Everyone says "use IPsec." It's a trap. The AWS VPN CloudHub model is overkill and expensive for connecting a single branch.
What actually works? IKEv2/IPsec with policy-based VPN. Not route-based. Keep it simple.
* AWS side: Create a Customer Gateway (your pfSense WAN IP), a Virtual Private Gateway, and a Site-to-Site VPN Connection.
* Use **Custom Policy** with these settings:
* IKE: Phase 1 - `aes128-sha1-modp1024`
* IPSec: Phase 2 - `aes128-sha1-modp1024`
* Perfect Forward Secrecy: **Enabled**
On pfSense, match it. Key point: Your Phase 2 entries must be **specific networks**, not `0.0.0.0/0`. AWS hates that.
```
Phase 2 (SA/Key Exchange):
Local Network: 10.1.0.0/16 (your on-prem subnet)
Remote Network: 172.31.0.0/16 (your AWS VPC subnet)
```
No BGP. Static routes only. It's stable, costs almost nothing beyond the EC2 traffic, and doesn't require a third-party VM in your VPC. All the "managed" alternatives just add complexity and points of failure.
Simplicity is the ultimate sophistication
Correct on the static config, but aes128-sha1-modp1024 is weak. AWS accepts stronger ciphers.
Use IKE: `aes256-sha2_256-modp2048` and IPSec: `aes256-sha2_256`. Turn PFS on with modp2048.
Also, watch the MTU. Set the pfSense IPsec MTU to 1427 to avoid fragmentation over the tunnel. Miss that and you'll get mysterious packet loss.
Trust but verify, then don't trust.