In this article, we will show you how to configure a site-to-site VPN “Site to Site” with an SSL certificate for authentication using pfSense. This connection will allow us to link 2 sites so that devices at each site can see one another. If you have trouble accessing pfSense through the web interface, we recommend reading this article on firewall rules in pfSense.
Typically, both sites authenticate using a preSharedKey shared by both endpoints to establish the connection. This time, we will replace the preSharedKey with SSL certificates, making our VPN even more secure.
The LANs (private networks) at the sites must use different address ranges. Here is an example diagram; we will use these details throughout this article.
In this article, both sites will use pfSense.
- Phase 1
- Encryption: AES 128 bits
- Algorithm: SHA256
- Diffie Hellman Group: 14
- SSL certificate
- Lifetime: 28800
- Phase 2
- Encryption: AES 128 bits
- Algorithm: SHA256
- PFS: Disabled
- Lifetime: 3600
Configure the LAN
Our pfSense image comes with the LAN unconfigured. First, log in to pfSense and, in the top menu, go to Interfaces > Assignments and click the “+ Add” button for vtnet1. Now go to Interfaces > LAN and select the “Enable interface” checkbox. For “IPv4 Configuration Type”, select Static IPv4 and go to the next section, “Static IPv4 Configuration”, then enter the IP address 10.20.10.1 at site 1 and 10.20.11.1 at site 2.
Example for site 1:
Generate the SSL certificates
Before configuring IPsec, we need to generate the SSL certificates in pfSense. In pfSense at site 1, go to the top menu and select System > Cert. manager > CAs. First, create a certificate authority by clicking Add. Fill in the details as shown below:
Now we need to create an SSL certificate for pfSense at site 1. In pfSense at site 1, go to the top menu and select System > Cert. manager > Certificates and click Add/sign. Fill in the certificate details as shown below, making sure to select the type "Server Certificate" and specify the public IP address of pfSense at site 1.
Go back to System > Cert. manager > Certificates and click Add/sign again to create the SSL certificate for pfSense at site 2. This time, select "User Certificate" and specify the public IP address of pfSense at site 2.
The SSL certificates are now ready for configuration.
Export and import the CA and SSL certificate for pfSense at site 2
In pfSense at site 1, go to the top menu and select System > Cert. manager > CAs. To export the certificate authority, click the two middle icons under "Actions" to download the CA and private key that you will need to import into pfSense at site 2.
The next step is to export the SSL certificate generated for pfSense at site 2. In the top menu, go to System > Cert. manager > Certificates and export the certificate by clicking the first two icons for the site 2 certificate.
The final two steps before configuring IPsec are to import the CA and certificate generated at site 1 into pfSense at site 2. To do this, log in to pfSense at site 2 and go to System > Cert. manager > CAs and click ADD. Make sure to select the "Import an existing certificate authority" option. Fill in Certificate data and Certificate Private Key with the contents of the CA files downloaded from pfSense at site 1, then click Save.
Go to System > Cert. manager > Certificates and click Add/Sign. Make sure to select the "Import an existing certificate authority" option. Fill in Certificate data and Certificate Private Key with the contents of the certificate files downloaded from pfSense at site 1, then click Save.
The SSL certificate setup is now complete in pfSense at both site 1 and site 2.
The following screenshots show what pfSense at site 1 should look like:
The following screenshots show what pfSense at site 2 should look like:
Configure IPsec
Now we will configure the IPsec tunnel in pfSense at site 1. In the top menu, go to VPN> IPsec and click the green “+ Add P1” button. In the form, fill in “Remote Gateway” with the public IP address of site 2, in our case 161.22.46.187. You can also add a description if you wish. Next, select "Mutual RSA" to authenticate with an SSL certificate and configure the remaining settings as shown in the following images. Finally, click Save.
Repeat the same step in pfSense at site 2, but under "Remote Gateway" now enter the public IP address of pfSense at site 1 and select the corresponding certificates as shown in the following images. Finally, click Save.
Now that Phase 1 is configured, we will configure Phase 2 at both sites. To do this, click the green “Add P2” button. Here, fill in “Remote Network” with the LAN of site 2 for pfSense at site 1, and with the LAN of site 1 for pfSense at site 2, in our example 10.20.11.0/24, and configure the encryption. Once saved, apply the changes.
Here is a screenshot of the Phase 2 configuration at site 1:
Here is a screenshot of the Phase 2 configuration at site 2:
Configure firewall and NAT rules
Now we will configure the pfSense firewall to allow all IPsec tunnel traffic. To do this, go to Firewall > Rules > IPsec, then click the green “↑ Add” button. The configuration is shown in the screenshot below. Once saved, apply the changes:
Configure Clouding firewall rules
For our VPN to work, we will create a firewall profile with the following rules:
Connect the VPN
To connect the VPN, go to the top menu, select VPN > IPsec and click "related status".
In this new window, click "Connect VPN".
Finally, you will see the VPN status:
Have you tried it? Leave us your comments! 🙂