> For the complete documentation index, see [llms.txt](https://docs.acecloud.ai/knowledge-base/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.acecloud.ai/knowledge-base/tutorials/how-to-configure-a-site-to-site-ipsec-vpn-on-pfsense.md).

# How to Configure a Site-to-Site IPsec VPN on pfSense?

## Objective

To establish a secure IPsec Site-to-Site VPN tunnel between two pfSense firewalls.

## Prerequisites

* Non-overlapping LAN subnets.
* Pre-Shared Key (PSK).
* Internet connectivity on both sites.

## Client-Side Requirements

* WAN IP address.
* LAN subnet(s) for Phase 2.
* Matching Phase 1 settings (IKE version, PSK, encryption).
* Matching Phase 2 settings (subnets, encryption, PFS).
* Confirm NAT or routing requirements.

## Step 1: Configure Phase 1 (IKE)

* Navigate to VPN > IPsec > Add P1.
* Set Key Exchange Version: IKEv2.
* Remote Gateway: Client WAN IP.
* Authentication Method: Mutual PSK.
* Pre-Shared Key: \[Client-provided key].
* Encryption: AES-256, SHA256, DH Group 20, Lifetime: 28800 seconds.
* Save and Apply.

![](/files/d18e1fac06abcfb6b141d8159e705621ad75482f)

<figure><img src="/files/38e39a128f944e4e92a1af4aaa26dcbff9667c35" alt=""><figcaption></figcaption></figure>

## Step 2: Configure Phase 2 (ESP)

* Local Network: Site A LAN subnet.
* Remote Network: Site B LAN subnet.
* Encryption: AES-256, SHA256.
* Lifetime: 3600 seconds.
* Save and Apply.

## Step 3: Firewall Rules

* Navigate to Firewall > Rules > IPsec.
* Add rules to allow traffic between LAN subnets.
* Action: Pass, Interface: IPsec, Protocol: Any, Source: Local LAN subnet, Destination: Remote LAN subnet.
* Save and Apply.

  <figure><img src="/files/29fefefa2ddfb2f069fa73c94465c593ef3e1836" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/ade625a4bd387c5c5df0adf5aeaf81bfff3f896c" alt=""><figcaption></figcaption></figure>

## Step 4: Test the Tunnel

* Go to Status > IPsec and verify the tunnel is established.
* Test connectivity: Ping from Site A LAN to Site B LAN.
* Use Diagnostics > Traceroute if needed.

  <figure><img src="/files/ea2e5841312a7a04324535d02f9b89ac0aca290a" alt=""><figcaption></figcaption></figure>

## Troubleshooting

* Ensure Phase 1 and Phase 2 settings match exactly on both ends.
* Check firewall rules and NAT settings.
* Verify routing and DNS.

## Best Practices

* Use strong encryption (AES-256, SHA256).
* Enable Dead Peer Detection.
* Monitor tunnel status regularly.