Remote Access Mobile VPN Client Compatibility

A variety of remote access (“mobile”) VPN configuration styles are available to accommodate nearly any potential client. The table below shows which operating systems have compatible clients with some of the most common remote access VPN configurations.

Warning

WireGuard has been removed from the base system in releases after pfSense Plus 21.02-p1 and pfSense CE 2.5.0, when it was removed from FreeBSD.

If upgrading from a version that has WireGuard active, the upgrade will abort until all WireGuard tunnels are removed. For more details, see the Release Notes

WireGuard is available as an experimental add-on package on pfSense Plus 21.05, pfSense CE 2.5.2, and later versions. The settings for the WireGuard add-on package are not compatible with the older base system configuration.

Note

The WireGuard package is still under active development. Follow the development progress on the developer’s YouTube channel

Mobile/Remote Access VPN Client Availability

Protocol/Operating System

Windows 10

Android

iOS

macOS

OpenVPN

3PA 1 2

3PA 4

3PA 6

3PA 2

WireGuard

3PA 3

3PA 3

3PA 3

3PA 3

IPsec PSK

?

Varies

?

?

IPsec RSA

?

Varies

?

?

IPsec IKEv2 EAP-MSCHAPv2/RADIUS

Yes

Yes (11+),
3PA (4.x+) 5

Yes

Yes

IPsec IKEv2 EAP-TLS

Yes

Yes (11+),
3PA (4.x+) 5

Yes

Yes

Legend:

  • Yes = OS Native Client Available

  • 3PA = Third Party Client Required

  • Varies = Varies by device model and vendor options

Unless otherwise stated, UNIX clients (*BSD, Linux, etc) can support any style with manual configurations but the availability of GUI configuration tools varies by distribution.