If you’re like me you’ve tried a to find a pfSense Road Warrior configuration for IPSec that actually works and you’ve banged your head against the wall for hours because its one giant problem after another.  Every pfSense mobile configuration on the pfSense site has a different box checked and every website has a different story on why the configuration you are testing doesn’t work. And almost none of the sites say what those pesky options actually do! Leaving you guessing as to whether you should attempt to change the setting or look somewhere else for a solution to your problem!

Well I am here to show you a mobile IPSec Road Warrior configuration that actually works, and explain all of the problems I had getting it to work and what I did to fix them.  I’ll also explain what some of those pesky options actually do and why changing them might or might not be a good idea.

A Working pfSense Road Warrior IPSec Configuration

Let’s start by running through the configuration one step at a time. (This guide is for pfSense 2.3+.)  There are five basic steps.  Enable the Mobile configuration, followed by the Phase, and then Phase 2 configuration. Then we need to create and enable users to connect and then configuring the client machines. We’ll discuss each one in detail.

Step 1: Enable the IPSec VPN Mobile Configuration

The first step in getting our pfSense Road Warrior configuration working is to enable Mobile Client Support for IPSec (which enables IKE extensions).

Under VPN –> IPSec click on Mobile Clients.

On the Enable IPSec Mobile Client Support, under IKE extensions check the box that says “Enable IPsec Mobile Client Support”.

pfSense Road Warrior Configuration IPSEC 0001

On the Extended Authentication box, under User Authentication select “Local Database”.  If you had a remote radius server or another pfSense box that had users on it you could configure that here.  In our example, we’re only going to use the local database. Leave Group Authentication set to “none”.

pfSense Road Warrior Configuration IPSEC 0002

On the Client Configuration box, under Virtual Address Pool check the box and enter a subnet. This is the subnet of IP addresses pfSense will give to mobile clients that connect to your VPN.

Note: I had trouble when entering a class C (/24) in this box.  For some reason traffic would not route.  Changing this to something else (in my case I used a /27) traffic started routing. I think this might be a pfSense bug.

Check the box next to Save Xauth Password. This allows client devices to save the password on their device. If you leave this unchecked you’ll be prompted to enter your password each time you connect, which might be fine if you’re looking for higher security but will certainly be annoying for most.

pfSense Road Warrior Configuration IPSEC 0004

Continuing on in the same box, check the box next to DNS Default Domain, and enter the domain name for your internal network.  In my case I use the domain name .home, so I just entered “home” (not dot in front of it). Yours might be home.com, or a real domain name like TheGeekPub.com.

Next check the box next to DNS Servers and enter the IP address of your DNS server. In my case I want to use the IP address of my pfSense box, because I want to pass internet DNS names to my clients in addition actual domain names on the internet.  This will allow client machines connected to my VPN to access my internal servers by name.  For example my Plex media server is http://plex.home so you can just enter plex/ in your browser and access my movies when connected to my VPN.

pfSense Road Warrior Configuration IPSEC 0005

Notice: If you run into trouble with DNS not working for VPN users on pfSense, this is because your DNS resolver or Forwarder interface is set to ALL interfaces.  Go to the DNS Resolver or DNS Forwarder configuration (Services –> DNS Forwarder or Services –> DNS Resolver) and make sure that the Interfaces section is set to LAN. DNS should work normally after that.

pfSense Road Warrior Configuration IPSEC 0007

Step 2: Create the Phase 1 Entry

The next step in our pfSense Road Warrior configuration for IPSec is to create a Phase 1 Entry. You should automatically be prompted to create this after clicking save on the the Mobile Client Configuration.

pfSense Road Warrior Configuration IPSEC 0006

If for some reason you weren’t prompted, no worries, just go to VPN –> IPSec and click on Tunnels, and click on the Add P1 button.

On the General Information box under Description, enter a name for this VPN. This is purely optional, but makes it easier later on to know what a connection is when looking on the status screens (especially if you have multiple VPNs or clients connected). I just named mine “Home VPN”. Leave everything else default.

pfSense Road Warrior Configuration IPSEC 0008

Under the Phase 1 Proposal (Authentication), change the Authentication Method to “Mutual PSK + Xauth.  Change Negotiation Mode to “Aggressive”. Change Peer Identifier to “Distinguished name” and enter a group name.  You’ll need to remember this group name when configuring your clients.  Under Pre-Shared Key enter a key. You’ll also need to remember this key when configuring your clients.

