---
title: "Connect branches and data centers: Site-to-Site VPN"
sidebar_label: "Connect branches and data centers: Site-to-Site VPN"
sidebar_position: 12
description: "Example of setting up a Site-to-Site VPN tunnel for the IPsec protocol"
---

import Formbricks from '@theme/MDXComponents/Formbricks';
import { CustomTable } from '@selectel/docux/components';
import PfsenseAlert from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/firewalls/selectel/pfsense-alert.mdx';

# Connect branches and data centers: Site-to-Site VPN

:::info

This is a guide for configuring a Selectel firewall when creating a Site-to-Site VPN tunnel between a data center and an external site, such as your office or another data center. The guide covers configuration using the IPsec protocol.

You must configure the equipment on the other side of the tunnel yourself according to the manufacturer's documentation. Before configuring, ensure that your equipment supports the IPsec protocol.

:::

1. [Connect to your Selectel firewall](#connect-to-firewall).
2. [Configure IKE Phase 1 parameters](#configure-ike-first-phase-parameters) for each device.
3. [Configure IKE Phase 2 parameters](#configure-ike-second-phase-parameters) for each device.
4. [Configure allow rules on the firewall](#configure-rules-on-firewall) for the IPsec protocol to work.
5. [Bring up the tunnel between devices](#tunnel-inintiation).

## 1. Connect to the Selectel firewall \{#connect-to-firewall}

1. Open the following page in your browser:

   ```bash
   https://<ip_address>:5443
   ```

   Enter `<ip_address>` — the IP address of the firewall.

2. Enter the username and password received in the ticket after [ordering a firewall](/firewalls/order/order-hardware-firewall.mdx). The main page of the graphical interface with the dashboard will open.

## 2. Configure IKE Phase 1 parameters \{#configure-ike-first-phase-parameters}

Configure the parameters on the Selectel firewall. You must set identical parameter values on your equipment on the other side of the tunnel.

1. In the **VPN** menu, go to the **IPsec** section.

2. Open the **Tunnels** tab.

3. Click **Add P1**.

4. In the **Key Exchange Version** field, select the key exchange protocol version — IKEv2.

5. In the **Internet Protocol** field, select the internet protocol — IPv4.

6. In the **Interface** field, select the network interface to be used for the tunnel.

7. In the **Remote Gateway** field, enter the IP address of the remote device.

8. In the **Authentication Method** field, select the authentication method:

   * **Mutual PSK**;
   * or **Mutual Certificate** and fill in the **My Certificate** and **Peer Certificate Authority** fields.

9. In the **My Identifier** field, select the type and enter the identifier of the device from which you are configuring the tunnel.

10. In the **Peer Identifier** field, select the type and enter the identifier of the remote device.

11. In the **Pre-Shared key** field, enter the authentication code. This is used when configuring and connecting the remote device.

12. In the **Encryption Algorithm** block, configure the encryption algorithm:

    12.1. In the **Algorithm** field, select AES.

    12.2. In the **Key Length** field, select 256 bits.

    12.3. In the **HASH** field, select SHA512.

    12.4. In the **DH Group** field, select 14.

13. Click **Save** → **Apply Changes**.

## 3. Configure IKE Phase 2 parameters \{#configure-ike-second-phase-parameters}

Configure the parameters on the Selectel firewall. You must set identical parameter values on your equipment on the other side of the tunnel.

1. In the **VPN** menu, go to the **IPsec** section.

2. Open the **Tunnels** tab.

3. Below the [IKE Phase 1](#configure-ike-first-phase-parameters) line, click **Show Phase 2 Entries**.

4. Click **Add P2**.

5. In the **Mode** field, select the tunnel operation mode — Tunnel IPv4.

6. In the **Local Network** field, select the local network type behind the VPN gateway — Network and enter the IP address of the local subnet.

7. In the **Remote Network** field, select the remote network type behind the VPN gateway — Network and enter the IP address of the remote subnet.

8. In the **Protocol** field, select the data protection protocol — ESP.

9. In the **Encryption Algorithm** block, configure the encryption algorithm:

   9.1. Select the **AES** checkbox and set Key Length to 128 bits.

   9.2. Select the **AES256-GCM** checkbox and set Key Length to 128 bits.

10. In the **Hash Algorithms** field, select the hash algorithm — SHA512.

11. In the **PFS Key Group** field, select the additional encryption key protection parameters — 14.

12. Click **Save** → **Apply Changes**.

## 4. Configure allow rules on the firewall \{#configure-rules-on-firewall}

Create an allow rule for the IPsec protocol on the WAN and IPsec interfaces.

1. In the **Firewall** menu, go to the **Rules** section.
2. Open the tab with the **WAN** interface.
3. Click **Add**.
4. In the **Action** field, select the action for received or sent data packets — Pass.
5. In the **Interface** field, select the network interface — IPsec.
6. In the **Source** field, select the source subnet for network traffic.
7. In the **Destination** field, select the destination address to which network traffic is allowed.
8. Click **Save**.
9. Click **Add**.
10. In the **Action** field, select the action for received or sent data packets — Pass.
11. In the **Interface** field, select the network interface — WAN.
12. In the **Source** field, select the source of network traffic.
13. In the **Destination** field, select the destination address to which network traffic is allowed.
14. Click **Save**.
15. Drag the created rules above the denying ones. Rules are executed in order in the list — from top to bottom.
16. Click **Apply Changes**.

## 5. Bring up the tunnel between devices \{#tunnel-inintiation}

1. In the **Status** menu, go to the **IPsec** section.
2. Open the **Overview** tab.
3. Click **Connect P1 and P2**.

<Formbricks />