In this article, we will show you how to configure pfSense to create an L2TP/IPsec VPN. If you have trouble accessing pfSense, check that the pfSense firewall rules are configured correctly.
Clouding firewall configuration
To make our VPN work, we will create a firewall profile with the following rules and assign it to our server:
Configure L2TP
Now we will configure the L2TP server. In the top menu, go to VPN > L2TP and click “Enable L2TP server”. Under Interface, leave “WAN” selected. In Server address, enter “10.10.10.1”, set “Remote address range” to 10.10.10.128/25, and finally specify the “Number of L2TP users” that will connect concurrently. Next, we will create the users. Open the “User” tab and create as many users as you need.
Configure IPsec
Now we will configure the IPsec tunnel. In the top menu, go to VPN > IPsec and open the “Mobile Clients” tab. Click “Enable IPsec Mobile Client Support”, select Local Database under “User Authentication”, and save your changes.
To configure Phase 1 of the VPN, click the green “+ Create Phase 1” button that has appeared in the upper-right corner. In the form, change “Negotiation mode” to Main and set the encryption options to AES 256, SHA1 and DH 14.
Now click the blue “Show Phase 2 Entries” button, then click the green “+ Add p2” button. Change “Mode” to Transport and set the encryption options to AES 128, SHA1 and PFS Off.
Next, go to the Pre-Shared Key menu and create your “Pre-Shared Key”. In the form, set “Identifier” to allusers and enter TestKB-Clouding in “Pre-Shared Key”. This is an example; we recommend using strong passwords.
Configure pfSense firewall rules
Now that the VPN is configured, all that remains is to allow traffic in pfSense. In the top menu, go to Firewall > Rules and open the L2TP VPN tab. Click the green “Add” button and change “Protocol” to Any. Now open the IPsec tab and repeat the previous step. Once the rules have been created, you can apply the changes.
Have you tried it? Leave us your comments! 🙂