Ubiquiti router vpn setup guide for site-to-site and remote access on UniFi routers and EdgeRouter

Yes, you can set up a VPN on a Ubiquiti router. In this guide, you’ll learn how to configure site-to-site IPsec VPN between Ubiquiti devices USG, UDM Pro, UDR, and EdgeRouter, how to enable remote access VPN when supported by your OS version, and practical tips to avoid common pitfalls. We’ll cover the exact steps for popular models, compare IPsec vs OpenVPN approaches, show real-world examples, and share best practices to keep your traffic secure. If you want extra privacy while you test and browse, consider grabbing a VPN deal like NordVPN’s current offer by tapping the banner below. NordVPN 77% OFF + 3 Months Free

What you’ll get in this guide quick snapshot

Step-by-step IPsec site-to-site VPN setup on USG/UDM Pro and compatible EdgeRouters
Remote access VPN options on UniFi OS when the feature is available L2TP/IPsec and alternatives
Firewall and routing rules to allow cross-site traffic and secure access
Performance-impact expectations and optimization tips
Troubleshooting tips, common issues, and how to verify your VPN connection
A handy FAQ with practical, no-fluff answers

Useful URLs and Resources unclickable text

Ubiquiti official VPN documentation – docs.ui.com
UniFi Network Controller / UniFi OS VPN guides – docs.ui.com
Ubiquiti community forums – community.ui.com
IPsec VPN standards and best practices – ietf.org
NordVPN official site affiliate – nordvpn.com

Introduction: what this guide covers and who it’s for
This guide is for anyone using Ubiquiti routers who wants to securely connect multiple sites or allow remote clients to reach a private network. Whether you’re running a small home lab with a USG or a full-blown small business setup with a UDM Pro, the core concepts stay the same: authenticate endpoints, encrypt traffic, and carefully control what’s reachable across the tunnel. We’ll walk through practical, real-world steps with clear screenshots-style guidance, explain the difference between site-to-site and remote access VPN, and share troubleshooting steps you can actually use.

Body

Table of Contents

VPN basics for Ubiquiti devices

VPN stands for virtual private network. On Ubiquiti gear, the two main flavors you’ll encounter are:

Site-to-site VPN IPsec: securely connects two or more physical locations over the internet. Great for syncing two office networks as if they were on the same LAN.
Remote access VPN often L2TP over IPsec, depending on OS version: lets individual users connect to your central network from anywhere. This option is sometimes limited by firmware versions, so you’ll want to verify support for your exact model and OS release.

Key numbers you’ll care about

Encryption: AES-256 is common and recommended. AES-128 can be faster on low-power devices but still secure.
Integrity: SHA-256 is typical for IKE/IPsec setups.
VPN throughput: expect some drop in WAN speed when the VPN tunnel is active. the exact drop depends on your hardware, firmware, and concurrent traffic.
MTU considerations: keep tunneling overhead in mind. sometimes you need to adjust MTU to avoid fragmentation.

VPN options by device type

USG UniFi Security Gateway and UDM Pro: strong support for Site-to-Site IPsec VPN. remote access options exist in newer UniFi OS versions.
UniFi Dream Router UDR and other UniFi OS devices: IPsec site-to-site is common. remote access VPN availability depends on the OS version.
EdgeRouter devices EdgeOS: flexible, robust VPN options including IPsec and OpenVPN. great for advanced setups or non-UniFi endpoints.

Why the distinction matters: if you’re running a simple two-site setup, IPsec site-to-site is usually the easiest path. If you need VPN access for individual users, you’ll have to confirm that your specific UniFi OS version supports remote access VPN and follow the corresponding steps.

Step-by-step: IPsec site-to-site VPN on USG/UDM Pro and compatible UniFi OS

Note: UI paths can vary slightly by firmware. The following steps reflect common sequences in modern UniFi OS versions.

