Site-to-site tunnels (OpenVPN and IPsec)
A site-to-site tunnel joins two networks over the internet as if they were one. Use OpenVPN Site-to-Site when both ends are Nexwall units, or when you want a simple setup. Use IPsec Site-to-Site for interoperability with the wide range of devices that support IPsec.
OpenVPN site-to-site
One unit is the server and the other is the client.
On the server
- Open VPN > OpenVPN Site-to-Site and create a tunnel server.
- Set the public endpoints (addresses or names the client will use to reach the server), the local networks (networks that must be reachable from the other end) and the remote networks (networks behind the other end). The remote networks become static routes while the tunnel is up.
- Save and Apply changes.
- Export the tunnel. You can download a configuration ready to import on another Nexwall unit, or the certificates and key material to build the tunnel with a third party device.
On the client
Open the same page on the other unit, choose the client side and import the file you downloaded. You can also configure the client by hand to connect to any device that speaks OpenVPN.
Check that the tunnel is up in the list, and in the Monitor.
IPsec site-to-site
IPsec is the best choice when the other side is not a Nexwall unit.
- Open VPN > IPsec Site-to-Site and add a tunnel.
- Enter the remote address. If the other side has a dynamic address, enter
any. - Set the identifiers. The local identifier is a string that starts with
@and identifies this unit; on the other end the identifiers are reversed. - Enter or generate the pre-shared key.
- Set the local and remote networks to connect.
- Choose the security parameters. Both ends must agree on the encryption, integrity and key exchange group. Choosing a Diffie-Hellman group enables perfect forward secrecy.
- Choose what to do when the tunnel fails: dead peer detection sets the action after a timeout, and the close action sets what happens after the peer closes the tunnel (nothing, restart on demand, or restart at once).
- Save and Apply changes.
:::note Restart after changing networks Adding or removing networks from an existing tunnel requires restarting the IPsec service. This restarts all tunnels, and the page asks you to confirm. :::
Choosing between them
| OpenVPN | IPsec | |
|---|---|---|
| Both ends Nexwall | Simple, import and go | Works |
| Third party device | Possible with exported material | Best interoperability |
| Behind restrictive networks | Can use TCP | Needs its ports open |