Looking to implement a pfSense SG-2440 downstream from the primary router so that we can (road warrior) VPN in.

I know that I'll have to forward ports 500, 50, and 51 to the pfSense device from the upstream router but am unclear on what other configuration changes I'll need to make in creating the VPN tunnel. What other changes will I need to make to the configuration to make this VPN scenario work such that by VPNing in the client will be privy to the upstream router's network?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 14, 2017 at 2:13

1 Answer 1


First you are confusing protocol and ports.

Assuming you want to use IPSEC , you have to allow / forward:
UDP port 500
protocol 50 (ESP)
protocol 51 (AH)

50 and 51 are protocols numbers and not ports

Furthermore if you are using NAT between your upstream router and the pfsense, the connection will use NAT traversal on UDP 4500 as well as UDP 500.
In this case you don't need to forward protocols 50/51 since they will be encapsulated in UDP.

For the question itself, there's nothing special to do on the upstream router, you just have to configure the VPN on the Pfsense. Of course the pfsense must be able to reach the internal network you want to give access to.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.