pfSense

This tutorial explains how to set up a policy-based or route-based IPsec VPN with a pfSense device.

​​ (Policy-based only) LAN interface configuration

1. From the pfSense WebGUI, select Interfaces > LAN.
2. Choose an interface from the Available network ports list.
3. Select Add. The General Configuration dialog displays.

Refer to the image below for guidance on which values to use.

​​ Phase 1

Policy-based configuration

Field	Value
Description	Name
Key Exchange Version	IKE v2
Internet Protocol	IPv4
Interface	WAN
Remote Gateway	<Anycast IP provided by Cloudflare>

Field	Value
Life Time	28800
Rekey Time	14400
Reauth Time	0

Route-based configuration

Field	Value
Description	Name
Key Exchange Version	IKE v2
Internet Protocol	IPv4
Interface	WAN
Remote Gateway	<Anycast IP provided by Cloudflare>

Field	Value
Life Time	28800
Rekey Time	14400
Reauth Time	0

​​ Phase 2

Policy-based configuration

Field	Value
Description	Name
Mode	Tunnel IPv4
Local Network	<Local Network to be tunneled>
NAT/BINAT translation	None
Remote Network	Remote network available via the tunnel

Field	Value
Protocol	ESP
Encryption Algorithm	✔️ AES128-GCM, 128 bits
PFS key group	14 (2048 bit)

Field	Value
Life Time	3600
Rekey Time	3240
Rand Time	360
Automatically ping host	Specify an IP address available via the tunnel. Refer to the Description field for more information.

Route-based configuration

Field	Value
Description	Name
Mode	Routed (VTI)
Local Network	<Local Tunnel Inside IP>
Remote Network	<Remote Tunnel Inside IP>

Field	Value
Protocol	ESP
Encryption Algorithm	✔️ AES128-GCM, 128 bits
PFS key group	14 (2048 bit)

Field	Value
Life Time	3600
Rekey Time	3240
Rand Time	360
Automatically ping host	Specify an IP address available via the tunnel. Refer to the Description field for more information.

​​ (Route-based only) Interface assignment

1. From the pfSense WebGUI, select Interfaces > LAN.
2. Choose an interface from the Available network ports list.
3. Select Add. The General Configuration dialog displays.

Refer to the image below for guidance on which values to use.

4. From the pfSense WebGUI, select Interfaces > Assignments.

5. From Available network ports, select + Add.

6. Under Interface, select OPT1.

7. Ensure Enable interface is selected.
8. For Description, add a description to help you identify the interface.
9. For MSS, enter 1446, which should be the same as the LAN interface.
10. Select Save to save your changes when you are done.

​​ Routing configuration

1. From the pfSense WebGUI, select System, Routing, Static Routes.
2. On the Static Routes page, select Add.
3. Create static routes for all network that will be routed via the tunnel with Gateway as the IPsec VTI interface.

​​ Firewall configuration

1. From the pfSense WebGUI, select Firewall Rules.
2. Select LAN.
3. Ensure a rule exists that allows traffic from LAN to IPsec.
4. Select Save when you are done.

If you need to allow traffic from IPsec to LAN, you will need to create rules that allow this.