> For the complete documentation index, see [llms.txt](https://docs.greennode.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.greennode.ai/vnetwork/vpn-virtual-private-network-site-to-site/demo-site-to-site-vpn.md).

# Demo Site-to-Site VPN

Below is a demonstration of how to connect two LAN networks via the internet secured by a VPN connection (two VPNs at 2 sites)

* Site A: VPC 10.1.0.0/16 with VPN server using PFsense of GreenNode Market Place.
* Site B: VPC 10.200.0.0/16 with VPN server using GreenNode VPN Site-To-Site Service

<figure><img src="/files/KgSbN1oY2BIBR1oyfibl" alt=""><figcaption><p>Demostration</p></figcaption></figure>

## 1. Create a Remote Site VPN (using PFsense)

### a. Create PFsense server

* Access link <https://marketplace.console.greennode.ai/overview>
* Click Launch
* Choose Flavor (example 2x4)
* Network Settings: External Interface Priority = 1

<figure><img src="/files/JwKMaXRfVtaFDQB3gCdi" alt=""><figcaption><p>vMarket Placer - pfSense</p></figcaption></figure>

<figure><img src="/files/nazVy5UPXiZy9sfN1pFg" alt=""><figcaption><p>Request Pfsense - Config Network</p></figcaption></figure>

<figure><img src="/files/LbrChHfoyhdKcPQQ1RuI" alt=""><figcaption><p>Request Pfsense - Config Network</p></figcaption></figure>

### b. Access PFsense Dashboard

* Go to vServer page
* Show detail Created Server and open new Url with IP Public https\://\<FixedIp>.
* Login with default user admin/pfsense

<figure><img src="/files/W9DJ2C92N62vW4yAq2RS" alt=""><figcaption><p>Server List</p></figcaption></figure>

<figure><img src="/files/dj0gbvY2jAANs06TvxpI" alt=""><figcaption><p>Server Detail</p></figcaption></figure>

<figure><img src="/files/OUXeZ4n2jNVeyoUJrq9c" alt=""><figcaption><p>pfSense Admin Dashboard</p></figcaption></figure>

<figure><img src="/files/ryP0yVdm7klT113LrLY7" alt=""><figcaption><p>pfSense Welcome Page</p></figcaption></figure>

<figure><img src="/files/DRw7w1gEDq1E8QosSsZ3" alt=""><figcaption><p>pfSense Dashboard - DNS config</p></figcaption></figure>

<figure><img src="/files/OPBnEURpRjdmuS1pcdv7" alt=""><figcaption><p>pfSense Dashboard - Timezone config</p></figcaption></figure>

<figure><img src="/files/qKJeWlClxz0rjusayBZE" alt=""><figcaption><p>pfSense Dashboard - WAN config - Keep default</p></figcaption></figure>

<figure><img src="/files/OGjPTRKVqfuqAr1QCoSj" alt=""><figcaption><p>pfSense Dashboard - Update Password</p></figcaption></figure>

### c. Config pfsense Network

* Allow port 443 [**https://61.28.239.244/firewall\_rules.php?if=wan**](https://61.28.239.244/firewall_rules.php?if=wan)

<figure><img src="/files/umtlnpKRLWBxcEXz1eg9" alt=""><figcaption><p>pfSense Firewall Rule - Allow 443</p></figcaption></figure>

<figure><img src="/files/uO3qrRl3WU6bj7vIIm2D" alt=""><figcaption><p>pfSense Firewall Rule - Allow UDP any</p></figcaption></figure>

<figure><img src="/files/XgfOK83iZElrDiJFk96o" alt=""><figcaption><p>pfSense Firewall Rule - Allow UDP any</p></figcaption></figure>

<figure><img src="/files/CkUdlRhMzlVySu89KitC" alt=""><figcaption><p>pfSense Firewall Rule - Result</p></figcaption></figure>

<figure><img src="/files/bXYOl8HjWKmQ8zDR3ua5" alt=""><figcaption></figcaption></figure>

**-** Access to Assign Interface LAN 10.1.0.0/24. [**https://61.28.239.244/interfaces\_assign.php**](https://61.28.239.244/interfaces_assign.php)

<figure><img src="/files/DUvo2GnKUa2ae88Znm3y" alt=""><figcaption><p>pfSense Interface Assignments - Add LAN Interface</p></figcaption></figure>

<figure><img src="/files/yJcOTmwqdD2VhBW23HlH" alt=""><figcaption><p>pfSense Interface Assignments - Result</p></figcaption></figure>

\- Enable LAN Interface <https://61.28.239.244/interfaces.php?if=lan>

<figure><img src="/files/pXWIARLs4KKeRbUzXd9Z" alt=""><figcaption><p>pfSense Interface Lan - Enable Use of LAN</p></figcaption></figure>

<figure><img src="/files/hnfgpUgrzf6kbhlArmXH" alt=""><figcaption><p>pfSense Interface Lan - Result</p></figcaption></figure>

**-** Access **https\://\<FixedIp>/firewall\_rules.php** to config firewall rule for LAN

<figure><img src="/files/POuxjzTnF0qnB3FhSmmF" alt=""><figcaption><p>pfSense Firewall Lan</p></figcaption></figure>

**-** Access **https\://\<FixedIp>/firewall\_rules.php** to config firewall rule

<figure><img src="/files/JsrDAMuBS2XHw5jIC6Kh" alt=""><figcaption><p>pfSense Firewall IPSec</p></figcaption></figure>

## 2. Create a Local Site VPN (using GreenNode VPN)

### a. Create VPN

<figure><img src="/files/rruZVYDkWjwu83IKGbs9" alt=""><figcaption><p>GreenNode VPN creates</p></figcaption></figure>

### b. Detail VPN

<figure><img src="/files/qI1iy2GwyywFGgzP6c2C" alt=""><figcaption><p>GreenNode VPN - Detail</p></figcaption></figure>

## 3. Config pfSense VPN IPSec

### a. Config IPSec Phase 1

* Access IPSec Dashboard *https\://\<FixedIp>/vpn\_ipsec.php*. ***Figure 3 IPSec Dashboard***
* Click “Add P1” to config Phase 1
* Fill your information
  * Key Exchange version: IKEv2
  * Protocol IPv4
  * Interface WAN
  * Remote gateway: Input \<FixedIp>
  * Pre-shared Key: Input your random preshare (anything you want) -> this key will use to input on VNG’s VPN (**Important!**)
  * Encryption Algorithm
* Method AES256 CGM, Key length 128, Hash 256, DH Group 3072 (**Important**!)
  * Life Time: 4 hours = 144000 (**Important!**)
* **Save**

<figure><img src="/files/wAuWEgiQ4NEoXIwOvmpT" alt=""><figcaption><p>Figure 4 IPSec Dashboard</p></figcaption></figure>

<figure><img src="/files/LGDoh1OyaYAshJMf6s95" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/sTvZOZxUbxlzbe4ZkUzy" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/1liyugoZuMz1qONIxrhb" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/BajN0bhItgo7O7g3oc9s" alt=""><figcaption></figcaption></figure>

### b. Config IPSec Phase 2

* Click Add “Phase2”
* Local Network: LAN Subnet
* Remote Network: VPC GreenNode (you selected in create VPN flow) 10.200.0.0/16
* Encryption Algorithms: AES256 (**Important!**)
* Hash SHA 256 (**Important!**)
* LifeTime 16h = 57600 (**Important!**)
* SAVE
* Apply Changes

<figure><img src="/files/Jw5Ujm63UwjyTTqA9XPV" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/j2QeM9OhREJGRMzItDbV" alt=""><figcaption></figcaption></figure>

<div data-full-width="true"><figure><img src="/files/hCaqC8khaR9vEBFW9LIu" alt=""><figcaption></figcaption></figure></div>

### f. Check Status IPSec

* Access IPSec Status link https\://\<FixedIP>/status\_ipsec.php
* Click **Connect P1 and P2s**

<figure><img src="/files/j3bopW0VZGxbAFif5L6y" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/zOdjj9kICYLupdkGGOoc" alt=""><figcaption></figcaption></figure>

## 4. Add route on Local Site

* Access VPN Detail and copy Local Private Gateway
* Access vServer Router Tables to config routing for VPN
  * Destination: Remote Private CIDR (10.1.0.0)
  * Target: Local Private Gateway (10.200.3.3)

<figure><img src="/files/zenInOfRHDVhu3kIlxry" alt=""><figcaption><p>VPN Detail - Page</p></figcaption></figure>

<figure><img src="/files/Wu2rEHHs8cDfWTopftKO" alt=""><figcaption><p>Update Route Table</p></figcaption></figure>

## 5. Add route on Remote Site

<figure><img src="/files/KEOWux73Naei0lQBXbir" alt=""><figcaption></figcaption></figure>

## 6. Testing Ping Between 2 Client VM

<figure><img src="/files/4FZtdlpSeUKfDmiIRn17" alt=""><figcaption></figcaption></figure>