In this tutorial, we’ll see how to configure a site-to-site IPSec VPN with pfSense and a Ubiquiti EdgeRouter Lite router.

This tutorial is 100% functional on all EdgeRouter devices being in 1.9.7 version minimum.

Equipment used in this article:

• EdgeRouter Lite
• pfSense Community Edition 2.4

I’m quite fan of Ubiquiti hardware. It’s simple, sober, robust and efficient.  I have the EdgeRouter Lite available here and the Ubiquiti Networks UAP-AC-LITE (802.11 a/b/g/n/ac) Wifi Access Point available here.

Network topology

To begin, the network topology

ERL :

eth0 (LAN1) : 192.168.10.254/24

eth1 (WAN) : 82.227.24.25

eth2 (LAN2) : 192.168.11.254/24

pfSense :

vmx0 (WAN) : 151.80.84.160

vmx1 (LAN) : 192.168.20.254/24

Source image

Configuring Site-to-Site IPSec VPN with pfSense – ERL

Configuration via GUI

1. Connect to the router’s web interface and go to the VPN tab> IPsec Site-to-Site > + Add Peer
2. Select : Show advanced options
3. Select : Automaticaly open firewall and exclude from NAT
4. Complete info as below :

Clic on +Add subnets

Configuration via CLI

Access the command line interface (CLI). You can do this using the CLI button in the GUI or by using a program such as PuTTY.

1. Enter configuration mode :
   
   configure

   1

   configure

2. Change the IKE proposal (P1) and Security Associations (SAs)
   
   set vpn ipsec ike-group FOO0 lifetime 86400 set vpn ipsec ike-group FOO0 proposal 1 hash sha256

   1 2	set vpn ipsec ike-group FOO0 lifetime 86400 set vpn ipsec ike-group FOO0 proposal 1 hash sha256

3. Change the ESP proposal (P2) and Security Associations (SAs)
   
   set vpn ipsec esp-group FOO0 lifetime 43200 set vpn ipsec esp-group FOO0 proposal 1 encryption aes128 set vpn ipsec esp-group FOO0 proposal 1 hash md5

   1 2 3

   set vpn ipsec esp-group FOO0 lifetime 43200 set vpn ipsec esp-group FOO0 proposal 1 encryption aes128 set vpn ipsec esp-group FOO0 proposal 1 hash md5

4. Disable Perfect Forward Secrecy (PFS)
   
   set vpn ipsec esp-group FOO0 pfs disable

   1	set vpn ipsec esp-group FOO0 pfs disable

5. Change the local IPsec interface address (Optional) :Use the following command to specify the local IP address to be used as the source for IPsec packets destined for the remote peer. The dhcp-interface and local-address statements CANNOT be used simultaneously. Decide on which command is best for your situation using these options:(A) You are using multiple WAN interfaces and want the VPN to respond on multiple interfaces.With this statement any IPv4 address present on the system can be used as the source of the VPN. You can also use this command if your WAN interface receives an address through PPPoE.
   
   set vpn ipsec site-to-site peer 151.81.84.160 local-address 0.0.0.0

   1	set vpn ipsec site-to-site peer 151.81.84.160 local-address 0.0.0.0

   
   (B) Your WAN interface receives an address through DHCP
   
   delete vpn ipsec site-to-site peer 151.80.84.160 local-address set vpn ipsec site-to-site peer 151.80.84.160 dhcp-interface eth1

   1 2	delete vpn ipsec site-to-site peer 151.80.84.160 local-address set vpn ipsec site-to-site peer 151.80.84.160 dhcp-interface eth1

6. Enable the IPsec offloading feature to increase ESP (not IKE) performance (optional – need reboot)
   
   set system offload ipsec enable

   1	set system offload ipsec enable

7. Commit the changes
   
   commit

   1

   commit

8. Save the configuration
   
   save

   1

   save

   
    

Configuring Site-to-Site IPSec VPN with pfSense – pfSense

Listed pfSense we use the downloadable appliance on the publisher’s website, and in a VMware environment. We are in version 2.4 (last stable available on this date). Listed pfSense, everything can be done via the web interface.

Adding IPSec firewall rules

To add rules in the pfSense, go to Firewall > Rules > WAN and click on Add

We should have something like this:

Phase 1 configuration (IKE)

To configure the phase 1 on the pfSense, go to VPN > IPSec > Tunnels > +Add P1

We should have something like this :

Phase 2 configuration (ESP)

To configure phase 2 on the pfSense, go to VPN > IPSec > Tunnels > Show Phase 2 Entries > +Add P2

We should have something like this :

Do the same thing for the second subnet.

Select “Enable” if it is not done automatically and click on “Apply changes“:

Check that the status of the IPsec daemon is OK by going to Status > Services

Adding subnet firewall rules

To configure subnet firewall rules, go to Firewall > Rules > IPSec > Add

We should have something like this :

Do the same thing for the second subnet.

Troubleshooting

With pfSense

To verify that the connection is well established, go to Status > IPsec 

If the status is “ESTABLISHED” then the connection is up!

With EdgeRouter

With Ubiquiti, just go to the tab Wizards > VPN Status

I hope this article has been helpful to you! If you have any questions, do not hesitate to leave me a comment!