Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
Looking to implement a pfSense SG-2440 downstream from the primary router so that we can (road warrior) VPN in.
I know that I'll have to forward ports 500, 50, and 51 to the pfSense device from the upstream router but am unclear on what other configuration changes I'll need to make in creating the VPN tunnel. What other changes will I need to make to the configuration to make this VPN scenario work such that by VPNing in the client will be privy to the upstream router's network?
First you are confusing protocol and ports.
Assuming you want to use IPSEC , you have to allow / forward:
UDP port 500
protocol 50 (ESP)
protocol 51 (AH)
50 and 51 are protocols numbers and not ports
Furthermore if you are using NAT between your upstream router and the pfsense, the connection will use NAT traversal on UDP 4500 as well as UDP 500.
In this case you don't need to forward protocols 50/51 since they will be encapsulated in UDP.
For the question itself, there's nothing special to do on the upstream router, you just have to configure the VPN on the Pfsense. Of course the pfsense must be able to reach the internal network you want to give access to.