Note: If for some reason some of the fields or options do not show up, just scroll to the bottom and click save, then re-open the Phase 1 tunnel again and they should be there this time.  This is a known bug in some versions.

pfSense Road Warrior Configuration IPSEC 0009

Under Phase 1 Proposal (Algorithms) make no changes.  The defaults should work fine for all iOS, Android, etc devices.

pfSense Road Warrior Configuration IPSEC 0010

Under Advanced Options, change NAT Traversal to “Force”. If you don’t change this, clients behind NAT firewalls may have a hard time connecting or not be able to connect at all.

pfSense Road Warrior Configuration IPSEC 0011

Step 3: Configuring the Phase 2 Entry

Step 3 of our pfSsense Road Warrior configuration for IPSec involves creating a Phase 2 Entry.  Phase 1 of the configuration defines the tunnels and trades keys.  Phase 2 is about building the tunnel for traffic.

Under the General Information box, under Local Network change the the type to “Network” and enter the address as “0.0.0.0/0”.  This will tell the local clients to send all traffic to you, even traffic bound for the internet. When clients pull down a webpage or file from the internet it will traverse your VPN.

pfSense Road Warrior Configuration IPSEC 0012

If you only want clients to access your local network and send all other traffic out their own ISP then you’d just select “LAN Subnet” from the dropdown and leave the address box empty. This might cause issues with DNS, as your clients will poll the VPN DNS first, so make sure you set the DNS appropriate if you do this back in step 1 (such as google DNS 8.8.8.8, rather your own pfSense box).

pfSense Road Warrior Configuration IPSEC 0013

Continuing on under Phase 2 Proposal (SA/Key Exchange), leave everything here to default. It should work just fine.

pfSense Road Warrior Configuration IPSEC 0014

Under Advanced configuration, also leave this unchanged (empty box).

pfSense Road Warrior Configuration IPSEC 0015

Step 4: Create a User and give them Permissions

Step 4 of our pfSense Road Warrior configuration for IPSec is to create a user and give them permissions to connect. It is highly recommended that you do not use your pfSense admin account for this connection, as it would be a huge security risk should the account be compromised later on. Do yourself a favorite and create a separate account for VPN access, even if you’re the only one connecting to the VPN.

Go to System –> User Manager and click +Add.

Enter a username under Username, and a password under the Password fields (twice).  Don’t change anything under the group settings.

pfSense Road Warrior Configuration IPSEC 0016

Under Keys, don’t enter anything.  We’ve already set our pre-shared key on the tunnel configuration.

pfSense Road Warrior Configuration IPSEC 0017

Now save the account and then reopen it. You’ll see a new section called Effective Privileges. Click the +Add button.

pfSense Road Warrior Configuration IPSEC 0018

Under User Privileges, select “User – VPN: IPSec xauth Dialin” and then click Save.  That’s it.  You’ve created a user that can connect to your VPN tunnel.

pfSense Road Warrior Configuration IPSEC 0019

Step 5: Configure the Client Computers and Devices

The final step is to configure our client machines to connect to the VPN we just made. I’ll give two examples, iOS and MacOS, but most other clients are just as easy.

pfSense Road Warrior Configuration IPSEC 0020Configuring iOS for pfSense Road Warrior IPSec

Go to Settings –> VPN –> Add VPN Configuration. Select Type as IPSec.

Under Description put something like “Connect to Home”.

Under Server, enter the DNS name (fully qualified FQDN) or the WAN IP address of your pfSense box.  Then enter the Account username and password.  Leave Use Certificate set to off.

Under Group Name enter the Group Name you used in Step 2 above. In addition, enter the Secret that you entered in Step 2 above.  That’s all there is to it. Your iOS client should now be able to connect to the VPN. The example given is the iPhone, but the iPad will be exactly the same settings.

Configuring MacOS for pfSense Road Warrior IPSec

pfSense Road Warrior Configuration IPSEC 0021Under Settings –> Network press the plus (+) button at the bottom of the list.

 

Under Interface select “VPN” and then under VPN Type select “Cisco IPSec”.

