In this article, we will show you how to configure a site-to-site VPN using pfSense. This connection will allow us to link 2 locations so that devices at both locations can communicate with each other. If you have trouble accessing pfSense through the web interface, we recommend reviewing this article on firewall rules in pfSense.
The LANs (private networks) at the locations must use different address ranges. Below is an example diagram; we will use these details throughout this article.
Location 1 uses pfSense. The VPN configured at Location 2 has the following settings:
- Phase 1
- Encryption: AES 128 bits
- Algorithm: SHA256
- Diffie Hellman Group: 14
- PreSharedKey: TestVPN (use secure keys; this is an example)
- Lifetime: 28800
- Phase 2
- Encryption: AES 128 bits
- Algorithm: SHA256
- PFS: Disabled
- Lifetime: 3600
Configure the LAN
Our pfSense image comes with the LAN unconfigured. First, we will log in to pfSense and go to Interfaces > Assignments in the top menu, then click the “+ Add” button for vtnet1. Next, we will go to Interfaces > LAN and select the “Enable interface” checkbox. Under “IPv4 Configuration Type”, we will select Static IPv4 and go to the next section, “Static IPv4 Configuration”, where we will enter the IP address 192.168.1.1
Configure IPsec
Now we will configure the IPsec tunnel. To do this, we will go to VPN> IPsec in the top menu and click the green “+ Add P1” button. In the form, we will fill in “Remote Gateway” with the public IP address of Location 2, which in our case is 185.166.214.68. We can also add a description if we wish. Next, we will fill in “Pre-Shared Key” with TestVPN in our case, and configure encryption. After saving, we will apply the changes. Below is a screenshot of the Phase 1 configuration:
Now that Phase 1 is configured, we will configure Phase 2. To do this, we will click the green “Add P2” button. Here, we will fill in “Remote Network” with the LAN of Location 2, which in our example is 10.20.10.0/24, and configure encryption. After saving, we will apply the changes. Below is a screenshot of the Phase 2 configuration:
Configure Firewall and NAT Rules
Now we will configure the pfSense firewall to allow all traffic through the IPsec tunnel. To do this, we will go to Firewall > Rules > IPsec and click the green “↑ Add” button. Below is a screenshot of the configuration. After saving, we will apply the changes:
Configure Clouding.io Firewall Rules
To make our VPN work, we will create a firewall profile with the following rules:
Have you tried it? Leave us your comments! 🙂