{"id":12298,"date":"2022-04-20T23:20:47","date_gmt":"2022-04-20T20:20:47","guid":{"rendered":"https:\/\/kifarunix.com\/?p=12298"},"modified":"2024-03-09T11:47:37","modified_gmt":"2024-03-09T08:47:37","slug":"configure-site-to-site-ipsec-vpn-on-pfsense-and-libreswan","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/configure-site-to-site-ipsec-vpn-on-pfsense-and-libreswan\/","title":{"rendered":"Configure Site-to-Site IPSec VPN on pfSense and Libreswan"},"content":{"rendered":"\n

In this tutorial, you will learn how to configure Site-to-Site IPSec VPN on pfSense and Libreswan. IPSec<\/a> (Internet Protocol Security) is a secured network protocol commonly used on VPNs to create a secured and encrypted communication tunnel between the communicating endpoints through data packet authentication and encryption.<\/p>\n\n\n\n

Both pfSense and Libreswan can be configured to establish a site to site IPSec VPN tunnel to enable remote systems to communicate securely. They can be integrated with other commercial tools like Cisco ASA\/Fortinet devices to setup secured IPSec VPN tunnel between communicating sites.<\/p>\n\n\n\n

Configure Site-to-Site IPSec VPN on pfSense and Libreswan<\/h2>\n\n\n\n

In order to demonstrate how to setup Site-to-Site IPSec VPN between pfSense and Libreswan, here is our deployment architecture.<\/p>\n\n\n\n

NOTE that the IP addresses, 11.22.33.44 and 55.66.77.88<\/strong> used in this guide are just BOGUS<\/strong>! for the purposes of demonstration. Replace them accordingly!<\/p>\n\n\n\n

\"Configure<\/figure>\n\n\n\n

IPSec VPN configurations must match on both peers in order to the tunnel to be established successfully. In that case, below are the configuration settings were using in this particular setup;<\/p>\n\n\n\n

VPN device host information<\/strong><\/td>Side A<\/strong><\/td>Side B<\/strong><\/td><\/tr>
VPN device version<\/td>pfSense 2.5.0<\/td>Libreswan<\/td><\/tr>
IP address<\/td>11.22.33.44 (bogus IP address<\/strong>)<\/td>55.66.77.88 (bogus IP address<\/strong>)<\/td><\/tr>
<\/td><\/td><\/td><\/tr>
IKE – Phase 1 properties<\/strong><\/td>Side A<\/strong><\/td>Side B<\/strong><\/td><\/tr>
Authentication method<\/td>PSK (ChangeME)<\/td>PSK (ChangeME)<\/td><\/tr>
Encryption scheme<\/td>IKEv2<\/td>IKEv2<\/td><\/tr>
Perfect Forward Secrecy – IKE<\/td>DH Group 20<\/td>DH Group 20<\/td><\/tr>
Encryption algorithm – IKE<\/td>AES256<\/td>AES256<\/td><\/tr>
Hashing algorithm – IKE<\/td>SHA256<\/td>SHA256<\/td><\/tr>
IKE SA lifetime<\/td>86400 sec<\/td>86400 sec<\/td><\/tr>
<\/td><\/td> <\/td><\/tr>
IPSec – Phase 2 properties<\/strong><\/td>Side A<\/strong><\/td>Side B<\/strong><\/td><\/tr>
Transform (IPSec protocol)<\/td>ESP<\/td>ESP<\/td><\/tr>
Perfect Forward Secrecy – IPSec<\/td>DH Group 20<\/td>DH Group 20<\/td><\/tr>
Encryption algorithm – IPSec<\/td>AES256<\/td>AES256<\/td><\/tr>
Hashing algorithm – IPSec<\/td>SHA256<\/td>SHA256<\/td><\/tr>
IPSec SA lifetime<\/td>3600 sec<\/td>3600 sec<\/td><\/tr>
<\/td><\/td><\/td><\/tr>
Encryption hosts<\/strong><\/td>Side A<\/strong><\/td>Side B<\/strong><\/td><\/tr>
Remote Networks<\/td> 172.16.0.0\/24<\/td>192.168.0.0\/24<\/td><\/tr>
Hosts<\/td>172.16.0.20<\/td>192.168.0.200<\/td><\/tr><\/tbody><\/table>
IPSec VPN Tunnel between pfSense and Libreswan configurations<\/figcaption><\/figure>\n\n\n\n

Configure IPSec VPN on pfSense on Side A<\/h3>\n\n\n\n

You can start by configuring the IPSec VPN settings on pfSense on side A.<\/p>\n\n\n\n

We extensively explained how to configure IPSec VPN on pfSense in our previous guide. You can check the link below on how to go about this configuration;<\/p>\n\n\n\n

Configuring IPSec on pfSense on Side A<\/a><\/p>\n\n\n\n

This is how our configurations are like;<\/p>\n\n\n\n

\"Configure<\/figure><\/a><\/div>\n\n\n\n

Configure Libreswa IPSec VPN<\/h3>\n\n\n\n

On the remote end, we are using a Rocky Linux server which acts as a Linux router for the Side B LAN.<\/p>\n\n\n\n

Thus, to setup Libreswan for IPSec VPN on Rocky Linux;<\/p>\n\n\n\n