This tutorial includes the steps required to configure IPsec tunnels to connect a pfSense firewall to Cloudflare WAN (formerly Magic WAN).
| Manufacturer | Firmware revision |
|---|---|
| pfSense | 24.03 |
This tutorial requires the following information:
- Anycast IP addresses (Cloudflare provides these)
- External IP addresses
- Internal IP address ranges
- Inside tunnel
/31ranges
This tutorial uses the following IP addresses. These examples replace legally routable IP addresses with IPv4 Address Blocks Reserved for Documentation (RFC 5737 ↗) addresses within the 203.0.113.0/24 subnet.
| Tunnel name | PF_TUNNEL_01 |
PF_TUNNEL_02 |
|---|---|---|
| Interface address | 10.252.2.26/31 |
10.252.2.28/31 |
| Customer endpoint | 203.0.113.254 |
203.0.113.254 |
| Cloudflare endpoint | <YOUR_ANYCAST_IP_ADDRESS_1> |
<YOUR_ANYCAST_IP_ADDRESS_2> |
| pfSense IPsec Phase 2 Local IP | 10.252.2.27 |
10.252.2.29 |
| pfSense IPsec Phase 2 Remote IP | 10.252.2.26 |
10.252.2.28 |
| Cloudflare WAN static routes - Prefix | 10.1.100.0/24 |
10.1.100.0/24 |
| Cloudflare WAN static routes - Next hop | PF_TUNNEL_01 |
PF_TUNNEL_02 |
Use the Cloudflare dashboard or API to configure two IPsec tunnels. This guide uses the settings mentioned below for the IPsec tunnels throughout the remainder.
- Follow the Add tunnels instructions to create the required IPsec tunnels with the following options:
- Tunnel name:
PF_TUNNEL_01 - Interface address:
10.252.2.26/31 - Customer endpoint:
203.0.113.254 - Cloudflare endpoint: Enter one of the anycast IP addresses assigned to your account, available in Leased IPs ↗.
- Health check rate: Medium
- Health check type: Request
- Health check direction: Bidirectional
- Turn on replay protection: Enable
- Tunnel name:
- Select Add pre-shared key later > Add tunnels.
- Repeat the process to create a second IPsec tunnel with the following options:
- Tunnel name:
PF_TUNNEL_02 - Interface address:
10.252.2.28/31
- Tunnel name: