OPNsense IPsec delivers a powerful, open source VPN solution for teams that need secure site to site and remote access tunnels without licensing costs. This guide walks through practical deployment scenarios, configuration details, and performance considerations on modern networks.
As a turnkey alternative to commercial firewalls, OPNsense combines an intuitive interface with strong upstream integrations, making IPsec setup approachable for both small offices and distributed enterprises.
| Feature | Description | Impact | Typical Use Case |
|---|---|---|---|
| Site to Site Tunnel | Encrypts traffic between two fixed locations | Secure interoffice links, centralized resources | Branch office to headquarters |
| Remote Access | Individual clients connect securely | Mobile workforce protection | Teleworkers, field engineers |
| IKEv2 with MOBIKE | Fast rekeying and roaming support | Stable VPN on roaming devices | Laptops moving between networks |
| ESP Transform Sets | Define encryption, integrity, and DH groups | Balance security and performance | AES-GCM, SHA2, PFS groups |
Planning Your IPsec Deployment on OPNsense
Effective IPsec planning starts with clear objectives for connectivity, authentication, and traffic segmentation. You should decide whether you need site to site tunnels, remote user access, or a mix of both before selecting cryptographic settings.
Document the local and remote subnets, decide on proposal combinations for redundancy, and verify reachable UDP ports 500 and 4500 across NAT devices. A well defined plan prevents rework when you add new offices or mobile clients later.
Consider high availability options early, because OPNsense supports redundant gateways and state synchronization. Choosing between aggressive and main mode, as well as lifetime values, will impact renegotiation frequency and firewall load over time.
IPsec Proposal and Negotiation Details
OPNsense lets you control phase 1 and phase 2 parameters down to the proposal level, giving you fine grained security and compatibility control. You can select modern algorithms like AES256 GCM, SHA384, and Curve25519 DH groups while still supporting legacy endpoints when necessary.
Use proposal entries to define lifetime in seconds or kilobytes, enable or disable replay detection, and enforce perfect forward secrecy. Matching proposals across peers is essential for successful tunnel establishment and stable throughput.
For heterogeneous environments, create multiple proposal entries so that OPNsense can negotiate the strongest set supported by both sides. Testing with different traffic patterns helps confirm that your chosen settings deliver the required throughput and latency behavior.
Configuring IPsec Tunnels and Virtual IPs
The tunnel configuration page in OPNsense guides you through associating gateways, proposals, and authentication methods. You can bind interfaces, define remote gateways as static or dynamic, and set policy generation options to control which traffic triggers the tunnel.
Virtual IPs are useful when the remote endpoint uses a dynamic public address or when multiple peers connect to a single public IP. By assigning a VIP to the external interface, OPNsense can present a consistent address for inbound policy references and simplify rule management.
Advanced settings such as split include and exclude policies, disable encap, and anti replay protections allow you to tailor behavior for specialized topologies. Carefully validate these options with your peer device to avoid negotiation failures or dropped packets.
Monitoring, Diagnostics, and Performance Tuning
OPNsense provides live status views, traffic graphs, and detailed logs for each IPsec SA, making it straightforward to spot negotiation errors or performance bottlenecks. You can inspect packet counters, verify proposal matches, and troubleshoot phase failures without resorting to CLI commands.
Performance tuning may involve adjusting hardware acceleration, offloading crypto to NICs, and tuning fragment or mtu settings for paths with restrictive devices. When latency sensitive applications traverse the tunnel, prioritize low latency proposals and test under load to confirm that jitter and throughput remain within acceptable ranges.
Regularly review lifetime thresholds and enable rekey policies that align with your risk profile. Automated backups of your IPsec configuration protect you from misconfigurations and make recovery after hardware changes predictable and fast.
Recommended IPsec Practices for OPNsense
- Document local and remote subnets, NAT policies, and gateway addresses before configuration.
- Prefer IKEv2 with EAP certificates or strong PSKs and enable MOBIKE for mobile clients.
- Use strong proposals such as AES256 GCM or ChaCha20 with SHA384 and PFS groups.
- Leverage Virtual IPs for dynamic remote endpoints and consistent policy references.
- Monitor SA status, packet counters, and logs regularly, and automate configuration backups.
FAQ
Reader questions
How do I choose between IKEv1 and IKEv2 for OPNsense IPsec setups?
IKEv2 is generally recommended for new deployments because of better roaming support, faster rekeying with MOBIKE, and stronger cryptographic defaults. Use IKEv1 only when connecting to legacy devices that do not support IKEv2.
What should I do if IPsec tunnels keep dropping behind a NAT device?
Enable NAT traversal in OPNsense and confirm that UDP 4500 is forwarded to the firewall. Set NAT keepalives on both peers, use main mode with XAuth for legacy clients, and verify that rekey intervals are aligned to avoid silent drops.
Can I use certificates only, or do I need a pre shared key too?
You can rely solely on certificates for authentication, which is more scalable and secure than PSKs for larger environments. For simple point to point links, a PSK may be acceptable, but certificates are strongly recommended for multi peer setups.
How can I verify that my IPsec traffic is correctly segmented across VLANs?
Assign separate IPsec interfaces and virtual IPs per VLAN, then build firewall rules that reference the VIPs and tunnel network aliases. Monitor traffic counters and run end to end connectivity tests to confirm that each VLAN’s traffic stays isolated as intended.