pfSense

This tutorial explains how to set up a policy-based or route-based IPsec VPN with a pfSense device.

​​ (Policy-based only) LAN interface configuration

1. From the pfSense WebGUI, select Interfaces > LAN.
2. Choose an interface from the Available network ports list.
3. Select Add. The General Configuration dialog displays.

Refer to the image below for guidance on which values to use.

​​ Phase 1

​​ Phase 2

​​ (Route-based only) Interface assignment

1. From the pfSense WebGUI, select Interfaces > LAN.
2. Choose an interface from the Available network ports list.
3. Select Add. The General Configuration dialog displays.

Refer to the image below for guidance on which values to use.

4. From the pfSense WebGUI, select Interfaces > Assignments.

5. From Available network ports, select + Add.

6. Under Interface, select OPT1.

7. Ensure Enable interface is selected.
8. For Description, add a description to help you identify the interface.
9. For MSS, enter 1446, which should be the same as the LAN interface.
10. Select Save to save your changes when you are done.

​​ Routing configuration

1. From the pfSense WebGUI, select System, Routing, Static Routes.
2. On the Static Routes page, select Add.
3. Create static routes for all network that will be routed via the tunnel with Gateway as the IPsec VTI interface.

​​ Firewall configuration

1. From the pfSense WebGUI, select Firewall Rules.
2. Select LAN.
3. Ensure a rule exists that allows traffic from LAN to IPsec.
4. Select Save when you are done.

If you need to allow traffic from IPsec to LAN, you will need to create rules that allow this.