Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [SOLVED] Slow PIA VPN connection on pfsense 2.4b

    Scheduled Pinned Locked Moved OpenVPN
    86 Posts 4 Posters 28.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      pfBasic Banned
      last edited by

      Don't have time to read all right now but change WAN net to LAN net on your gateway group rule in the first screen shot.
      I'll try to check out rest later.

      1 Reply Last reply Reply Quote 0
      • R
        Runenaldo
        last edited by

        @pfBasic:

        Don't have time to read all right now but change WAN net to LAN net on your gateway group rule in the first screen shot.
        I'll try to check out rest later.

        Will do.

        No problem. Thank you for taking your time to help, its very appreciated.  :)

        EDIT
        After setting it to LAN net and switching one VPN clints server (apparently the closest one to me is congested), I'm now running at full speed 106mbit

        But again I'm seeing less CPU usage than running with with a single VPN.

        I found this guide https://nguvu.org/pfsense/pfsense-multi-vpn-wan/
        Is it any good?
        He's doing a lot of things I haven't done fx. the way he set up the FW rules to block and log all IP traffic.

        ![Steam VPNGG LAN net.JPG_thumb](/public/imported_attachments/1/Steam VPNGG LAN net.JPG_thumb)
        ![Steam VPNGG LAN net.JPG](/public/imported_attachments/1/Steam VPNGG LAN net.JPG)

        1 Reply Last reply Reply Quote 0
        • R
          Runenaldo
          last edited by

          Tried pinging a few websites to test my latency and found that 99% of the time the first ping fails and then the rest comes through and if I then ping the same page again they all go through.

          It fits with how every homepage I open hangs for 2-12 seconds and then loads.

          ![Ping VPNGG.jpg](/public/imported_attachments/1/Ping VPNGG.jpg)
          ![Ping VPNGG.jpg_thumb](/public/imported_attachments/1/Ping VPNGG.jpg_thumb)

          1 Reply Last reply Reply Quote 0
          • P
            pfBasic Banned
            last edited by

            Delete the second allow any rule on your LAN to any Gateway

            Delete all rules on PIAVPN1&2 interfaces

            Then repost your rules.

            1 Reply Last reply Reply Quote 0
            • R
              Runenaldo
              last edited by

              @pfBasic:

              Delete the second allow any rule on your LAN to any Gateway

              Delete all rules on PIAVPN1&2 interfaces

              Then repost your rules.

              There you go.

              ![FW rule WAN.JPG](/public/imported_attachments/1/FW rule WAN.JPG)
              ![FW rule WAN.JPG_thumb](/public/imported_attachments/1/FW rule WAN.JPG_thumb)
              ![FW rule LAN new.JPG](/public/imported_attachments/1/FW rule LAN new.JPG)
              ![FW rule LAN new.JPG_thumb](/public/imported_attachments/1/FW rule LAN new.JPG_thumb)
              ![FW rule WLAN.JPG](/public/imported_attachments/1/FW rule WLAN.JPG)
              ![FW rule WLAN.JPG_thumb](/public/imported_attachments/1/FW rule WLAN.JPG_thumb)
              ![FW rule PIA1_WAN.JPG](/public/imported_attachments/1/FW rule PIA1_WAN.JPG)
              ![FW rule PIA1_WAN.JPG_thumb](/public/imported_attachments/1/FW rule PIA1_WAN.JPG_thumb)
              ![FW rule PIA2_WAN.JPG](/public/imported_attachments/1/FW rule PIA2_WAN.JPG)
              ![FW rule PIA2_WAN.JPG_thumb](/public/imported_attachments/1/FW rule PIA2_WAN.JPG_thumb)
              ![FW rule OpenVPN.JPG](/public/imported_attachments/1/FW rule OpenVPN.JPG)
              ![FW rule OpenVPN.JPG_thumb](/public/imported_attachments/1/FW rule OpenVPN.JPG_thumb)

              1 Reply Last reply Reply Quote 0
              • P
                pfBasic Banned
                last edited by

                On your LAN & WLAN, if oyu want all of your traffic to go through the Gatewat group, you need to specify the gateway group as the only gateway.

                The way those are written, nothing will go out of your gateway group except your OpenVPN server.

