Creating an IPsec Tunnel in pfSense #
Step 1: Open IPsec Configuration
Top menu → VPN → IPsec.
Step 2: Add Phase 1
Click Add P1 to begin Phase 1 (the secure connection setup between the two networks).
Step 3: Phase 1 — Basic Settings
- Internet Protocol and Interface: leave at default.
- Choose IKE Version (v1 or v2) as required.
- Remote Gateway: enter the public IP of the remote network.
Step 4: Phase 1 — Authentication
- My Identifier: IP address (your own public IP).
- Peer Identifier: Peer IP address.
- Set a secure Pre-Shared Key — it must match exactly on both sides.
⚠ If the Pre-Shared Key does not match on both sides, Phase 1 will fail to connect.
Step 5: Review Phase 1 & Save
Confirm Interface, Remote Gateway, Protocol, IKE Version, Identifiers, and Pre-Shared Key, then click Save.
Step 6: Phase 1 — Encryption Settings
Select encryption/authentication algorithms (e.g., AES, SHA256). Default lifetime is 28800 seconds (8 hours). Click Save.
Step 7: Phase 1 — Advanced Settings
- Child SA Close Action: Restart/Reconnect.
- NAT Traversal: Auto.
Click Save to finalize Phase 1.
Step 8: Apply Changes & Start Phase 2
Click Apply Changes, then click Show Phase 2 Entries → Add P2.
Step 9: Phase 2 — Network Settings
- Mode: Tunnel IPv4.
- Local Network: as provided by QCloud (typically 172.16.17.0/24).
- Remote Network: obtain from the remote side’s network team.
Step 10: Phase 2 — Encryption & Protocols
Select the encryption algorithms/protocols agreed with the remote side — both ends must match exactly.
Step 11: Phase 2 — Lifetime
Default lifetime is 3600 seconds (1 hour); keep it consistent on both sides. Click Save, then Apply Changes.
Step 12: Finalize
Click Save, then Apply Changes. Double-check that Phase 1 and Phase 2 settings exactly match the remote side.
Step 13: Verify Tunnel Status
Click Status on the IPsec page. If both phases show ‘Established’ / ‘Up’, the tunnel is connected.
Step 14: If the Tunnel Is Not Up
Click Connect to manually bring the tunnel up. If it still fails, re-check all Phase 1 and Phase 2 settings against the remote side.
