In this guide, you will learn how to configure a robust Site-to-Site IPsec VPN between OPNsense and pfSense firewalls. We will use IKEv2 with AES-GCM encryption to ensure both high security and performance. This setup allows seamless connectivity between two distinct private LANs over the internet.
Before beginning configuration, it is essential to understand the network schema used in this example.
10.1.1.0/2410.2.2.0/24We will start by configuring the OPNsense side of the tunnel.
Navigate to VPN > IPsec > Pre-shared Keys and click the + button.
ABC123).Navigate to VPN > IPsec > Tunnel Settings and add a new connection.
Inside the connection settings, add a "Child" entry to define the networks.
Ensure you check the Enable IPsec box and click Apply.
Go to Firewall > Rules > IPsec and add a rule to pass all traffic (Any/Any) for testing. If connecting over the WAN, ensure UDP 500, UDP 4500, and ESP protocols are allowed on the WAN interface.
Now we will configure the pfSense side to match the settings we just created.
Navigate to VPN > IPsec > Tunnels and click Add P1.
Click Show Phase 2 Entries and Add P2.
Go to Firewall > Rules > IPsec and add a rule to pass traffic. Ensure the protocol is set to Any (or allow ICMP specifically) to enable ping testing.
Once both sides are configured and changes are applied, you should verify the connection.
On pfSense, go to Status > IPsec. You should see the tunnel status as established.
Use a client on the OPNsense LAN (e.g., Linux Mint at 10.1.1.x) to ping a client on the pfSense LAN (e.g., Windows 10 at 10.2.2.x). If the ping replies, traffic is successfully routing through the encrypted tunnel.