# Demo Site-to-Site VPN

Below is a demonstration of how to connect two LAN networks via the internet secured by a VPN connection (two VPNs at 2 sites)

* Site A: VPC 10.1.0.0/16 with VPN server using PFsense of GreenNode Market Place.
* Site B: VPC 10.200.0.0/16 with VPN server using GreenNode VPN Site-To-Site Service

<figure><img src="/files/KgSbN1oY2BIBR1oyfibl" alt=""><figcaption><p>Demostration</p></figcaption></figure>

## 1. Create a Remote Site VPN (using PFsense)

### a. Create PFsense server

* Access link <https://marketplace.console.vngcloud.vn/overview>
* Click Launch
* Choose Flavor (example 2x4)
* Network Settings: External Interface Priority = 1

<figure><img src="/files/JwKMaXRfVtaFDQB3gCdi" alt=""><figcaption><p>vMarket Placer - pfSense</p></figcaption></figure>

<figure><img src="/files/nazVy5UPXiZy9sfN1pFg" alt=""><figcaption><p>Request Pfsense - Config Network</p></figcaption></figure>

<figure><img src="/files/LbrChHfoyhdKcPQQ1RuI" alt=""><figcaption><p>Request Pfsense - Config Network</p></figcaption></figure>

### b. Access PFsense Dashboard

* Go to vServer page
* Show detail Created Server and open new Url with IP Public https\://\<FixedIp>.
* Login with default user admin/pfsense

<figure><img src="/files/W9DJ2C92N62vW4yAq2RS" alt=""><figcaption><p>Server List</p></figcaption></figure>

<figure><img src="/files/dj0gbvY2jAANs06TvxpI" alt=""><figcaption><p>Server Detail</p></figcaption></figure>

<figure><img src="/files/OUXeZ4n2jNVeyoUJrq9c" alt=""><figcaption><p>pfSense Admin Dashboard</p></figcaption></figure>

<figure><img src="/files/ryP0yVdm7klT113LrLY7" alt=""><figcaption><p>pfSense Welcome Page</p></figcaption></figure>

<figure><img src="/files/DRw7w1gEDq1E8QosSsZ3" alt=""><figcaption><p>pfSense Dashboard - DNS config</p></figcaption></figure>

<figure><img src="/files/OPBnEURpRjdmuS1pcdv7" alt=""><figcaption><p>pfSense Dashboard - Timezone config</p></figcaption></figure>

<figure><img src="/files/qKJeWlClxz0rjusayBZE" alt=""><figcaption><p>pfSense Dashboard - WAN config - Keep default</p></figcaption></figure>

<figure><img src="/files/OGjPTRKVqfuqAr1QCoSj" alt=""><figcaption><p>pfSense Dashboard - Update Password</p></figcaption></figure>

### c. Config pfsense Network

* Allow port 443 [**https://61.28.239.244/firewall\_rules.php?if=wan**](https://61.28.239.244/firewall_rules.php?if=wan)

<figure><img src="/files/umtlnpKRLWBxcEXz1eg9" alt=""><figcaption><p>pfSense Firewall Rule - Allow 443</p></figcaption></figure>

<figure><img src="/files/uO3qrRl3WU6bj7vIIm2D" alt=""><figcaption><p>pfSense Firewall Rule - Allow UDP any</p></figcaption></figure>

<figure><img src="/files/XgfOK83iZElrDiJFk96o" alt=""><figcaption><p>pfSense Firewall Rule - Allow UDP any</p></figcaption></figure>

<figure><img src="/files/CkUdlRhMzlVySu89KitC" alt=""><figcaption><p>pfSense Firewall Rule - Result</p></figcaption></figure>

<figure><img src="/files/bXYOl8HjWKmQ8zDR3ua5" alt=""><figcaption></figcaption></figure>

**-** Access to Assign Interface LAN 10.1.0.0/24. [**https://61.28.239.244/interfaces\_assign.php**](https://61.28.239.244/interfaces_assign.php)

<figure><img src="/files/DUvo2GnKUa2ae88Znm3y" alt=""><figcaption><p>pfSense Interface Assignments - Add LAN Interface</p></figcaption></figure>

<figure><img src="/files/yJcOTmwqdD2VhBW23HlH" alt=""><figcaption><p>pfSense Interface Assignments - Result</p></figcaption></figure>

\- Enable LAN Interface <https://61.28.239.244/interfaces.php?if=lan>

<figure><img src="/files/pXWIARLs4KKeRbUzXd9Z" alt=""><figcaption><p>pfSense Interface Lan - Enable Use of LAN</p></figcaption></figure>

