VPN IPSec site-to-site between PfSense and BlockBit

VPN IPSec site-to-site entre PfSense e BlockBit

Cotocs · 2025-07-31T12:06:38+00:00

Estamos tentando fechar uma VPN IpSEC entre um PFsense versão 2.8 e um Blockbit, tanto usando uma chave compartilhada quanto usando certificados RSA o proble...

Cotocs

We are trying to close an IpSEC VPN between a PFsense version 2.8 and a Blockbit, both using a shared key and using RSA certificates the problem is the same.
In the case of pre-shared key for lack of identification by Blockbit authentication fails.
PFSense log:

When we try to use certificates, Blockbit's certificate lacks the SAN that would be Blockbit's ID or IP, I believe PFSense is rejecting for lack of SAN.
Can you create a certificate with the SAN field filled in the blockbit?

Leonardo Souza

Good morning.

How are the Local ID and Remote ID field settings in Blockbit?

And how is the identification configured in the PFSense? By default you use IP for identification, but it can be used fqdn, or a basic string as well. How's that conf at PFSense?

Icaro Rocha

Hello,

Below is a detailed step by step for setting up a VPN IPsec site-to-site between a Blockbit NGFW and a pfSense:

Enable service:

Make the settings in the peer

In the part of “Gateway Remote” we insert the IP Address of the other end in the case put “187.887.80” that would be the NGFW of the Lab in question.

Set your PSK

Configure Phase 1

Configure Phase 2

Phase 2 in pfsense we need to create another configuration as follows by clicking on the tunnel and selecting the “Add P2” button

By clicking on this option we will be directed to other configurations similar to phase 1, but to put the information in phase 2

Network declaration

In Pfsense we declare the networks in phase 2 by clicking on the tunnel and selecting the “Add P2” button

Clicking this option will be directed to other configurations similar to phase 1, but with the extra field “Networks”

How to validate tunnel status