticate method pre-shared-secret
set vpn ipsec peer site-b authenticate pre-shared-secret StrongSecret123
set vpn ipsec peer site-b ike-group IKEV2-GROUP
set vpn ipsec peer site-b default-esp-group ESP-GROUP
set vpn ipsec peer site-b dpd-echo-request 10
set vpn ipsec peer site-b local-address 203.0.113.1
set vpn ipsec peer site-b remote-address 198.51.100.1

5 Define tunnel network mappings the networks to encrypt

set vpn ipsec site-to-site peer site-b tunnel 1 local prefix 192.168.10.0/24
set vpn ipsec site-to-site peer site-b tunnel 1 remote prefix 192.168.20.0/24

6 Commit and apply

commit
save

7 Firewall considerations allow VPN traffic and route it correctly
- If you have a firewall zone for the LAN and WAN, ensure the security policy allows IPsec traffic.
- Create a rule to allow ESP 50 and ISAKMP 4500 through the firewall if you’re using a separate IPsec firewall policy.

Site A Notes:
- Repeat the same steps at Site B with local/remote subnets swapped and local/remote public IPs updated.

Site B notes:
- Use the corresponding remote subnet Site A’s 192.168.10.0/24 and the peer’s public IP.

8 Verification
- Check status:
show vpn ipsec sa
- Check overall IPsec status:
show vpn ipsec status
- Check routing to ensure traffic to the remote subnet is entering the tunnel via the VPN:
show ip route

# Scenario B: EdgeRouter to a third-party gateway e.g., Cisco ASA or pfSense

- Site A: EdgeRouter 192.168.10.0/24
- Site B: Cisco ASA 192.168.20.0/24
- Public IPs: 203.0.113.1 EdgeRouter and 203.0.113.2 ASA
- Pre-shared key: StrongSecret123
- Use IKEv2 for consistency where possible

The steps are similar, but you’ll adjust the remote peer details to reflect the ASA’s public IP and ensure the SA parameters encryption, DH group, PFS align with the ASA’s configuration.

1 Create IKE group and IPsec policy same as Scenario A if ASA supports the same crypto suites. If ASA requires particular suites, adjust accordingly.

2 Define the peer with the ASA’s public IP and PSK:
set vpn ipsec peer asa peer 203.0.113.2
set vpn ipsec peer asa authenticate method pre-shared-secret
set vpn ipsec peer asa authenticate pre-shared-secret StrongSecret123
set vpn ipsec peer asa ike-group IKEV2-GROUP
set vpn ipsec peer asa default-esp-group ESP-GROUP
set vpn ipsec peer asa local-address 203.0.113.1
set vpn ipsec peer asa remote-address 203.0.113.2

3 Tunnel definitions:
set vpn ipsec site-to-site peer asa tunnel 1 local prefix 192.168.10.0/24
set vpn ipsec site-to-site peer asa tunnel 1 remote prefix 192.168.20.0/24

4 Commit and verify as above.

5 If issues arise, verify ASA-side logs for phase 1/2 negotiations, and check for mismatched proposals, such as incompatible encryption or mismatched PSKs.

 Common pitfalls and how to avoid them

- Mismatched IKE/ESP proposals
  - Ensure both sides agree on the encryption, hash, and DH group. If the peer rejects, you’ll see phase 1 negotiation failures.
- NAT Traversal NAT-T
  - If you’re behind NAT, enable NAT-T usually on by default in EdgeOS. If you’re facing dropped packets, verify UDP 4500 is open and NAT-T is active.
- Firewall blocking IPsec
  - The EdgeRouter’s firewall must allow ESP 50 and AH 51, often disabled and UDP 500/4500 for IKE negotiates.
- Dynamic IPs
  - If either side uses a dynamic IP, set up Dynamic DNS on that side and configure the peer with the DDNS hostname, ensuring the IP is updated automatically.
- Overlapping subnets
  - Avoid overlapping LAN subnets across sites. if necessary, readdress one side to prevent routing conflicts.
- NAT for LAN behind EdgeRouter
  - If you want to reach devices on the remote LAN, ensure proper NAT exemption no NAT for traffic between the two VPN networks. This ensures traffic remains private to the VPN tunnel.