                1 Reply Last reply Reply Quote 0
                • R
                  Runenaldo
                  last edited by

                  @pfBasic:

                  On your LAN & WLAN, if oyu want all of your traffic to go through the Gatewat group, you need to specify the gateway group as the only gateway.

                  The way those are written, nothing will go out of your gateway group except your OpenVPN server.

                  Ok, I thought that was fine as the NAT i specified was the OpenVPN.

                  but I've changed it now.
                  EDIT
                  Just to clarify, what I've change is what you said. haven't changed anything in NAT rules.

                  download speed is on pair with running over my pc client now, but latencies are still high.

                  ![FW rule LAN to GG.JPG](/public/imported_attachments/1/FW rule LAN to GG.JPG)
                  ![FW rule LAN to GG.JPG_thumb](/public/imported_attachments/1/FW rule LAN to GG.JPG_thumb)
                  ![FW rule WLAN to GG.JPG](/public/imported_attachments/1/FW rule WLAN to GG.JPG)
                  ![FW rule WLAN to GG.JPG_thumb](/public/imported_attachments/1/FW rule WLAN to GG.JPG_thumb)

                  1 Reply Last reply Reply Quote 0
                  • P
                    pfBasic Banned
                    last edited by

                    OK, great! Can you get full speed with just one VPN client now that your rules are set up correctly? Try just changing one of the VPNs in the gateway group to never.

                    High latency is a fact of life when you are routing all of your traffic via a VPN.

                    To pick the best VPN server for you check out this list. https://www.privateinternetaccess.com/pages/network/

                    Closer is generally better latency but not always.

                    I would expand out from your closest server and test them out on pfSense to see which one is the best for you.

                    Also, VPN servers performance will vary over time. If there are a lot of users on it you will notice. So, when using a gateway group, it is probably to your advantage to pick the two best servers for you, and put one of them in each of your clients so that if one network goes down or gets shitty. You will seamlessly be using a different server. This is what gateway grouping is usually used for.

                    The OpenVPN gateway group is just a hack to get around the fact that OpenVPN is single threaded.

                    1 Reply Last reply Reply Quote 0
                    • R
                      Runenaldo
                      last edited by

                      I got full speed again with one VPN set to never (see picture bellow)
                      But it seems that pfsense ignored it completely and still used both VPN's

                      ![GG group VPN2 NEVER.JPG](/public/imported_attachments/1/GG group VPN2 NEVER.JPG)
                      ![GG group VPN2 NEVER.JPG_thumb](/public/imported_attachments/1/GG group VPN2 NEVER.JPG_thumb)
                      ![Bandwidth monitor with VPN2 disabled.JPG](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled.JPG)
                      ![Bandwidth monitor with VPN2 disabled.JPG_thumb](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled.JPG_thumb)

                      1 Reply Last reply Reply Quote 0
                      • P
                        pfBasic Banned
                        last edited by

                        Sorry, set your gateway group back to the way you had it, just change the LAN firewall rule from your gateway group to one of your VPN clients and try again.

                        1 Reply Last reply Reply Quote 0
                        • R
                          Runenaldo
                          last edited by

                          @pfBasic:

                          Sorry, set your gateway group back to the way you had it, just change the LAN firewall rule from your gateway group to one of your VPN clients and try again.

                          Not quite, I would say its the same as before bandwidth wise, running with only one VPN.. Also it seems that pfsense refrains from using my VPN2 connection at in the beginning as the monitor reported no bw. but somehow it kicks in midway in the Ubuntu download and starts using it anyway..

                          The picture dosn't show the beginning of the download, but the VPN2 connection was completely dead, nothing was going in or out.

                          ![Bandwidth monitor with VPN2 disabled 2nd try.JPG](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled 2nd try.JPG)
                          ![Bandwidth monitor with VPN2 disabled 2nd try.JPG_thumb](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled 2nd try.JPG_thumb)

                          1 Reply Last reply Reply Quote 0
                          • P
                            pfBasic Banned
                            last edited by

                            You mean it's still using the other VPN connection even when you change the firewall rule to one VPN insteadof the gateway group? You might need to reset the state table (diagnostics/states) and restart the VPN service (Status/OpenVPN).

                            Have you tried trouble shooting different VPN servers? Try some that have a lot of throughput even if they are far away from you.
                            us-east.privateinternetaccess.com
                            us-texas.privateinternetaccess.com
                            us-california.privateinternetaccess.com
                            uk-london.privateinternetaccess.com

                            It is really strange that you can't hit line speeds on a single instance.

