Opnsense Ipsec Vpn Configuration: Setup Guide

Setting up a secure site-to-site or remote-access tunnel doesn't have to turn into an endless debugging session. If you're running OPNsense as your edge firewall, building an IPsec connection gives you strong cryptographic protection for traffic traversing public infrastructure. Let's walk through a production-ready deployment without getting bogged down in marketing fluff.

IPsec operates at the network layer, making it transparent to applications while securing everything passing between two endpoints. Whether you're connecting a branch office to headquarters or setting up secure road-warrior access, OPNsense provides native support for Internet Key Exchange version 2 (IKEv2). We'll cover pre-shared keys (PSK), Phase 1 and Phase 2 security associations, firewall rules, and troubleshooting common routing traps.

Prerequisites and Network Topology

Before touching the OPNsense web GUI, you'll need clear details about both ends of the tunnel. IPsec demands precision; mismatched encryption algorithms or mismatched subnet declarations will cause silent connection drops.

Make sure you have the following information handy:

The public IP address or fully qualified domain name of your local OPNsense firewall.
The public IP address of the remote peer.
The local subnet behind your OPNsense firewall (e.g., 192.168.10.0/24).
The remote subnet behind the peer device (e.g., 192.168.20.0/24).
A strong, randomly generated pre-shared key (PSK) or certificate authority setup.

If your local firewall sits behind a consumer Network Address Translation (NAT) device, you'll need to configure NAT-T (NAT Traversal) and ensure UDP ports 500 and 4500 are forwarded correctly. For official documentation on firewall hardening and interface assignments, consult the OPNsense Documentation.

Step 1: Enabling the IPsec Service

By default, the IPsec daemon on OPNsense is disabled. You must initialize the service and ensure it starts automatically on boot before configuring individual tunnels.

Log into your OPNsense web interface with administrative credentials.
Navigate to VPN in the left-hand sidebar, click on IPsec, and then select Administration.
Check the box to Enable IPsec service.
If your local firewall is behind a NAT router, check the box for NAT Traversal. This encapsulates IPsec packets inside UDP ports to bypass translation blocks.
Click Save and then click the Apply changes banner that appears at the top of the screen.

Step 2: Configuring Phase 1 (IKE Settings)

Phase 1 establishes a secure, authenticated channel between the two peers using IKEv2. This channel negotiates how Phase 2 will be secured.

Go to VPN > IPsec and select the Connections or Phase 1 tab depending on your specific OPNsense version layout.
Click the + (Add) button to create a new Phase 1 proposal.
Configure the general parameters:
- Interface: Select your WAN interface (typically wan).
- Remote Gateway: Enter the public IP address or hostname of the remote peer.
- Description: Provide a clear label, such as HQ-to-Branch-P1.
Configure the Authentication and Key Exchange:
- Key Exchange version: Select IKEv2. IKEv2 offers faster connection establishment and better roaming stability than IKEv1.
- Authentication method: Choose Mutual PSK (Pre-Shared Key).
- My identifier: Select IP address and input your local WAN IP.
- Peer identifier: Select IP address and input the remote peer's public IP.
- Pre-Shared Key: Enter your strong, randomly generated secret key. Both ends must match character-for-character.
Configure Encryption Algorithms (Proposal Options):
- Encryption Algorithm: Select AES with a key length of 256 bits. Avoid weaker algorithms like 3DES or DES.
- Hash / Digest: Choose SHA-256 or SHA-512.
- DH Group: Select Group 14 (2048-bit Diffie-Hellman) or higher for robust forward secrecy.
Click Save and apply the changes.

Step 3: Configuring Phase 2 (Child Associations)

Phase 2 negotiates the actual IPsec security associations that protect your data packets. You must define the local and remote subnets that are allowed to talk through the tunnel.

Navigate to VPN > IPsec and click on Phase 2 (or child associations under your connection).
Click the + (Add) button associated with your Phase 1 entry.
Configure the Mode and Subnets:
- Mode: Select Tunnel IPv4 (or IPv6 if applicable).
- Local subnet: Choose Type as Local subnet and select your local network address range (e.g., 192.168.10.0/24).
- Remote subnet: Enter the exact subnet range of the remote network (e.g., 192.168.20.0/24).
Configure Encryption Algorithms for Phase 2:
- Protocol: Select ESP (Encapsulating Security Payload).
- Encryption algorithms: Check AES (256 bits).
- Hash algorithms: Check SHA-256.
- PFS key group: Select Group 14 to enable Perfect Forward Secrecy, ensuring compromised keys don't expose past traffic.
Click Save and apply changes.

