Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfSense-IPcop VPN

    Scheduled Pinned Locked Moved
    IPsec
    4
    8
    12.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      ryanpatel
      last edited by

      Has anyone been able to successfully create a pfSense to IPCop VPN?  My colleague and I have been trying for a few days to get an IPSec VPN established from a pfSense to IPcop as well as a pfSense to pfSense.  Any help, documentation, or advice would be greatly appreciated.

      Ryan
      Cowboyz R #1

      1 Reply Last reply Reply Quote 0
      • H
        hoba
        last edited by

        You might want to watch one of the tutorials showing how to configure 2 pfsense systems (one with dynamic IP, one with static IP): http://pfsense.com/index.php?id=36
        It shows some kind of special configuration but it might get you started (configuring tunnels from static IP to static IP are even easier to set up). I know that IPSEC between pfSense systems works great but I can't say anything about connections to IPCOP.

        1 Reply Last reply Reply Quote 0
        • O
          omarf
          last edited by

          I managed to do that with Preshared Key.
          I found a problem with NATTED Pfsense (THE PROBLEM IS ON IPCOP).
          If your PfSense is behind a router with Red interface having a private address, you have to do the following on IpCop machine:

          manually add to /var/ipcop/vpn/ipsec.conf 'rightid=RemotePrivateIp' (and/or 'leftid=LocalPrivateIp' if private)
          and consequently change /var/ipcop/vpn/ipsec.secrets
          and add a new line to /var/ipcop/vpn/config in order to see the connection detail/status on web page.
          No way to do that trhu web interface (bear in mind that if you change again the configuration thru web interface your manual setting will be deleted). On Pfsense just tell to show the machine with IpAddress.

          Hope this can help.
          Omar

          1 Reply Last reply Reply Quote 0
          • H
            hoba
            last edited by

            There is another solution to this problem that can be made on the pfSense side of the connection without hacking conf files (isn't a good webGui nicer to use?  ;) ) . Change the identifier of the pfSense from "my ip adress" to the public IP-Adress of the Router in front of pfSense which does the forwarding. This way the other end will not see the private IP but the public IP and the packets will find their way  ;D

            1 Reply Last reply Reply Quote 0
            • I
              Inca
              last edited by

              Hello everyone, this is my first post here, so please be gentle  :)

              I've been struggeling with pfsense <-> ipcop vpn, but I found the answer in the m0n0wall mailing lists:

              Hi,

              This can be done with the following settings:

              Phase 1 proposal (Authentication)

              Negotiation mode : Main
              Encryption algorithm : 3DES
              Hash algorithm : MD5
              DH key group : 2

              Phase 2 proposal (SA/Key Exchange)

              Encryption algorithms : 3DES
              Hash algorithms :  MD5
              PFS key group : 2

              I think the rest of the settings will speak for themself. sometimes you have
              to ping to open the vpn link.

              Richard Trip

              Thanks to the original poster!

              This has been working since pfsense version 0.53!!!

              1 Reply Last reply Reply Quote 0
              • H
                hoba
                last edited by

                We are all gentle here  ;D
                The original problem was IPSEC with one box behind a NAT and identifier trouble. We have different 2 solutions for that (one modifying a conf of IPCOP, one modifying the identifier of the pfSense). But thanks for posting the answer. I think we should start an IPSEC-compatibility thread where people can report ONLY CONFIRMED WORKING configurations and maybe with information how to get it going. Maybe you want to start it with some details? The posts to this thread should hold info about corresponding settings as some IPSEC implementations use different terms to name things.

                1 Reply Last reply Reply Quote 0
                • R
                  ryanpatel
                  last edited by

                  Inca,

                  Thanks!  I tried it exactly the way you stated and I was able to get the pfSense<–>IPcop VPN online.  I would get some screenshots and post them somewhere if someone would tell me where?

                  1 Reply Last reply Reply Quote 0
                  • H
                    hoba
                    last edited by

                    It would be appreciated if you record a tutorial for our tutorials section. It's nearly the same like shooting screenshots with wink but you add some descriptions on top of it instead placing them between the shots in the text. You find examples and info about wink at our tutorials section: http://pfsense.com/index.php?id=36

                    1 Reply Last reply Reply Quote 0
                    • First post
                      Last post