PFSense Mobile Client IPSEC Setup

This video covers all the stages of setting up support, rules, and users for IPSEC VPN on PFSense. Please use the comments below to ask questions, and please subscribe and like this video if it helped you!

[@danielhubbard5739]

Finally, not only did it work but you explained everything which helped with learning! Thank you so much for taking the time to do this!

[@lorneshantz4892]

I would LOVE to see you update your video for version 2.4.x. THey are up to 2.4.3 as of this writing. Some things have changed in your instructions, which made it a little difficult to follow. We still managed within the roughly 20 minutes of instruction. By far the best explanation I have seen in the last 2 years. It is SO helpful to have someone explain the steps! Thanks much!!!

[@jamestravels9554]

Finally... thank you! My longstanding PFsense VPN now allows me to browse the web from from its location. One tiny little setting, overlooked, time and time again. Thank you!

[@nissedhulla]

This might be the best explanation I have seen on setting up mobile VPN. Taking some time to explain what the settings do and how they effect other parts of the configuration is what put this video a peg or two above other videos I have seen on this subject (imho). Well done!

[@z_a_c_h]

Thank you for taking the time to post this video. I found it very helpful.

[@ThatThrottle]

Thank you! This worked perfectly. I did change the following: Phase 1: Hash Algorithm = SHA256 Phase 2: Hash Algorithms = SHA1 AND SHA256 Then I followed your iPhone tutorial and my iPhone 6 running iOS 10.3.2 connected just fine. Thank you so much for this!! I hit "like" and subscribed!

[@DanielDooijes]

Thank you for this perfect explanation. This is really one of the best how-tos!

[@mareklotocki]

It's the best howto video about pfSense configuration. Hope we will see more.

[@netassassinsecurity]

Thanks! Glad it helped you!

[@twistable_deer]

Excellent video! One thing to note is if you are using a manual outbound NAT, you must create an outbound NAT rule for your VPN clients or else, they won't be able to reach the internet. To do this, go to Firewall > NAT > Outbound > (only do this if you have Manual Outbound NAT rule generation selected) > click Add > keep the interface as WAN > Protocol = any > source = Network > enter the virtual address pool range (10.254.69.0/24 for example) > leave the rest as default and Save the changes. You should now be able to surf the web!

[@xTruMB]

Awesome Video! Helped me a lot on OPNsense!

[@falazarte]

excellent, it worked like a champ for me!

[@bmfairweather]

Great VID! helped me about a lot.

[@NthgToFear]

Extremely helpful!

[@lawrencebrewer8769]

Excellent! Thank you!

[@darklemon1]

Great video, helped me alot

[@hamed55411]

very much appreciated about the coll video. one minor problem at my end however, I have followed the instruction in the video to the letter and I see the Login banner on the client machine when I try to connect, but I have not traffic to my LAN network. clients can surf the Internet after the VPN connection is established, but NO access to the LAN network. what might have I missed in here?

[@antonkikets2356]

Hello NetAssasin, Thanks for Awesome video. I will try this tomorrow at work. For Windows, u use the built in client. Am I right? Thanks Anton

[@sholzapfeld]

Great video of howto have yet seen over here, but there is a little question, all Mac devices and also Android devices do connect with this config, but Windows fails, I have been changeing the Windows config to use CHAP method but it still fails to conect.

[@y948ken]

That's a great video. I followed your steps to created a ipsec VPN tunnel on my android phone. How ever when I tried to reconnect, it failed. I have on been able to make the connection again. Where can I find the log to see what's going on with the tunnel in pfsense?

[@cbremer83]

This seems like a better solution to OpenVPN. Are there any protocol limitations? For example I use an SMB sync app on our phones to sync to my files server. I have a vacation coming up and would like to use a VPN to all me to sync from the hotel WiFi or cell network. Will SMB still work or should I be looking at other solutions?

[@vktvalojaaani]

Thanks!

[@NasirMxd]

Well explained

[@lontownsend3012]

will this mobile ipsec affect the already ipsec tunnels we have established with the other pfsense firewalls of our clients?

[@richsamuel2922]

Once I get connected on my Android phone I cannot browse through my pfSense's WAN connection.

[@lennymontalbano2398]

How do you correctly download this

[@bufo333]

Just so you know ikev1 and agressive move fails pci compliance. If using ikev1 you must use main mode which is more secure, or switch to ike v2.

[@netassassinsecurity]

While true, unless you are a company clearing credit cards - not really an issue. I would suggest ikev2 regardless.

[@romdata2]

Thx Great Video, helped a lot, I was wondering if you have any tips on how you can trace a connection that dosen´t work ( Windows 10 client ) WireShark or Pfsense logs? The Client dosen´t say much just dosen´t work.

[@netassassinsecurity]

That's a very tricky answer due to what happened in Windows 10. You have to make a few changes to DNS resolution and set the VPN interface to be a higher priority than any other interface otherwise things don't route through it properly. I will try to post a video on this. It's annoying. Also, disable IPV6 if you are not using it, as that takes priority over IPV4, and the VPN will not be used.

[@miroslavzeleznik1986]

Thank you very much for your video. Im sucessfully using ipsec for my clients access ever since you posted your video :) You said in the video that different network scopes for users can be set in phase 2. I would like allow only for one user access to one of the subnest not whole network. Is this possible with pfSense? Im trying to figure this out for more than a week but there is almost none information regarding this on the internet. If you could advice you help would be very appreciated.

[@netassassinsecurity]

I am going to assume you set the Phase2 to use 0.0.0.0/0 which means you now accept everything over the VPN. This means the only way you now can filter is in the Firewall rules for the IPsec interface. To do this, you would have to then have a static IP for the client, and while this is possible it cannot be done via the web GUI and requires a bit of mucking about with he config files by hand. Not something I recommend as that work can be undone when there is a new update of the system. So for now, it's probably not possible with any degree of ease. You might, instead, setup and have that person use OpenVPN and have that service setup to be quite restrictive. Then the IPsec and the OpenVPN would have two different scopes / rulesets. Another way would be if they allowed PfSense to have more than one "Mobile Client" setup, thus allowing you to bind to a second IP Address because you set the DHCP scope on the Mobile Clients panel. But, again - you cannot do this currently. Nor does it have a robust enough UI to allow you to setup static IP addresses. (Normally this would be done by UserID on more enterprise-grade VPNs.)

[@flahammerhead]

Great video. One disagreement however. Aggressive mode is NOT more secure; it is in fact LESS secure and discouraged. The client IP address or client certificate is the preferred method when one has a dynamic client address. Aggressive mode allows for brute force of stage-1 psk, because the client source is not checked. Thanks however for a great vid.

[@magnatron1086]

"Main [mode] is just lighter and easier on the clients". I don't know where you get this from. Main mode is more secure than aggressive mode since it protects identities and encrypts the PSK hash. Nothing to do with compute requirements, purely down to the process of setting up the tunnel and the amount of communication involved in the Phase 1 setup.

[@netassassinsecurity]

You are correct, it is more secure than aggressive.

[@kjemradio]

SHA1 is being deprecated because it is NOT secure. SHA2 is now the recommended hashing. So for this lesson I'd recommend SHA2 for the hash algorithm. Even for a home setup it is not good practice to use SHA1. It's like using WEP for wireless security.

[@netassassinsecurity]

While deprecated to those using SSL certificates and the public view due to some poor coverage of the topic, no it's actually very secure. There is no "insecurity" in SHA-1. Especially in this use. It is nothing like WEP, which is encryption. SHA is a hash... it's how we hide the password. WEP is how we encrypt traffic.WEP has a flaw because I can gain the password for access to an AP by collecting enough traffic and then figuring out the cypher with a flaw in the encryption math. SHA-1 has an impossibility to recover the password from its hashed version; relies on "preimage resistance" which is, as far as we know, still fully infeasible with SHA-1. It is also fully infeasible with SHA-512, SHA-256, or even MD4 or MD5. A Sci-Fi oriented mind may envision computers achieving the power to find preimages for MD4 or MD5 around year 2050; it will take much longer for SHA-1. SSL keys with SHA-1 is slightly different, and even then it is just improbable. Feel free to set yourself to SHA-256 or higher if you want...

[@kjemradio]

NetAssassin I'm not gonna argue dude. They HAVE been deprecating SHA1. READ. www.infoworld.com/article/3064654/security/tick-tock-time-is-running-out-to-move-from-sha-1-to-sha-2.html I'm not going to waste time commenting when I've done my homework, and have spent YEARS working with web site encryption.

[@brandy3312]

I would basically agree that if stronger algorithms are supported, one should use them. Therefore for P1 I only allow SHA256. However for P2, it seems that SHA1 has to be allowed as well in order to get the VPN running, at least with my Android phone.

[@Udith6415]

Hi sir, Can you please let me know what are the subnetmasks of your LAN and WAN IP's? According the video it seems that your IP's are, WAN-10.254.254.141(DHCP) and LAN-10.254.254.69 Is the subnetmask 255.255.255.0(/24) or something else? Also, I would like to know how you have configured your LAN and WAN interfaces. What mode are they in (Bridge/Host only/ Internal Network) ?