Step 4: Configuring Firewall Rules and Security Associations

Even when an IPsec tunnel is up, OPNsense's default firewall policies will block traffic passing through it unless you explicitly permit it.

Navigate to Firewall > Rules.
Select the IPsec tab from the top interface list. If the tab isn't visible, go to Firewall > Virtual Interfaces and ensure an IPsec interface assignment exists.
Click the + button to add a new rule:
- Action: Pass
- Interface: IPsec
- Source: The remote network subnet (192.168.20.0/24).
- Destination: Your local network subnet (192.168.10.0/24).
- Description: Allow incoming traffic from remote VPN branch.
Click Save and apply changes.
Next, ensure your WAN rules permit incoming UDP traffic on ports 500 and 4500 if your firewall initiates or receives aggressive mode handshakes. For background on standard port allocations, check the Internet Assigned Numbers Authority (IANA).

Step 5: Bringing Up and Testing the Tunnel

Now that your parameters match on both ends, it's time to test the connection.

Go to VPN > IPsec > Status Overview.
Click Connect next to your newly created tunnel if it doesn't spin up automatically.
Look for status indicators showing established security associations (SAs). If the status shows "ESTABLISHED", your cryptographic handshake succeeded.
Open a terminal on a local machine and ping an IP address on the remote network:
```
ping 192.168.20.5
```
If packets drop, don't guess. Use the built-in packet capture utility under Diagnostics > Packet Capture on your WAN or IPsec interface to see if ESP packets are arriving from the peer.

For further reading on network security standards, visit the National Institute of Standards and Technology (NIST) guidelines on cryptographic key management.

Common Configuration Pitfalls and Troubleshooting

When an IPsec tunnel fails, error logs can feel cryptic. Here are the most frequent mistakes administrators make and how to fix them.

Phase 1 Parameter Mismatch: If the logs show IKE_SA establishment failed, check your encryption, hash, and DH group settings. Both sides must use identical cryptographic primitives. A single mismatch in Diffie-Hellman groups halts the handshake immediately.
Incorrect Subnet Declarations: If Phase 1 connects successfully but traffic won't pass through Phase 2, verify your local and remote subnet CIDR notations. If one side expects 192.168.1.0/24 and the other sends 192.168.1.0/16, the traffic selector will reject the packets.
Routing and Gateway Conflicts: Ensure that your OPNsense box has no overlapping static routes that conflict with your tunnel subnets. IPsec bypasses standard routing tables when matching policies, but conflicting local interfaces cause packet drops.
Blocked UDP Ports: ISPs occasionally filter UDP ports 500 and 4500. Verify that your upstream ISP modem is in bridge mode or that your port forwards are intact.

Frequently Asked Questions

Can I run IPsec and OpenVPN simultaneously on OPNsense?

Yes. OPNsense runs multiple VPN daemons concurrently without resource conflict. You can terminate remote-user connections on OpenVPN or WireGuard while maintaining a site-to-site IPsec tunnel to a branch office.

Why is my IPsec tunnel dropping after a few hours of inactivity?

This usually happens because Dead Peer Detection (DPD) isn't configured, or your security associations are expiring without a keep-alive packet. Enable DPD in your Phase 1 advanced settings to automatically renegotiate dropped connections.

💡 You might also like: Peer-to-Peer Networks: Architecture, Types, and Real-World Use

Do I need a static public IP address for IPsec?

While a static IP makes configuration much simpler, you can establish IPsec tunnels if one side has a dynamic IP by using aggressive mode with aggressive identifiers or dynamic DNS hostnames, provided the initiator knows how to reach the dynamic peer.

Is IPsec faster than OpenVPN on OPNsense?

Generally, yes. IPsec runs closer to the kernel level and often leverages hardware cryptographic acceleration (AES-NI) built into modern CPUs, resulting in higher throughput and lower CPU overhead than user-space VPN alternatives.