Under Service Name enter whatever you want to call this VPN connection.  I called mine “Connect to Home” and then click Create.

pfSense Road Warrior Configuration IPSEC 0022On the next screen under Server Address enter the Fully Qualified DNS name or IP address of your pfSense WAN interface. Then enter the same username and password you created earlier. Then click Authentication Settings.

Select Shared Secret and enter the Secret you chose in Step 2 and then enter the Group Name you also chose in Step 2.

TroubleShooting and Final Thoughts

At this point your pfSense Road Warrior VPN should be working like a champ.  If its not there are a few things you might need to check.

Firewall Rules and NAT for pfSense IPSec

If you turned off auto generation of firewall rules, then your going to need to open ports 500 and 4500 inbound to your WAN IP Address. You can check this under System –> Advanced.

In addition, you might need to change your NAT reflection settings, which can be found in the same location. Change the NAT Reflection mode for port forwards to “Pure NAT”.

 

One last note.  Some ISPs block inbound ports to your home network.  Most all block ports 25 and 80.  But some of the worst offending ISPs will also block port 500 and 4500 specifically to keep you from VPNing to your home network.  If your ISP does this you should dump them as they truly do suck.

On another note, if you are looking for a new pfSense firewall for your home, I highly recommend this unit from Amazon. It is really nice. I and several of my friends have it and it works quite well!

40 Responses

  1. Slide R.

    Well I’ll be damned. It worked. I’ve tried 10 of these including the one on the pfsense wiki. none of them worked till this one. thanks!

    Reply
  2. JF

    Hi… I’m looking for a config that work with IKEv2, with pfsense 2.3
    Apple Configurator user profile with always ON enable.

    Any clues where to look… the one on the PFsense forum is not working for me, as the certificate can’t be create with a psw and Apple configurator refuse a certificate if no psw is entered.

    Thanks

    Reply
    • Luke H

      Looking for the working IKEv2 config myself. I’ll let you know when I find it!

      Reply
    • Daniel

      Also looking for IKEv2. And preferably one which works with iOS 10+ and Windows 10.

      Although big thanks for the author, at least now I have one the works with iOS. Might be working with Win10 just don’t know how.

      Reply
      • Daniel

        OK, thx, but why don’t just use IKEv2 when it’s there, beeing the newest, supported by pfSense and all the platforms? A clean and dry solution it would be. Have tried? No luck? Mission Impossible?

      • Mike Murray
        Mike Murray

        There’s a reason the title of this article is “…config that works.” 🙂 If you can get it to work, I’d be happy to create another tutorial.

      • Jf

        Hoooo so no one ever find a working IKEv2 that works!!

        Who develop those things and why don’t they do a tutorial !?!

        And Apple that ask for a psw on every certificate installed with Configurator, no way to force supervised device to comply with business security, user have to turn it on manually !!

        Some tweak when you’re jailbreak can force VPN… But I think you can’t have a supervised device and jailbreak at the same time !!??

  3. Charles

    Do you currently connect using iOS 10.x or Android? I can’t connect with either.

    Reply
  4. Laurent

    Hello, very good work !!!
    i configure my Pfsense like you. When i have configured my ShrewSoft Client on my computer, the “tunnel” is “enabled” but the “security associations” is “Failed”. So, i can’t connect to my network.
    Can you see me how you have configured your ShrewSoft Client on your computer ?
    Thanks a lot.

    Reply
  5. Laurent

    I found the problem. It’s a parameter on phase in my Shrewsoft Client that wasn’t good (PFS Exchange) …
    Your guide is great. Thanks again

    Reply
  6. Jason

    I have had this setup running for several months I have two issues though…
    1. The internet traffic with my client is NOT running through my home pfsense so I made the change you suggested under step 3 by changing the Local Network setting to “network” and 0.0.00/24 and while I am still able to connect with the client the browsing still does not go through my home pfsense and I can no longer access anything on my LAN, I can’t even ping the LAN IP yet the VPN session is connected. If I change it back to LAN and the second field to blank I can access the devices on my LAN. Any idea why?

    A separate issue, but maybe related
    When I try to change the DNS resolver from “All” to “LAN” I get an error saying “This system is configured to use the DNS Resolver as its DNS server, so Localhost or All must be selected in Network Interfaces” so I am not sure how you get that one set… Maybe the first issue is related to not being able to set the second. I dunno otherwise everything is identical with my setup and I am able to access everything by IP address until I change the step 3 and then I can’t ping anything by IP even.

