Journalist 
Edgerouter site-to-site vpn is a secure connection between two separate networks that uses EdgeRouter devices to create a VPN tunnel, typically over the public Internet, so branches or data centers can share resources as if they were on the same local network. In this guide, you’ll get a practical, field-tested walkthrough of setting up IPsec site-to-site VPNs on EdgeRouter devices, compare IPsec with OpenVPN for site-to-site use cases, and walk through common problems and real-world tips to keep tunnels stable and fast. Think of this as a friend-with-a-router-wisdom guide: clear steps, pragmatic checks, and a few tricks that actually work in production.
- How EdgeRouter handles site-to-site VPNs and why IPsec is the workhorse for most deployments
- A side-by-side look at IPsec vs OpenVPN for site-to-site scenarios
- A step-by-step, copy-paste friendly IPsec setup guide for two EdgeRouter devices
- Practical testing, troubleshooting, and performance tips
- Quick-fire security recommendations to keep tunnels safe
- A run-through of common gotchas when you’re juggling multiple sites or subnets
For extra protection beyond your site-to-site tunnel, NordVPN often runs promotions and promotions like 77% off + 3 months free. If you’re curious, check out this deal by clicking the banner:
Useful resources and references unlinked in this intro text:
- EdgeRouter Documentation – help.ubnt.com
- Ubiquiti Community – community.ubnt.com
- IPsec overview – en.wikipedia.org/wiki/IPsec
- OpenVPN – openvpn.net
- VPN best practices for small offices – en.example.org
- Network security basics – en.example.org
What is Edgerouter site-to-site VPN
Edgerouter site-to-site VPN creates a private, encrypted tunnel between two distinct networks, so devices on one side can reach devices on the other side as if they shared the same LAN. EdgeRouter devices rely on EdgeOS Vyatta-derived to manage VPN tunnels, with IPsec being the most common protocol for site-to-site deployments. You typically pair a local network for example, 192.168.1.0/24 with a remote network for example, 192.168.2.0/24, configure a tunnel on both ends, and route traffic across the tunnel based on your static routes.
Key realities I’ve learned from real-world setups:
- IPsec tends to be more predictable for site-to-site, especially across diverse ISP paths.
- EdgeRouter’s GUI and CLI expose the same underlying VPN primitives, but the CLI tips you’ll need for large deployments are easier to scale.
- You’ll usually set up a pair of peers one on each edge device, define IKE phases, negotiate a shared secret, and then pin down the local and remote subnets for the tunnel.
EdgeRouter supports both GUI-based configuration and a CLI route that’s friendly for scripted deployments. For most SMBs and branch-office setups, IPsec with a static pre-shared key PSK or certificates offers a robust balance of security and performance. OpenVPN on EdgeRouter is more commonly used for remote access client-to-site rather than site-to-site, though there are advanced ways to bridge OpenVPN into a site-to-site topology if you’re doing something special with virtual routing or virtualization.
EdgeRouter VPN capabilities and topologies
- IPsec site-to-site is the default, battle-tested choice for connecting two offices.
- You can run multiple site-to-site tunnels to different remote sites from a single EdgeRouter.
- IPsec supports both transport and tunnel modes, but site-to-site is almost always tunnel mode.
- OpenVPN is available on EdgeRouter for remote-access clients, but site-to-site OpenVPN is less common and typically requires workarounds or separate devices.
- You’ll usually implement a firewall rule set that allows VPN traffic only between the two subnets and perform NAT exemptions for the VPN traffic to prevent double-NAT on the tunnel.
A quick look at typical data points in real environments:
- AES-256 with SHA-256 is the standard for modern IPsec agreements. many deployments also enable Perfect Forward Secrecy PFS with a DH group e.g., group 14 or higher.
- Tunnel throughput can be limited by the EdgeRouter hardware, CPU, and the chosen crypto settings. Residential-grade devices will bottleneck faster than enterprise-class EdgeRouter models with hardware acceleration.
- The success of a site-to-site VPN heavily relies on stable Internet paths and consistent NAT behavior, so plan for a backup path or a failover option if you rely on a VPN for critical services.
IPsec vs OpenVPN for site-to-site on EdgeRouter
- IPsec: The default workhorse for site-to-site. Faster on average, better integrated with routing, and widely supported by enterprise-grade hardware.
- OpenVPN: Great for remote access. for site-to-site, it’s less common and can require more manual tuning or an additional device to act as a bridge between sites.
If you’re implementing a new site-to-site link today, IPsec is usually the simplest path. OpenVPN remains excellent for remote workers who need to connect to a central network from various locations, or when you have strict interoperability requirements with partners that already rely on OpenVPN. Tunnelbear vpn es seguro: a comprehensive guide to TunnelBear security, privacy, features, and setup in 2025
Pre-flight checklist and planning
Before you roll up your sleeves, do a quick plan:
- Inventory: Local and remote subnets e.g., 192.168.1.0/24 and 192.168.2.0/24.
- Public IPs: Static public IPs on both ends, or dynamic IPs with dynamic DNS. state how you’ll handle failover if one side’s IP changes.
- Encryption and auth: Choose AES-256 or AES-128 if you need more throughput with SHA-256 or better. decide on PSK vs certificate-based authentication. decide on PFS group e.g., 14 or higher.
- NAT and firewall: Ensure VPN traffic is exempt from NAT, and set up firewall rules to allow only VPN traffic to the remote subnet.
- Routing: Plan static routes so traffic destined for the remote network flows through the VPN tunnel.
- Monitoring: Prepare a plan to verify the tunnel’s status, including showing VPN SA status, and a simple uptime goal e.g., 99.9%.
A simple ordering of tasks:
- Gather networks and IPs
- Choose protocol IPsec
- Pick IKE and ESP parameters
- Configure VPN peer on both sides
- Establish tunnel and test connectivity
- Harden security and monitor performance
Step-by-step: IPsec site-to-site on EdgeRouter
Note: The exact command names can vary slightly between EdgeOS versions, but the structure remains similar. The following is a representative, copy-paste friendly guide you can adapt to your devices.
Step 1 – Prepare information
- Local network: 192.168.1.0/24
- Remote network: 192.168.2.0/24
- Local public IP: your public IP on the EdgeRouter
- Remote public IP: the peer EdgeRouter’s public IP
- Shared secret PSK: create a strong key
Step 2 – Basic IKE group and phase 1 Vpn gratis para edge best free VPN options for Microsoft Edge, how to install, compare features, and tips
configure
set vpn ipsec ike-group IKE-PROFILE proposal 1 encryption aes256
set vpn ipsec ike-group IKE-PROFILE proposal 1 hash sha256
set vpn ipsec ike-group IKE-PROFILE proposal 1 dh-group 14
set vpn ipsec ike-group IKE-PROFILE lifetime 3600
Step 3 – Phase 2 / ESP
set vpn ipsec esp-group ESP-PROFILE proposal 1 encryption aes256
set vpn ipsec esp-group ESP-PROFILE proposal 1 hash sha256
set vpn ipsec esp-group ESP-PROFILE lifetime 3600
Step 4 – Local and remote endpoints
set vpn ipsec site-to-site peer 203.0.113.2 authentication mode pre-shared-secret
set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret YOUR_PRESHARED_SECRET
set vpn ipsec site-to-site peer 203.0.113.2 ike-group IKE-PROFILE
set vpn ipsec site-to-site peer 203.0.113.2 esp-group ESP-PROFILE
set vpn ipsec site-to-site peer 203.0.113.2 local-subnet 192.168.1.0/24
set vpn ipsec site-to-site peer 203.0.113.2 remote-subnet 192.168.2.0/24
set vpn ipsec site-to-site peer 203.0.113.2 tunnel 1 allow-nat-networks disable
Step 5 – Local/Remote address binding if needed
set vpn ipsec site-to-site peer 203.0.113.2 local-address 198.51.100.10
set vpn ipsec site-to-site peer 203.0.113.2 remote-address 198.51.100.20
Step 6 – Firewall and NAT exemptions
- Ensure VPN traffic is not NATed, and create a firewall rule that permits traffic between 192.168.1.0/24 and 192.168.2.0/24 through the VPN.
Step 7 – Commit and save
commit
save
Step 8 – Validate
show vpn ipsec sa
show vpn ipsec status
ping 192.168.2.1
traceroute 192.168.2.1
Tips
- If the tunnel doesn’t come up, double-check PSK, peer IPs, and subnets to ensure there’s a precise match on both sides.
- If you have dynamic IPs, leverage a DDNS service and update the remote peer accordingly.
- Enable Dead Peer Detection DPD so the tunnel recovers quickly if the link flaps.
Code blocks above are examples. adapt the exact syntax to your EdgeOS version and the interface names on your devices.
Step-by-step: OpenVPN considerations for EdgeRouter remote access, not site-to-site
If you’re thinking about OpenVPN, remember EdgeRouter’s OpenVPN support is typically used for remote access clients rather than straightforward site-to-site. If you do want to pursue OpenVPN for remote users or a specialized site-to-site bridge, you’ll likely run the OpenVPN server on EdgeRouter with a dedicated interface and use a client config on remote machines. For most site-to-site needs, IPsec will be simpler and faster. Here’s what you’d typically consider:
- OpenVPN remote access: easier for individual users to connect from various devices
- OpenVPN site-to-site on EdgeRouter: possible with more complex bridging or virtualization setups, and might require extra hardware or virtual routing
- Performance: OpenVPN can be slower depending on CPU. you’ll want to enable hardware acceleration where available
If your goal is remote access for workers, set up OpenVPN on a dedicated EdgeRouter or use a VPN service that provides remote access clients, then keep IPsec for site-to-site interconnections.
Security best practices for Edgerouter site-to-site VPN
- Use AES-256 or AES-128 if you need higher throughput and can tolerate a little less security.
- Prefer SHA-256 or SHA-3 for message authentication.
- Enable Perfect Forward Secrecy PFS with a modern DH group e.g., group 14 or higher.
- Use long, unique, and complex pre-shared keys or, better yet, certificates if your EdgeRouter setup supports certificate-based authentication.
- Limit traffic to only the necessary subnets and use precise firewall rules to reduce exposed surfaces.
- Regularly rotate PSKs and review tunnel configurations when network changes occur new subnets, IP changes, new branches.
- Monitor VPN health. set up alerts for tunnel down events and keep a baseline for typical latency and jitter.
Performance tips
- If your EdgeRouter is CPU-constrained, choose a robust cipher suite and a DH group that offers good speed versus security.
- Make sure hardware acceleration is enabled for IPsec if your device supports it.
- Keep firmware up-to-date. vendor updates often include security and performance improvements.
- Minimize the number of NAT rules and ensure VPN traffic is exempt from NAT to reduce processing overhead.
- Use local DNS resolvers on the edge when possible to reduce extra lookups that can add latency.
Troubleshooting common issues
- Tunnel won’t come up:
- Recheck the PSK, remote IP, and local IP addresses.
- Verify that the remote subnet matches on both sides.
- Confirm firewall rules let VPN traffic through and that NAT exemptions are in place.
- Traffic not routing over VPN:
- Ensure static routes on both sides point to the VPN tunnel.
- Check that the VPN tunnel interface is associated with the right routing table.
- Flapping tunnels with ISP changes:
- Check for inconsistent MTU or path MTU discovery issues. adjust MTU settings if needed.
- Consider enabling DPD or more conservative timeouts to handle flaps gracefully.
- Performance dips:
- Review cipher and SA parameters. adjust to balance security and throughput.
- Check for CPU saturation on EdgeRouter during encryption tasks. consider upgrading hardware if needed.
Real-world tips and variations
- For multi-site deployments, keep a standardized template for all EdgeRouter VPN peers to avoid misconfigurations.
- Consider using static routes instead of dynamic routing for VPN-heavy environments to reduce route churn.
- If you must, segregate VPN management networks from production data networks to minimize risk if a VPN device is compromised.
- Periodically test failover by simulating an outage on one branch to ensure the other sites remain reachable.
- Document every site’s tunnel settings in a centralized repository so you don’t get lost when staff changes happen.
Frequently Asked Questions
# What is Edgerouter site-to-site VPN?
Edgerouter site-to-site VPN is a secure connection that links two separate networks through EdgeRouter devices, allowing devices on both sides to communicate across a tunnel over the public Internet, typically using IPsec.
# Which VPN protocol should I use on EdgeRouter for site-to-site?
IPsec is the default and most reliable choice for site-to-site connections on EdgeRouter. OpenVPN is better suited for remote access clients, not as a primary site-to-site solution.
# Can I have more than one site-to-site VPN on a single EdgeRouter?
Yes. EdgeRouter devices can support multiple IPsec site-to-site tunnels, each connecting to a different remote network, as long as the hardware resources and routing policies permit it.
# Do I need a static IP on both sides?
Static IPs simplify configuration and stability. If you’re using dynamic IPs, you’ll need a dynamic DNS solution and a method to update the peer when IPs change.
# How do I test if the VPN tunnel is up?
Use commands like show vpn ipsec sa and show vpn ipsec status to check tunnel status, and ping or traceroute to a host on the remote network to confirm traffic is flowing through the tunnel.
# What are the best encryption settings for IPsec on EdgeRouter?
AES-256 with SHA-256 is a strong standard. pair it with a DH group e.g., group 14 for PFS. Then ensure SA lifetimes are balanced to maintain a stable tunnel without excessive renegotiation.
# Should I use a pre-shared key or certificates for IPsec?
Certificates provide a higher level of security and easier key management for larger deployments, but they require a PKI setup. For smaller setups, a strong PSK is common and simpler.
# How do I handle NAT in IPsec site-to-site on EdgeRouter?
Typically you want NAT exemption for VPN traffic so that encryption is applied to the internal addresses and the VPN traffic doesn’t get translated by the firewall’s NAT.
# Can EdgeRouter support WireGuard for site-to-site?
As of 2025, WireGuard support on EdgeRouter for site-to-site is not the standard approach. IPsec remains the mainstream solution for site-to-site VPNs. WireGuard may be available in some builds or through add-ons, but it’s not as widely deployed for site-to-site VPNs as IPsec.
# How do I recover if a tunnel falls over after a power interruption?
Check physical connections, verify that the tunnel is re-established automatically, review the tunnel’s dead-peer detection settings, and ensure a stable boot sequence to avoid race conditions after a power loss.
# What about remote offices with dynamic IPs?
Dynamic IPs require a dynamic DNS setup and a mechanism to refresh the peer configuration when IPs change. This is more complex but doable. static IPs make life easier for site-to-site VPNs.
# Is OpenVPN viable for site-to-site with EdgeRouter?
OpenVPN is excellent for remote access, but for site-to-site deployments, IPsec is generally simpler, faster, and more robust. If you need OpenVPN, consider a dedicated OpenVPN appliance or a separate EdgeRouter running OpenVPN in a bridging or bridging-like mode, but be prepared for more complexity.
# How do I monitor VPN health over time?
Set up routine checks for tunnel status, latency, and packet loss, plus alerts for tunnel down events. Regularly review logs for failed negotiations, authentication errors, and odd IPs causing issues.
# How can I optimize VPN performance for a busy branch office?
Use strong crypto but keep an eye on CPU usage. enable hardware acceleration if supported. reduce tunnel SA lifetimes to ensure renegotiations don’t spike during peak hours. prune unused routes to reduce processing overhead.
Resources and further reading
- EdgeRouter VPN official guide – help.ubnt.com
- EdgeRouter CLI reference – documentation for the Vyatta/EdgeOS command set
- IPsec protocols and encryption standards – en.wikipedia.org/wiki/IPsec
- OpenVPN official site – openvpn.net
- Networking best practices for small offices – general IT resources
- Community forums for EdgeRouter users – community.ubnt.com
If you’re implementing Edgerouter site-to-site VPN today, this guide should give you a solid, actionable path from planning to testing. Remember, the most time-efficient approach is to standardize your tunnel templates and keep a clean inventory of each site’s subnets, IPs, and PSKs. With that foundation, your site-to-site VPN will be easier to manage, troubleshoot, and scale as your network grows.
What is vpn edge