Many of you asked me to create an easy to understand step-by-step tutorial on how to create a pfSense site to site VPN tunnel between two pfSense firewalls. I try to make it as simple as possible.

The Scenario: pfSense Site to Site VPN

I try to keep this example scenario as simple as possible, therefore I created an easy to understand, self-explaining diagram.

This should give you a pretty good understanding of what we want to achieve. We simply want to establish a pfSense site to site VPN connection between pfSense #1 HQ and pfSense #2 Remote Location. To do this, we need to create IPSec tunnels and firewall rules on both sides. I kept the subnets simple so you don’t get confused by too many different IPs. The Gateway in your case would be your WAN IP Address.

Without further ado, let’s get right started.

Step 1 – Creating IPSec Phase 1 on pfSense #1 HQ

To create a pfSense site to site VPN, you need to log in to your pfSense #1 HQ and navigate to VPN / IPsec and click on + Add P1. Set the address of the Remote Gateway and a Description.

IP of your WAN Interface on your pfSense #2 Remote Location Enter a Description

Scroll down to Phase 1 Proposal (Authentication). Now head to any page you like, or this one, to create a Pre-Shared Key.

You can also use the tool pwgen on Linux with the following command to create a key:

pwgen -sy 25

Copy this key and paste it in the Pre-Shared Key field.

Scroll down to the bottom leaving everything else on Default and click Save. Click Apply Changes after.

Step 2 – Creating IPSec Phase 2 on pfSense #1 HQ

Time to create the second Phase. Click on + Show Phase 2 Entries and click on + Add P2.

Now enter values like in the following example:

On Local network choose Network Enter the Subnet of your Local Network (192.168.1.0/24 for pfSense #1 HQ) On Remote Network choose Network Enter the Subnet of your Remote Network (192.168.2.0/24 for pfSense #2 Remote Location)

Enter a description if you want.

Scroll down to Phase 2 Proposal (SA/Key Exchange). Enter values like in the following example:

Change AES Encryption to 256 bits Change PFS key group to 15 (3072 bit) Enter the pfSense #2 Remote Location’s IP Address to be pinged automatically (this ensures that the tunnel stays active at all times) Smash that Save button (Sorry, watched too many YouTube videos) Hit Apply Changes

Almost done with pfSense #1, now we just need to create a Firewall Rule for the IPsec interface.

Step 3 – Creating a Firewall Rule on pfSense #1 HQ

Navigate to Firewall / Rules / IPsec. Click on Add. Enter values as the following:

Change Protocol to Any For Source select Network Enter the Subnet of pfSense #2 Remote Location (192.168.2.0/24) Enter a Description Hit Save & Apply Changes

That’s it. We are done with pfSense #1 HQ, let’s head over to pfSense #2 Remote Location to create our pfSense site to site VPN.

Step 4 – Creating IPSec Phase 1 on pfSense #2 Remote Location

Now we basically need to repeat those exact steps again just with slightly changed values. I will guide you through every step anyway. Navigate to VPN / IPsec and click on + Add P1. Enter values as in the following:

IP of your WAN Interface on your pfSense #1 HQ

Enter a Description

Scroll down to Phase 1 Proposal (Authentication). Enter the same Pre-Shared Key like in pfSense #1 HQ that we created in Step 1.

Scroll to the bottom and hit Save & Apply Changes.

Step 5 – Creating IPSec Phase 2 on pfSense #2 Remote Location

Once again, click on +Show Phase 2 Entries and click on + Add P2.

Now enter values like in the following example:

On Local network choose Network Enter the Subnet of your Local Network (192.168.2.0/24 for pfSense #2 Remote Location) On Remote Network choose Network Enter the Subnet of your Remote Network (192.168.1.0/24 for pfSense #1 HQ)

Enter a description if you want.

Scroll down to Phase 2 Proposal (SA/Key Exchange) and enter the values like below.

Change AES Encryption to 256 bits Change PFS key group to 15 (3072 bit) Enter the pfSense #1 HQ’s IP Address to be pinged automatically (this ensures that the tunnel stays active at all times) Hit Save & Apply Changes.

Step 6 – Creating a Firewall Rule on pfSense #2 Remote Location

Navigate to Firewall / Rules / IPsec. Click on Add. Enter values as the following:

Change Protocol to Any For Source select Network Enter the Subnet of pfSense #1 HQ (192.168.1.0/24) Enter a Description Hit Save & Apply Changes

Now, in theory, a tunnel should be established between the two.

Step 7 – Testing the Tunnel

Back on pfSense #1 HQ head to Status / IPsec. You should see, if everything went well, that a connection is established.

You will see a similar picture on pfSense #2 Remote Location. We can do two more things to also validate if the firewall rules are correct: Running a Ping from a Client on each Firewall’s Subnet.

First I will try to Ping pfSense #1 HQ from a Client connected to pfSense #2 Remote Location.

And now I run a Ping from a client connected to pfSense #1 HQ to pfSense #2 Remote Location.

And sure enough, you can see that a connection is established. And that’s it. That should give a good idea of how to create an pfSense Site to Site Tunnel with pfSense 2.4.3!

Until next time.

Please Share! Email

Facebook

Reddit

Twitter

Pinterest

More

LinkedIn