Prepare both sides

Public IP addresses: Ensure both gateways have reachable public IPs or are behind a stable NAT with port forwarding if needed.
Subnets: Define your local LAN e.g., 192.168.1.0/24 and the remote site LAN e.g., 192.168.2.0/24.
Pre-shared key PSK: Generate a strong PSK for the IPsec tunnel.

Configure the local gateway Site A

Open UniFi Network / UniFi OS settings.
Go to Networks or VPN section and choose Create New VPN.
VPN Type: Site-to-Site IPsec.
Name: SiteA_to_SiteB.
Local WAN address: public IP of Site A gateway.
Remote WAN address: public IP of Site B gateway.
Local LAN Subnet: 192.168.1.0/24.
Remote LAN Subnet: 192.168.2.0/24.
Encryption: AES-256. Integrity: SHA-256. DH Group: 14 2048-bit or as recommended.
IKE version: IKEv2 is preferred when available for better stability.
Preshared key: enter the PSK you generated.
Phase 1/Phase 2 lifetimes: match both sides e.g., 28800s / 3600s.
NAT traversal: enabled if behind NAT.
Save the configuration.

Configure the remote gateway Site B

Mirror the settings exactly: remote WAN address becomes Site A’s public IP, local LAN becomes 192.168.2.0/24, remote LAN 192.168.1.0/24, and use the same PSK, encryption, and IKE settings.
Ensure firewall rules allow traffic from Site A’s subnet to Site B’s subnet and vice versa.

Firewall and routing

On both sides, create firewall rules to permit traffic from the local VPN subnet to the remote VPN subnet and to drop anything not required.
Ensure the VPN interface is included in the appropriate routing tables so that devices on Site A can reach 192.168.2.0/24 and devices on Site B can reach 192.168.1.0/24.
If you’re using NAT on LAN, you may need to disable NAT for traffic between peers or set appropriate rules to prevent double NAT issues.

Testing and verification

From a client device on Site A, ping devices on Site B e.g., 192.168.2.10.
Check VPN status in the UniFi OS dashboard. look for green status on the VPN tunnel.
Use traceroute to verify the path actually goes over the VPN.

Troubleshooting tips

Ensure clocks are synchronized NTP on both gateways. time drift can break IKE.
Double-check PSK and IDs. misaligned pre-shared keys are a common problem.
Confirm that the remote peers’ firewall allows ESP protocol 50 and UDP ports 500 and 4500 if NAT-T is used.
If failing over NAT-T, lower MTU or adjust MSS to prevent fragmentation.
Look at log messages for “IKE negotiation failed” or “SA negotiation failed” to pinpoint misconfigurations.

Step-by-step: Remote Access VPN on UniFi OS L2TP/IPsec if supported

Windows/macOS/Linux clients can connect remotely if your UniFi OS version exposes Remote Access VPN. If your model doesn’t support it, you’ll want to rely on a dedicated VPN server behind the firewall or upgrade the OS version. Proton vpn edge extension

Confirm feature availability

Check your UniFi OS version’s VPN settings to see if “Remote Access” or “L2TP over IPsec” is present.
If not available, you can consider a separate VPN server like OpenVPN on a small device or a dedicated router behind your UniFi gateway that can distribute VPN clients.

Create remote access user accounts

In UniFi OS, go to Settings > VPN > Remote Access.
Add a user with a username and password or certificate-based authentication if your version supports it.
Note the VPN type and the details server address, shared secret, and any client configuration snippets provided by the UI.

Configure the VPN client devices

On Windows: Add a VPN connection L2TP/IPsec with the server address, account, and shared secret.
On macOS: Add a VPN connection in Network settings using L2TP over IPsec with the same credentials.
On Linux: Use strongSwan or NetworkManager with L2TP/IPsec support, depending on your distro.

Firewall and NAT considerations

Ensure VPN traffic is allowed to reach the LAN behind the UniFi gateway.
If you’re routing VPN clients to specific internal resources, set appropriate firewall rules to restrict or permit access as needed.

