Its also just screams – person doesn't know what they are doing at all ;) Then that seems to have served my purpose well. I changed my LAN interface to 10.233.233.1/24 and everything is working now! Thanks for the feedback. I'm still trying to wrap my head around how it was a problem but for now I'll have to accept that I'm not as smart as my mom tells me I am.

No, I said to check Don't Pull Routes not Don't Add/Remove Routes. Check Don't pull routes Uncheck Don't Add/Remove Routes

You could always just pass DNS (TCP/UDP on port 53) to This firewall and then block all other TCP/UDP port 53 destinations. If that's really what's important to you.

Thanks - solved my problem as well. I would have thought this was a pretty common configuration.  An easier to find guide for newbies would be helpful.

pfSense will add a static route for the monitoring IP via the given interface. If there is a x.x.x.x address is used there then the router will always send traffic for that IP to PIA, adding latency for non-VPN users and breaking Geo lookup (in DNS case). I'm using there one of Level 3 DNS resolvers (4.2.2.1 - 4.2.2.6)  which I don't need to contact for any other purpose.

How is the client supposed to know which DNS server to use? Before it knows the answer to the query it has no idea if the destination is out on the internet or over the VPN. You are probably best off sending the queries to the DNS server over the VPN and letting it return the appropriate answer.

@SpaceBass: out of curiosity, it looks like your screenshot is of the client end. Does the client eventually time out and reconnect? Yeah, it's a client setup to a 3rd party VPN provider.  And nope, the client doesn't time out and reconnect on its own.  The service is completely stopped in pfSense until I manually log in and restart it. I've had success testing the Service_Watchdog package in a VM.  Just enabled it in production.  This may be a decent workaround. I'm still curious what the root cause of the service failing in the first place.

Also upgrade the OpenVPN clients.

I have the same issue with a IKEv2 VPN. The VPN clients don't route through squid / squidguard. Does anybody have a solution / configuration to get this working together?

I have confirmed that the issue is defintely linked to the multiple remote networks in the open vpn config as if I remove the additional remote networks and only have one subnet per vpn server it starts working again. The problem with this is the remote client networks then can't communicste with each other, only the server network.  While this isn't critical, as I can remote desktop into the server lan and access the other subnets from there, it isn't very elegant.

Thanks again for pointing me in a useful direction.  I clearly had not done all of my homework.  I am using TUN.  However, after further reading the TAP configuration might better fit my use case. Currently the connection to the VPN is rather fast.  I have no issue navigating documents, pictures things of this nature.  However, when I open my accounting software it takes 3-5 minutes to load the file.  Once it has loaded lag is barely noticeable in most cases.  I do have adaptive compression enabled. You're Awesome!

Yes, that's what I'm trying to do. It always me using different devices..

Hate to bump!!!

@jahonix: @Ryu945: Though I think I will be going with this case instead. Oh boy, if the case is one of your major concerns, then take a consumer router and start painting it or so. That could lead to more satisfying results for you personally. It has a shelf it needs to be able to fit onto.