Table of Contents

Edgerouter x site to site vpn setup: complete guide to setting up a robust site-to-site IPsec VPN on EdgeRouter X with GUI and CLI tips

Edgerouter x site to site vpn setup is possible. In this guide, you’ll learn how to configure a site-to-site IPsec VPN on EdgeRouter X, with practical steps for both the GUI EdgeOS and the CLI, plus tips on addressing, firewall rules, testing, and common troubleshooting. This is designed for real-world use, not fluff. Below you’ll find a clear, step-by-step path, examples you can adapt, and best-practice notes to help you get a stable tunnel up quickly.
For extra protection while you’re learning or testing, consider NordVPN as an extra layer of security for your devices when you don’t want to expose admin traffic on public networks:

Useful URLs and Resources text only: Edgerouter X product page – ubnt.com/products/edgerouter-x, EdgeOS documentation – help.ubnt.com, IPsec overview – en.wikipedia.org/wiki/IPsec, NAT traversal explanation – en.wikipedia.org/wiki/Network_Address_Translation, VPN site-to-site guides – docs.cisco.com, mikrotik site-to-site VPN tips – mikrotik.com, Ubiquiti community forums – community.ui.com

Understanding the Edgerouter X and site-to-site VPNs

EdgeRouter X is a budget-friendly, 5-port router that runs EdgeOS, offering solid performance for home offices and small businesses. It supports IPsec site-to-site VPNs, which lets you connect remote networks securely over the internet without exposing internal devices to the public internet.
A site-to-site VPN creates a secure tunnel between two different networks for example, your office network and a branch office. Traffic destined for the remote network travels through the encrypted tunnel automatically, so devices on-site don’t need to establish a VPN connection individually.
Common deployment patterns include connecting two physical sites, disaster-recovery links, or providing secure access to a cloud-hosted network while keeping your internal addressing intact.

Prerequisites and planning

Before you start, have these ready and planned:

EdgeRouter X on a current EdgeOS release and accessible management interface GUI or SSH.
Public IP addresses for both sites, or a static remote hostname if you’re using dynamic DNS DDNS with a hostname update.
Local networks at each site for example: Site A 192.168.10.0/24, Site B 192.168.20.0/24. Plan which subnet will be used across the VPN tunnel for routing.
A strong pre-shared key PSK if you’re using traditional IPsec PSK-based authentication. For higher security, consider certificates, but be aware EdgeRouter X may require more complex setup.
Firewall rules that allow IPsec ISAKMP/IKE traffic and the VPN tunnel traffic to pass UDP 500, UDP 4500 for NAT-T, and ESP protocol 50 for the tunnel.
Decide on a routing approach: route-based VPN is common for site-to-site tunnels and tends to be easier to manage when you have multiple subnets to reach across sites.

Network planning and addressing examples

Site A your main site: 192.168.10.0/24
Site B remote site: 192.168.20.0/24
VPN tunnel uses a dedicated, non-overlapping subnet for tunnel endpoints sometimes 10.0.0.0/30 or 10.0.1.0/30 to simplify routing and troubleshooting.
If you’re using a dynamic IP at one site, pair the remote gateway with a DDNS hostname and configure the EdgeRouter to resolve it regularly.

Why planning matters: if subnets overlap or you don’t set proper routing, traffic will not traverse the VPN as expected, and you’ll spend more time chasing holes in your tunnel.

Two main configuration paths: GUI EdgeOS and CLI

You’ll typically configure IPsec site-to-site VPN either through the EdgeOS GUI or via the CLI. The GUI is friendlier for beginners, while the CLI gives you precise control and is easier to reproduce in scripts.

A. GUI EdgeOS approach

Log in to the EdgeRouter X web interface.
Create firewall rules to allow IPsec traffic:
- Allow IPsec IKP/Others traffic from your LAN to the WAN.
- Allow ESP and NAT-T UDP 4500 if NAT is involved.
Go to VPN > IPsec, and add a new site-to-site peer:
- Remote gateway: the public IP or hostname of the remote site.
- Authentication: pre-shared key enter the PSK you chose.
- IKE group / phase 1: choose a strong crypto for example AES-256, SHA-1 or SHA-256, and a reasonable DH group like 14 or 16.
- Phase 2 ESP proposal: AES-256, AES-128, SHA-256, PFS group as needed.
- Local and remote subnets: specify Site A and Site B subnets, respectively e.g., 192.168.10.0/24 -> 192.168.20.0/24.
Save and enable the tunnel. The GUI will show tunnel status: Down/Connecting/Up.
Add static routes or policy-based routing if needed:
- Route traffic destined for 192.168.20.0/24 to the VPN tunnel.
- Ensure normal internet traffic exits via the WAN as usual no VPN path for that unless you want split tunneling.

