Setting Up Site to Site IPsec VPN on pfSense

A site to site IPsec VPN connects two distinct networks across the internet securely, allowing hosts on both sides to communicate as if they were on the same local network.

In this post, we will walk through configuring a policy based site to site IPsec VPN on pfSense using IKEv2, configuring Phase 1 and Phase 2 parameters, setting up firewall rules, and handling multi subnet or VLAN routing.

Phase 1 Configuration

Phase 1 establishes the secure, encrypted channel (IKE SA) between the two pfSense firewalls.

1. Navigate to VPN > IPsec > Tunnels.
2. Click Add P1 and configure the following:
   • Key Exchange Version: IKEv2 (if both sides support it)
   • Internet Protocol: IPv4
   • Interface: WAN
   • Remote Gateway: Remote public IP address (e.g., 10.20.20.2)
   • Description: Enter a descriptive identifier
   • Authentication Method: Mutual PSK
   • My Identifier: IP address
   • Peer Identifier: IP address
   • Pre-Shared Key: Enter your pre shared key string
   • Encryption Algorithm: AES 128-bit, Hash: SHA256, DH Group: 14 (2048 bit)
   • Lifetime: 28800 seconds
3. Click Save and Apply Changes.

Both endpoints must have matching Phase 1 proposal parameters for negotiation to succeed.

Phase 2 Configuration

Phase 2 establishes the IPsec Security Association (IPsec SA) that encrypts and routes traffic between specific subnets.

1. On VPN > IPsec > Tunnels, click Show Phase 2 Entries under your Phase 1 entry.
2. Click Add P2 and configure:
   • Mode: Tunnel IPv4
   • Local Network: LAN Subnet (or specify your local network CIDR, e.g., 192.168.1.0/24)
   • NAT Configuration: None
   • Remote Network: Network (enter remote subnet CIDR, e.g., 192.168.2.0/24)
   • Protocol: ESP
   • Encryption Algorithm: AES 128-bit
   • Hash Algorithm: SHA256
   • PFS Key Group: 14
   • Lifetime: 3600 seconds
3. Click Save and Apply Changes.

Configuring Firewall Rules

By default, pfSense blocks all incoming traffic on the IPsec interface. Even if Phase 1 and Phase 2 negotiate successfully, traffic will be dropped unless explicit firewall rules are created.

1. Navigate to Firewall > Rules > IPsec.
2. Click Add to create a rule:
   • Action: Pass
   • Interface: IPsec
   • Address Family: IPv4
   • Protocol: Any
   • Source: Any (or specify your remote subnet for tighter security)
   • Destination: Any (or specify your local subnet)
3. Click Save and Apply Changes on both firewalls.

Ensure Phase 1, Phase 2, and Firewall rules are configured on both pfSense nodes, with inverted local and remote network settings on the peer firewall.

Handling Multiple Subnets or VLANs

Policy based IPsec requires a dedicated Phase 2 entry for every local and remote subnet combination. If you have an additional VLAN (e.g., 192.168.10.0/24) on one side that needs access through the tunnel:

1. On the local firewall, go to VPN > IPsec > Tunnels and expand Show Phase 2 Entries.
2. Click Add P2:
   • Local Network: Select Network and enter your VLAN subnet (192.168.10.0/24).
   • Remote Network: Select Network and enter the remote network IP (192.168.2.0/24).
   • Match the Encryption, Hash, and PFS settings with your previous P2 entry.
3. On the remote firewall, add a corresponding Phase 2 entry:
   • Local Network: LAN Subnet (192.168.2.0/24).
   • Remote Network: Select Network and enter the local VLAN subnet (192.168.10.0/24).

If a Phase 2 entry exists on one side without a matching entry on the remote peer, traffic for that subnet will fail to negotiate or route across the tunnel.

Verifying Tunnel Status

To check the IPsec status and connect:

1. Navigate to Status > IPsec.
2. Check the Phase 1 and Phase 2 status.
3. Click Connect VPN if the tunnel is down.
4. Verify end-to-end connectivity using ping from a local client:

ping 192.168.2.10