Jump to content

Training Lab 5: IPsec VPN

From MediawikiCIT
Revision as of 07:07, 23 April 2026 by Justinaquino (talk | contribs) (Imported from Netgate pfSense training PDF via bot)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)


Netgate pfSense Plus Fundamentals — Lab 5: IPsec VPN
Hands-on lab covering site-to-site IPsec with pre-shared key and mobile IPsec remote access configuration.

Lab 5: IPsec

In this lab, we connect the HQ and branch networks with a site-to-site IPsec VPN, then configure mobile IPsec to offer a remote access option for mobile clients.

Lab topology references:

  • HQ WAN IP: 192.0.2.2
  • Branch WAN IP: 203.0.113.10
  • HQ network: 172.17.0.0/16
  • Branch network: 172.18.0.0/16

Part 1: IPsec Pre-Shared Key Site-to-Site VPN

Enable fw1-HQ IPsec

On fw1-HQ, browse to VPN > IPsec. Click +Add P1 to add a new Phase 1 configuration.

HQ Phase 1 Configuration

At the resulting Edit Phase 1 screen:

  • Remote Gateway: Branch WAN IP (203.0.113.10)
  • Interface: WAN
  • Description: (your choice)

Phase 1 Proposal Configuration

Scroll down to the Phase 1 proposal configuration.

Generating Pre-Shared Key:

  • Click the yellow button to generate your pre-shared key automatically
  • Make note of it — it will be needed to configure the other end of the VPN

Advanced Options:

  • Leave NAT Traversal to Auto
  • The underlying strongSwan service will determine if NAT-T is required and automatically enable it if so

Leave the other settings at their defaults, then click Save.

Adding HQ Phase 2

Back at the IPsec Tunnels tab, click the + under the newly-created Phase 1 to expose the Phase 2 configuration, then click +Add P2.

Configuring HQ Phase 2

For local and remote networks, use the /16 network summarizing all available IP subnets for each location:

  • Local Network: Type: Network, 172.17.0.0/16
  • Remote Network: Type: Network, 172.18.0.0/16

Phase 2 Proposal Configuration

Choose specific parameters for each area rather than having multiple options enabled. This is always best for site-to-site VPNs.

Setting Recommendation
Encryption AES-256 (single option)
Hash SHA256 (single option)
PFS On (match group)

Having multiple options enabled could lead to a less secure, slower algorithm like 3DES being chosen over a faster, more secure option like AES-256.

Automatically Ping Host

Enter an IP address within the remote subnet to keep the VPN alive:

  • Use fw1-branch LAN IP (e.g., 172.18.1.1)
  • IPsec is "dial-on-demand" — it doesn't try to connect unless traffic is trying to traverse the VPN
  • The IP doesn't have to reply; it's the initiation of the request that triggers the VPN to come up

Then click Save, and at the main IPsec Tunnels screen click Apply Changes.

Configure HQ IPsec Firewall Rules

Traffic coming in via IPsec is filtered by the firewall rules on the IPsec tab. By default, this contains no rules, so all VPN traffic will be blocked.

Browse to Firewall > Rules, IPsec tab. Click Add and configure:

Field Value
Action Pass
Interface IPsec
Protocol any
Source 172.18.0.0/16
Destination any
Description allow branch network in via IPsec

Click Save, and Apply Changes.

Notes:

  • The outer portion of the VPN requires UDP port 500 and ESP protocol on WAN — these rules are handled automatically
  • Traffic is allowed out from HQ to branch by the default LAN rule
  • The HQ DMZ subnet will not be able to initiate connections to the remote branch network because of the DMZ rule rejecting private network destinations

Configure fw1-branch IPsec

Browse to https://172.18.1.1 to reach fw1-branch.

Add Phase 1 Entry

Add a new Phase 1 entry for the HQ VPN:

  • Remote Gateway: fw1-HQ's WAN IP — 192.0.2.2
  • Match all other parameters exactly with fw1-HQ

Phase 1 Proposal and Advanced

All Phase 1 proposal settings must match exactly to fw1-HQ. After matching up everything, click Save.

Branch Phase 2 Configuration

Add a new Phase 2 entry under the Phase 1 just added. Everything is identical to HQ's Phase 2, except flip local and remote networks:

  • Local Network: 172.18.0.0/16
  • Remote Network: 172.17.0.0/16

Leave Automatically ping host blank on this side (the other end will keep the tunnel active).

Then click Save, and Apply Changes.

Add IPsec Firewall Rule

Browse to Firewall > Rules, IPsec tab, and add an allow-all rule:

Field Value
Action Pass
Interface IPsec
Protocol any
Source Network, 172.17.0.0/16
Destination any
Description allow HQ in via VPN

Save and Apply Changes.

Testing the VPN

Browse to Status > IPsec on the branch firewall. If the status shows "Disconnected", click the Connect VPN button.

Once something attempts to bring up the VPN, it should change status to ESTABLISHED.

