Howto Configure PFSense Site-to-Site IPSec VPN Tunnel For Remote Access

Our sample setup to configure PFSense Site-to-Site IPSec vpn tunnel

Fig.01: A simple site-to-site VPN setup

VPN config provided by a CISCO/OpenBSD gateway located in remote IDC

Phase 1:

Phase 2:

Howto Configure PFSense Site-to-Site IPSec VPN Tunnel

Let us get started with the configuration.

PFSense appliance VPN IPSec configuration

pfSense must be set up and be working correctly for the existing local network environment. Both locations must be using non-overlapping LAN IP subnets. For demo purpose my PFSense appliance located at https://192.168.1.254/.

Step #1: Login to admin webui

Fire a browser and type the following url:
https://192.168.1.254/
Sample outputs:

Fig.02: PFSense admin Login Username and Password

Step #2: Setup the VPN Tunnel

Click on VPN > IPSec:

Fig.03: PFSense configure the vpn

Fig.04: Enable PFSense

Step #3: Configure a new tunnel

Click on + button (see fig.04) to add a new IPsec tunnel Phase 1 configuration. Make sure Interface set to “WAN”, Remote Gateway to “173.191.1.42”, Authentication Method to Pre-Shared key to “YOUR-super-secret-password-key”, Encryption to “3DES”, Authentication to “MD5”, Diffie-Hellman Group to “2”, Keylife to “14400”, and finally press the Save button.

Fig.05: PFSense New IPsec VPN Tunnel Phase 1 Configuration

The IPsec tunnel configuration has been changed. You must apply the changes in order for them to take effect.

Click on the Apply changes button:

Fig.06: Saving Phase 1 Config

Step #4: Create a new Phase 2 config

To create a new Phase 2, click the large + inside the Phase 1 entry in the list, on the left-hand side. This expands the list to display all Phase 2 entries for this Phase 1. Click the + button on the right to add a new entry:

Gif 01: Create a new Phase 2 to build the VPN

Fig. 07: PFSense IPSec VPN Phase 2 Configuration

Step #5: Add IPSec firewall rules

By default firewall rules are automatically added to the WAN to allow the tunnel to connect, but if the option to disable automatic VPN rules is checked, then manual rules may be required. The following rules added by the firewall (you can see them by typing the pfctl -sr | grep -i ipsec command at PFSense console)

anchor "ipsec/*" all
pass out on enc0 all flags S/SA keep state label "IPsec internal host to host"
pass out route-to (rl0 192.168.0.1) inet proto udp from any to 	173.191.1.42 port = isakmp keep state label "IPsec: SL IPsec - outbound isakmp"
pass in on rl0 reply-to (rl0 192.168.0.1) inet proto udp from 	173.191.1.42 to any port = isakmp keep state label "IPsec: SL IPsec - inbound isakmp"
pass out route-to (rl0 192.168.0.1) inet proto udp from any to 	173.191.1.42 port = sae-urn keep state label "IPsec: SL IPsec - outbound nat-t"
pass in on rl0 reply-to (rl0 192.168.0.1) inet proto udp from 	173.191.1.42 to any port = sae-urn keep state label "IPsec: SL IPsec - inbound nat-t"
pass out route-to (rl0 192.168.0.1) inet proto esp from any to 	173.191.1.42 keep state label "IPsec: SL IPsec - outbound esp proto"
pass in on rl0 reply-to (rl0 192.168.0.1) inet proto esp from 	173.191.1.42 to any keep state label "IPsec: SL IPsec - inbound esp proto"

To setup IPSec firewall rules as per your needs, click on the Firewall > Rules and IPsec tab. Setup rules as per your needs.

How do I see the current status of the IPSec vpn?

Click on the Status > IPSec:

Fig.08: PFSense IPSec Status: Connect or Disconnect VPN Tunnel

Fig 09: Current IPSec Status

How do I test my vpn setup?

Try to ping or ssh into one of the remote server:

$ ping -c2 10.10.29.68
PING 10.10.29.68 (10.10.29.68): 56 data bytes
64 bytes from 10.10.29.68: icmp_seq=0 ttl=60 time=267.420 ms
64 bytes from 10.10.29.68: icmp_seq=1 ttl=60 time=271.900 ms

--- 10.10.29.68 ping statistics ---
2 packets transmitted, 2 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 267.420/269.660/271.900/2.240 ms
## try ssh now ##
$ ssh root@10.10.29.68

Conclusion

And, there you have it, VPN up and running from your SOHO. For more info see the official doc here.