Journalist 
Ubiquiti edge router site to site vpn is a feature that lets you securely connect two or more sites over the internet using IPsec. In this guide, I’ll walk you through what a site-to-site VPN is on Ubiquiti’s EdgeRouter, why it’s a smart move for growing networks, and how to set it up step-by-step. You’ll also find practical tips, troubleshooting steps, and real-world considerations so your remote offices can communicate as if they’re on the same LAN. If you’re looking to add extra privacy to your online sessions while you manage these connections, check out this current NordVPN deal:
Introduction: what you’ll learn
- A quick understanding of how EdgeRouter site-to-site VPN works and when to use it
- A practical, step-by-step configuration workflow for two sites
- How to plan network subnets, choose encryption, and handle dynamic vs. static IPs
- Firewall and NAT considerations to keep the tunnel stable
- Common gotchas, troubleshooting tips, and performance expectations
- A thorough FAQ to cover typical questions beginners and pros alike ask
- Useful resources and references to deepen your setup
What is a site-to-site VPN on a Ubiquiti EdgeRouter?
A site-to-site VPN creates a secure, encrypted tunnel between two or more remote networks so devices at one site can reach resources at another as if they were on the same local network. EdgeRouter devices use IPsec IKE/IPsec to negotiate the tunnel, manage encryption, and route traffic across the public internet. This is different from a client-to-site VPN, where a single user connects to a network. a site-to-site VPN is designed for continuous, automatic connectivity between entire networks. Browsec vpn google chrome: A Comprehensive Guide to Browsec Chrome Extension Installation, Usage, Privacy, and Comparisons
Why use a site-to-site VPN between EdgeRouters?
- Secure inter-site connectivity: All traffic between sites is encrypted, protecting sensitive data as it traverses the internet.
- Centralized resource access: Remote sites can access file servers, printers, application servers, and other resources without exposing them to the wider internet.
- Network segmentation and security: You can segment traffic with firewall rules so only specific subnets communicate across the tunnel.
- Scalability: Add more sites by configuring additional IPsec peers, without reworking the entire network design.
- Reduced exposure: By keeping the traffic within a controlled tunnel, you reduce the risk of direct exposure to the public internet.
Prerequisites: what you’ll need before you begin
- Two EdgeRouter devices or more for multiple sites running EdgeOS with IPsec support
- Public IP addresses for the WAN interfaces on both sides static or dynamic with a DDNS fallback
- Known internal subnets for each site LAN ranges you want to route across the tunnel
- Basic familiarity with EdgeOS CLI or the Web UI
- A shared pre-shared key PSK or, if you’re using certificates, a plan for certificate management
- Firewall rules that allow IPsec ESP, AH, IKE through the WAN and into the VPN interface
- A rough understanding of how you want to split traffic: full-tunnel all site traffic through VPN or split-tunnel only specific subnets
Step-by-step: configure IPsec site-to-site VPN on EdgeRouter
Note: The exact UI labels can vary slightly by firmware version, but the underlying concepts and commands remain the same. I’ll show a practical CLI example that you can adapt to your environment.
Step 1 – Plan your network and gather details
- Document each site’s LAN subnet e.g., Site A: 192.168.1.0/24, Site B: 10.1.0.0/24
- Record each site’s public IP or dynamic hostname with a DDNS service
- Decide on the tunnel direction and routing: Should Site A’s 192.168.1.0/24 reach Site B’s 10.1.0.0/24? Should Site A also reach other networks behind Site B?
- Choose your IPsec parameters: IKE group DH group, encryption AES-256, integrity SHA-256, and the tunnel lifetime
- Decide PSK or certificate-based authentication
Step 2 – Configure IPsec on Router A left side
Below is a representative example you can adapt. Replace PEER1 with a friendly name, addresses with your real ones, and PSK with something strong. Edge vpn location: how server locations shape speed, privacy, streaming access, and how to pick the best Edge vpn location
# Define IKE and ESP groups
set vpn ipsec ike-group IKE-GROUP1 proposal 1 encryption aes256
set vpn ipsec ike-group IKE-GROUP1 proposal 1 hash sha256
set vpn ipsec ike-group IKE-GROUP1 lifetime 3600
set vpn ipsec esp-group ESP-GROUP1 proposal 1 encryption aes256
set vpn ipsec esp-group ESP-GROUP1 proposal 1 hash sha256
set vpn ipsec esp-group ESP-GROUP1 lifetime 3600
# Configure the remote peer Router B
set vpn ipsec site-to-site peer PEER1 address 198.51.100.5 # public IP of Router B
set vpn ipsec site-to-site peer PEER1 authentication mode pre-shared-secret
set vpn ipsec site-to-site peer PEER1 authentication pre-shared-secret 'YOUR_STRONG_PSK'
set vpn ipsec site-to-site peer PEER1 ike-group IKE-GROUP1
set vpn ipsec site-to-site peer PEER1 esp-group ESP-GROUP1
set vpn ipsec site-to-site peer PEER1 local-subnet 192.168.1.0/24
set vpn ipsec site-to-site peer PEER1 remote-subnet 10.1.0.0/24
# WAN interface and global enable
set interfaces ethernet eth0 description 'WAN'
set vpn ipsec options yet-to-be-set # optional advanced options
Commit and save:
commit
save
Step 3 – Configure IPsec on Router B right side
Use the mirror configuration from Router A. The local-subnet becomes Site B’s LAN, and the remote-subnet becomes Site A’s LAN. The address is the public IP of Router A.