Troubleshooting

If the VPN does not come up:

  • Closely review all settings in Phase 1 and Phase 2 on both sides
  • Check for typos in IP addresses
  • Verify the pre-shared key was pasted correctly
  • Ensure no inadvertently mismatched settings

Passing Traffic Across VPN

On HQ-client, test connectivity: 

training@hq-client:~$ ping -c 3 172.18.1.1
training@hq-client:~$ ping -c 3 172.18.1.100

On branch-client, ping back: 

training@branch-client:~$ ping -c 3 172.17.1.1
training@branch-client:~$ ping -c 3 172.17.1.100
training@branch-client:~$ ping -c 3 172.17.2.10

You should also be able to browse to web servers in the HQ DMZ network from branch-client.

Part 2: IPsec Remote Access VPN

Next, configure IPsec for mobile clients. This works with any standard IPsec clients, specifically focused towards the Cisco IPsec clients built into Mac OS X and Apple iOS. The Shrew Soft client is used in this lab.

User and Group Setup

IPsec remote-access users require the "IPsec xauth Dialin" privilege.

Add IPsec Mobile Group

On fw1-HQ, browse to System > User Manager, Groups tab. Click +Add:

  • Give the group a name (e.g., "Mobile_IPsec") and description
  • Save
  • Edit the group and under Assigned Privileges, click Add
  • Choose only the "VPN - IPsec xauth Dialin" privilege
  • Save again

Creating User for VPN

Go to the Users tab, click +Add:

  • Username: vpntest
  • Password: password
  • Group: Mobile_IPsec
  • Save

Server Configuration

On fw1-HQ, browse to VPN > IPsec, click the Mobile clients tab:

Setting Value
Enable IPsec Mobile Client Support Checked
User Authentication Local Database
Group Authentication Checked
Authentication Groups Rights for Mobile IPsec (Mobile_IPsec)
Virtual Address Pool 172.17.5.0/24
Network List Checked — "Provide a list of accessible networks to clients"
DNS Default Domain example.com
DNS Servers 172.17.1.1

Leave all other fields at defaults and click Save.

Phase 1 Creation

After saving, you will see a prompt to create a Phase 1 definition for mobile clients. Click Create Phase 1.

Parameter Value
Key Exchange Version IKEv1
Description Mobile clients
Authentication Method Mutual PSK + Xauth
My Identifier My IP address
Peer Identifier User distinguished name, vpn@example.com
Pre-Shared Key Generate new (make note)
Encryption Algorithm AES 128 bit
Hash Algorithm SHA1
DH Group 2
Lifetime 86400
NAT Traversal Force

Leave all else at defaults, and click Save.

Configure Phase 2

Back at the IPsec Tunnels screen, expand the mobile Phase 1 and click +Add P2:

Parameter Value
Mode Tunnel IPv4
Local Network Type: Network, 0.0.0.0/0
Encryption AES 128
Hash SHA1
PFS off
Lifetime 28800

Note: The Phase 2 "Local Network" determines what networks are sent to the client. 0.0.0.0/0 sends all traffic across the VPN. To send only internal traffic, use 172.17.0.0/16 or 172.16.0.0/12.

Then click Save, and Apply Changes. The server-side IPsec configuration is now complete.

Firewall Rule Configuration

Browse to Firewall > Rules, IPsec tab. Add a new rule:

Field Value
Action Pass
Interface IPsec
Protocol Any
Source Network 172.17.5.0/24
Destination any
Description allow in mobile client IPsec

Then Save and Apply Changes.

Client Configuration

On remote-host, launch Shrew Soft VPN Access Manager. Click Add to create a new configuration.

General Tab

  • Fill in the WAN IP of fw1-HQ: 192.0.2.2
  • Leave all else at defaults

Authentication Tab

  • Authentication Method: Mutual PSK + XAuth
  • Local Identity: User Fully Qualified Domain Name — vpn@example.com

Remote Identity Tab

  • Choose Identification type: IP address

Credentials Tab

  • Enter or paste the PSK generated during Phase 1 creation

Phase 1 Tab

  • Change DH Exchange to group 2
  • Leave all else at defaults

Phase 2 Tab

  • Set Lifetime to 28800 seconds
  • Leave everything else at defaults

Then click Save. You can rename the connection (e.g., "HQ VPN").

Testing

Select the connection and click Connect. Fill in:

  • Username: vpntest
  • Password: password

Then click Connect. If you see "tunnel enabled" as the last line in the status, it's connected successfully.

Try to ping across to HQ-client (172.17.1.100) and server1 (172.17.2.10).

This concludes the IPsec lab.

Next Module

Source Attribution

  • Document: FUND001-LIVE-Lab5-IPsec.pdf
  • Course: pfSense Plus Fundamentals and Practical Application
  • Copyright: © 2021 Rubicon Communications, LLC (Netgate)
  • Extracted: 2026-04-23 via pdftotext
Retrieved from "https://mediawiki.comfac.net/index.php?title=Training_Lab_5:_IPsec_VPN&oldid=238"