Testing remotely

From a remote network, connect the VPN client and verify you can reach internal IPs ping 192.168.1.x, access internal services.
Check the VPN connection status on the UniFi OS dashboard to confirm the tunnel is established.
If you can’t connect, verify the pre-shared key or certificate settings, server address, and that the user has permission to access the VPN.
Check for IP conflicts in your internal subnets that the VPN client might try to reach.
Confirm the remote device’s firewall rules allow VPN traffic in and out. Ubiquiti er-x vpn: comprehensive setup guide for OpenVPN and WireGuard on EdgeRouter X

EdgeRouter VPN setup if you’re using EdgeRouter devices or want a more hands-on approach

EdgeRouter EdgeOS devices offer robust VPN options, including IPsec and OpenVPN, with a direct CLI or graphical interface.

IPsec site-to-site on EdgeRouter

You’ll configure phase 1 and phase 2 proposals, define the VPN peer’s public IP, set the pre-shared key, and map local/remote subnets.
Create firewall policies to permit traffic between the VPN tunnel and LAN subnets.
Enable NAT exemption for traffic between the VPN peers to prevent double NAT.

OpenVPN remote access on EdgeRouter

Install and configure the OpenVPN server on EdgeRouter.
Create client certificates, push routing rules, and provide clients with the .ovpn config file.
Adjust firewall rules to allow OpenVPN traffic UDP 1194 by default, or your chosen port.

Testing and monitoring

Use the EdgeRouter’s VPN status page or CLI to check tunnel status.
From a connected client, verify connectivity to internal resources and monitor logs for any authentication or routing errors.

Practical tips

Keep firmware up to date on EdgeRouter and UniFi devices to ensure compatibility and security.
When combining EdgeRouter with UniFi controllers, try to centralize VPN control on the EdgeRouter if you’re using non-UniFi VPN servers to avoid conflicts.

Security and performance considerations

Use strong authentication: PSK with a long, random string for IPsec or, when possible, certificate-based authentication for added security.
Limit VPN access: only allow the minimum necessary subnets and services reachable through the tunnel.
Enable logging and monitor VPN activity to detect anomalies early.
Keep devices updated: firmware updates often include security fixes that affect VPN handling.
Test failover scenarios if you have multiple WAN uplinks to ensure your VPN remains reliable during outages.

Real-world tips and best practices

Plan your subnets carefully: overlapping subnets across sites are a common source of routing headaches. avoid them if possible.
Use IKEv2 for better stability and performance when available. it’s generally more robust on dynamic WAN connections.
For remote access VPN, consider splitting tunnels by client or by traffic type e.g., allow VPN users to access only specific internal resources.
Document your configuration: keep a written record of PSKs, subnets, firewall rules, and device models/firmware versions for quick recovery.

Common mistakes to avoid

Mismatched IP ranges between sites resulting in failed routes.
Neglecting firewall rules on either side that block VPN traffic.
Not updating the VPN devices after a firmware upgrade, which can cause compatibility issues.
Overlooking time synchronization. IKE requires accurate clocks.

Troubleshooting quick-start checklist

Check tunnel status in the UniFi OS dashboard and EdgeRouter GUI.
Verify PSKs and IKE/IKEv2 settings match across peers.
Confirm NAT rules and firewall policies allow VPN subnets to talk to each other.
Ensure your public IPs are reachable and not behind host-based firewalls that block IPsec ports.
Test with a direct ping/traceroute from the VPN device to a remote subnet address.

Sample deployment scenarios

Small office to home lab: Site-to-site IPsec between USG Pro and a home USG with overlapping or separate subnets. easy to manage via UniFi OS.
Multi-site branch: A three-site IPsec mesh, with a hub-and-spoke topology, using a central UDM Pro and multiple USGs or EdgeRouters.
Remote workers: Use remote access VPN on UniFi OS if supported and provide users with configured clients. keep traffic restricted to internal resources.

