Pfsense Mikrotik Ipsec Tunnel Setup Guide

Setting up a secure site-to-site connection between a pfSense firewall and a MikroTik RouterOS device requires exact parameter matching across both platforms. Because these two systems use different terminology—pfSense relies on Phase 1 and Phase 2 while MikroTik uses peers, profiles, proposals, and policies—small configuration gaps often break handshakes.

This guide walks you through building a stable, high-performance IPsec tunnel using Internet Key Exchange version 2 (IKEv2). You'll get explicit configuration values, firewall rule adjustments, and troubleshooting steps for common pitfalls like NAT traversal and FastTrack packet loss.

Core Prerequisites and Network Requirements

Before touching any configuration menus, verify that your network environment meets these baseline conditions:

• Public IP Addresses: At least one end must have a static public IP address. If both ends use dynamic IP addresses, you'll need to configure Dynamic DNS (DDNS) and ensure the side behind NAT initiates the connection.
• Non-Overlapping Subnets: The local network behind your pfSense box and the remote network behind your MikroTik router must use distinct subnets (for example, pfSense on 192.168.10.0/24 and MikroTik on 192.168.20.0/24).
• Protocol Consistency: Both sides must agree on encryption algorithms, hash functions, and Diffie-Hellman groups. A mismatch on even a single setting will cause the security association to fail.

Step 1: Configuring Phase 1 on pfSense

Phase 1 establishes the secure, authenticated communication channel between the two firewalls.

1. Log into your pfSense web interface and navigate to VPN > IPsec > Tunnels.
2. Click Add P1 to create a new Phase 1 entry.
3. Configure the general parameters with these settings:
   • Key Exchange Version: IKEv2
   • Internet Protocol: IPv4
   • Interface: WAN
   • Remote Gateway: The public IP address or FQDN of your MikroTik router
4. Under Authentication, select Mutual PSK and generate a strong, random pre-shared key. Copy this key; you'll need it on the MikroTik side.
5. Set the cryptographic algorithms:
   • Encryption Algorithm: AES, Key Length: 256 bits
   • Hash Algorithm: SHA256
   • DH Group: 14 (2048 bit)
6. Save the settings and apply changes.

Step 2: Configuring Phase 1 on MikroTik RouterOS

Next, mirror these security parameters on your MikroTik device using RouterOS.

1. Access your MikroTik router via WinBox or WebFig and navigate to IP > IPsec.
2. Open the Profiles tab, click the plus icon, and create a profile matching your pfSense choices:
   • Name: pfsense-profile
   • Hash Algorithms: sha256
   • Encryption Algorithms: aes-256
   • DH Group: modp2048
3. Go to the Peers tab and add a new peer:
   • Name: pfsense-peer
   • Address: The public IP address of your pfSense firewall
   • Profile: pfsense-profile
   • Exchange Mode: ike2
   • Send Initial Contact: Enabled (crucial if MikroTik is behind NAT)
4. Go to the Identities tab and add a new entry:
   • Peer: pfsense-peer
   • Auth. Method: pre shared key
   • Secret: Paste the exact pre-shared key generated in pfSense

Step 3: Configuring Phase 2 (Child SAs)

Phase 2 defines what traffic is allowed through the encrypted tunnel and how it is protected.

On pfSense:

1. Navigate back to VPN > IPsec > Tunnels, find your Phase 1 entry, and click Show Phase 2 Entries.
2. Click Add P2 and configure the traffic selectors:
   • Mode: Tunnel IPv4
   • Local Network: LAN subnet
   • Remote Network: The local subnet behind your MikroTik router
3. Set Phase 2 proposals:
   • Encryption Algorithms: AES256-GCM or AES256-CBC
   • Hash Algorithms: SHA256
   • PFS Group: 14 (2048 bit)
4. Save and apply.

On MikroTik:

1. Navigate to IP > IPsec > Proposals and edit the default proposal (or create a new one):
   • Auth. Algorithms: sha256
   • Encr. Algorithms: aes-256-cbc (or matching GCM settings)
   • PFS Group: modp2048
2. Go to the Policies tab and add a new policy:
   • Peer: pfsense-peer
   • Tunnel: Checked
   • Src. Address: Your local MikroTik LAN subnet (e.g., 192.168.20.0/24)
   • Dst. Address: Your remote pfSense LAN subnet (e.g., 192.168.10.0/24)
   • Action: encrypt
   • Level: require

Firewall Rules and Common Pitfalls

Once configurations match, you must clear path restrictions on both firewalls.

pfSense Firewall Rules

Go to Firewall > Rules > IPsec and ensure you have a rule allowing traffic from your remote MikroTik subnet to your local resources. If you want a restrictive setup, limit the protocol and destination ports, or use an "Any to Any" rule during initial testing.

MikroTik NAT and FastTrack Bypass

By default, MikroTik's FastTrack feature accelerates packet processing by bypassing the connection tracking system. Unfortunately, this drops IPsec traffic before it hits the policy engine.

To fix this, you must add an accept rule in your NAT configuration above your masquerade rule, or exclude IPsec subnets from FastTrack:

/ip firewall nat add chain=srcnat action=accept dst-address=192.168.10.0/24 src-address=192.168.20.0/24 place-before=0

Replace 192.168.10.0/24 with your pfSense subnet and 192.168.20.0/24 with your MikroTik subnet.

Frequently Asked Questions

Why is Phase 1 failing to establish?

Phase 1 failures usually stem from typos in the pre-shared key, mismatched IKE versions (mixing IKEv1 and IKEv2), or incorrect remote gateway IP addresses. Check your system logs on both devices to see if packets are reaching the public interfaces.

What should I do if the tunnel connects, but I can't ping across it?

If Phase 1 and Phase 2 show as established but traffic won't pass, check your MikroTik FastTrack rules and ensure you haven't hidden the IPsec traffic behind a standard WAN masquerade rule. Also verify that local firewalls on individual end-host machines aren't blocking ICMP requests from foreign subnets.

Can I use this setup with dynamic public IP addresses?

Yes. You can use dynamic DNS hostnames in the remote gateway field on pfSense and the peer address field on MikroTik. However, ensure your routers update their DDNS providers immediately whenever an IP address changes to prevent prolonged downtime.

Do I need to open specific ports on my home router if it's behind an ISP modem?

If either router sits behind a carrier-grade NAT or an ISP-provided gateway, you must enable NAT Traversal (NAT-T) on both devices and forward UDP ports 500 and 4500 to your internal firewall's WAN interface.