Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN: two clients in a gateway group

    Scheduled Pinned Locked Moved OpenVPN
    16 Posts 3 Posters 4.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      pfBasic Banned
      last edited by

      • Create another client identical to the one you've already created. (If you have the option to choose from multiple servers I would recommend that you test them all and select the two fastest servers for your two clients, this way if one server is performing poorly, you can mitigate it by grouping it with a different server).

      • Assign your clients interfaces and enable them.

      • Go to System / Routing / Gateway Groups.
        Add a new Gateway Group and select all of the clients you want to use as gateways as Tier 1, make sure any gateways you do not want to use are set to Never.

      • Edit all relevant firewall rules to use only the gateway group you created. (Advanced Options > Gateway)

      1 Reply Last reply Reply Quote 0
      • P
        patrick0525
        last edited by

        Thanks. I will setup another vpn client to a different vpn provider server. I am planning to use one LAN port for both vpn clients. That is ok ? Right?

        1 Reply Last reply Reply Quote 0
        • P
          pfBasic Banned
          last edited by

          @patrick0525:

          I am planning to use one LAN port for both vpn clients.

          I'm not sure what you mean by this? VPN Gateways will work over your WAN port as they are gateways to the internet. You don't need 1:1 physical port to VPN Client if that's what you mean?

          1 Reply Last reply Reply Quote 0
          • P
            patrick0525
            last edited by

            Thanks for clearing it up. I was mistaken for talking about  lan. It should have been wan instead.

            I guess you could have number of VPN clients connected  to different VPN server, and then  gateway grouped to maximize performance.

            Thanks

            1 Reply Last reply Reply Quote 0
            • P
              pfBasic Banned
              last edited by

              Yeah, you can have one physical wAN port connected from pfSense to modem, and have 1, 2, 5, etc VPN clients configured into a gateway group acting over that one WAN port.

              The usual reason to use multiple VPN clients in a gateway group is to utilize multiple cores. So it's probably not worthwhile to have more clients than you have CPU cores.

              1 Reply Last reply Reply Quote 0
              • P
                patrick0525
                last edited by

                Assign your clients interfaces and enable them.  I am not sure I did this.
                Two VPN clients are enabled/connected to two different VPN servers.

                How do I configure the next step? No new interfaces show up.

                Go to System / Routing / Gateway Groups.
                Add a new Gateway Group and select all of the clients you want to use as
                gateways as Tier 1, make sure any gateways you do not want to use are set to Never.

                1 Reply Last reply Reply Quote 0
                • P
                  pfBasic Banned
                  last edited by

                  Interfaces / Interface Assignments: Next to "Available network ports:" select your VPN client from the dropdown, click "+ ADD" Repeat for all clients

                  Click your new VPN interfaces, click "Enable Interface", Save & Apply, Repeat for all clients

                  Then try to setup a gateway group again, you should see your new interfaces.

                  1 Reply Last reply Reply Quote 0
                  • B
                    BrianX
                    last edited by

                    i just did this very thing.  (except i used 4 VPNs and the WAN in a group, with the VPNs as tier1 and the WAN as tier5).

                    i think that should allow me to RR all my traffic between four different VPN vendors, plus fall back to WAN in the case of them all being offline.

                    1 Reply Last reply Reply Quote 0
                    • P
                      pfBasic Banned
                      last edited by

                      I'm glad it worked out for you!

                      Keep in mind that if you are using VPNs for anonymity then in this setup you will broadcast your real IP if your VPNs go down, which is not desirable. If you don't care about anonymity then that's fine.

                      FWIW the only time all of my VPN clients (or even two of them) have gone down was when my WAN port got a lot of packet loss for a few hours.

                      1 Reply Last reply Reply Quote 0
                      • B
                        BrianX
                        last edited by

                        is it any or all of the VPNs going down?  that part was not entirely clear.

                        but yeah, this is sort of a hedge against ISP targeted marketing and sticking crap into packets/web pages.  i actually only shuffle traffic from certain systems out the VPNs, so things like Xbox and PS work with as little drama as possible.  (DNS, http, https, and a few other non-basic protocols)

                        1 Reply Last reply Reply Quote 0
                        • P
                          pfBasic Banned
                          last edited by

                          Tiers in gateway groups require all gateways in a tier to go down before it will use a gateway in the next tier.

                          Ex:
                          GW1: Tier 1
                          GW2: Tier 1
                          GW3: Tier 2
                          GW4: Tier 3

                          If none are down Tier 1 is used
                          If one is down Tier 1 is used
                          If two is down Tier 1 is used
                          If one and two are down Tier 2 is used
                          If one and three are down Tier 1 is used
                          If one two and three are down Tier 3 is used

                          1 Reply Last reply Reply Quote 0
                          • B
                            BrianX
                            last edited by

                            OK, that is how i read it and it is correct.  I have 4 VPNs at Tier1 and the naked WAN at Tier5.  This passes the wife test as failing safe.  Thanks!

                            1 Reply Last reply Reply Quote 0
                            • P
                              patrick0525
                              last edited by

                              I have been using this link as a guide : https://nguvu.org/pfsense/pfsense-multi-vpn-wan/

                              I was sending everything through WAN_DHCP(default) and then added  VPN1_WAN and VPN2_WAN as new gateways. VPN1_WAN and VPN2_WAN are in gateway group called VPN_Group_packet_loss. In here, I also set WAN_DHCP to never.

                              How do I set the the firewall settings properly?

                              pf_1.JPG
                              pf_1.JPG_thumb
                              pf2.JPG
                              pf2.JPG_thumb
                              pf3.JPG
                              pf3.JPG_thumb

                              1 Reply Last reply Reply Quote 0
                              • P
                                pfBasic Banned
                                last edited by

                                Set the monitor IPs on your VPN gateways to something public like 8.8.8.8 and 8.8.4.4

                                I didn't read that guide but I don't know what the port forwards are for? I don't use any port forwarding for VPN?

                                Use Hybrid Outbound NAT rules, that way you keep all of the auto rules and your manual rules.

                                1 Reply Last reply Reply Quote 0
                                • P
                                  patrick0525
                                  last edited by

                                  Much better. I am online now. Thank you. I removed the port forwarding and add the suggested IP monitor of 8.8.8.8 and 8.8.4.4

                                  I did the the hybrid nat. See below.

                                  In firewall/nat/outbound, do I still need those four OpenVpn interfaces?

                                  pf4.JPG
                                  pf4.JPG_thumb
                                  pf5.JPG
                                  pf5.JPG_thumb
                                  pf6.JPG
                                  pf6.JPG_thumb

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.