<figure><img src="/files/hnfgpUgrzf6kbhlArmXH" alt=""><figcaption><p>pfSense Interface Lan - Result</p></figcaption></figure>

**-** Access **https\://\<FixedIp>/firewall\_rules.php** to config firewall rule for LAN

<figure><img src="/files/POuxjzTnF0qnB3FhSmmF" alt=""><figcaption><p>pfSense Firewall Lan</p></figcaption></figure>

**-** Access **https\://\<FixedIp>/firewall\_rules.php** to config firewall rule

<figure><img src="/files/JsrDAMuBS2XHw5jIC6Kh" alt=""><figcaption><p>pfSense Firewall IPSec</p></figcaption></figure>

## 2. Create a Local Site VPN (using GreenNode VPN)

### a. Create VPN

<figure><img src="/files/rruZVYDkWjwu83IKGbs9" alt=""><figcaption><p>GreenNode VPN creates</p></figcaption></figure>

### b. Detail VPN

<figure><img src="/files/qI1iy2GwyywFGgzP6c2C" alt=""><figcaption><p>GreenNode VPN - Detail</p></figcaption></figure>

## 3. Config pfSense VPN IPSec

### a. Config IPSec Phase 1

* Access IPSec Dashboard *https\://\<FixedIp>/vpn\_ipsec.php*. ***Figure 3 IPSec Dashboard***
* Click “Add P1” to config Phase 1
* Fill your information
  * Key Exchange version: IKEv2
  * Protocol IPv4
  * Interface WAN
  * Remote gateway: Input \<FixedIp>
  * Pre-shared Key: Input your random preshare (anything you want) -> this key will use to input on VNG’s VPN (**Important!**)
  * Encryption Algorithm
* Method AES256 CGM, Key length 128, Hash 256, DH Group 3072 (**Important**!)
  * Life Time: 4 hours = 144000 (**Important!**)
* **Save**

<figure><img src="/files/wAuWEgiQ4NEoXIwOvmpT" alt=""><figcaption><p>Figure 4 IPSec Dashboard</p></figcaption></figure>

<figure><img src="/files/LGDoh1OyaYAshJMf6s95" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/sTvZOZxUbxlzbe4ZkUzy" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/1liyugoZuMz1qONIxrhb" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/BajN0bhItgo7O7g3oc9s" alt=""><figcaption></figcaption></figure>

### b. Config IPSec Phase 2

* Click Add “Phase2”
* Local Network: LAN Subnet
* Remote Network: VPC GreenNode (you selected in create VPN flow) 10.200.0.0/16
* Encryption Algorithms: AES256 (**Important!**)
* Hash SHA 256 (**Important!**)
* LifeTime 16h = 57600 (**Important!**)
* SAVE
* Apply Changes

<figure><img src="/files/Jw5Ujm63UwjyTTqA9XPV" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/j2QeM9OhREJGRMzItDbV" alt=""><figcaption></figcaption></figure>

<div data-full-width="true"><figure><img src="/files/hCaqC8khaR9vEBFW9LIu" alt=""><figcaption></figcaption></figure></div>

### f. Check Status IPSec

* Access IPSec Status link https\://\<FixedIP>/status\_ipsec.php
* Click **Connect P1 and P2s**

<figure><img src="/files/j3bopW0VZGxbAFif5L6y" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/zOdjj9kICYLupdkGGOoc" alt=""><figcaption></figcaption></figure>

## 4. Add route on Local Site

* Access VPN Detail and copy Local Private Gateway
* Access vServer Router Tables to config routing for VPN
  * Destination: Remote Private CIDR (10.1.0.0)
  * Target: Local Private Gateway (10.200.3.3)

<figure><img src="/files/zenInOfRHDVhu3kIlxry" alt=""><figcaption><p>VPN Detail - Page</p></figcaption></figure>

<figure><img src="/files/Wu2rEHHs8cDfWTopftKO" alt=""><figcaption><p>Update Route Table</p></figcaption></figure>

## 5. Add route on Remote Site

<figure><img src="/files/KEOWux73Naei0lQBXbir" alt=""><figcaption></figcaption></figure>

## 6. Testing Ping Between 2 Client VM

<figure><img src="/files/4FZtdlpSeUKfDmiIRn17" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.vngcloud.vn/vng-cloud-document/vnetwork/vpn-virtual-private-network-site-to-site/demo-site-to-site-vpn.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.