---
title: "Setting up site-to-site on Ubiquiti EdgeRouter / EdgeMax"
slug: "site-to-site-ubiquiti-edgerouter-edgemax"
description: "On the EdgeRouter/Edgemax device go to the CLI and enter configuration mode."
status: "update"
updated: 2026-09-08T13:14:23Z
published: 2026-09-08T13:14:23Z
canonical: "help.nordlayer.com/site-to-site-ubiquiti-edgerouter-edgemax"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.nordlayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting up site-to-site on Ubiquiti EdgeRouter / EdgeMax

**Note**: If your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead.

- Replace 'DEDICATED_SERVER_IP' with the IP of your NordLayer server with a dedicated IP;
- LOCAL_IP_ADDRESS - with the static public IP of your site (place where a router resides);

## Ubiquity EdgeRouter - Client side

1. On the EdgeRouter/Edgemax device go to the CLI and enter configuration mode

```
configure
```

1. Enable the auto-firewall-nat-exclude feature which automatically creates the IPsec firewall/NAT policies in the iptables firewall

```
set vpn ipsec auto-firewall-nat-exclude enable
```

1. Create the IKE / Phase 1 (P1) Security Associations (SAs)

```
set vpn ipsec ike-group FOO0 key-exchange ikev2
set vpn ipsec ike-group FOO0 lifetime 28800
set vpn ipsec ike-group FOO0 proposal 1 dh-group 14
set vpn ipsec ike-group FOO0 proposal 1 encryption aes256
set vpn ipsec ike-group FOO0 proposal 1 hash sha256
```

1. Create the ESP / Phase 2 (P2) SAs and enable Perfect Forward Secrecy (PFS)

```
set vpn ipsec esp-group FOO0 lifetime 3600
set vpn ipsec esp-group FOO0 pfs enable
set vpn ipsec esp-group FOO0 proposal 1 encryption aes256
set vpn ipsec esp-group FOO0 proposal 1 hash sha256
```

1. Define the remote peering address (replace <secret> with your pre-shared passphrase)</secret>

```
set vpn ipsec site-to-site peer DEDICATED_SERVER_IP authentication mode pre-shared-secret
set vpn ipsec site-to-site peer DEDICATED_SERVER_IP authentication pre-shared-secret <secret>
set vpn ipsec site-to-site peer DEDICATED_SERVER_IP description ipsec
set vpn ipsec site-to-site peer DEDICATED_SERVER_IP local-address LOCAL_IP_ADDRESS
```

1. Link the SAs created above to the remote peer and bind the VPN to a virtual tunnel interface (vti0)

```
set vpn ipsec site-to-site peer DEDICATED_SERVER_IP ike-group FOO0
set vpn ipsec site-to-site peer DEDICATED_SERVER_IP vti bind vti0
set vpn ipsec site-to-site peer DEDICATED_SERVER_IP vti esp-group FOO0
```

1. Configure the virtual tunnel interface (vti0) and assign it an IP address

```
set interfaces vti vti0 address 10.255.12.1/30
```

1. Create a static route for the remote subnet

```
set protocols static interface-route 10.6.0.0/20 next-hop-interface vti0
```

1. Commit the changes and save the configuration

```
commit ; save
```

## Ending note:

In order to finalize the site-to-site tunnel, please create a setup in [Sites tab of the NordLayer Control Panel](/v1/docs/site-to-site).

- Pre-shared key - you can generate it or we can provide it
- Encryption  details (AES, SHA and DH group) - AES256, SHA256 and DH group 14 are recommended (also must support [IKEv2](https://nordlayer.com/learn/vpn/ikev2/))
- Remote gateway/router public IP (must be reachable while connected to the server with a dedicated IP)
- Remote subnet and mask (the subnet is used in your local network)

---

**Note**: In case you have any questions or issues, press '**Chat with support**' at the bottom of the page.