Comments on: Significant IPsec Improvements now in 1.3!

By: Chris Buechler

Chris Buechler — Tue, 03 Feb 2009 15:25:22 +0000

FBI01: Yes, eventually.

By: FBI01

FBI01 — Tue, 03 Feb 2009 14:55:04 +0000

Cool! The new featres will be documented with example configurations?
Best regards.

By: Josh

Josh — Thu, 11 Dec 2008 16:20:34 +0000

This looks very promising!!! Has there been any progress made on this since this article has been posted?

By: Pixa

Pixa — Mon, 11 Aug 2008 22:59:38 +0000

The L2TP over IPSec feature will be #1 on my wishlist
As a OSX user it would be really nice to switch to l2tp/ipsec from pptp.
Best regards.

By: JF

JF — Mon, 04 Aug 2008 05:08:26 +0000

Re. the per-user restriction, that would help make pfsense a viable alternative to the commercial boxes like Cisco ASA/PIX, Checkpoint etc. They all allow quite fine grained per user/group VPN user control, and that is sorely missing in pfsense and the other open source solutions I evaluated.

By: Matthew

Matthew — Fri, 25 Jul 2008 08:01:45 +0000

It is possible to restrict user access to a specific destination network based on group inclusion when Xauth is used. I am evaluating the possibility of adding support for this to pfSense. This will require a bit of work with respect to the user management system which is my current focus of development. More details regarding this should surface soon.

By: Chris Buechler

Chris Buechler — Wed, 23 Jul 2008 19:18:55 +0000

L2TP is not part of this, no, it’s a different beast entirely. It is being considered separately. It can run under mpd, this is strictly IPsec as it runs under ipsec-tools.

By: Ide

Ide — Wed, 23 Jul 2008 18:54:13 +0000

Will the 1.3 be supporting L2TP with this IPSEC improvement

By: Chris Buechler

Chris Buechler — Wed, 23 Jul 2008 14:14:35 +0000

Kim:
a) There is no standard IPsec client in Windows XP. You can deploy the Shrew Soft client which works great.
b) Yes, no differently than you can already filter IPsec traffic in 1.2.
c) as always – when it’s ready. we’ll have a development road map up in the next couple months or so

By: Kim

Kim — Wed, 23 Jul 2008 13:06:16 +0000

Will it be possible to:
a) Have multiple mobile users connect using standard Windows XP VPN (IPSEC)?
b) Filter these so they can and cannot reach different destination hosts on the LAN?
c) When will all this be available (in beta and GA)?