[@netassassinsecurity]

The IPs you see in the video are on the VM I am running, they have no true outcome on the setup other than shouldn't overlap. I don't cover this in the video because I assume your firewall is setup with non-overlapping subnets. Normally, most people are going to have this setup with some RFC1918 range on the LAN, and a true IP on the WAN using NAT/PAT. You could, if you have multiple static IPs, confirm a CARP or some other alias IP on the external interface and then use that as the VPN endpoint. It doesn't matter really, other than you need to use that IP or the FQDN that resolves to it in the client so it can connect to the VPN service.

[@jobbies]

Are you still taking questions on this video mate? Can you please explain why you're using "Network 0.0.0.0/0" instead of "LAN Subnet"? What wouldn't I be able to do if "LAN Subnet" was set as opposed to "Network 0.0.0.0/0" when accessing from the remote client for example? Any clarification would be appreciated, I can't get my head around it.

[@netassassinsecurity]

Sure. The use of 0.0.0.0/0 forces ALL traffic into the tunnel. The point of the video is to make a tunnel that takes even Internet bound traffic from the client and sends it through the VPN tunnel and out the PfSense Firewall vs. the firewall and network where you have the client (laptop for example.) This is done for privacy and security. You can bypass any proxy that the local site has, and you avoid any monitoring they are doing on where you may have visited, what you did, they cannot collect passwords etc. If you left it as "LAN Subnet" then only traffic for the LAN would go across the tunnel. So let's assume the lan is 10.10.10.0/24. Only traffic for a machine in that range would then go across the tunnel, all Internet traffic would go over the network where your client is located (let's assume it is a hotel because you are traveling.) So now the hotel could see what you did on the Internet, but you would also have access to your remote network. This is called a "split tunnel." I designed the video, as I explain in the beginning, to not be split - and therefore it is a privacy or secure tunnel.

[@netassassinsecurity]

Another reason is that the VPN Tunnel when it isn't split provides added security for your LAN. Someone on the network you are using, again assume a hotel or coffee shop, cannot leverage an exploit and use your connection there to route across your VPN into your secure network. For example, you left internet sharing on in your MacBook, and they simply use your laptop now as a router between the coffee shop and your secure private LAN back at your office or house. ;)

[@jobbies]

Thank you so much for your reply, I 100% understand why 0.0.0.0 is used. Sub'd.

[@rayyanthamim]

Thanks alot, its working fine, i've small problem, when i choose 'group gateway' in the interface (dual WAN), it will not connect, works if i choose single wan, any idea?

[@netassassinsecurity]

I think we corresponded via email. If not, let me know and I will share what I wrote to that person. :)

[@rayyanthamim]

Yea i've got your replay Thanks

[@shyneedeline8756]

nice video, how to configure mobile to connect vpn thanks,

[@marcelk.4371]

Still working on pfSense 2.6.0 with Android (on my Galaxy S9+ with Android 10)

[@FatzyRider]

Hi there i have followed through your steps but i cant seem to ping my local subnet and i got no internet on my phone once im connected. Im not too sure if i miss out any steps.

[@netassassinsecurity]

See 12:38 in the video for what you missed. ;)

[@netassassinsecurity]

Alos, verify you created a firewall rule to allow the traffic from the IPsec network.

[@jschroedl983]

I followed all the steps but in the firewall there is no IPsec tab.

[@Temido2222]

Click the enable button on the P1 tunnel

[@Icycoldcoke]

works on mac android IOS no problems but no on windows

[@bobkoure]

I have it working* on Win10, using EAP-MSCHAPV2. see doc.pfsense.org/index.php/IKEv2_with_EAP-MSCHAPv2 Also works on android with strongSWAN app (you can import certs on the app, so no need to password your phone. To be fair, I do not have data connectivity, can only ping, probably some setting I missed.

[@dennismeijer3512]

To bad, with the new pfsense 2.3 there is no tab in the firewall called ipsec anymore. So I have no idea how to make the rule that this would work. Can anyone help me?

[@ricardopeu]

+Dennis Meijer You try create rule on wan (allow udp 500, 4500 and separate rule allow ESP protocol), in your "lan" interface allow source ipsec network to your network lan ( create alias to allow services in this case) and verify automatic outbound rules...

[@falazarte]

+Dennis Meijer, I thought I had the same problem, but in 2.3 once you setup the Ipsec you have push the "play" button. After that the IPsec interface will show up in the firewall.

[@netassassinsecurity]

Actually, there is. I think Fabian Lazarte is correct, you have to hit the "play" button to turn-on the IPSec now and then the rules tab will appear as the virtual interface (IPSec) is then active. I may remake the video for the new version.

[@ricardopeu]

Yes, I misunderstood his question :D

[@robreviewsstuff]

Where is this "play" button on 2.3? I didn't see it anywhere during the IPsec configuration. Thanks

[@kevinbradt835]

This does not work at all so don’t believe a single thing the video creator says because he’s fake I have tried this so many times and it does not work at all