IPsec vs. OpenVPN for self-hosted VPN connection

Hey, folks!

I purchased a pfSense router recently and would like to set it up to allow inbound VPN connections when I’m away so I can have:

  • automatic file sync
  • media streaming
  • server management

If these are my basic use cases, would it matter whether I choose IPsec or OpenVPN as the protocol? I’ve heard IPsec is faster which might matter for streaming, but I’m not sure if it’s faster by an appreciable amount.

Regardless, what are some of the pros/cons for using either protocol for such a use case? Would it really matter (subjective, I know, but I’d like to hear others’ subjective thoughts and reasoning) which is used?

Long explanation copied and pasted from stackexchange, TLDR version use the OpenVPN (it’s called SSL VPN) is more than enough for what you are trying to achieve:

IPSec vs SSL VPNs

Both SSL and IPSec VPNs are good options, both with considerable security pedigree, although they may suit different applications.

IPsec VPNs operate at layer 3 (network), and in a typical deployment give full access to the local network (although access can be locked down via firewalls and some VPN servers support ACLs). This solution is therefore better suited to situations where you want remote clients to behave as if they were locally attached to the network, and is particularly good for site-to-site VPNs. IPSec VPNs also tend to require specific software supplied by the vendor, which is harder to maintain on end-user devices, and restricts usage of the VPN to managed devices.

SSL VPNs are often cited as being the preferred choice for remote access. They operate on layers 5 and 6, and in a typical deployment grant access to specific services based on the user’s role, the most convenient of which are browser-based applications. It is usually easier to configure an SSL VPN with more granular control over access permissions, which can provide a more secure environment for remote access in some cases. Furthermore, SSL/TLS is inherently supported by modern devices, and can usually be deployed without the need for specialist client-side software, or with lightweight browser-based clients otherwise. These lightweight clients can often also run local checks to ensure that connecting machines meet certain requirements before they are granted access - a feature that would be much harder to achieve with IPSec.

In both cases one can be configured to achieve similar things as the other - SSL VPNs can be used to simply create a tunnel with full network access, and IPSec VPNs can be locked-down to specific services - however it is widely agreed that they are better suited to the above scenarios.

However, for exactly these reasons, many organisations will use a combination of both; often an IPSec VPN for site-to-site connections and SSL for remote access.

There are a number of references on the subject of SSL vs IPSec (some of these are directly from vendors):

End-to-End Encryption

In some of the above cases, such as IPSec VPNs and SSL VPN tunnels, you may not be getting end-to-end encryption with the actual service you’re using. This is where using an additional layer of SSL/TLS comes in handy.

Say you’re remote and trying to connect to an internally hosted web application via an IPSec VPN. If you use the HTTP protocol via your browser, your traffic is encrypted whilst it is running through the VPN tunnel itself, but it is then decrypted when it hits the remote VPN endpoint, and travels over the internal network in cleartext. This might be acceptable in some use cases, but in the interest of defence in depth, we ideally want to know that our data cannot be intercepted anywhere between you and the actual service itself. By connecting to this application over HTTPS, you effectively have two layers of security: one between you and the VPN endpoint, and another travelling through that (between you and the web server itself).

Of course, this is not limited to HTTPS - you should equally employ other secure protocols like SSH, FTPS, SMTP with STARTTLS etc etc.

Checkout Wireguard, you can control routing on the clients. I personally find it to be much easier to setup than OVPN. Somepeople say it is faster than OVPN.

I use Wguard to do the things you mentioned above. I also use Tinc VPN but Wguard is even easier than that.

Been my experience getting it working on a Nokia. Royal pain, while OpenVPN is copying a file from server to client.

Thanks, will save this for future reference!

Not sure I agree with the “specific software” for IPSec - at least on Linux. For the server you can use something like StrongSwan or similar from my research, and most Linux distributions at least come with IPSec support built-in.

Wow that’s a lot to read through! I will do so soon, and thank you so much for pointing me to this answer :+)

I’ve been using Wireguard as my single always on connection home on my laptop. Works like a charm and setup was stupid simple! Speed seems better than OpenVPN but I can’t say that quantitatively.

I do also run it on android using the userspace driver and it seems much worse. I think FreeBSD only has a userspace driver, so be aware of that. It just seems slower and will interfere with other services like syncing my mail using my split tunnel. It might be due to android’s VPN implementation though.

Thank you for the reply! I considered Wireguard but read this thread on pfSense’s forum saying (if I understood the gist) it wasn’t really ready for prime time yet and that IPsec would be better for some reasons that I haven’t yet delved into it much for lack of time and understanding. What do you think of the discussion?

tried setting up openvpn on an endian firewall and downloaded the cert to my phone and tried to get it working but it never does. Now I run docker with a simple IPSEC vpn cert that does work :stuck_out_tongue:

No problem, sorry that the awnser is long but I found this to be a shorter and better in terms of explanation compared to what I initially writing.

It is important to choose right specially if your doing something that requires lower level layer of presentation in terms of networking, but if you just want to access your management applications (like me), SSL VPN is fine.

Also follow the K.IS.S. (keep it simple stupid) methodology, it will help down the line belive me…

Yes, some of those replies are somewhat old since WG has steady development daily.

Linus found it good enough that he praised it, not sure if Linus or some random internet dude is more reliable source for judging it.

If you have questions about the validity of it go with OVPN I guess, but setting it up is a bit harder, nbot sure how easy to do it in Pfsense.

No need to apologize; more info is good! It’ll just take more time to digest it all esp. with my busy schedule, but that’s fine and I need to learn to do this right.

I agree with K.IS.S: it’s served me well when I’ve employed it and I’m now seeing the downsides to not employing it… didn’t document some server setup I did a few months back and I need to replicate it, and it’s like starting from scratch!

I was referring mostly to the 2nd-to-last comment from the Netgate employee (e: according to their forum flair, at least) that was fairly recent and delved into a lot of technical aspects that went over my head, but I wasn’t aware that Linus thought it worthy of praise. I would like to look into that as well.

It seems like OVPN is certainly a safe bet. I may go with it for now and play with Wireguard when I get the chance.

Yes I read his comments, he sounds legit, he was not dead against WG, at least that is how I took his words.

The issue with setting up OVPN or more complex VPN servers is that the starters will make mistakes during setup (since some of this stuff requires many steps) which will weaken the security of the tunnel when setting things up therefor this whole idea of secure VPN is a bit misleading if you are just starting over.

If you are an advanced VPN admin, you probably wont go for WG for sure, at least for now.

Yeah it didn’t seem like he was against it.

Hmm, I see. Well then maybe I’ll reverse it and try Wireguard as I’m new to networking and then mess around with OVPN if Wireguard isn’t cutting it for some reason.

Thanks! :+)

e: other comments saying to stay away from it until it is more mature, still; will read through the lengthy answer in another thread but it seems increasingly likely that I’ll just rely on OVPN…