CloudLabBox
Try the free demo

Firewalls and VPNs lab 7 of 16

MikroTik to pfSense IPsec then WireGuard between MikroTiks

Join a MikroTik shop router to a pfSense head office with IKEv2, including the pfSense bogon trap and MikroTik's NAT bypass, then link two MikroTik shops with WireGuard and compare a policy-based IPsec tunnel with a routed WireGuard one.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 2,816 MB in total. That fits the free demo too.

In your workspace: Shared, then Firewalls and VPNs multi-vendor guided labs, then 07 - MikroTik to pfSense IPsec then WireGuard between MikroTiks

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 90 minutes
Nodes need
5 vCPU, 2,816 MB
Smallest plan
Lite

The scenario

Dartmoor Outdoor runs pfSense at head office, because it is open source and the team knows it well, and small MikroTik routers in its shops, because they are cheap and capable. Shop 1 needs the stock system at HQ (10.1.0.0/24). Shop 2 opens next month and only needs to reach shop 1's click-and-collect server, so the shops get a quick WireGuard link between them.

DeviceInterfaceAddressNotes
PF-HQem0 WAN / em1 LAN203.0.113.2/24, gateway 203.0.113.1 / 10.1.0.1/24You set both in Task 1
ADMINeth010.1.0.10/24Gateway 10.1.0.1
ISPether1 / ether2 / ether3203.0.113.1 / 198.51.100.1 / 192.0.2.1 (/24 each)
SHOP1ether1 / lan198.51.100.2/24 / 10.2.0.1/24Masquerade on ether1
SHOP2ether1 / lan192.0.2.2/24 / 10.3.0.1/24Masquerade on ether1
WireGuardSHOP1 / SHOP2 wg-shops10.255.12.1/30 / 10.255.12.2/30UDP 13231
IPsec setting (HQ to shop 1)Value
Phase 1IKEv2, AES-256, SHA-256, DH group 19 (ECP-256), 28,800 s, peers identified by IP address
AuthenticationPre-shared key Dart-VPN-27
Phase 2ESP AES-256 with SHA-256, PFS group 19, 3,600 s, 10.1.0.0/24 to and from 10.2.0.0/24

What you’ll practise

  • Address a factory pfSense from its console and open its web interface from a LAN desktop
  • Build an IKEv2 phase 1 and phase 2 on pfSense and the matching profile, proposal, peer, identity and policy on RouterOS
  • Explain why pfSense's bogon block and RouterOS's masquerade both break a VPN, and fix each
  • Read the tunnel on both ends: Status > IPsec or swanctl --list-sas, /ip ipsec active-peers and installed-sa
  • Build a routed WireGuard tunnel between two RouterOS routers with keys, allowed addresses and routes
  • Compare IPsec's negotiation with WireGuard's fixed cryptography

The tasks

  1. Bring PF-HQ onto the network
  2. IPsec on pfSense
  3. IPsec on SHOP1
  4. Read the tunnel on both ends
  5. WireGuard between the shops

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of MikroTik to pfSense IPsec then WireGuard between MikroTiks5 nodes, 4 links. Every link is listed as text below the diagram.PF-HQADMINISPSHOP1SHOP2e1eth0e0ether1ether2ether1ether3ether1
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • PF-HQ e0 to ISP ether1
  • PF-HQ e1 to ADMIN eth0
  • ISP ether2 to SHOP1 ether1
  • ISP ether3 to SHOP2 ether1
Nodes in MikroTik to pfSense IPsec then WireGuard between MikroTiks, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
PF-HQNetgate pfSense CEpfsense-CE-2.5.2-RELEASE1 vCPU, 1,024 MB
ADMINEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
ISPMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
SHOP1MikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
SHOP2MikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Firewalls and VPNs multi-vendor guided labs.

  3. Open 07 - MikroTik to pfSense IPsec then WireGuard between MikroTiks and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Firewalls and VPNs labs

All Firewalls and VPNs labs

Related labs in other courses

CloudLabBox is independent of Check Point, Cisco, CompTIA, Fortinet, Juniper Networks, MikroTik, Netgate and Palo Alto Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.