                            1 Reply Last reply Reply Quote 0
                            • R
                              Runenaldo
                              last edited by

                              @pfBasic:

                              You mean it's still using the other VPN connection even when you change the firewall rule to one VPN insteadof the gateway group? You might need to reset the state table (diagnostics/states) and restart the VPN service (Status/OpenVPN).

                              Yup! but only in the end of the download.

                              @pfBasic:

                              Have you tried trouble shooting different VPN servers? Try some that have a lot of throughput even if they are far away from you.
                              us-east.privateinternetaccess.com
                              us-texas.privateinternetaccess.com
                              us-california.privateinternetaccess.com
                              uk-london.privateinternetaccess.com

                              It is really strange that you can't hit line speeds on a single instance.

                              No not yet, but I'm currently using the NL server, which has the highest throughput in Europe and also always have worked flawlessly on my pc client. I can however of course try the others.

                              ![FW rule LAN one VPN.JPG](/public/imported_attachments/1/FW rule LAN one VPN.JPG)
                              ![FW rule LAN one VPN.JPG_thumb](/public/imported_attachments/1/FW rule LAN one VPN.JPG_thumb)
                              ![Bandwidth monitor with VPN2 disabled beginning 3nd try.JPG](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled beginning 3nd try.JPG)
                              ![Bandwidth monitor with VPN2 disabled beginning 3nd try.JPG_thumb](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled beginning 3nd try.JPG_thumb)
                              ![Bandwidth monitor with VPN2 disabled endning 3nd try.JPG](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled endning 3nd try.JPG)
                              ![Bandwidth monitor with VPN2 disabled endning 3nd try.JPG_thumb](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled endning 3nd try.JPG_thumb)

                              1 Reply Last reply Reply Quote 0
                              • P
                                pfBasic Banned
                                last edited by

                                weird, easiest thing is just ot reboot the whole router and try again.

                                1 Reply Last reply Reply Quote 0
                                • R
                                  Runenaldo
                                  last edited by

                                  @pfBasic:

                                  weird, easiest thing is just ot reboot the whole router and try again.

                                  Tried, almost the same result.

                                  ![Bandwidth monitor with VPN2 disabled after reboot 4th try.JPG](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled after reboot 4th try.JPG)
                                  ![Bandwidth monitor with VPN2 disabled after reboot 4th try.JPG_thumb](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled after reboot 4th try.JPG_thumb)

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    pfBasic Banned
                                    last edited by

                                    Try disabling the other VPN client

                                    1 Reply Last reply Reply Quote 0
                                    • R
                                      Runenaldo
                                      last edited by

                                      @pfBasic:

                                      Try disabling the other VPN client

                                      Close but no cigar.

                                      and I'm leaking my ISP IP DNS

                                      ![Bandwidth monitor with VPN2 disabled and stopped after reboot 5th try.JPG](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled and stopped after reboot 5th try.JPG)
                                      ![Bandwidth monitor with VPN2 disabled and stopped after reboot 5th try.JPG_thumb](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled and stopped after reboot 5th try.JPG_thumb)

                                      1 Reply Last reply Reply Quote 0
                                      • P
                                        pfBasic Banned
                                        last edited by

                                        So everything is working except you have a DNS leak?

                                        1 Reply Last reply Reply Quote 0
                                        • R
                                          Runenaldo
                                          last edited by

                                          @pfBasic:

                                          So everything is working except you have a DNS leak?

                                          Yes when running with one VPN server shut down.

                                          1 Reply Last reply Reply Quote 0
                                          • I
                                            isolatedvirus
                                            last edited by

                                            can you post your gateway groups, firewall rules, and nat rules please?

                                            As mentioned before, your latency increasing will be a tradeoff and the only thing you can try to bring it down is other VPN servers.

                                            DNS leaking is usually because you have your DNS being run by PFSense. PFSense in resolver mode will leak your WAN address unless you change your default gateway to the PIA VPN. PFSense set to forward will leak your upstream DNS servers (such as google or open dns if youre using those) regardless of default gateway configuration, unless youre forwarding to another internal DNS server and that server is being routed over the VPN.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.