Frequently Asked Questions

What is the difference between IPsec site-to-site and Remote Access VPN?

IPsec site-to-site connects two networks as if they’re one LAN, ideal for linking multiple offices. Remote Access VPN lets individual devices connect to a central network for access to internal resources, typically used for remote workers.

Do all Ubiquiti devices support VPNs?

Most UniFi OS devices USG, UDM Pro, UDR, and newer models support IPsec site-to-site VPNs. Remote access VPN availability depends on the OS version. EdgeRouter devices offer broader VPN options, including OpenVPN and IPsec.

Can I use OpenVPN on a UniFi device?

OpenVPN is supported on EdgeRouter devices and can be used behind a UniFi gateway, but it’s not as seamlessly integrated into UniFi OS as IPsec. For remote access with UniFi OS, you’ll typically use L2TP over IPsec if supported. Is mullvad a good vpn for privacy, speed, pricing, and value in 2025: a comprehensive review

Which VPN protocol should I choose?

IPsec IKEv2 is the most common and robust choice for site-to-site VPNs on Ubiquiti gear. L2TP over IPsec is often used for remote access where supported. OpenVPN is a solid alternative on EdgeRouter if you need features not in IPsec.

How secure is a VPN on Ubiquiti routers?

When configured with strong encryption AES-256, robust IKE settings, and a strong PSK or certificates, VPNs on Ubiquiti gear are highly secure for typical small-to-medium deployments.

How do I test if the VPN is working?

From a device on Site A, try pinging a host on Site B’s LAN, run traceroute to a remote host, and check the VPN status in the UniFi OS or EdgeRouter UI. Logs can reveal negotiation or routing issues.

What ports do I need open for IPsec VPN?

Common ports include UDP 500 IKE, UDP 4500 NAT-T, and ESP protocol 50. If you’re behind a NAT, NAT-T is often required for reliable traversal.

Can VPN affect my internet speed?

Yes. Encrypting traffic and routing it through a VPN tunnel adds processing overhead. Expect some speed reduction, especially on lower-end devices or with high traffic. Edgerouter show vpn config

How do I handle subnets that overlap between sites?

Avoid overlapping subnets. If unavoidable, redesign subnets or introduce a NAT/segmentation strategy to prevent route conflicts. Always validate routing tables after adding a new VPN.

Is there a risk with DIY VPN setups on home networks?

DIY VPNs are generally safe when you follow best practices, keep firmware updated, and restrict access. Always back up configurations and test changes in a controlled way before rolling them out.

Can I combine VPNs with VPN or firewall rules to restrict traffic?

Yes. You can create rules to allow only specific subnets to reach certain services across the VPN, and you can segment VPN clients from your main network for tighter security.

How often should I update VPN configs or keys?

Regularly rotate pre-shared keys e.g., every 6–12 months or switch to certificates if your setup supports it. Keep firmware up to date to ensure you have the latest security patches.

Do I need a VPN if I already have SSH or remote management?

A VPN adds an extra layer of protection by encrypting all traffic between sites or clients and your network, not just remote management traffic. It’s a best practice when exposing devices or services over the internet. Pia vpn chrome review and guide: how Pia VPN Chrome extension works, features, setup, performance, pricing, and tips

What if my VPN tunnel drops?

Check WAN connectivity, verify that the remote gateway is reachable, confirm that IKE/ESP ports aren’t blocked by a firewall, and review logs for negotiation errors. Rebooting the gateway or re-establishing the tunnel often resolves transient issues.

Where can I find the latest official guidance from Ubiquiti?

Always refer to the official docs at docs.ui.com or the UniFi OS release notes for VPN features, limitations, and configuration examples tailored to your device model and firmware version.

J edgar review of the best VPNs for privacy, security, and streaming in 2025

What is edge traversal in networking and VPNs: edge traversal techniques, NAT traversal, and secure access