B. CLI EdgeOS approach

SSH into EdgeRouter X or connect via the console.
Define the IKE and IPsec policies. A typical approach uses a named IKE group and a pair of tunnel definitions that link local and remote networks.
Create a site-to-site IPsec peer with the remote gateway IP and PSK:
- set vpn ipsec site-to-site peer authentication mode pre-shared-secret
- set vpn ipsec site-to-site peer authentication pre-shared-secret
- set vpn ipsec site-to-site peer ike-group
- set vpn ipsec site-to-site peer default-peer-crypto
Define the local and remote subnets for the tunnel:
- set vpn ipsec site-to-site peer tunnel 1 local-subnet 192.168.10.0/24
- set vpn ipsec site-to-site peer tunnel 1 remote-subnet 192.168.20.0/24
Commit and save, then check the status:
- show vpn ipsec sa
- show vpn ipsec status
Add routing so traffic to the remote subnet goes through the tunnel:
- set protocols static route 192.168.20.0/24 next-hop
Verify with pings and traceroutes across the tunnel.

Note: If you’re using dynamic IPs on one side, you may need DDNS integration and a dynamic update to the EdgeRouter’s VPN peer configuration when the remote IP changes.

Key firewall and NAT considerations

IPsec requires allowing ISAKMP UDP 500 and NAT-T UDP 4500 if NAT is involved between sites. ESP IP protocol 50 must not be blocked.
If you’re using a LAN-to-LAN rule, ensure the firewall allows traffic from the LAN networks to the VPN subnet and vice versa.
If you’re using split tunneling only VPNing specific subnets, configure policy-based routing so only 192.168.20.0/24 traffic goes through the VPN, while other traffic exits normally.
On some setups, you may need to disable NAT on the VPN interface or create a NAT exemption rule so internal traffic to the remote site isn’t NATed in unexpected ways.

Verification and testing

Check tunnel status in EdgeOS GUI or run the CLI status commands:
- show vpn ipsec sa security associations
- show vpn ipsec status
Ping from a host on Site A e.g., 192.168.10.10 to a host on Site B e.g., 192.168.20.20 to test end-to-end connectivity across the VPN.
Use traceroute or mtr to confirm the path goes through the VPN tunnel.
Validate that traffic to the remote subnet uses the VPN path, not the public internet:
- Look at routing tables or use policy-based routing status in EdgeOS.
If the tunnel won’t come up:
- Recheck pre-shared keys on both sides.
- Confirm the public IP addresses are accessible from each side.
- Double-check that the chosen IKE and ESP proposals match on both ends.
- Confirm that firewall rules aren’t inadvertently blocking IPsec.

Common issues and practical fixes

Tunnel not forming: verify that the remote gateway is reachable, the PSK matches, and the IKE/ESP policies align. A mismatched policy on either side is a frequent culprit.
Traffic not routing through VPN: ensure static routes exist for the remote network via the VPN tunnel, and that the firewall allows VPN traffic to reach the tunnel.
NAT-related problems: if NAT-T is blocked or ESP is blocked, IPsec won’t establish. Make sure ESP protocol 50 is allowed in both directions.
Dynamic IP at remote site: use a reliable dynamic DNS service and configure a dynamic update routine so the EdgeRouter can re-establish the tunnel if the remote IP changes.

Security best practices and maintenance

Use strong authentication: PSK should be long and random. consider certificate-based authentication when feasible for stronger identity verification.
Use robust encryption and integrity: AES-256 with SHA-256 and a modern DH group is a common default. Avoid older algorithms like DES or MD5.
Rotate keys periodically: set up a schedule to refresh PSKs if you’re sticking with PSK-based authentication.
Keep firmware updated: EdgeRouter X firmware updates can include security fixes and improved VPN compatibility. Regularly check for updates.
Monitor tunnel health: enable logging for VPN events and review periodically to catch issues early.
Consider redundancy: if uptime is critical, you may want a secondary tunnel or alternate path to the remote site.

Performance expectations

The EdgeRouter X is a capable device for home and small-office VPN workloads, but real-world VPN speeds vary based on encryption level, tunnel configuration, and other traffic on the router.
In typical setups with a moderate number of VPN tunnels and standard AES-256 encryption, you should expect a stable tunnel with low latency suitable for file transfers, remote desktop, and regular inter-site communication.
If your sites have heavy throughput requirements or multiple concurrent VPNs, consider upgrading to a higher-end EdgeRouter or a firewall appliance that’s known for VPN acceleration to maintain consistent performance.

