User:Mauirixxx/pfSense IPSec VPN - Revision history

Mauirixxx: /* Advanced Options */ formatting

2019-07-23T22:48:27Z

‎Advanced Options: formatting

Mauirixxx: /* Configuration */ all done

2019-07-20T03:20:59Z

‎Configuration: all done

Mauirixxx: /* Advanced Configuration */ formatting

2019-07-20T03:11:11Z

‎Advanced Configuration: formatting

Mauirixxx: /* Phase 1 Proposal (Authentication) */ strange that neither one like the peer identifier of their ip address

2019-07-20T02:52:51Z

‎Phase 1 Proposal (Authentication): strange that neither one like the peer identifier of their ip address

Mauirixxx: /* Phase 2 */ done sort of

2019-07-20T02:13:23Z

‎Phase 2: done sort of

Mauirixxx: /* Configuration */ starting phase 2

2019-07-20T01:58:45Z

‎Configuration: starting phase 2

Mauirixxx: /* Advanced Options */

2019-07-20T01:48:09Z

‎Advanced Options

Mauirixxx: finished phase 1

2019-07-20T01:47:54Z

finished phase 1

Mauirixxx: /* Configuration */ saving current progress

2019-07-20T01:28:20Z

‎Configuration: saving current progress

Mauirixxx: /* Requirements */ updated AES-NI

2019-07-20T00:55:31Z

‎Requirements: updated AES-NI

@@ Line 47: / Line 47: @@
 ==== Advanced Options ====
 Leave everything defaulted in this section, and click Save. When finished, it should look like this:
 [[File:Phase1-complete.png]]

← Older revision		Revision as of 03:20, 20 July 2019
Line 73:		Line 73:

	[[File:Phase2-complete.png]]		[[File:Phase2-complete.png]]
		+	== Firewall Rules ==
		+	After you hit "Apply Changes" on both firewalls, your IPsec VPN should connect right away. You may find that you can't ping anything across the VPN though - you'll need to click on Firewall -> Rules -> Add to create a hole in the firewall to allow traffic to pass.
		+	=== Insecure allow all traffic rule ===
		+	This rule will allow ALL traffic to traverse the firewalls (remember you have to make the same rule for both sides). This is NOT a secure setting! If your home network gets compromised, your home network can be a jumping off point for bots/hackers/viruses to invade the network on the other side of the VPN.
		+
		+	''' You have been warned.'''
		+	==== Edit Firewall Rule ====
		+	* Protocol: Any
		+
		+	And that's it, unless you want to add a description. End result looks like this:
		+
		+	[[File:IPsec-any-rule.png]]

← Older revision		Revision as of 03:11, 20 July 2019
Line 71:		Line 71:

	After you hit save, this is what your Phase 2 will look like:		After you hit save, this is what your Phase 2 will look like:
		+
	[[File:Phase2-complete.png]]		[[File:Phase2-complete.png]]

@@ Line 33: / Line 33: @@
 ** Home: home.piracyforjesus.xyz
 ** Work: work.piracyforjesus.xyz
-* Peer identifier: Peer IP address
+* Peer identifier: Distinguished name
 * Pre-Shared Key: On one firewall, click generate key, then copy & paste that key to the other firewall
 ==== Phase 1 Proposal (Encryption Algorithm) ====
 * Encryption Algorithm:

← Older revision		Revision as of 02:13, 20 July 2019
Line 47:		Line 47:

	=== Phase 2 ===		=== Phase 2 ===
−	From the above screen, click on "Show Phase 2 Entries (0)" and expand out the menu, then click on the green "'''+''' Add P2" button.	+	From the above screen, click on "Show Phase 2 Entries (0)" and expand out the menu, then click on the green "'''+''' Add P2" button that appears.
		+	==== General Information ====
		+	* Mode: Tunnel IPv4
		+	* Local Network: LAN subnet
		+	* NAT/BINAT translation: None
		+	* Remote Network: Network
		+	** Address (Work): 192.168.10.0/24
		+	** Address (Home): 192.168.1.0/24
		+	* Description:
		+	** Home: Work LAN
		+	** Work: Home LAN
		+	==== Phase 2 Proposal (SA/Key Exchange) ====
		+	* Protocol: ESP
		+	* Encryption Algorithms: AES128-GCM @ 128 bits
		+	* Hash Algorithms: AES-XCBC (or SHA256 if your CPU doesn't have AES-NI)
		+	* PFS key group: 14 (2048)
		+	* Lifetime: 3600
		+	==== Advanced Configuration ====
		+	* Automatically ping host: set this IP address to a server you run 24/7, this will keep the VPN up 24/7
		+
		+	After you hit save, this is what your Phase 2 will look like:
		+	[[File:Phase2-complete.png]]

@@ Line 18: / Line 18: @@
 Let's get started:
-* Click on VPN -> IPsec, and on the bottom right, click on +Add P1
+* Click on VPN -> IPsec, and on the bottom right, click on the green "'''+''' Add P1" button at the bottom of the screen.
 === Phase 1 ===
 ==== General Info ====
@@ Line 45: / Line 45: @@
 Leave everything defaulted in this section, and click Save. When finished, it should look like this:
 [[File:Phase1-complete.png]]

← Older revision		Revision as of 01:47, 20 July 2019
Line 42:		Line 42:
	** DH Group: 14 (2048)		** DH Group: 14 (2048)
	* Lifetime (Seconds): 28800		* Lifetime (Seconds): 28800
		+	==== Advanced Options ====
		+	Leave everything defaulted in this section, and click Save. When finished, it should look like this:
		+	[File:Phase1-complete.png]

← Older revision		Revision as of 01:28, 20 July 2019
Line 14:		Line 14:

	Both locations must NOT have the same internal LAN address - meaning both can't be running 192.168.1.x addresses, one can run 192.168.1.x while the other can run 192.168.2.x.		Both locations must NOT have the same internal LAN address - meaning both can't be running 192.168.1.x addresses, one can run 192.168.1.x while the other can run 192.168.2.x.
		+
		+	Final note - the VPN configuration on both firewalls will be exactly the same, save for parts that require IP addresses or hostnames.
		+
		+	Let's get started:
		+	* Click on VPN -> IPsec, and on the bottom right, click on +Add P1
		+	=== Phase 1 ===
		+	==== General Info ====
		+	* Key exchange version: IKEv2
		+	* Internet Protocol: IPv4 (IPv6/Dual stack will work if you're running IPv6 at both sites)
		+	* Interface: WAN (or whatever you named the interface with the public IP address)
		+	* Remote Gateway: this is where you need either your own domain, or a free Dynaimc DNS provider - or manually entering the IP addresses works, users with dynamic IP addresses the "work" location will have to update your IP address manually every time it changes.
		+	** Remote Gateway (home): work.piracyforjesus.xyz
		+	** Remote Gateway (work): home.piracyforjesus.xyz
		+	* Description: put whatever you like or leave blank
		+	==== Phase 1 Proposal (Authentication) ====
		+	* Authentication Method: Mutual PSK
		+	* My Identifier: Distinguished name:
		+	** Home: home.piracyforjesus.xyz
		+	** Work: work.piracyforjesus.xyz
		+	* Peer identifier: Peer IP address
		+	* Pre-Shared Key: On one firewall, click generate key, then copy & paste that key to the other firewall
		+	==== Phase 1 Proposal (Encryption Algorithm) ====
		+	* Encryption Algorithm:
		+	** Algorithm: AES128-GCM
		+	** Key Length: 128 bits
		+	** Hash: SHA256
		+	** DH Group: 14 (2048)
		+	* Lifetime (Seconds): 28800

@@ Line 8: / Line 8: @@
 * Dynamic '''OR''' static IP address
 * A [https://www.namecheap.com/ domain name] or a [https://www.maketecheasier.com/best-dynamic-dns-providers/ free dynamic DNS provider].
 == Configuration ==