---
title: "Setting up site-to-site on UniFi USG"
slug: "site-to-site-unifi-usg"
status: "update"
updated: 2026-09-08T13:06:08Z
published: 2026-09-08T13:06:08Z
canonical: "help.nordlayer.com/site-to-site-unifi-usg"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.nordlayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting up site-to-site on UniFi USG

**Note**: If your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead.

***If you're operating on UniFi Controller 5.13.29 and above please switch to Classic Mode first.***

## Configuring the tunnel at the UniFi - USG Management Interface

1. Open the UniFi - USG management interface
2. In the left panel, select Networks, then select VPN:

![UniFi Network settings showing Site-to-Site VPN configuration page with create tunnel option](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202026-02-12%20at%2014.24.23_b(1).png)

1. Select Create Site-to-Site VPN and fill in with the following information:

- **Enable this Site-to-Site VPN**
- **Remote Subnets**: Enter the NordLayer server with a dedicated IP subnet (by default it is 10.6.0.0/20)
- **Peer IP**: Enter the public IP of your NordLayer server with a dedicated IP
- **Local WAN IP**: Enter the public IP of the UniFi SCG
- **Pre-shared key**: Enter the Shared Key you have generated (we will also need this value)

![UniFi IPsec VPN configuration form with pre-shared key, network settings, and IKE encryption options](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202026-02-12%20at%2014.25.27_b(1).png)

1. In the Advanced Options fill in the following information:

- **Key Exchange Version**: IKEv2
- **Encryption**: AES-256
- **Hash**: SHA256
- **DH Group**: 14
- **PFS**: Enable
- **Dynamic Routing**: Disable

## Configuring a firewall and static routing

It is necessary to add static routes from the NordLayer subnet (10.6.0.0/20) to the local network and from the local network to the NordLayer subnet (10.6.0.0/20) to the local network through the VPN tunnel gateway. Also, it is necessary to create firewall rules to allow this traffic.

1. Go to Routing & Firewall > Static Routes > Create New Route

- Choose a name.
- Enable the route.
- Enter the NordLayer subnet (by default it is 10.6.0.0/20) in Destination Network.
- Make sure to choose the interface you created in the previous section

1. Create a firewall rule that allows traffic from the NordLayer subnet to the LAN Network

![UniFi Network settings dashboard showing VPN, routing, and network configuration options](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202026-02-12%20at%2014.24.11_b(1).png)

## Ending note:

In order to finalize the site-to-site tunnel, please create a setup in [Sites tab of the NordLayer Control Panel](/v1/docs/site-to-site).

- Pre-shared key - you can generate it or we can provide it
- Encryption  details (AES, SHA and DH group) - AES256, SHA256 and DH group 14 are recommended (also must support IKEv2)
- Remote gateway/router public IP (must be reachable while connected to the server with a dedicated IP)
- Remote subnet and mask (the subnet is used in your local network)

---

**Note**: In case you have any questions or issues, press '**Chat with support**' at the bottom of the page.