IPsec

IPsec provides a standards-based VPN implementation that is compatible with a wide range of clients for mobile connectivity and other devices for site-to-site connectivity. It supports numerous third party devices and is being used in production with devices ranging from consumer grade Linksys routers all the way up to IBM z/OS mainframes, and everything imaginable in between.

See also

For general discussion of the various types of VPNs available in pfSense® software and their pros and cons see Virtual Private Networks.

pfSense software supports IPsec with IKEv1 and IKEv2, policy-based and route-based tunnels, multiple phase 2 definitions for each tunnel, NAT traversal, NAT on Phase 2 definitions, a large number of encryption and hash options, and many more options for mobile clients including EAP and xauth.

• IPsec Terminology
  • IKE
  • ISAKMP Security Association
  • Security Policy
  • Phase 1
  • Phase 2
  • Mobile IPsec
• IPsec Configuration
  • IPsec Tunnel Design
  • IPsec Tunnels Tab
  • Phase 1 Settings
  • Phase 2 Settings
  • IPsec Mobile Clients Tab
  • IPsec Pre-Shared Keys Tab
  • Advanced IPsec Settings
• Choosing a Mobile IPsec Style
  • IKEv2 with EAP-MSCHAPv2
  • IKEv2 with EAP-RADIUS
  • IKEv2 with EAP-TLS
  • IKEv1 with Xauth and Pre-Shared Keys
  • IKEv1 with Xauth and RSA Certificates
  • IKEv1 with Pre-Shared Keys Only
  • L2TP/IPsec (IKEv1)
• NAT with IPsec Phase 2 Networks
  • Configuration
  • NAT Types
  • Example
  • Firewall Rules
  • Remote End Notes
  • Packet Capturing Quirk
• Routed IPsec (VTI)
  • Prerequisites
  • IPsec Configuration
  • IPsec Interface Assignment
  • Routing
  • Routed IPsec Firewall Rules
  • Caveats
• IPsec and firewall rules
  • Outer IPsec Traffic
  • Tunneled IPsec Traffic from Remote to Local
  • Tunneled IPsec Traffic from Local to Remote
• Using IPsec with Multiple Subnets
  • Supernetting Example
• Configuring IPsec Keep Alive
  • Automatic Ping
  • Periodic Check
  • IKEv1 vs IKEv2
• Testing IPsec Connectivity
  • Specifying a Ping Source in the GUI
  • Specifying a Ping Source in the Shell
• Client Routing and Gateway Considerations
• Configuring Third Party IPsec Devices
  • Terminology Differences
  • Compatible Devices
• Accessing Firewall Services over IPsec
  • Service Binding Workaround
  • Static Route Workaround
  • Routed IPsec (VTI)

See also

• IPsec Logs

• IPsec Status

• IPsec in Multi-WAN Environments

• IPsec in High Availability Environments

• IPsec Site-to-Site VPN Example with Pre-Shared Keys

• IPsec Site-to-Site VPN Example with Certificate Authentication

• IPsec Remote Access VPN Example Using IKEv2 with EAP-MSCHAPv2

• IPsec Remote Access VPN Example Using IKEv2 with EAP-RADIUS

• IPsec Remote Access VPN Example Using IKEv2 with EAP-TLS

• IPsec Remote Access VPN Example Using IKEv1 with Xauth

• IPsec Remote Access VPN Example Using IKEv1 with Pre-Shared Keys

• Routing Internet Traffic Through a Site-to-Site IPsec Tunnel

• Connecting to L2TP/IPsec from Android

• L2TP/IPsec Remote Access VPN Configuration Example

• Troubleshooting IPsec VPNs