Real-world tips and best practices

Start small: configure a single site-to-site tunnel first, test thoroughly, then add more subnets or tunnels if needed.
Document everything: write down the remote gateway IP, PSK, subnets, and exact route rules you used. It makes future changes painless.
Use a test host at each site: keep a couple of dedicated test devices that you can ping across the VPN to quickly verify health when you adjust rules or update firmware.
Plan for failover: if your internet connection at one site goes down, a backup path or a secondary remote VPN gateway if you have that option can help you maintain connectivity.
Keep a rollback plan: if a change breaks connectivity, know how to revert quickly to the previous working configuration.

Example scenario walkthrough

Site A: 192.168.10.0/24, public IP 203.0.113.10
Site B: 192.168.20.0/24, public IP 203.0.113.20
Remote site uses PSK: “SuperSecureKey123!”
IKE with AES-256, SHA-256, DH group 14. ESP with AES-256/SHA-256
Tunnel 1 local-subnet 192.168.10.0/24, remote-subnet 192.168.20.0/24
Routing: any traffic to 192.168.20.0/24 goes through the VPN tunnel
Firewall: allow ISAKMP, NAT-T, ESP. ensure VPN traffic is permitted through both sites

With this setup, you’ll have a reliable, secure site-to-site VPN using EdgeRouter X that’s suitable for home offices, small businesses, or lab environments. X vpn microsoft edge

Frequently Asked Questions

What is the EdgeRouter X best used for in a site-to-site VPN?

EdgeRouter X is a cost-effective, compact router that runs EdgeOS, making it a solid choice for creating a site-to-site IPsec VPN between small office networks or lab environments without heavy hardware demands.

Can EdgeRouter X support multiple site-to-site VPN tunnels?

Yes, EdgeRouter X can support multiple IPsec site-to-site tunnels, but you’ll want to monitor CPU load and ensure you configure routing and firewall rules correctly to avoid conflicts.

Which VPN protocol should I use on EdgeRouter X, IPsec or OpenVPN?

IPsec is the standard choice for site-to-site VPNs between networks. OpenVPN can be used in certain EdgeOS configurations, but IPsec is typically more straightforward for site-to-site tunnels and better interoperability with many vendors.

How do I choose the right authentication method?

PSK is simple and works well for small setups, but if you can use certificates IKE with certificate-based authentication, you’ll get stronger identity verification and less risk of PSK leakage.

How do I test a site-to-site VPN after it’s configured?

Ping hosts on the remote side from a host on the local side, verify routing tables show the VPN tunnel as the path for remote subnets, and check VPN status with show vpn ipsec sa/status. Disable edge secure network: how to turn off Edge Secure Network and switch to a VPN for privacy, speed, and control

What do I do if the tunnel keeps dropping?

Double-check IP addresses, PSK, and matching IKE/ESP proposals on both sides. Confirm firewall rules allow VPN traffic, and verify there are no NAT or routing conflicts.

Can I use dynamic IP addresses on either site?

Yes, but you’ll need a dynamic DNS setup on the side with the changing IP and ensure the tunnel is configured to handle a non-static remote gateway.

How do I secure the VPN beyond PSK?

Use strong, unique PSKs and rotate them periodically. Consider certificates if your hardware and management allow it. Keep firmware up to date to reduce vulnerabilities.

What final checks should I perform after a successful setup?

Test cross-subnet communication, ensure traffic routes properly through the VPN, verify firewall logs for blocked VPN traffic, and confirm that Internet-bound traffic exits through the internet gateway as expected unless you’ve configured split tunneling.

How often should I update EdgeRouter X firmware?

Check for updates at least quarterly, and whenever you notice a security patch or improved VPN compatibility. Update in a maintenance window to avoid disrupting active sessions. Does microsoft have vpn

Is EdgeRouter X suitable for a 24/7 VPN connection?

For small to medium sites with modest traffic, yes, EdgeRouter X can handle all-day operation, provided you keep the device updated and monitor for any signs of overheating or performance bottlenecks.

What if my sites use non-overlapping subnets?

Non-overlapping subnets are ideal. If you must work with overlapping subnets, you’ll need more advanced routing or NAT configurations to prevent conflicts, and you may want to readdress one side if possible.

Can I run more than one site-to-site VPN on a single EdgeRouter X?

Yes, but plan your traffic flow and firewall rules carefully. Each tunnel adds load and complexity, so test thoroughly and monitor connection stability.

Do I need to back up configurations after every VPN change?

Absolutely. Save a backup after each major change so you can revert to a known-good state quickly if something goes wrong.

What’s the fastest way to learn EdgeOS VPN setup?

Start with the GUI to get the concepts down, then practice the CLI commands in a lab or test environment. Keep a small “cheat sheet” of the exact commands you use to implement tunnels across sites. What type of vpn is hotspot shield

Vpn for chinese valorant 在中国 Valorant 游戏中的 VPN 使用与优化指南

Edgerouter x site to site vpn setup