Skip to Content

How to Setup IPsec Site to Site VPN in pfSense with Multiple Subnets?

How to Setup IPsec Site to Site VPN in pfSense with Multiple Subnets?

We have set up IPsec in one of our previous articles, and some readers reached out to me and said, yes the tunnel came up and I can initiate communication towards the other side, but what if I have multiple subnets how do I enable the communication to both sides?

So, in this blog article we are going to setup an IPsec vpn tunnel between two pfsense firewalls, and in the headquarters pfsense firewall has 2 subnets and the branch network also has 3. 

So after we build the tunnel both sides will be able to talk to each on multiple subnets without any issue.

Below is the topology that we are going to build.

We have headquarters with pfsense that has the subnet of,and172.1.0.0/16. And the remote branch has the subnet of and 

At the moment, all the devices on both sides can go out to the internet. However both sides cannot talk to each other.

After we will set up an IPsec tunnel, we should be able to initiate communication with each side’s local networks

For testing, in each subnet, I have a host machine with the last octet of 50, for example for the subnet I have a host with the ip, and we would be testing from those hosts.

Setup IPsec phase1 on the pfsense on Headquarter.

We are going to start he pfsense IPsec configuration with phase1 and in phase2 we will start adding the multiple subnets.

Login to pfsense VPN-> IPsec

Click on Add P1 to add Ipsec phase1 parameters.

You will be taken to the Ipsec configuration wizard in Pfsense.

Under Tunnels, fill in the following fields.

General information:

Description: Pfsense IPsec tunnel with multiple subnets.

IKE Endpoint configuration:
Key Exchange version: IKEv2
Interface: WAN
Remote Gateway: Enter the public IP address of the remote gateway.

Phase1 proposal – pre-shared key.

Authentication method: Choose Mutual PSK.
Pre-Shared key: I have generated pre-shared key within pfsense, copy the pre-shared key and keep it in a secure location, as we would require this to be copied on the remote branches.

Phase1 proposal (Encryption Algorithm)

Encryption Algorithm: 
Key Lenghth: 256bits
Hash: SHA256
DH Group: 14(2048bit)

Leave everything else default and click on Save

Add Pfsense Ipsec multiple subnets.

In our scenario, we are going to add 2 local subnets to be able to talk to 2 remote subnets, so we would end up creating 4 phase2 parameters. Lets create a table with local and remote subnets and start configuration from there.

Add the first subnet in phase2.

At the moment, you will now see the pfsense IPsec phase1 parameters defined, just below that, you could find Show phase2 entries, just click on that.

Click on Add P2 to add phase2 parameters.

We are going to add the first subnet and then we will add the rest of the subnets. 

So our first requirement is that should be able to talk to both and secondly to remote subnets.

Which means we need to add two phase2 parameters for the local subnet

In the tunnel tab, configure the following parameters.

General Information.

Description: Add the name of the first local subnet for eg: Subnet_10.1.1.0_24


Local Network: Choose LAN Subnet, because configured on the LAN interface with the IP
Remote network:

Phase2 Proposal

Protocol: ESP
Encryption Algorithm: AES 256
Hash Algorithm: SHA256
PFS Key group: 14

Leave everything else default and then click on save and apply changes.

You can now see, only the first subnet has been added that can talk to the remote subnet lets go ahead and add the second remote subnet.

Add the second remote subnet.

We added the first local and remote subnet, next we want the local subnet be able to talk to the network.

Clone the Phase2 parameters.

On the same Ipsec screen, click on the copy icon to clone from the existing ipsec phase2 configuration, this will copy the entire phase2 configuration.

You will see the same configuration screen as before.

Description: Change to some meaningful description for eg: Subnet

Local Network: Leave the same lan subnet, because this time we want the to be able to talk to the network.

Remote network: 
Type: Network.

Leave everything else default and click on Save.

Add the second Local subnet to phase2.

We have completed the primary LAN to be able to talk to both the remote subnets( and

Lets now focus on the second LAN network which is

Click on the clone again by clicking on the copy icon in phase2 of the first subnet.


General information: Change the description according to the phase2 of the tunnel.

Local network: This time change it to Network and Address:
Remote network: Leave the default which is

Clone the second phase2 parameters as well.

This time change the description of the tunnel.

Local network to the second local network.

Remote network : leave the default to

As you can see, we have completed the local branch configuration, and we have a total of 4 phase2 tunnel that consist of multiple subnets as planned.

Configure the headquarter Security policy.

We defined the phase2 parameters that can talk to the remote sites, however when the remote sites try to talk to the local site, the pfsense firewall will block the connection so we required to allow the connection that are coming from both and networks.

When you define the security policy you need to add multiple subnets into the same policy, for that we have to create something called alias which is nothing but address group.

Add the subnet Address alias.

Click on Firewall-> Alias

You can already see, I have an alias called ALL_LAN, where I have captured all the LAN networks that I have.

Click on Add to alias. 

Name: IPsec remote multiple subnet.
Description: Branch1 subnets
Type: Networks.

Network or FQDN: add and network and click on Save.

Configure the policies.

Goto firewall-> Rules.

Click on Ipsec tab-> Add rules.

