Edgerouter site-to-site vpn setup guide: how to configure a secure Edgerouter site-to-site VPN between two networks, best practices, troubleshooting, and expert tips

Edgerouter site-to-site vpn is a secure method to connect two networks over the internet using EdgeRouter devices. This guide gives you a practical, beginner-friendly walkthrough plus pro tips to make your site-to-site VPN reliable, fast, and easy to manage. In this video-ready post, you’ll get a step-by-step setup, performance considerations, common pitfalls, and real-world testing techniques. Whether you’re tying together two office networks, a branch and a data center, or a home lab, I’ve laid out clear instructions, tested commands, and sanity checks you can perform before you click that “Save” button. For extra protection while testing, consider NordVPN with this deal:

Useful resources for deeper reading non-clickable text:

• EdgeRouter official documentation – help.ubnt.com
• EdgeRouter firewall and IPsec guide – support.ubnt.com
• VyOS IPsec site-to-site guide – vyos.net
• strongSwan site-to-site VPN documentation – strongswan.org
• Community discussions on EdgeRouter IPsec setup – reddit.com/r/homenet

What you’ll learn in this Edgerouter site-to-site vpn guide

• How a site-to-site VPN on EdgeRouter works at a high level, and what you gain by using it
• A practical, tested step-by-step configuration for a typical two-network scenario
• How to verify connectivity, diagnose problems, and tune performance
• Common edge cases dynamic IPs, IPv6, firewall rules and how to handle them
• Security best practices and maintenance tips to keep your tunnel healthy

Why use a site-to-site VPN with EdgeRouter

• You can securely join two private networks over the public internet without exposing internal resources
• It’s ideal for linking remote offices, disaster recovery sites, or a secure bridge between lab networks
• EdgeRouter devices offer robust IPsec support with flexible subnets, custom firewall rules, and command-line visibility
• You can manage access controls, logging, and routing centralized through EdgeOS

EdgeRouter’s IPsec implementation is designed to be deterministic and repeatable, which helps when you’re building multiple tunnels or when you need to script rollouts. While many people reach for commercial SD-WAN solutions for large deployments, a well-configured EdgeRouter site-to-site VPN is still a solid, budget-friendly choice for many small to medium-size networks.

Prerequisites and planning

Before you start, gather these details and pre-checks:

• Public IP addresses of both sites or dynamic DNS if you don’t have static IPs
• Local network subnets at Site A and Site B for example, Site A: 192.168.1.0/24. Site B: 10.0.0.0/24
• Desired VPN encryption and integrity: AES-256, SHA-256 are common defaults
• A pre-shared key PSK that’s strong and unique to this VPN
• EdgeRouter model and firmware version EdgeRouter X, 4, 6, etc.
• Firewall stance: allow VPN traffic protocols and ports while protecting the rest of the network
• Whether you need only traffic between the two subnets to be VPN-traversed or also remote access for clients

Key planning notes:

• Keep your VPN subnets distinct from LAN subnets to avoid routing conflicts
• Decide if you want to use IKEv2 or IKEv1 in your tunnel negotiations IKEv2 is generally more efficient and resilient
• Ensure time synchronization is correct on both devices for proper IKE authentication
• Plan a strategy for PSK rotation and how you’ll update keys if a key is compromised

Step-by-step: configuring Edgerouter site-to-site vpn example scenario

Example scenario:

• Site A EdgeRouter at 203.0.113.2, LAN 192.168.1.0/24
• Site B Remote peer IP 203.0.113.1, LAN 10.0.0.0/24
• Public IPs are static for simplicity in this guide

Note: Adapt IPs and subnets to match your own network. The commands below are typical EdgeRouter EdgeOS syntax. Vpn gratis para edge

Step 1: Define your IKE and ESP groups phase 1 and phase 2

configure
set vpn ipsec ike-group IKE-GRP-1 proposal 1 encryption aes256
set vpn ipsec ike-group IKE-GRP-1 proposal 1 hash sha256
set vpn ipsec ike-group IKE-GRP-1 proposal 1 dh-group 14
set vpn ipsec ike-group IKE-GRP-1 lifetime 3600

set vpn ipsec esp-group ESP-GRP-1 proposal 1 encryption aes256
set vpn ipsec esp-group ESP-GRP-1 proposal 1 hash sha256
set vpn ipsec esp-group ESP-GRP-1 lifetime 3600

Step 2: Configure the IPsec site-to-site peer the remote site

set vpn ipsec site-to-site peer 203.0.113.1 authentication mode pre-shared-secret
set vpn ipsec site-to-site peer 203.0.113.1 authentication pre-shared-secret YourStrongP@ssw0rd
set vpn ipsec site-to-site peer 203.0.113.1 ike-group IKE-GRP-1
set vpn ipsec site-to-site peer 203.0.113.1 esp-group ESP-GRP-1
set vpn ipsec site-to-site peer 203.0.113.1 local-address 203.0.113.2
set vpn ipsec site-to-site peer 203.0.113.1 tunnel 1 local-subnets 192.168.1.0/24
set vpn ipsec site-to-site peer 203.0.113.1 tunnel 1 remote-subnets 10.0.0.0/24

Step 3: Apply and enable the tunnel commit and save

commit
save

Step 4: Bring up the interface and verify tunnel status

show vpn ipsec sa
show vpn ipsec tunnel

Step 5: Firewall and NAT considerations no NAT between VPN subnets

- Ensure VPN traffic is allowed through the firewall
- If you’re using a basic firewall, add a rule that permits IPsec/IKE and ESP and does not NAT VPN traffic between the two subnets
- Verify local firewall rules on both sites allow ICMP ping and necessary management protocols for testing

Firewall example simplified concept:
set firewall name VPN-ACL rule 10 action accept
set firewall name VPN-ACL rule 10 description 'Allow VPN traffic'
set firewall name VPN-ACL rule 10 protocol all
set firewall name VPN-ACL default-action drop

Step 6: Static routes or dynamic routing

- If you’re using static routes, add routes on both sides so that traffic for the opposite LAN is steered through the VPN
- If you’re using dynamic routing OSPF/BGP, configure the routing protocol on both ends and ensure the IPsec tunnel is treated as directly connected in the routing table

Routing example static:
set protocols static route 10.0.0.0/24 next-hop 192.168.1.1
set protocols static route 192.168.1.0/24 next-hop 10.0.0.1

Step 7: Test connectivity

- From Site A: ping 10.0.0.1 or a host on the remote network
- From Site B: ping 192.168.1.10 or another host on Site A
- Use traceroute/ping in both directions to verify path integrity
- If you don’t reach the remote host, double-check PSK, remote-subnets, and firewall rules

Step 8: Tune and optimize

- If you’re seeing instability, consider increasing IKE lifetime and ESP lifetime to reduce renegotiation
- If throughput is lower than expected, consider upgrading to a model with better CPU performance or enabling hardware acceleration
- If MTU issues appear fragmentation, dropped packets, test with smaller packet sizes or adjust MSS/MTU settings

 Practical tips for reliability and performance

- Use AES-256 with SHA-256 as a good baseline for security and performance
- Prefer IKEv2 if your EdgeRouter supports it. it tends to recover faster from network changes
- Regularly update firmware to benefit from security patches and stability fixes
- Keep a test tunnel with a simple network to isolate issues before deploying to production
- Document your configuration carefully so you or a teammate can reproduce or modify it later
- Use a strong, unique pre-shared key and rotate it on a schedule or if you suspect a compromise
- Consider a secondary VPN method for example, a separate remote access VPN for admins so you don’t overload a single tunnel

 Security best practices

- Use strong PSKs. avoid easily guessable phrases
- Disable weak ciphers. prefer AES-256 and SHA-256/sha2 when possible
- Keep EdgeRouter firmware up to date
- Enable logging for IPsec events and monitor for unusual connection attempts
- Limit remote access to management IPs, if you’re using remote management capabilities
- Regularly audit your firewall rules and VPN policy to ensure they reflect your current network design

 Common pitfalls and how to avoid them

- Mismatched subnets: If your local and remote subnets don’t line up with what you configured, the tunnel will stay down. Always double-check local-subnets vs remote-subnets
- Wrong pre-shared key: A wrong PSK is a frequent cause of tunnel failures. Reconfirm on both sides
- Dynamic IP address: If either side uses dynamic IPs, you need dynamic DNS DDNS on the peer and a method to update the peer’s IP
- Firewall blocking IPsec: The firewall is a common blocker. ensure IKE UDP 500, 4500 and ESP traffic is allowed, including NAT-T
- Clock skew: NTP misconfig can break IKE authentication. ensure time is synchronized on both devices
- NAT mistakes: If you NAT VPN traffic by accident, remote networks may see translated addresses and fail to route correctly

 IPv6 considerations

- Site-to-site VPNs can be extended to IPv6, but configuration is more involved. If you’re using IPv6, you’ll need to configure IPv6 subnets, firewall rules, and potentially native IPv6 routing between sites
- If IPv6 is not required, consider disabling IPv6 on VPN interfaces to simplify the tunnel and reduce potential issues

 Troubleshooting checklist

- Verify PSK, remote IP, and local IP are correct
- Check the IKE and ESP proposals match on both sides
- Confirm the remote subnet is reachable from the local router via a basic ping
- Look at the EdgeRouter system logs for IPsec errors
- Ensure the VPN is not being blocked by a firewall rule
- Confirm there is no overlapping or conflicting routing on either side
- Validate MTU settings to prevent fragmentation
- Test with a minimal config first, then add more complex routing rules
- If you’re stuck, revert to a known-good baseline and rebuild the tunnel step by step

 FAQs

# What is an Edgerouter site-to-site vpn used for?
Edgerouter site-to-site vpn connects two separate networks securely over the internet, enabling private IP routing between sites without exposing internal resources.

# Do I need a static IP for IPsec site-to-site VPN?
Static IPs simplify configuration and stability, but you can use dynamic IPs with DDNS and appropriate updates, though it’s more complex.

# Which EdgeRouter models support IPsec site-to-site VPN?
Most EdgeRouter models support IPsec, including EdgeRouter X, EdgeRouter Lite, EdgeRouter 4/6, and newer EdgeRouter models with current EdgeOS firmware.

# Should I use IKEv2 or IKEv1 for EdgeRouter VPN?
IKEv2 is generally preferred for its efficiency, faster rekeying, and better resilience to network changes.

# How do I choose encryption and hashing for IPsec?
AES-256 with SHA-256 is a strong, widely supported default. You can tune based on your performance needs and security requirements.

# How can I test the VPN tunnel if there’s no traffic?
Ping a host on the remote network from a host on your local network. check the IPsec SA status and tunnel status on the EdgeRouter.

# What if the tunnel stays down after configuration?
Double-check PSK, remote IP, local-subnets, remote-subnets, IKE/ESP groups, and firewall rules. Review logs for IPsec errors and confirm the remote site mirrors your configuration.

# How do I rotate the PSK safely?
Plan a maintenance window, update both sides simultaneously, verify the tunnel, then revoke the old PSK. Keep a backup of the working configuration.

# Can I run VPNs on both IPv4 and IPv6?
Yes, but you’ll need separate configurations for IPv4 and IPv6 traffic paths, including subnets and firewall rules.

# How do I add monitoring and alerts for the VPN in EdgeRouter?
Use system logs and IPsec status commands to monitor tunnel health, and consider sending logs to a central syslog server or network monitoring tool.

# Is a site-to-site VPN the same as a remote access VPN?
No. A site-to-site VPN connects networks two sites permanently. A remote access VPN lets individual clients connect to the network from anywhere.

# Can I mix different vendors on each end of the VPN?
You can, as long as you configure compatible IPsec settings IKE/ESP algorithms, PSK, and traffic selectors on both sides.

 Final notes and next steps

- Start with a simple two-network tunnel like the example above, verify connectivity, then expand with additional subnets or more tunnels as needed
- Keep a changelog of all VPN modifications so you can quickly back out if something breaks
- Consider visualizing your VPN topology with a diagram to help future maintenance and onboarding

If you’re ready to explore VPNs beyond EdgeRouter, or if you want to compare EdgeRouter with other gear, I’ve got more videos and posts that break down performance, price, and ease of use for different setups. And again, if you’re evaluating a broader security stack and want a trusted VPN partner for other devices, check out the NordVPN deal linked in the introduction. It’s a great way to test secure remote access while you build your on-site VPN.

Useful URLs and Resources non-clickable:

Vpn拨号指南：在家用与工作环境中设置VPN拨号连接的完整手册