set vpn ipsec site-to-site peer PEER1 address 203.0.113.1 # public IP of Router A
set vpn ipsec site-to-site peer PEER1 local-subnet 10.1.0.0/24
set vpn ipsec site-to-site peer PEER1 remote-subnet 192.168.1.0/24
Step 4 – Ensure NAT and firewall rules permit VPN traffic
- Allow IPsec IKE/ISAKMP, ESP through the WAN on both sides
- Exclude VPN traffic from NAT where appropriate, or create a dedicated VPN firewall rule
Example firewall concept:
- Allow: ipsec-ESP, ipsec-managment, udp/500 IKE, udp/4500 NAT-T
- Create a firewall rule to drop all other inbound VPN traffic from WAN to LAN unless it’s part of the VPN
Step 5 – Verify the tunnel status and functionality
- On both routers, verify the tunnel state and IPsec SA status
- Check for children routes or dynamic routing if you’re using routing protocols
- Test connectivity: ping from Site A to Site B and vice versa
- Validate that traffic bound for the remote subnet flows through the tunnel full-tunnel or only specific subnets if you implemented split-tunnel
Common verification commands conceptual
- show vpn ipsec sa
- show vpn ike sa
- show interfaces
- show firewall all
Step 6 – Fine-tuning and maintenance
- If you have dynamic IPs, add a Dynamic DNS DDNS entry on each site and configure the VPN to reference the updated IP when needed
- Consider enabling Dead Peer Detection DPD to quickly recover from a temporarily broken tunnel
- Schedule regular PSK rotation or, if you’re using certificates, manage certificate lifecycles
- Document changes so your team can troubleshoot quickly in the future
Alternative approaches and considerations
- OpenVPN and WireGuard: EdgeRouter devices can run IPsec natively and are widely used for site-to-site VPNs. OpenVPN can be used as an alternative, but IPsec tends to be more robust for site-to-site, with better integration into routing. WireGuard is popular for remote-access VPNs and newer hardware. however, EdgeRouter support for WireGuard is not as universal as IPsec, so verify firmware capabilities if you’re considering it for a new site-to-site deployment.
- Certificates vs. PSK: For stronger security and easier key management across multiple sites, consider certificate-based authentication instead of pre-shared keys. This involves setting up a PKI Public Key Infrastructure and issuing certificates to each EdgeRouter.
- Dynamic IPs: If your WAN IP can change, DDNS is your friend. You’ll configure a hostname on each side and reference it in the VPN peer settings so the tunnel can re-establish even if the public IP shifts.
- Redundancy: For mission-critical sites, add a secondary VPN peer or leverage a failover WAN link to keep traffic flowing if one WAN path goes down.
Performance considerations and real-world expectations
- Hardware matters: EdgeRouter models range from small, budget-friendly devices to more capable units. Performance for IPsec is closely tied to CPU power and memory. Higher-end models for example, ER-4 and above in some lineups typically deliver better IPsec throughput and smoother tunnel handling than entry-level models.
- Encryption choice: AES-256 is strong and widely supported, but you’ll want to test your specific devices. In practice, AES-256 with SHA-256 tends to provide a good balance of security and performance. If latency is a concern, consider testing AES-128 as a baseline for performance comparisons, though you should maintain a strong security posture.
- Network design: If you’re routing all traffic between sites through the VPN, expect higher CPU usage on both routers. Consider optimizing routing or using dedicated links for heavy inter-site traffic if you see bottlenecks.
- Monitoring: Set up basic monitoring for tunnel uptime, MTU issues, and path stability. Small hiccups in WAN connectivity can cause VPN flaps. DPD and keep-alive settings can help mitigate this.
Security best practices
- Use a strong pre-shared key minimum 20+ characters or, better, authentication via certificates
- Enforce strong IKE and ESP proposals AES-256, SHA-256, modern DH groups
- Regularly rotate credentials and keep firmware up to date
- Limit remote access and enforce strict firewall rules to minimize exposure
- Log and monitor VPN activity to detect anomalies early
- Consider network segmentation so only necessary subnets cross the VPN
Common issues and quick fixes
- VPN tunnel not establishing: double-check the PSK, ensure the remote subnet is correct, confirm that both sides’ local-subnet and remote-subnet definitions align, and verify that the public IPs are reachable.
- Tunnel drops after a few minutes: verify WAN stability, enable DPD, and consider increasing IKE/ESP lifetimes if your environment is unstable but reliable.
- Traffic not flowing to the remote subnet: confirm routing tables on both sides and ensure firewall rules are not inadvertently blocking traffic between the subnets.
