IPsec IKEv2 Mobile VPN in pfSense - Remote Access Setup

IKEv2 (Internet Key Exchange version 2) is the most practical protocol for providing mobile users with VPN access to a corporate network through pfSense. The key advantage of IKEv2 over other remote access protocols is native support in all modern operating systems: Windows 10/11, macOS, iOS, and Android. Users do not need to install third-party VPN clients - connections are established using built-in operating system capabilities.

This guide covers the complete lifecycle of an IPsec IKEv2 configuration for mobile clients in pfSense: from certificate creation through client device setup. The material is intended for administrators familiar with the pfSense web interface and basic PKI concepts.

Advantages of IKEv2 for Remote Access

Before selecting a remote access protocol, it is worth evaluating the advantages of IKEv2 compared to the alternatives.

MOBIKE (IKEv2 Mobility and Multihoming Protocol, RFC 4555) allows a VPN connection to persist when the network interface changes - for example, when switching from Wi-Fi to a cellular network. For mobile users, this is a critically important feature.

Certificate Preparation

IKEv2 for mobile clients requires a public key infrastructure (PKI). Three types of certificates must be created: a root Certificate Authority (CA) certificate, a server certificate, and user certificates (when using certificate-based authentication).

Creating the Certificate Authority (CA)

Navigate to System > Cert. Manager > CAs and click Add.

Click Save. The root CA certificate will be used to sign the server and user certificates.

Creating the Server Certificate

Navigate to System > Cert. Manager > Certificates and click Add/Sign.

Warning:

The Alternative Names field must include a SAN (Subject Alternative Name) of type FQDN or IP Address matching the address clients connect to. Without a SAN, Windows and iOS clients will refuse to connect. If using an IP address, add a SAN of type IP Address; if using a domain name, add a SAN of type FQDN.

Warning:

Apple devices (macOS, iOS) reject server certificates with a Lifetime exceeding 825 days. Exceeding this value will result in a certificate validation error during connection.

Creating User Certificates

User certificates are only required when using certificate-based authentication. When using EAP-MSCHAPv2 (username/password authentication), this step can be skipped.

For each user, navigate to System > Cert. Manager > Certificates and click Add/Sign.

To export a user certificate in PKCS#12 (.p12) format, navigate to System > Cert. Manager > Certificates, locate the desired certificate, and click the PKCS#12 export icon. This file contains the certificate and private key, protected by a password.

Mobile Client Configuration

Mobile client settings are configured under VPN > IPsec > Mobile Clients.

Mobile Clients Tab

Virtual Address Pool

The pool subnet must not overlap with existing local subnets.

DNS Servers

Click Save. pfSense will prompt you to create Phase 1 - click the link to proceed to configuration.

Phase 1 Configuration

Phase 1 for mobile clients is configured under VPN > IPsec > Tunnels. After saving the Mobile Clients settings, pfSense automatically creates a Phase 1 entry with the mobile type.

Fig. 1. Phase 1 configuration for mobile clients

General Information

Phase 1 Proposal - Authentication

When using certificate-based authentication instead of EAP-MSCHAPv2, select Authentication Method: Mutual RSA and specify the appropriate CA for validating client certificates.

Warning:

When using EAP-MSCHAPv2, users must be created in System > User Manager with passwords. These credentials are used to authenticate VPN connections.

Phase 1 Proposal - Encryption Algorithm

For compatibility with a broader range of clients, additional Encryption Algorithms may be added. Recommended set:

Expiration and Replacement

Advanced Options

Warning:

MOBIKE must be enabled for mobile clients. Without MOBIKE, the VPN connection drops when switching networks (for example, when moving from Wi-Fi to LTE).

Phase 2 Configuration

After saving Phase 1, a Phase 2 entry must be created. Click Show Phase 2 Entries, then Add P2.

Fig. 2. Phase 2 configuration for mobile clients

General Information

When access to multiple subnets (LAN, DMZ, server network) is required, create a separate Phase 2 entry for each subnet.

Phase 2 Proposal

Expiration and Replacement

Firewall Rules

Two sets of firewall rules are required for IKEv2 VPN to function: on the WAN tab and the IPsec tab.

WAN Interface Rules

Inbound traffic for establishing IKE connections must be permitted on the WAN interface.

pfSense automatically creates rules for IKE traffic when IPsec tunnels are configured. However, when using floating rules or a non-standard firewall configuration, these rules may need to be added explicitly.

IPsec Tab Rules

The Firewall > Rules > IPsec tab controls traffic passing through the VPN tunnel. By default, all traffic is blocked.

Minimum rule set:

In production environments, rules should be restricted to specific protocols and ports. For example, allow only DNS (UDP/TCP 53), RDP (TCP 3389), SSH (TCP 22), and HTTPS (TCP 443).

For more details on firewall rules, see pfSense Firewall Rules .

Client Configuration

Windows 10/11

Windows 10 and 11 support IKEv2 through the built-in VPN client. To connect, the CA certificate must be imported and a VPN connection created.

Importing the CA Certificate

1. Export the CA certificate from pfSense: System > Cert. Manager > CAs - click the CA Certificate export icon.
2. Copy the .crt file to the Windows computer.
3. Double-click the .crt file.
4. Click Install Certificate.
5. Select Local Machine and click Next.
6. Select Place all certificates in the following store and click Browse.
7. Select Trusted Root Certification Authorities and click OK.
8. Click Next, then Finish.

Warning:

The CA certificate must be installed in the Trusted Root Certification Authorities store of the computer (Local Machine), not the user (Current User). Otherwise, Windows will be unable to validate the server certificate.

Creating the VPN Connection

1. Open Settings > Network & Internet > VPN.
2. Click Add a VPN connection.
3. Fill in the parameters:

4. Click Save.
5. To connect, click the VPN connection and click Connect.

Strengthening Security on Windows

By default, Windows may use weak encryption algorithms. To enforce strong algorithms, run the following in PowerShell as Administrator:

Set-VpnConnectionIPsecConfiguration -ConnectionName "Office VPN" `
    -AuthenticationTransformConstants GCMAES256 `
    -CipherTransformConstants GCMAES256 `
    -EncryptionMethod AES256 `
    -IntegrityCheckMethod SHA256 `
    -DHGroup Group14 `
    -PfsGroup PFS2048 `
    -Force

macOS

macOS supports IKEv2 through built-in capabilities. Configuration requires importing the CA certificate and creating a network profile.

Importing the CA Certificate

1. Export the CA certificate from pfSense in .crt format.
2. Open the file on macOS - Keychain Access will launch.
3. Add the certificate to the System keychain.
4. Double-click the added certificate.
5. Under Trust, set When using this certificate to Always Trust.
6. Close the window and enter the administrator password to confirm.

Creating the VPN Connection

1. Open System Settings > VPN (macOS 13+) or System Preferences > Network (macOS 12 and earlier).
2. Click Add VPN Configuration > IKEv2.
3. Fill in the parameters:

4. Click Create.
5. To connect, toggle the VPN connection switch.

iOS

iOS supports IKEv2 without installing additional applications.

Installing the CA Certificate Profile

1. Export the CA certificate from pfSense.
2. Transfer the .crt file to the device (via AirDrop, email, or a web server).
3. Open the file on the device - a prompt to install the profile will appear.
4. Navigate to Settings > General > VPN & Device Management.
5. Tap the downloaded profile and tap Install.
6. After installation, navigate to Settings > General > About > Certificate Trust Settings.
7. Enable trust for the installed CA certificate.

Creating the VPN Connection

1. Navigate to Settings > General > VPN & Device Management > VPN.
2. Tap Add VPN Configuration.
3. Fill in the parameters:

4. Tap Done.
5. To connect, toggle the VPN switch in Settings.

Android

Android supports IKEv2 natively starting from version 11 through the built-in VPN client. For earlier versions, the strongSwan VPN Client from Google Play is required.

Android 11 and Later (Built-in Client)

1. Export the CA certificate from pfSense.
2. Navigate to Settings > Security > Encryption & credentials > Install a certificate.
3. Select CA certificate and install the .crt file.
4. Navigate to Settings > Network & Internet > VPN.
5. Tap + to add a new VPN profile.
6. Fill in the parameters:

7. Tap Save.

strongSwan VPN Client (Android 10 and Earlier)

1. Install strongSwan VPN Client from Google Play.
2. Import the CA certificate through the application.
3. Create a new VPN profile:

4. Tap Save and connect.

Split Tunnel vs Full Tunnel

The tunneling mode determines which client traffic passes through the VPN.

Full Tunnel

With full tunneling, all client traffic is routed through the VPN, including internet access. This mode provides maximum protection but increases VPN server and bandwidth load.

To configure Full Tunnel:

1. Under VPN > IPsec > Mobile Clients, uncheck Provide a list of accessible networks to clients.
2. In Phase 2, set Local Network to Network / 0.0.0.0/0.
3. Configure an outbound NAT rule for VPN client traffic: Firewall > NAT > Outbound - add a rule for the 10.10.10.0/24 subnet on the WAN interface.

Warning:

With Full Tunnel, Outbound NAT must be configured for the VPN client subnet. Without it, VPN clients will not have internet access through the tunnel.

Split Tunnel

With split tunneling, only traffic destined for specified networks passes through the VPN. All other traffic (including internet) uses the client’s regular connection.

To configure Split Tunnel:

1. Under VPN > IPsec > Mobile Clients, check Provide a list of accessible networks to clients.
2. In Phase 2, create a separate entry for each protected subnet (for example, 10.1.0.0/24 for LAN, 10.2.0.0/24 for the server network).
3. The subnet list from Phase 2 will be automatically pushed to clients.

DNS Considerations with Split Tunnel

With Split Tunnel, DNS queries may be routed through either the VPN or the local connection. This creates a DNS leak risk - queries for internal domains may be sent through the ISP.

To minimize DNS leakage:

• Push a DNS server to clients through the Mobile Clients settings.
• On Windows: use the NRPT (Name Resolution Policy Table) to route DNS queries for specific domains through the VPN.
• On macOS/iOS: DNS traffic to the specified server is automatically routed through the VPN when routes are correctly configured.

Troubleshooting

Client Cannot Connect

Certificate Errors

EAP Errors

Connected but No Access to Resources

Diagnostic Commands

# View active IKEv2 sessions
ipsec statusall

# View connected mobile clients
ipsec leases

# View IPsec logs in real time
clog -f /var/log/ipsec.log

# Restart IPsec service
ipsec restart

Related Sections

• IPsec Site-to-Site VPN in pfSense - configuring site-to-site tunnels, IPsec terminology, and general configuration principles
• IPsec VPN Troubleshooting in pfSense - systematic IPsec diagnostics, log analysis, and resolving Phase 1/Phase 2 errors
• pfSense Firewall Rules - principles of creating and managing firewall rules for VPN traffic