Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN: two clients in a gateway group

    Scheduled Pinned Locked Moved OpenVPN
    16 Posts 3 Posters 4.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      patrick0525
      last edited by

      I got my VPN working. How do I set-up  for two clients in a gateway group? Any good reference links?

      1 Reply Last reply Reply Quote 0
      • P
        pfBasic Banned
        last edited by

        • Create another client identical to the one you've already created. (If you have the option to choose from multiple servers I would recommend that you test them all and select the two fastest servers for your two clients, this way if one server is performing poorly, you can mitigate it by grouping it with a different server).

        • Assign your clients interfaces and enable them.

        • Go to System / Routing / Gateway Groups.
          Add a new Gateway Group and select all of the clients you want to use as gateways as Tier 1, make sure any gateways you do not want to use are set to Never.

        • Edit all relevant firewall rules to use only the gateway group you created. (Advanced Options > Gateway)

        1 Reply Last reply Reply Quote 0
        • P
          patrick0525
          last edited by

          Thanks. I will setup another vpn client to a different vpn provider server. I am planning to use one LAN port for both vpn clients. That is ok ? Right?

          1 Reply Last reply Reply Quote 0
          • P
            pfBasic Banned
            last edited by

            @patrick0525:

            I am planning to use one LAN port for both vpn clients.

            I'm not sure what you mean by this? VPN Gateways will work over your WAN port as they are gateways to the internet. You don't need 1:1 physical port to VPN Client if that's what you mean?

            1 Reply Last reply Reply Quote 0
            • P
              patrick0525
              last edited by

              Thanks for clearing it up. I was mistaken for talking about  lan. It should have been wan instead.

              I guess you could have number of VPN clients connected  to different VPN server, and then  gateway grouped to maximize performance.

              Thanks

              1 Reply Last reply Reply Quote 0
              • P
                pfBasic Banned
                last edited by

                Yeah, you can have one physical wAN port connected from pfSense to modem, and have 1, 2, 5, etc VPN clients configured into a gateway group acting over that one WAN port.

                The usual reason to use multiple VPN clients in a gateway group is to utilize multiple cores. So it's probably not worthwhile to have more clients than you have CPU cores.

                1 Reply Last reply Reply Quote 0
                • P
                  patrick0525
                  last edited by

                  Assign your clients interfaces and enable them.  I am not sure I did this.
                  Two VPN clients are enabled/connected to two different VPN servers.

                  How do I configure the next step? No new interfaces show up.

                  Go to System / Routing / Gateway Groups.
                  Add a new Gateway Group and select all of the clients you want to use as
                  gateways as Tier 1, make sure any gateways you do not want to use are set to Never.

                  1 Reply Last reply Reply Quote 0
                  • P
                    pfBasic Banned
                    last edited by

                    Interfaces / Interface Assignments: Next to "Available network ports:" select your VPN client from the dropdown, click "+ ADD" Repeat for all clients

                    Click your new VPN interfaces, click "Enable Interface", Save & Apply, Repeat for all clients

                    Then try to setup a gateway group again, you should see your new interfaces.

                    1 Reply Last reply Reply Quote 0
                    • B
                      BrianX
                      last edited by

                      i just did this very thing.  (except i used 4 VPNs and the WAN in a group, with the VPNs as tier1 and the WAN as tier5).

                      i think that should allow me to RR all my traffic between four different VPN vendors, plus fall back to WAN in the case of them all being offline.

                      1 Reply Last reply Reply Quote 0
                      • P
                        pfBasic Banned
                        last edited by

                        I'm glad it worked out for you!

                        Keep in mind that if you are using VPNs for anonymity then in this setup you will broadcast your real IP if your VPNs go down, which is not desirable. If you don't care about anonymity then that's fine.

                        FWIW the only time all of my VPN clients (or even two of them) have gone down was when my WAN port got a lot of packet loss for a few hours.

                        1 Reply Last reply Reply Quote 0
                        • B
                          BrianX
                          last edited by

                          is it any or all of the VPNs going down?  that part was not entirely clear.

                          but yeah, this is sort of a hedge against ISP targeted marketing and sticking crap into packets/web pages.  i actually only shuffle traffic from certain systems out the VPNs, so things like Xbox and PS work with as little drama as possible.  (DNS, http, https, and a few other non-basic protocols)

                          1 Reply Last reply Reply Quote 0
                          • P
                            pfBasic Banned
                            last edited by

                            Tiers in gateway groups require all gateways in a tier to go down before it will use a gateway in the next tier.

                            Ex:
                            GW1: Tier 1
                            GW2: Tier 1
                            GW3: Tier 2
                            GW4: Tier 3

                            If none are down Tier 1 is used
                            If one is down Tier 1 is used
                            If two is down Tier 1 is used
                            If one and two are down Tier 2 is used
                            If one and three are down Tier 1 is used
                            If one two and three are down Tier 3 is used

                            1 Reply Last reply Reply Quote 0
                            • B
                              BrianX
                              last edited by

                              OK, that is how i read it and it is correct.  I have 4 VPNs at Tier1 and the naked WAN at Tier5.  This passes the wife test as failing safe.  Thanks!

                              1 Reply Last reply Reply Quote 0
                              • P
                                patrick0525
                                last edited by

                                I have been using this link as a guide : https://nguvu.org/pfsense/pfsense-multi-vpn-wan/

                                I was sending everything through WAN_DHCP(default) and then added  VPN1_WAN and VPN2_WAN as new gateways. VPN1_WAN and VPN2_WAN are in gateway group called VPN_Group_packet_loss. In here, I also set WAN_DHCP to never.

                                How do I set the the firewall settings properly?

                                pf_1.JPG
                                pf_1.JPG_thumb
                                pf2.JPG
                                pf2.JPG_thumb
                                pf3.JPG
                                pf3.JPG_thumb

                                1 Reply Last reply Reply Quote 0
                                • P
                                  pfBasic Banned
                                  last edited by

                                  Set the monitor IPs on your VPN gateways to something public like 8.8.8.8 and 8.8.4.4

                                  I didn't read that guide but I don't know what the port forwards are for? I don't use any port forwarding for VPN?

                                  Use Hybrid Outbound NAT rules, that way you keep all of the auto rules and your manual rules.

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    patrick0525
                                    last edited by

                                    Much better. I am online now. Thank you. I removed the port forwarding and add the suggested IP monitor of 8.8.8.8 and 8.8.4.4

                                    I did the the hybrid nat. See below.

                                    In firewall/nat/outbound, do I still need those four OpenVpn interfaces?

                                    pf4.JPG
                                    pf4.JPG_thumb
                                    pf5.JPG
                                    pf5.JPG_thumb
                                    pf6.JPG
                                    pf6.JPG_thumb

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.