Action: Pass
Protocol: Any
Source: Choose a single host or alias from the drop down and choose the remote alias we just created.
Destination: Single host or alias, choose the All_LAN alias that we had defined earlier.
Log: Check the log packets that are handled by the rule and click con Save and apply the changes.

Lets move on to the branch site configuration.

Configure the Ipsec on the remote branch.

We have just completed phase1 of the ipsec configuration, added multiple subnet using the phase2 configuration, we finished the configuration by allowing the remote subnet with the security policy in the headquarters pfsense firewall. Let’s now move on to the branch1 site.

Configure the remote site ipsec phase 1 in pfsense.

Login to the pfsense firewall, and goto VPN-> IPsec

Add P1.

In the phase1 of the configuration.

General information.

Description: Connection to headquarters.

IKE Endpoint Configuration:
Key exchange version: IKEv2
Interface: WAN
Remote Gateway: enter the public IP address of the headquarters firewall.

Phase1 proposal(Authentication)

Authentication method: mutual psk.
Pre-shared key: paste the key that we saved from the headquarters firewall.

Phase1 proposal (Encryption Algorithm);

This should be the same as the headquarters firewall.

Encryption Algorithm

Algorithm: AES

Key length: 256bits

Hash: SHa256

DH Group: 14

Leave everything else default and click on Save.

You will see that phase1 of the IPsec configuration is now complete.

Add Phase2 configuration for multiple subnets.

Like before we have to create 4 phase2 parameters as well.

Click on Add P2 to add the phase2 parameters.

General information:

Description: Enter a meaningful name.

Local network: LAN subnet.
Remote network: Type: network.

Encryption algorithm: Choose the same as the previous tunnel.
Aes 256
Hash Algorithm: SHA256
PFS key group: 14

Click on Save.

Add the secondary subnet in phase2.

You can now see the phase2 of the tunnel now added underneath phase1,  click on the copy button next to the phase2 configuration to add the second subnet to enable the communication.

When you click on the copy icon, it will create the exact clone of the previous policy. Change according to the new subnet.

General information:
Description: Enter the description.
Local network: Change the local network, to Network and the subnet address to

Remote network: this one will remain the same.

Leave everything else default and scroll down and click on save.

You can see the new subnets are added under phase2, let add the phase2 parameters  from to and

In the first policy click on the copy icon.

General information: 
Description; change the description according to the new subnet.

Local network: leave it default as the previous policy.
Remote network: choose network and address

Leave everything default and click on save.

You will see the 3rd phase2 parameters are now added. Lets now add the final one which is to allow the communication between to

Click copy on the second phase2 parameters, this will create the clone of the second policy with the same parameters.

General information:

Description: change the description according to the new subnet.
Local network: Leave the local network to the same.
Remote network: change the remote network from to

Scroll down and click on Save.

You can now see the IPsec phase2 configuration with multiple subnets.

Configure the security policy.

We enabled the tunnel, however when the traffic coming from the remote side by default will be blocked by the firewall, we need to allow the traffic using the security policy.

As we have to allow multiple subnets in the policy, like we did before, we  are going to add an alias.

Add subnet alias.

Click on Firewall-> Alias

You already can see the LAN alias, which consists of both my LAN networks. Click on Add to add new Alias.

Name: Enter the name of the IPsec phase2 tunnel.
Type: Choose networks.

Add the remote networks as the network. and click on save.

Configure the policy.

We added the alias for the policy, lets now go ahead and add the policy that would enable the communication from the headquarters to the branch network.

Goto firewall -> rule.
Choose IPsec tab from the top
Click on Add to  add new rule.

In the action choose pass.
Address family: IPv4 as we dont run Ipv6 in our network.
Protocol: Any
Source: single host or alias, in this choose the alias that we defined.
Destination: same way choose the single host or alias and choose the alias that we defined, check the option that says Log packets that are handled by this rule and click on save.

Check the IPsec status

We have set up the IPsec on pfsense with multiple subnets in the phase2, and we also configured the policy to allow the traffic from each other. Let’s now verify the IPsec tunnel status on each device and we would also test the traffic from each remote linux machines.

To test the pfsense Ipsec tunnel status, you could go to status-> Ipsec

Here you will be able to see the status of both Ipsec phase1 and phase2 tunnels. As you can see both the tunnels are established states, and if you look closely, you will see multiple subnets with both local having 2 subnets and so does the remote.

Headquarters ipsec status

Branch IPsec status.

Test the connectivity front the headquarters to the remote branch

We know that the ipsec connectivity looks good, let’s now connect to the machine that is connected to the headquarters LAN side and see if you are able to communicate with the remote branch.

I have logged into the first PC which has the IP address, and when I tried to ping both the remote PCs (, we are getting response, 

I also logged into the second PC ( ) in the headquarters and I tried to ping and and I was getting responses to that as well.

which indicates the connection from the headquarters to the branch network is working as expected..

Test the connectivity from the branch site.

Similarly you could login to a device in the branch side, as you can see I have logged into PC, and I was able to ping the headquarters IPs and and the communication was successful

Tried the same thing on the second PC in the branch site, and the communication to and was successful as well.


Monday 4th of December 2023

Thanks Man ! you hit my problem & Solved it ! God Bless You !