How to Configure IPsec Tunnel Mode Rules in Windows 11 Using PowerShell

In secure enterprise network architectures, IPsec protects sensitive network transmissions through two distinct operational modes: Transport Mode and Tunnel Mode. While Transport Mode encrypts only the payload between two directly communicating hosts, Tunnel Mode encapsulates the entire original IP packet—including source and destination addresses—inside a brand-new outer IP header. This makes Tunnel Mode essential for establishing site-to-site VPN tunnels, connecting remote endpoints to corporate security gateways, and masking internal network topologies. In Windows 11, the NetSecurity module in PowerShell provides granular cmdlets to provision, inspect, and enforce native IPsec Tunnel Mode rules.

Understanding IPsec Transport Mode vs Tunnel Mode

The distinction between IPsec operational modes dictates how the Windows Filtering Platform (WFP) encapsulates packets:

• Transport Mode: Inserts an IPsec header (ESP or AH) between the original IP header and the transport layer (TCP/UDP). Used for host-to-host server isolation where both endpoints know each other’s physical IP addresses.
• Tunnel Mode: Packages the complete original IP packet inside a new IPsec Encapsulating Security Payload (ESP) packet with newly minted outer source and destination gateway IP addresses. Used when connecting private subnets across untrusted public networks or when connecting mobile workstations to perimeter security concentrators.

Configuring Tunnel Mode via PowerShell bypasses cumbersome legacy MMC snap-ins, allowing network administrators to define tunnel endpoints, authentication credentials, and cryptographic suites within repeatable automation scripts.

Prerequisites and PowerShell Module Requirements

IPsec tunnel configuration requires elevated administrative privileges. Open PowerShell as an administrator by right-clicking Start and selecting Terminal (Admin).

Verify that the NetSecurity module is available and inspect the current IPsec rule inventory:

Get-NetIPSecRule | Format-Table Name, DisplayName, Mode, InboundSecurity, OutboundSecurity

Notice the Mode property; standard rules operate in Transport mode, while tunnel rules reflect Tunnel.

Configuring IPsec Tunnel Mode Cryptographic Proposals

Before establishing a tunnel rule, define the cryptographic proposals governing Phase 1 (Main Mode) authentication and Phase 2 (Quick Mode) encryption. This ensures the tunnel utilizes modern ciphers like AES-GCM and Diffie-Hellman Group 19/20.

Create a high-security Quick Mode cryptographic proposal and set:

$QMCryptoProposal = New-NetIPSecQuickModeCryptoProposal -Encapsulation ESP -Encryption AES256 -Hash SHA256 -KeyGroup ECP256
$QMCryptoSet = New-NetIPSecQuickModeCryptoSet -DisplayName "Tunnel-CryptoSet-GCM" -Name "Tunnel-CryptoSet-GCM" -Proposal $QMCryptoProposal

This ensures all payload traffic traversing the tunnel is encrypted with AES-256 and authenticated with SHA-256.

Creating an IPsec Tunnel Mode Rule

To create a Tunnel Mode rule, use the New-NetIPSecRule cmdlet with the -Mode Tunnel parameter. You must specify both the inner network traffic filters and the outer tunnel endpoints:

• -LocalAddress and -RemoteAddress: Represent the inner client/subnet IP addresses being protected.
• -TunnelLocalEndpoint: The physical IP address of the local Windows host initiating the tunnel.
• -TunnelRemoteEndpoint: The physical IP address of the remote VPN gateway or enterprise firewall.

Execute the following command to provision a tunnel routing private subnet traffic (10.100.0.0/16) through an external corporate gateway (203.0.113.50):

New-NetIPSecRule -DisplayName "Site-To-Gateway-Tunnel" -Name "Site-To-Gateway-Tunnel" `
    -Mode Tunnel `
    -TunnelLocalEndpoint 192.168.1.150 `
    -TunnelRemoteEndpoint 203.0.113.50 `
    -LocalAddress Any `
    -RemoteAddress 10.100.0.0/16 `
    -InboundSecurity Require `
    -OutboundSecurity Require `
    -QuickModeCryptoSet "Tunnel-CryptoSet-GCM"

When Windows 11 routes traffic destined for 10.100.0.0/16, the Windows Filtering Platform intercepts the packets, encapsulates them in an ESP tunnel packet addressed to 203.0.113.50, and dispatches them across the physical network.

Configuring Tunnel Authentication Methods

IPsec requires mutual authentication before establishing tunnel Security Associations (SAs). Supported authentication mechanisms include computer certificates (PKI) and pre-shared keys (PSK).

To configure computer certificate authentication using an enterprise Root Certificate Authority, use New-NetIPSecPhase1AuthSet:

$CertProposal = New-NetIPSecAuthProposal -Machine -Cert -Authority "CN=Enterprise-Root-CA, DC=corp, DC=local"
$AuthSet = New-NetIPSecPhase1AuthSet -DisplayName "Tunnel-Machine-Cert-Auth" -Name "Tunnel-Machine-Cert-Auth" -Proposal $CertProposal

Link the authentication set to your tunnel rule:

Set-NetIPSecRule -Name "Site-To-Gateway-Tunnel" -Phase1AuthSet "Tunnel-Machine-Cert-Auth"

If testing in an isolated lab environment using a pre-shared key, configure a PSK proposal:

$PSKProposal = New-NetIPSecAuthProposal -Machine -PresharedKey "SuperSecretEnterpriseKey2026!"
$PSKAuthSet = New-NetIPSecPhase1AuthSet -DisplayName "Tunnel-PSK-Auth" -Name "Tunnel-PSK-Auth" -Proposal $PSKProposal
Set-NetIPSecRule -Name "Site-To-Gateway-Tunnel" -Phase1AuthSet "Tunnel-PSK-Auth"

Auditing Active Tunnel Security Associations

Once traffic matching your destination subnet triggers the tunnel, the Windows IPsec engine negotiates Main Mode and Quick Mode Security Associations. You can inspect live tunnel associations in real time:

Get-NetIPSecQuickModeSA | Where-Object { $_.Mode -eq "Tunnel" } | Format-List LocalEndpoint, RemoteEndpoint, TunnelLocalEndpoint, TunnelRemoteEndpoint, EncryptionAlgorithm

A healthy tunnel connection will display the physical gateway endpoints under TunnelLocalEndpoint and TunnelRemoteEndpoint, confirming that encapsulation is fully operational.

Disabling and Removing Tunnel Rules

To disable a tunnel rule temporarily during maintenance:

Disable-NetIPSecRule -Name "Site-To-Gateway-Tunnel"

To remove the tunnel rule and associated cryptographic sets completely:

Remove-NetIPSecRule -Name "Site-To-Gateway-Tunnel" -Confirm:$false
Remove-NetIPSecQuickModeCryptoSet -Name "Tunnel-CryptoSet-GCM" -Confirm:$false

Using PowerShell to configure IPsec Tunnel Mode provides a robust, native encapsulation mechanism that shields enterprise network traffic without relying on third-party VPN clients.