 Verification: testing and troubleshooting tips

- Basic connectivity test:
  - Ping a device on the remote LAN from a device on the local LAN through the VPN tunnel.
- IPsec SA status:
  - Use show vpn ipsec sa to confirm that SAs are active and traffic is being encrypted.
- Logs and diagnostics:
  - Check the EdgeRouter logs for VPN-related messages:
   - show log  | match vpn
- Routing checks:
  - Confirm that there is a route for the remote subnet via the VPN tunnel:
    - show ip route 192.168.20.0/24
- NAT traversal checks:
  - If you’re behind NAT, ensure the VPN tunnel uses UDP 4500. verify traffic is not dropped by the NAT device.

 Security considerations

- Use strong IKEv2 with AES-256 and SHA-256 or better, and enable PFS perfect forward secrecy on the IPsec SA for additional forward secrecy.
- Set reasonable lifetimes and rekey intervals. a typical setup is 8 hours for IKE SA and 1 hour to 8 hours for IPsec SA lifetimes depending on traffic patterns.
- Limit VPN access to only what’s needed. use firewall rules to restrict traffic to specific subnets or hosts that require cross-site communication.
- Regularly update EdgeRouter firmware to mitigate security vulnerabilities.

 Performance and optimization tips

- Enable hardware offload if your EdgeRouter supports it to improve throughput for IPsec processing.
- Use a balanced combination of encryption AES-256 and hash SHA-256 for strong security without choking throughput.
- If you’re seeing instability, try reducing the number of tunnels or simplifying the cryptographic suite to improve compatibility with older peers.
- Consider split-tunneling when you don’t need all traffic to go through the VPN, which can reduce WAN load.

 Dynamic DNS and site resilience

- Dynamic IPs can complicate site-to-site VPNs. If you can’t get static IPs on both ends, configure Dynamic DNS on the peers and set the remote addresses to the DDNS hostnames.
- For high availability, you can deploy redundant peers and adjust the policy to use multiple possible remote addresses with stable rekey intervals.

 Real-world architectures you can copy

- Small business with two offices: One EdgeRouter in each office, each with a 192.168.10.0/24 and 192.168.20.0/24 network, respectively. a single IPsec tunnel between the sites with 1:1 traffic routing for required services.
- Branch-to-headquarters: EdgeRouter in a branch office tunnels only the required subnets to the data center, with strict firewall rules to minimize exposure.

 Monitoring and ongoing maintenance

- Schedule regular checks of VPN status as part of your network maintenance routine.
- Keep a log of tunnel rekey events and any disconnections. this helps identify flaky links or mismatched config changes.
- Update every 12–24 months or sooner if significant EdgeOS updates are released.

 Useful resources and references

- EdgeRouter IPsec configuration guide EdgeOS
- StrongSwan documentation for IPsec
- Dynamic DNS providers and DDNS setup guides
- Firewalld and EdgeOS firewall rule best practices
- Vendor-specific notes for third-party gateways e.g., Cisco ASA, PfSense

Frequently Asked Questions

# What is the EdgeRouter and what makes it good for VPNs?

EdgeRouter is Ubiquiti’s routing OS offering EdgeOS, which supports powerful IPsec VPN capabilities, flexible firewall rules, and straightforward CLI for complex setups. It’s a solid choice for small to medium networks that want reliable, configurable VPNs without enterprise-grade hardware.

# Can I run IKEv2 on EdgeRouter for site-to-site VPN?

Yes. IKEv2 is supported and is generally preferred for modern VPN deployments due to its stability and quicker rekeying. You’ll typically configure IKE groups and ESP policies as part of the IPsec settings.

