Ubiquiti EdgeRouter: site-to-site IKEv2 tunnel to a VPNGeek gateway

Build a policy-based IKEv2 IPsec tunnel from a Ubiquiti EdgeRouter (EdgeOS) to a VPNGeek gateway — IKE group, ESP group, site-to-site peer, and the NAT-exclude rule, with a UniFi note.

This guide connects a LAN behind a Ubiquiti EdgeRouter to a VPNGeek gateway with a policy-based IKEv2 tunnel. EdgeOS (built on Vyatta/strongSwan) configures IPsec as an ike-group, an esp-group, and a site-to-site peer that references both. The steps use the EdgeOS CLI (configure mode); a note at the end covers the UniFi equivalent.

Before you start

Collect these before you begin. A single mismatched proposal will hold the tunnel in negotiation.

A VPNGeek plan that includes IPsec Gateways, and admin access to the dashboard.
SSH or console access to an EdgeRouter running EdgeOS 2.0 or newer.
A static public IP or resolvable DDNS hostname on the WAN (assumed here as eth0).
Non-overlapping subnets — for example 10.20.0.0/16 on the VPNGeek side and 192.168.60.0/24 behind the EdgeRouter.

1. Create the tunnel in VPNGeek

In the dashboard open Gateways > Tunnels and add a new site-to-site tunnel. Enter the EdgeRouter WAN address as the peer and the local/remote subnets. The dashboard returns the values to mirror in the ike-group and esp-group:

peer_address: 203.0.113.130 # EdgeRouter WAN IP
gateway_address: 198.51.100.140 # VPNGeek gateway
local_subnet: 10.20.0.0/16 # VPNGeek side
remote_subnet: 192.168.60.0/24 # EdgeRouter LAN
ike_version: 2
encryption: aes256
hash: sha256
dh_group: 14
psk: (shown once)

Note. The pre-shared key is displayed only once. Copy it into your password manager before leaving the page — afterwards you can regenerate it but not read the original.

2. Create the IKE group (phase 1)

Enter configuration mode with configure, then define the phase 1 group. key-exchange ikev2 forces IKEv2.

configure

set vpn ipsec ike-group VPNGEEK-IKE key-exchange ikev2
set vpn ipsec ike-group VPNGEEK-IKE lifetime 28800
set vpn ipsec ike-group VPNGEEK-IKE proposal 1 encryption aes256
set vpn ipsec ike-group VPNGEEK-IKE proposal 1 hash sha256
set vpn ipsec ike-group VPNGEEK-IKE proposal 1 dh-group 14
set vpn ipsec ike-group VPNGEEK-IKE dead-peer-detection action restart
set vpn ipsec ike-group VPNGEEK-IKE dead-peer-detection interval 20

3. Create the ESP group (phase 2)

The esp-group defines the phase 2 transform. Enable PFS with the same DH group as phase 1.

set vpn ipsec esp-group VPNGEEK-ESP lifetime 3600
set vpn ipsec esp-group VPNGEEK-ESP pfs dh-group14
set vpn ipsec esp-group VPNGEEK-ESP proposal 1 encryption aes256
set vpn ipsec esp-group VPNGEEK-ESP proposal 1 hash sha256

4. Configure the site-to-site peer

The peer ties everything together: the VPNGeek gateway address, the PSK, the WAN interface, and the local/remote subnets as a tunnel. The subnets must mirror the VPNGeek side exactly.

set vpn ipsec site-to-site peer 198.51.100.140 authentication mode pre-shared-secret
set vpn ipsec site-to-site peer 198.51.100.140 authentication pre-shared-secret <your-psk>
set vpn ipsec site-to-site peer 198.51.100.140 ike-group VPNGEEK-IKE
set vpn ipsec site-to-site peer 198.51.100.140 local-address 203.0.113.130
set vpn ipsec site-to-site peer 198.51.100.140 connection-type initiate

set vpn ipsec site-to-site peer 198.51.100.140 tunnel 1 esp-group VPNGEEK-ESP
set vpn ipsec site-to-site peer 198.51.100.140 tunnel 1 local prefix 192.168.60.0/24
set vpn ipsec site-to-site peer 198.51.100.140 tunnel 1 remote prefix 10.20.0.0/16

commit ; save

Warning. Mismatched selectors are the top cause of "tunnel up, no traffic". The tunnel local/remote prefixes here must be the exact mirror of the local/remote subnets on the VPNGeek side.

5. Exclude the tunnel from NAT

EdgeOS masquerades LAN traffic out eth0. Add a source-NAT exclude rule for traffic to the VPNGeek subnet, numbered below your masquerade rule so it is evaluated first.

set service nat rule 10 description "exclude VPNGeek tunnel"
set service nat rule 10 type source
set service nat rule 10 outbound-interface eth0
set service nat rule 10 source address 192.168.60.0/24
set service nat rule 10 destination address 10.20.0.0/16
set service nat rule 10 exclude

commit ; save

Note. NAT rules are evaluated in numeric order. Give the exclude rule a lower number than the masquerade rule so it matches first, otherwise the source is translated and the IPsec policy never matches.

6. Verify the tunnel

From the VPNGeek dashboard the tunnel should reach ESTABLISHED within about 30 seconds. Confirm from the EdgeRouter (operational mode):

# tunnel state — look for "up" and matching subnets
show vpn ipsec sa

# peer detail and SA counters
show vpn ipsec status

# prove traffic flows from the LAN side
ping 10.20.0.1 interface 192.168.60.1

Note. On UniFi (UDM/USG), a site-to-site IPsec VPN uses the same underlying strongSwan parameters. Create the tunnel under Settings > VPN > Site-to-Site, choose Manual IPsec, and enter the identical IKEv2 / AES-256 / SHA-256 / DH-14 values, the PSK, and the two subnets. Advanced options (custom proposals, DPD) may require config.gateway.json on older USG models.

Troubleshooting

Tunnel stuck "down" / no SA

Check show log | match charon or swanctl --list-sas. A stuck phase 1 is almost always a PSK, encryption, hash, or dh-group mismatch, or UDP 500/4500 blocked on eth0's firewall. Confirm the ike-group matches the VPNGeek side and local-address is the WAN IP.

SA up but no traffic

Usually the NAT-exclude rule is missing or numbered above the masquerade rule, or the tunnel prefixes do not mirror the remote side. Confirm the exclude rule matches first and the prefixes are exact.

Tunnel drops after the lifetime

Ensure the ike-group and esp-group lifetimes match both peers and that dead-peer-detection is enabled so a dead tunnel is detected and restarted.

Did this guide get you connected?

← PREVIOUS Cisco IOS: site-to-site IKEv2 tunnel to a VPNGeek gateway