Setting up Site-to-Site VPN on pfSense

Note: If your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead.

pfSense IPsec Site-to-Site VPN tunnel configuration

1. Go to VPN -> IPsec

2. Select +Add P1

• Key Exchange Version: IKEv2
• Internet Protocol: IPv4
• Interface: Your pfSense WAN Interface
• Remote Gateway: the IP of your NordLayer server with a dedicated IP
• Authentication Method: Mutual PSK
• Negotiation Mode: Main
• My Identifier: My IP Address
• Peer Identifier: Peer IP Address
• Pre-Shared key: generate a key (we will also need this value on our end)

3. Encryption Algorithm

• Algorithm: AES
• Key Length: 256 bits
• HASH: SHA256
• DH Group: 14
• Lifetime (Seconds): 28800

4. Advanced Options

• Disable rekey: Unchecked
• Margintime (Seconds): Empty
• Responder Only: Unchecked
• NAT Traversal: Auto
• Dead Peer Detection: Checked
• Delay: 10
• Max failures: 5

5. Select Save

6. Add phase 2: Select +Add p2

• Mode: Tunnel IPv4
• Local Network: Network: Put your local LAN network subnet
• Remote Network: Network: 10.6.0.0/20
• Phase 2: Proposal
• Protocol: ESP
• Encryption Algorithm-AES: 256 bits
• Hash Algorithms: SHA256
• PFS Key Group: 14
• Lifetime (Seconds): 3600

7. Select Save

8. Select Apply Changes

pfSense Firewall Rules (Optional)

1. In the Menu Bar go to Firewall -> Rules

2. Under IPSEC add a new rule

• Action: Pass
• Quick: Mark v
• Interface: WAN and IPSEC
• Source: the IP of your NordLayer server with a dedicated IP
• Destination: Either put any or you can limit to your FW external IP
• Select Save.

3. Under IPSEC add a new rule:

• Action: Pass
• Source: the IP of your NordLayer server with a dedicated IP
• Destination: Either put any or you can limit to your FW external IP
• Select Save.

4. Select Apply Changes

Bringing the tunnel up

1. In the Menu Bar go to Status:-> IPsec

2. On the tunnel, you created select: Connect VPN

Ending note:

In order to finalize the site-to-site tunnel, please create a setup in Sites tab of the NordLayer Control Panel.

• Pre-shared key - you can generate it or we can provide it
• Encryption  details (AES, SHA and DH group) - AES256, SHA256 and DH group 14 are recommended (also must support IKEv2)
• Remote gateway/router public IP (must be reachable while connected to the server with a dedicated IP)
• Remote subnet and mask (the subnet is used in your local network)

Note: In case you have any questions or issues, press 'Chat with support' at the bottom of the page.