# How do I choose between IKEv1 and IKEv2?

IKEv2 is preferred for new deployments due to improved stability and efficiency. IKEv1 might be necessary when connecting to older gateways that don’t support IKEv2, but you should plan to upgrade those peers if possible.

# How many tunnels can EdgeRouter support?

It depends on the model and the CPU. Small models can comfortably handle several tunnels at reasonable throughput, while higher-end EdgeRouter models can support more tunnels and higher traffic with hardware offload.

# What should I use for the remote subnet mask?

Choose non-overlapping subnets on each side. Common choices are 192.168.10.0/24 and 192.168.20.0/24, but you can use any private ranges that don’t collide with other sites.

# How do I test a VPN tunnel is working?

Ping a host on the remote subnet from a host on the local subnet and verify that traffic is labeled as VPN-encapsulated via the IPsec SA status. Use show vpn ipsec sa for SA stats and ensure that traffic is flowing through the tunnel.

# How do I handle dynamic IPs on one side?

Configure Dynamic DNS on the side with the dynamic IP and use the DDNS hostname as the remote address. This requires matching the remote-address field to the DDNS hostname and ensuring keep-alives are properly configured.

# What firewall rules should I implement for a VPN?

Create rules that allow ESP traffic, UDP 500 for IKE, UDP 4500 for NAT-T, and then allow needed traffic between the local and remote subnets. Block all else by default.

# How do I troubleshoot common VPN issues?

- Verify IKE/ESP proposals match on both sides.
- Ensure NAT-T is enabled if either side is behind NAT.
- Check firewall rules on both sides to ensure VPN traffic is allowed.
- Review logs for phase 1/2 negotiation errors.
- Confirm route advertisements and that the networks you want to reach are correctly included in the tunnel definitions.

# Can I run multiple site-to-site VPNs with EdgeRouter?

Yes. EdgeRouter supports multiple IPsec peers and multiple tunnels per device. You’ll configure separate tunnel definitions for each site, ensuring there are no overlapping subnets and that firewall rules properly isolate traffic as needed.

# Are there performance considerations I should know about?

Yes. IPsec performance is bound by CPU capabilities and hardware acceleration if available. Use AES-256 with SHA-256 for security and consider enabling hardware offload if your model supports it. If you’re hitting throughput limits, scaling to a higher-end EdgeRouter model or reducing encryption strength can help, but weigh security requirements carefully.

# How often should I rotate VPN keys?

A common practice is to rotate IPsec pre-shared keys or certificates on a yearly basis or sooner if you suspect a compromise. Also, adjust rekey timers to balance security with compatibility. shorter lifetimes increase security but add management overhead.

# What are the best practices for maintaining a site-to-site VPN?

- Keep EdgeRouter firmware updated
- Use strong cryptography and enable PFS
- Document every tunnel’s purpose, subnets, and peers
- Validate connectivity regularly with automated tests
- Monitor logs for anomalies and maintain a standard change management process

# Can dynamic DNS increase security risks?

Dynamic DNS itself doesn’t inherently increase risk, but it can make your endpoints more discoverable. Use strong authentication, restrict access to the VPN only to necessary subnets, and keep your devices patched. For a higher security posture, pair DDNS with certificate-based authentication where possible.

This guide gives you a practical, end-to-end approach to Edgerouter vpn site to site configurations. Whether you’re connecting two offices or integrating an EdgeRouter with a third-party gateway, the steps here should help you get secure, reliable tunnels up and running. If you want extra privacy and value, don’t forget to check the NordVPN offer in the introduction, which can add an extra layer of security for devices and remote workstations beyond the VPN between sites.

Bd net vpn apk latest version 全网最佳选择：功能对比、下载安装、隐私保护、使用场景与风险

Vpn for edge browser: how to set up, best extensions, and privacy tips for Windows in 2025