- NAT traversal issues: ensure NAT-T is enabled for NAT-heavy environments. check MTU settings to prevent fragmentation.
Real-world deployment examples
- Small branch office to main office: two EdgeRouter devices with a single IPsec tunnel, monitoring via simple pings and a LAN-to-LAN route. This is common for SMBs needing quick, secure inter-site connectivity.
- Multi-site organization: hub-and-spoke topology. You can extend the IPsec tunnels to multiple branch sites, with central monitoring and consistent security policies across all links.
- Data center interconnect: use IPsec to extend a protected subnet across campuses, with firewall rules tightly controlling what traffic traverses the tunnel.
What to know about EdgeRouter models and IPsec capabilities
- EdgeRouter devices are popular for their balance of price and performance in small to medium networks.
- IPsec is a core feature, with built-in support for site-to-site connections. The exact throughput you get depends on your model, firmware version, and how heavily you’re NAT-ing or inspecting traffic.
- If you’re planning multiple tunnels or advanced routing, confirm your chosen model’s CPU performance and memory. For enterprises or high-traffic sites, you may look at higher-end EdgeRouter variants or consider a dedicated firewall appliance.
Useful tips to maximize your VPN setup
- Always test with a pilot site before rolling out to multiple sites
- Document every change. when you’ve got 3 or 4 sites, a quick reference sheet saves headaches later
- Maintain a rollback plan in case you need to revert configurations quickly
- Use monitoring to detect failing tunnels early, not after users start complaining
- Schedule periodic reviews of encryption settings to keep pace with security standards
URLs and resources unclickable text
- Ubiquiti EdgeRouter official documentation
- Ubiquiti community forums for EdgeRouter IPsec setup
- IPsec and VPN best practices from major security guides
- NordVPN deal for extra privacy and security when working remotely
Frequently Asked Questions
What is a site-to-site VPN in simple terms?
A site-to-site VPN is a secure tunnel that links two networks so devices on one network can talk to devices on the other as if they were on the same LAN, with traffic encrypted as it travels over the internet.
Do I need static or dynamic IPs for site-to-site VPNs?
Static IPs are the simplest to configure for site-to-site VPNs, but you can use dynamic IPs with DDNS services. The key is having reliable IP address updates on both sides so the peers can locate each other.
Can I use certificates instead of a pre-shared key?
Yes. Certificates provide stronger authentication and easier key management when you’re dealing with multiple sites. It requires setting up a PKI and issuing certificates to each edge router.
Is IPsec the only option for EdgeRouter site-to-site VPNs?
IPsec is the most common and widely supported option for site-to-site VPNs on EdgeRouter devices. OpenVPN and, in some environments, WireGuard can be considered, but IPsec remains the standard for site-to-site interconnects.
How do I know if my VPN is up and healthy?
Check the VPN status on both routers IKE/SAs and IPsec SAs, test connectivity with pings across the tunnels, and verify that traffic routes through the tunnel as intended.
What are split-tunneling and full-tunneling in a site-to-site VPN?
Split-tunneling sends only specific traffic across the VPN e.g., certain subnets, while full-tunneling routes all traffic aimed at the remote site across the VPN. Your choice affects performance and security.
How do I handle dynamic WAN IPs?
Use DDNS on each site so the VPN peers can resolve updated IPs automatically. Update your VPN peer configuration to reference the DDNS hostname rather than a static IP.
What encryption should I choose for IPsec?
AES-256 with SHA-256 is a strong default choice. Depending on hardware and performance needs, you can test AES-128 for speed, but prioritize security with SHA-256 and a solid DH group.
How can I improve VPN reliability?
Enable DPD Dead Peer Detection, use stable WAN links, and consider failover or backup tunnels. Regular maintenance and firmware updates also boost reliability.
What should I monitor after deployment?
Tunnel uptime, latency between sites, packet loss, MTU fragmentation, firewall hits, and the health of all routing paths. Set up alerts for any tunnel down events.
Can I have more than two sites in a single IPsec tunnel?
You can interconnect multiple sites by creating separate IPsec peers for each site. In some architectures, you might use a hub-and-spoke model with centralized routing.
How often should I rotate my authentication credentials?
Rotate PSKs periodically or refresh certificates before they expire. Establish a schedule e.g., every 6–12 months for PSKs, as recommended by your security policy.
What are common mistakes to avoid with EdgeRouter IPsec?
Mismatched remote-subnet definitions, wrong PSK, firewall rules that inadvertently block VPN traffic, and inconsistent IKE/ESP parameters across peers. Double-check subnet scopes and peer addresses.
By following this guide, you’ll be well on your way to a reliable, secure site-to-site VPN between Ubiquiti EdgeRouter devices. Whether you’re linking a small office to your central site or expanding to multiple branches, the combination of IPsec customization, careful planning, and smart firewall rules will help you maintain fast, private intersite communication. If you want additional privacy while you manage these connections, consider the NordVPN deal linked above.
Cyberghost vpn microsoft edge