Site-to-site VPN
Connects to routers at other sites through tunnels so the sites' networks can reach each other. The methods are IPsec (IKEv2, IKEv1) and WireGuard.
Each tunnel belongs to a zone. What may pass is decided by Inter-zone forwarding on the firewall page.
Adding an IPsec site
- On SITE-TO-SITE VPN › Site-to-site VPN, enter a site name (starts with a lowercase letter, up to 11 characters), choose IPsec as the type, and press Add site.
- Click the new site in the list to open its details.
- In Remote networks, enter the LAN of the peer site. e.g. 192.168.20.0/24
- In Peer address, enter the IP address or host name of the peer router. e.g. vpn.example.com
- Under Pre-shared key, press Generate, or enter a key of 8 or more characters and press Save. Set the key shown on the peer router as well.
- Match the IDs and proposals to the peer if needed, and press Save.
- On SECURITY › Firewall, under Inter-zone forwarding, set site → lan and lan → site to Accept.
- Use Review changes at the top of the page to apply, then Confirm within 5 minutes (Applying changes).
- When Status in the list shows Connected, you are done.
A new site starts with IKEv2, Always, pre-shared key and Recommended proposals. Local networks is filled with your LAN networks.
On the peer router, set the mirror values (its remote networks = your local networks; the IDs swapped).
Adding a WireGuard site
- Enter a site name, choose WireGuard as the type, and press Add site.
- Click the site to open its details. Local public key is shown; set it on the peer router. The private key stays on the router.
- In Peer public key, enter the peer router's public key (base64).
- If this side connects, enter
host:portin Peer endpoint. e.g. vpn.example.com:51820 - If the peer connects to this side, enter a Listen port.
- Enter Remote networks and press Save.
- As with IPsec, allow inter-zone forwarding, then apply and confirm.
Zones and forwarding
- If the site zone does not exist when you add a site, it is created automatically. The site zone accepts only ping to the router itself and drops everything else.
- A site tunnel cannot be placed in the wan zone.
- For traffic between the peer site and your LAN, allow site → lan (peer to LAN) and lan → site (LAN to peer) under Inter-zone forwarding. You can allow just one direction.
- Routes to the remote networks point into the tunnel automatically. No static routes are needed.
When the WAN uses MAP-E or DS-Lite
- IPsec always uses NAT traversal (wrapped in UDP 4500).
- Over IPv4, incoming IPsec connections from the peer cannot be received (UDP 500 and 4500 cannot be received). Connect from this side (Always), or connect over IPv6.
- The WireGuard Listen port must be inside the port range assigned by MAP-E. Leave it blank if only this side connects.
Status and reconnecting
Status in the list is one of:
| Status | Meaning |
|---|---|
| Connected | Traffic can flow. The time in parentheses is how long it has been up (IPsec) |
| Connecting | A connection is being attempted |
| Not connected | Not connected |
| Not applied | Not applied yet |
| Disabled | Enable is cleared for the site |
- Reconnect re-establishes that site's tunnel.
- An IPsec site set to Always is reconnected automatically every minute while it is down.
- When you change a site and apply, only that site reconnects. Other sites stay connected.
- While connected, the remote ID, the cipher in use, whether NAT traversal is used and the time until the next rekey are shown below the details.
Fields (common)
| Field | Description |
|---|---|
| Display name (optional) | Name shown in the list |
| Site | Clearing Enable stops the tunnel but keeps the settings |
| Zone | Zone for the tunnel. Normally site |
| Remote networks | Networks at the peer site. Traffic to them goes through the tunnel. Separate multiple entries with commas |
| Tunnel address (optional) | An address on the tunnel itself. Not required for traffic; useful for pinging across the tunnel. e.g. 169.254.10.1/30 |
| MTU | Largest packet size inside the tunnel. Defaults to 1400 if blank |
Fields (IPsec)
| Field | Description |
|---|---|
| Local networks | Networks on this side offered to the peer (traffic selectors). Must match the peer's remote networks. Blank means everything (0.0.0.0/0) |
| IKE version | Normally IKEv2. Use IKEv1 only when the peer supports nothing else |
| Peer address | IP address or host name (DDNS is fine) of the peer router. Blank means any, and the tunnel waits for the peer to connect |
| Connection | Always: connect from this side and reconnect when lost. Wait for peer: never initiate. On demand: connect when traffic for the peer appears. With peer address any, only Wait for peer is possible |
| Local ID | The ID presented to the peer. Types: FQDN, IP address, E-mail (user-FQDN), Key-ID. Blank uses this router's address. Use an FQDN etc. on lines whose address changes |
| Remote ID | The ID the peer presents. Required when the peer address is any; it tells which site is connecting |
| Authentication | Pre-shared key: the same key on both routers. Certificate: see below |
| Pre-shared key | 8 or more characters, without " or \. Show displays it |
| Proposals | Recommended: strong algorithms for current devices. Compatible: also accepts SHA-1, MODP1024 and 3DES for old devices. Custom: choose phase 1 and 2 yourself |
| NAT traversal | Auto: wraps in UDP 4500 when NAT is detected. Force: always wraps |
| Dead peer detection | Checks the peer at this interval (seconds); if it stops responding, the tunnel is closed and reconnected. Defaults to 30 seconds if blank |
| Aggressive mode | IKEv1 only. May be needed with IKEv1 and a pre-shared key when the peer address changes. IDs are sent unencrypted, so use it only when needed |
Adding or removing a site that uses aggressive mode with a pre-shared key restarts strongSwan when applied. IPsec connections (IKEv2 and L2TP/IPsec remote access, and other IPsec sites) drop briefly.
Custom proposals
With Custom proposals, you choose Phase 1 (IKE SA) and Phase 2 (IPsec SA) separately.
| Field | Description |
|---|---|
| Encryption | AES-256-GCM, AES-128-GCM, AES-256-CBC, AES-128-CBC, 3DES |
| Integrity | SHA-256, SHA-384, SHA-512, SHA-1. Required with non-GCM encryption |
| DH group (phase 1) | ECP256, ECP384, Curve25519, MODP2048 and others. At least one is required |
| PFS (phase 2) | DH group used to renew keys on each rekey. Also choosing None lets you rekey with peers that do not use PFS |
| Lifetime | Keys are renewed after this time. e.g. 8h. Defaults: phase 1 24h, phase 2 8h |
Certificate authentication
- Set Authentication to Certificate. Local ID is required (it is written in the certificate).
- This router's certificate is issued by its own CA for the Local ID.
- In Peer CA certificate, paste the PEM certificate of the CA that issued the peer's certificate. Blank uses this router's CA (when the peer is also FELIXXRT and uses a certificate from the same CA).
- Download this router's CA with Download CA certificate on SYSTEM › General and give it to the peer.
Fields (WireGuard)
| Field | Description |
|---|---|
| Local public key | Public key to set on the peer router. Created when the site is added |
| Peer public key | The peer router's WireGuard public key (base64) |
| Peer endpoint | Peer address (host names allowed) and port. Blank waits for the peer to connect (a listen port is required) |
| Listen port | UDP port to wait on when the peer connects. Leave blank if only this side connects. The router accepts this port automatically |
| Preshared key (optional) | An extra shared key on top of the public keys (44 base64 characters). If used, set the same key on the peer. Generate creates one |
| Keepalive | When this side connects, traffic is sent at this interval (seconds) to keep NAT mappings alive. Defaults to 25 seconds if blank |
A pre-shared key is stored as soon as you press Save or Generate, but it is used only after you save the site settings and apply.