---
title: "Setting up site-to-site on Linux server"
slug: "site-to-site-linux"
status: "update"
updated: 2026-09-08T13:07:35Z
published: 2026-09-08T13:07:35Z
canonical: "help.nordlayer.com/site-to-site-linux"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.nordlayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting up site-to-site on Linux server

## Prerequisites

* **SECRET_KEY** - replace with your generated secret preshared key
* **NordLayerIP** - replace with the IP of your NordLayer server with a dedicated IP
* **YourIP** - replace with your public static IP
* **LocalSubnet** - replace with the IP of your local subnet

:::(Info) (Note:)

Before setting up site-to-site, make sure you have all the dependencies on your Linux server. You can do that by running the following command:

```
sudo apt-get update && apt-get upgrade
```

Also, you will need to have the following packages:

```
sudo apt-get install strongswan libcharon-extra-plugins
```

For **Arch-based** **distributions** and others, you might not have libcharon packages, as they are in the strongswan package. You can simply run the following command and it will suffice:
```
pacman -S strongswan
```

:::

## Setting up Site-to-site client on Linux server

```
cat<<EOF>/etc/ipsec.secrets
YourIP NordLayerIP : PSK "SECRET_KEY"
EOF
```

 

```
cat<<EOF>/etc/ipsec.conf
config setup
  charondebug="all"
  uniqueids=yes
  strictcrlpolicy=no
```

 

```
conn Nordlayer
  authby=secret
  left=YourIP
  leftsubnet=LocalSubnet
  right=NordLayerIP
  rightsubnet=10.6.0.0/20
  ike=aes256-sha256-modp2048
  esp=aes256-sha256-modp2048
  keyingtries=0
  ikelifetime=1h
  lifetime=8h
  dpddelay=30
  dpdtimeout=120
  dpdaction=restart
  auto=start
EOF
```

 
## Add some iptable rules

```
/sbin/iptables -A INPUT -p esp -j ACCEPT
/sbin/iptables -A INPUT -p udp --dport 500 -j ACCEPT
/sbin/iptables -t nat -A POSTROUTING -s 10.6.0.0/20 -o InternalInterface -j MASQUERADE
/sbin/iptables net.ipv4.ip_forward = 1
```
*InternalInterface should correspond to your main network adapter - usually eth0
 
## Ending note:

In order to finalize the site-to-site tunnel, please create a setup in [Sites tab of the NordLayer Control Panel](/v1/docs/site-to-site).

* Pre-shared key - you can generate it or we can provide it
* Encryption  details (AES, SHA and DH group) - AES256, SHA256 and DH group 14 are recommended (also must support IKEv2)
* Remote gateway/router public IP (must be reachable while connected to the server with a dedicated IP)
* Remote subnet and mask (the subnet is used in your local network)

***
**Note**: In case you have any questions or issues, press '**Chat with support**' at the bottom of the page.