Connecting Two Pfsense Servers: Setup And Routing Guide

Linking two network firewalls together requires careful planning of interface assignments, static routes, and firewall rules to ensure stable communication. Whether you're bridging two branch offices or setting up a high-availability environment, connecting two pfSense servers starts with establishing a reliable transport layer—such as an IPsec or OpenVPN tunnel—and configuring explicit routing paths so that ICMP requests and data packets flow without obstruction.

Measuring latency via ping tests across your newly linked gateways helps verify that packet loss remains minimal and encryption overhead doesn't degrade performance. Let's walk through how to configure physical or virtual interfaces, set up secure tunnels, define static routing tables, and bypass default firewall blocks that commonly disrupt cross-server diagnostics.

Planning Your Server Topologies

Before touching any configuration screens, map out your network subnets carefully. Each pfSense instance must manage a distinct local area network (LAN) range to prevent IP address conflicts. For example, if Server A uses 192.168.1.0/24, Server B should operate on 192.168.2.0/24. Overlapping subnets will break routing tables instantly, rendering ping diagnostics useless.

Decide how the two servers will physically or virtually interconnect. You can bridge them through an existing WAN connection using a secure VPN tunnel, or link them via dedicated direct interfaces if the units sit in the same rack or virtual hypervisor environment. Direct connections eliminate internet-induced jitter, while VPN tunnels secure data traversing public infrastructure.

Configuring Direct Links and Static Routes

When two pfSense servers connect directly via an isolated physical or virtual switch port, you don't always need a heavy VPN protocol just to pass internal traffic. Instead, you can assign dedicated point-to-point IP addresses to the interconnecting interfaces and define manual static routes.

1. Navigate to Interfaces > Assignments on both servers and assign your new port (for instance, OPT1) as the direct link interface.
2. Assign static IPv4 addresses within a small subnet, such as 10.10.10.1/30 on Server A and 10.10.10.2/30 on Server B.
3. Leave the gateway field blank on the interface configuration page if you don't want pfSense to treat this link as a default WAN gateway.
4. Go to System > Routing on Server A and add a static route pointing to Server B's LAN subnet (192.168.2.0/24), using Server B's direct interface IP (10.10.10.2) as the gateway.
5. Repeat this step inversely on Server B, pointing to Server A's LAN subnet via Server A's direct IP (10.10.10.1).

For official documentation on interface and routing options, consult the Netgate pfSense Documentation.

Establishing Secure Tunnels via IPsec

If your pfSense servers are separated across different physical locations, an IPsec VPN tunnel provides secure, encrypted encapsulation. Both routers must agree on exact cryptographic parameters during Phase 1 (ISAKMP) and Phase 2 (IPsec SA) negotiations.

1. Go to VPN > IPsec on both servers and create a new Phase 1 entry.
2. Set the authentication method to Mutual PSK and generate a secure pre-shared key to paste on both ends.
3. Choose matching encryption algorithms, such as AES-256 with SHA256 hash protection.
4. Add a Phase 2 entry specifying the local subnet and the remote subnet of the opposing server.
5. Select an appropriate protocol like ESP and configure your PFS key group to match on both routers.

Once saved, navigate to Status > VPN > IPsec and click Connect to bring the tunnel up.

Permitting ICMP and Troubleshooting Ping Drops

By default, pfSense firewalls drop incoming traffic from unfamiliar subnets to protect your internal assets. If your ping requests time out after setting up a direct link or tunnel, you're likely running into default block rules rather than routing failures.

To allow diagnostic ping traffic across your new link:

• Go to Firewall > Rules and select the tab corresponding to your link type (such as IPsec or OPT1).
• Add a new rule allowing IPv4 ICMP traffic with an ICMP type of Echo Request.
• Ensure the source and destination match your intended cross-network ranges.
• Apply changes immediately.

If pings still fail, check the system logs under Status > System Logs > Firewall to see if specific packet drops are occurring. For broader networking concepts and protocol standards, reference resources provided by The Internet Society.

Common Configuration Mistakes

Avoiding a few typical missteps will save hours of troubleshooting time when linking network firewalls:

• Bogon and Private Network Blocking: Forgetting to uncheck "Block private networks" on WAN-facing or direct interfaces when working in lab environments with RFC 1918 addresses.
• Asymmetric Routing: Failing to ensure return packets travel back through the exact same gateway path they entered, which causes stateful firewalls to drop the connection.
• Mismatched Phase Parameters: Slight discrepancies in encryption or lifetime values between IPsec peers that cause silent tunnel negotiation failures.
• Missing Firewall Rules: Setting up static routes successfully but forgetting to add explicit firewall permit rules for the internal subnets on the receiving interface tab.

Frequently Asked Questions

Why does my ping time fluctuate heavily between the two servers?

Jitter and latency spikes usually stem from underlying network congestion, Wi-Fi interference if wireless bridges are used, or CPU throttling on virtualized pfSense instances. Switching to a wired direct connection or dedicated fiber link resolves physical medium instability.

Can I use OpenVPN instead of IPsec for server-to-server linking?

Yes. OpenVPN works well in peer-to-peer (SSL/TLS) mode and is often easier to configure through complex NAT layers, though IPsec generally offers better raw throughput due to kernel-level encryption handling.

How do I keep the VPN tunnel active permanently?

You can configure a periodic keepalive ping within your VPN settings or set up a small cron job to ping the remote gateway address every few minutes, preventing idle timeouts.

What should I do if static routes are saved but traffic won't pass?

Verify your firewall rule sets on both ends. A route tells the firewall where to send the packet, but interface rules determine whether the packet is legally allowed to cross into that zone.