    I really would like to have my browsing go through my home pfsense, and being able to use the DNS names instead of IP addresses would be great too.

    Just for the record I have a few VLANS and several opt LANs maybe those are complicating this. Anyway, this is a great guide I would love to get those two issues sorted though if you have any suggestions. The second issue really makes me wonder, it’s acting like that setting is not even possible, so I am not sure how you got it.

    Reply
  7. Jason

    Follow-up to my question. I figured out problem 1. for the subnet I put 0.0.0.0/24 because that’s what you said to do but your screenshot has 0.0.0.0/0 so I tried that and problem 1 went away. So I am not sure if 0.0.0.0/24 was a typo or what.

    I still have a question about the DNS Resolver though why do you think it won’t let me select LAN..

    Reply
    • Mike Murray
      Mike Murray

      You are indeed correct. I corrected the article! Thanks. As for the DNS issue, it’s not a problem I have seen. I’ll experiment later if I get a chance.

      Reply
      • Jason

        Ok thanks, I will try to tinker with it and come back and update if I get anything.

      • Jon Donshik

        Still have a problem with the DNS resolver too. Same message.

      • Eric

        Ya, I think I am having the same issue. My client can connect just fine, but cannot browse the web. Must be a DNS issue, but not sure exactly where to start diagnosing.

        On a side note, my pf sense is also connect to an openvpn service, and I have rules to send certain traffic through the WAN and others through the VPN. But I don’t think this is causing my problem.

    • bertelbertel

      Under: Firewall -> Rules -> IPsec
      Make sure that you have a rule that allows UDP acces to 192.168.1.1 (your firewall) on port 53 (dns)

      Reply
  8. Adam

    Damn, I hardly ever leave comments on these kinds of guides, but you really helped me out big time! Thanks Mike!

    Reply
  9. Steve

    Have you heard of anyone using a Radius Server to authenticate vs the local Database?

    Reply
  10. Shayne

    I’m new to PFSense, so I am glad I found this article so early in my endeavors to get it working. I had a similar issue with a Draytek router, but the information is pretty rare, which is why I changed to PFSense. In hindsight, I bet it was just a wrong setting somewhere.
    I’m also having issues with my Android devices & Squid Guard, does your expertise include Proxy Servers as well?

    Reply
  11. Tian

    Hi Mike,

    I have 2 networks connected with IPsec tunnel, using pfSense on both ends. If I setup this Road Warrier VPN on Network A. Once the PC connects, would it be able to see the devices on Network B cross the tunnel? Currently I’m using IKEv2 EAP-MSChapV2 for the VPN on the PC, and it just doesn’t see the devices from the next hop over the IPsec tunnel.

    Thank you

    Reply
  12. Erich

    This looks great, I’d like to give this a try. Does this allow multiple VPN connections from the same user from different machines (for example being VPNed in from Win10 and iOS10 at the same time), or is this the same like with OpenVPN where only the last connection works?

    Reply
  13. Nick

    like so many before, just stopping by to pay my regards and offer thanks – like the title says, this config works! I’ve been beating my head against the wall, assuming the IKEv2 profile generated by the built in tool should work; it seems it doesn’t. So I’m grateful to find this and to have a working config. …now to figure out the ‘always on’ part 🙂
    cheers!

    Reply
  14. hitasbs

    Thank you very much, it works perfectly , but i do have a problem with sip registration, two sides can ping each other (Elastix AND Mobile Phone) but the sip account cannot be registered , i have checked the firewall :
    IPsec udp 192.168.0.1:12693 -> 172.16.1.15:5060 NO_TRAFFIC:SINGLE
    i don’t know where is the problem . could you please advise ?

    Reply
    • Mike Murray
      Mike Murray

      Is the firewall rule on the IPSEC tunnel or the LAN/WAN interface? Remember, pfSense processes rules on the Ingress of of the port, even if it is virtual. Additionally, since this is UDP data you will need the same rule on the ingress port(s) of the firewall at the other end.

      Reply
      • hitasbs

        Thanks for your reply i have checked the rules :
        IPSEC=> source, destination, protocol are *
        there is no rule regarding to VPN on other interfaces

Leave a Reply