Setting Up an IPsec Transport Mode Connection Between Two Windows Machines

Network Architecture

For the purposes of this article, we'll keep our architecture as simple as possible. We'll set up a secure connection with an IPsec VPN with PSK between a computer running Windows 11 and a server running Windows 2022. Both computers will be on the same local network.

Windows Server

IPsec Configuration

Graphical User Interface (GUI)

• Open the Windows Defender Firewall with Advanced Security console:

• Do a right click on Connection Security Rules and select New Rule…:

• Select Custom and click Next:

• In the Which computers are in Enpoint 1 section, select These IP addresses and click on Add…:

• Here we add the Host or Network with which we need have to establish an IPsec connection to communicate:

• Do the same with Enpoint 2 entering the server's IP address then click Next:

• For maximum security and impose the use of IPsec select Require authentication for inbound and outbound connections:

• As we'll be using a preshared key as our Authentication Method in this example, click on Customize…:

• Follow this steps to set the Preshared key:

• We can specify one or more specific protocols to be encapsulated inside IPsec, here we encapsulate everything:

• We can restrict the rule to specific profiles:

• Finally specify the Name of the rule:

PowerShell

• We can create the same IPsec Rule as the one configured just above, in a three PowerShell commands line:

FireWall Configuration

We will create a Firewall Rule to allow encrypted flows.

Graphical User Interface (GUI)

• Do a right click on Inbound Security Rules and select New Rule…:

• Select Custom and click Next:

• Choose All programs and click on Next:

• We can specify one or more specific protocols to be matched by the rule, here we will match Any protocols:

• Restrict rule application to defined ip addresses concerned:

• In the Action step, configure the Require the connections to be encrypted condition:

• We can limit the application of the rule to specific users, which will not be used for our purposes:

• We can do the same to limit the rule to specific computers, which won't be used in this example either:

• We can restrict the rule to specific profiles:

• Finally specify the Name of the rule:

PowerShell

• We can create the same Firewall Rule sas the one configured just above, in a single PowerShell command line:

We've now finished configuring the server. Now it's time to move on to client configuration.

Windows 11

I'm going to describe them all, but the steps are pretty much the same as those we followed for the server.

• Open the Windows Defender Firewall with Advanced Security console:

• Do a right click on Connection Security Rules and select New Rule…:

• Select Custom and click Next:

• In the Which computers are in Enpoint 1 section, select These IP addresses and click on Add…:

• Here we add our client's IP address:

• Do the same with Enpoint 2 entering the server's IP address then click Next:

• For maximum security and impose the use of IPsec select Require authentication for inbound and outbound connections:

• As we'll be using a preshared key as our Authentication Method in this example, click on Customize…:

• Follow this steps to set the Preshared key:

• We can specify one or more specific protocols to be encapsulated inside IPsec, here we encapsulate everything:

• We can restrict the rule to specific profiles:

• Finally specify the Name of the rule:

• Do a ping to the server and check security association is present: