[SOLVED] Slow PIA VPN connection on pfsense 2.4b
-
Sorry, set your gateway group back to the way you had it, just change the LAN firewall rule from your gateway group to one of your VPN clients and try again.
Not quite, I would say its the same as before bandwidth wise, running with only one VPN.. Also it seems that pfsense refrains from using my VPN2 connection at in the beginning as the monitor reported no bw. but somehow it kicks in midway in the Ubuntu download and starts using it anyway..
The picture dosn't show the beginning of the download, but the VPN2 connection was completely dead, nothing was going in or out.
![Bandwidth monitor with VPN2 disabled 2nd try.JPG](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled 2nd try.JPG)
![Bandwidth monitor with VPN2 disabled 2nd try.JPG_thumb](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled 2nd try.JPG_thumb) -
You mean it's still using the other VPN connection even when you change the firewall rule to one VPN insteadof the gateway group? You might need to reset the state table (diagnostics/states) and restart the VPN service (Status/OpenVPN).
Have you tried trouble shooting different VPN servers? Try some that have a lot of throughput even if they are far away from you.
us-east.privateinternetaccess.com
us-texas.privateinternetaccess.com
us-california.privateinternetaccess.com
uk-london.privateinternetaccess.comIt is really strange that you can't hit line speeds on a single instance.
-
You mean it's still using the other VPN connection even when you change the firewall rule to one VPN insteadof the gateway group? You might need to reset the state table (diagnostics/states) and restart the VPN service (Status/OpenVPN).
Yup! but only in the end of the download.
Have you tried trouble shooting different VPN servers? Try some that have a lot of throughput even if they are far away from you.
us-east.privateinternetaccess.com
us-texas.privateinternetaccess.com
us-california.privateinternetaccess.com
uk-london.privateinternetaccess.comIt is really strange that you can't hit line speeds on a single instance.
No not yet, but I'm currently using the NL server, which has the highest throughput in Europe and also always have worked flawlessly on my pc client. I can however of course try the others.
![FW rule LAN one VPN.JPG](/public/imported_attachments/1/FW rule LAN one VPN.JPG)
![FW rule LAN one VPN.JPG_thumb](/public/imported_attachments/1/FW rule LAN one VPN.JPG_thumb)
![Bandwidth monitor with VPN2 disabled beginning 3nd try.JPG](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled beginning 3nd try.JPG)
![Bandwidth monitor with VPN2 disabled beginning 3nd try.JPG_thumb](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled beginning 3nd try.JPG_thumb)
![Bandwidth monitor with VPN2 disabled endning 3nd try.JPG](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled endning 3nd try.JPG)
![Bandwidth monitor with VPN2 disabled endning 3nd try.JPG_thumb](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled endning 3nd try.JPG_thumb) -
weird, easiest thing is just ot reboot the whole router and try again.
-
weird, easiest thing is just ot reboot the whole router and try again.
Tried, almost the same result.
![Bandwidth monitor with VPN2 disabled after reboot 4th try.JPG](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled after reboot 4th try.JPG)
![Bandwidth monitor with VPN2 disabled after reboot 4th try.JPG_thumb](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled after reboot 4th try.JPG_thumb) -
Try disabling the other VPN client
-
Try disabling the other VPN client
Close but no cigar.
and I'm leaking my ISP IP DNS
![Bandwidth monitor with VPN2 disabled and stopped after reboot 5th try.JPG](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled and stopped after reboot 5th try.JPG)
![Bandwidth monitor with VPN2 disabled and stopped after reboot 5th try.JPG_thumb](/public/imported_attachments/1/Bandwidth monitor with VPN2 disabled and stopped after reboot 5th try.JPG_thumb) -
So everything is working except you have a DNS leak?
-
So everything is working except you have a DNS leak?
Yes when running with one VPN server shut down.
-
can you post your gateway groups, firewall rules, and nat rules please?
As mentioned before, your latency increasing will be a tradeoff and the only thing you can try to bring it down is other VPN servers.
DNS leaking is usually because you have your DNS being run by PFSense. PFSense in resolver mode will leak your WAN address unless you change your default gateway to the PIA VPN. PFSense set to forward will leak your upstream DNS servers (such as google or open dns if youre using those) regardless of default gateway configuration, unless youre forwarding to another internal DNS server and that server is being routed over the VPN.
-
can you post your gateway groups, firewall rules, and nat rules please?
As mentioned before, your latency increasing will be a tradeoff and the only thing you can try to bring it down is other VPN servers.
DNS leaking is usually because you have your DNS being run by PFSense. PFSense in resolver mode will leak your WAN address unless you change your default gateway to the PIA VPN. PFSense set to forward will leak your upstream DNS servers (such as google or open dns if youre using those) regardless of default gateway configuration, unless youre forwarding to another internal DNS server and that server is being routed over the VPN.
ok I'll have to search around for a better server. I am running DNS ressolver, so will have to look more into that.
![GGroup config.JPG](/public/imported_attachments/1/GGroup config.JPG)
![GGroup config.JPG_thumb](/public/imported_attachments/1/GGroup config.JPG_thumb)
![FW rule LAN to GG.JPG](/public/imported_attachments/1/FW rule LAN to GG.JPG)
![FW rule LAN to GG.JPG_thumb](/public/imported_attachments/1/FW rule LAN to GG.JPG_thumb)
![FW rule WLAN to GG.JPG](/public/imported_attachments/1/FW rule WLAN to GG.JPG)
![FW rule WLAN to GG.JPG_thumb](/public/imported_attachments/1/FW rule WLAN to GG.JPG_thumb)
![FW rule OpenVPN.JPG](/public/imported_attachments/1/FW rule OpenVPN.JPG)
![FW rule OpenVPN.JPG_thumb](/public/imported_attachments/1/FW rule OpenVPN.JPG_thumb) -
can you post your gateway groups, firewall rules, and nat rules please?
As mentioned before, your latency increasing will be a tradeoff and the only thing you can try to bring it down is other VPN servers.
DNS leaking is usually because you have your DNS being run by PFSense. PFSense in resolver mode will leak your WAN address unless you change your default gateway to the PIA VPN. PFSense set to forward will leak your upstream DNS servers (such as google or open dns if youre using those) regardless of default gateway configuration, unless youre forwarding to another internal DNS server and that server is being routed over the VPN.
ok I'll have to search around for a better server. I am running DNS ressolver, so will have to look more into that.
Your current gateway group has both gateways set as tier 1, which will load balance outbound traffic on those gateways. If youre trying to test throughput, the easiest way would be to disconnect one of the gateways at a time. This will guarantee you wont see random load balancing happening in the middle of a test.
your firewall rules will route ALL traffic over the VPN. This will include traffic from your openvpn clients and wifi that might be headed to your LAN.
You also have an error in your openvpn firewall rule, youre only routing UDP traffic over the PIA VPN.You might want to add a rule above the VPN gateway rules that allows traffic headed to your LAN nets to pass. If you create an ALIAS that includes all of your local subnets, you can accomplish this in a single rule. Please see my current config as an example:
https://snag.gy/cGyrFU.jpgEdit:
Please excuse the crappy mspaint job on that screenshot. Local 2 would be my neighbor's subnets.Edit - v2:
By disconnect the gateway, i mean by going to Status -> OpenVPN and stopping one of the clients at a time. I thought my wording was ambiguous and needed clarification.Walk through of my rules from PIAVPN section down:
-all sources headed to sites listed in URL TUNNEL BYPASS will route direct through WAN (certain sites dont like PIA VPN IP addresses, so you'll have to route them out normally)
-second rule forces traffic that isnt destined for local subnets over the PIA VPN.
in the LAN section:
-traffic headed to my neighbor gets routed to the gateway on his side
-allow all outbound traffic from LAN via WAN gateway. (Hosts that are a member of my TUNNEL BYPASS alias get routed by this rule due to inverse matching on PIA Section rule 2)This allows traffic to flow between my openvpn clients to lan and vice versa.
Edit - v3:
Here is a screenshot of my openvpn firewall routing rules:
https://snag.gy/Kc2hOD.jpg -
all you have to do to plug your DNS leak with the resolver is select your PIA interface as your only outbound interface.
-
all you have to do to plug your DNS leak with the resolver is select your PIA interface as your only outbound interface.
changing the pia vpn gateway to the default gateway accomplishes this.
https://snag.gy/QoWkB9.jpg
-
Your current gateway group has both gateways set as tier 1, which will load balance outbound traffic on those gateways. If youre trying to test throughput, the easiest way would be to disconnect one of the gateways at a time. This will guarantee you wont see random load balancing happening in the middle of a test.
This is what I've been trying to do for the last page and a half with pfbasic. The pictures i attached by your request was for the normal setup. Just to clarify :)
your firewall rules will route ALL traffic over the VPN. This will include traffic from your openvpn clients and wifi that might be headed to your LAN.
You also have an error in your openvpn firewall rule, youre only routing UDP traffic over the PIA VPN.You might want to add a rule above the VPN gateway rules that allows traffic headed to your LAN nets to pass. If you create an ALIAS that includes all of your local subnets, you can accomplish this in a single rule. Please see my current config as an example:
https://snag.gy/cGyrFU.jpgEdit:
Please excuse the crappy mspaint job on that screenshot. Local 2 would be my neighbor's subnets.Edit - v2:
By disconnect the gateway, i mean by going to Status -> OpenVPN and stopping one of the clients at a time. I thought my wording was ambiguous and needed clarification.Walk through of my rules from PIAVPN section down:
-all sources headed to sites listed in URL TUNNEL BYPASS will route direct through WAN (certain sites dont like PIA VPN IP addresses, so you'll have to route them out normally)
-second rule forces traffic that isnt destined for local subnets over the PIA VPN.
in the LAN section:
-traffic headed to my neighbor gets routed to the gateway on his side
-allow all outbound traffic from LAN via WAN gateway. (Hosts that are a member of my TUNNEL BYPASS alias get routed by this rule due to inverse matching on PIA Section rule 2)This allows traffic to flow between my openvpn clients to lan and vice versa.
Edit - v3:
Here is a screenshot of my openvpn firewall routing rules:
https://snag.gy/Kc2hOD.jpgThank you, will try this when i get home.
-
Thank you for that detailed description. I do have few questions for you isolatedvirus anyways, since I'm a total noob in these things.. :-[
When I try to make the first FW rule you have directly under your anti-lockout rule, it puts it into my OpenVPN FW rules page. what am I doing wrong?
Is your "Internet_Gateway_Group" your VPNGG?
What are your "Tunnel_failover_Group" directing to?
In the FW rule to bypass certain websites, what action have you set it to?
What is in your "! Tunnel bypass" alias?
Your "LOCAL Subnets" alias is it done with all specific IP's on the local network or can it be done with ranges? ie. all who gains acces to my AP on the WLAN interface. Or even simpler, just type in my LAN and WLAN IP's?I have gotten the URL_Bypass rule to work, somewhat. By setting the gateway to WAN. I included www.ipmonkey.com to check if the connection was going around my VPN and it seems to do so, but one webpage I included (a local broadcasting company, who has geolock on some of their videos) still says I'm not in the approved country and therefore denied to watch the video.
-
This is what I've been trying to do for the last page and a half with pfbasic. The pictures i attached by your request was for the normal setup. Just to clarify :)
I know you were setting up load balancing but i saw you were having issues testing throughput over each individual link. Theres nothing wrong with marking a gateway as down then testing, i just do it differently and wanted to provide another option for your 'arsenal' if you will :)
When I try to make the first FW rule you have directly under your anti-lockout rule, it puts it into my OpenVPN FW rules page. what am I doing wrong?
When youre creating the rule you have the interface set as your openvpn interface.Is your "Internet_Gateway_Group" your VPNGG?
No. I have a fiber line ran to my neighbor, and if my internet goes out my traffic routes over his WAN and vice versa. "Internet Gateway Group" for me is just my WAN set as tier 1, and my neighbor's set as Tier 2.What are your "Tunnel_failover_Group" directing to?
"Tunnel failover group" for me is set as: PIA VPN Gateway - Tier 1, WAN - Tier 2, Neighbor's WAN - Tier 3. I have it set like this so should my PIA VPN drop, all outbound traffic isnt stopped.In the FW rule to bypass certain websites, what action have you set it to?
PassWhat is in your "! Tunnel bypass" alias?
"Tunnel Bypass" is an alias group with gaming consoles in it. Its anything that i never want to go over the VPN. the "!" in the rule denotes inverse matching, meaning 'not a member of the tunnel bypass group'. The actual group name has nothing to do with inverse matching, and doesnt have an exclamation point in it. Thats purely there to show the inverse matching on the rule.Your "LOCAL Subnets" alias is it done with all specific IP's on the local network or can it be done with ranges? ie. all who gains acces to my AP on the WLAN interface. Or even simpler, just type in my LAN and WLAN IP's?
I have my local subnets set as a CIDR range. So youd put 10.0.0.0/24, 10.0.100.0/24, etc. Depending on the actual subnet IP's.I have gotten the URL_Bypass rule to work, somewhat. By setting the gateway to WAN. I included www.ipmonkey.com to check if the connection was going around my VPN and it seems to do so, but one webpage I included (a local broadcasting company, who has geolock on some of their videos) still says I'm not in the approved country and therefore denied to watch the video.
You've got the rule set up correctly, but you might have the rule order wrong then. Since its first match, youd want the rule for bypass above the rule for the VPNGG that you have.Sorry for the late response, I was working on my truck and didnt realize the time lol.
Edit:
A good way to test the URL bypass is to add any of the "Whats my ip address" websites to the bypass group. That way you can debug the routing/firewall rules quickly by just going to a website and seeing which IP shows up. -
I know you were setting up load balancing but i saw you were having issues testing throughput over each individual link. Theres nothing wrong with marking a gateway as down then testing, i just do it differently and wanted to provide another option for your 'arsenal' if you will :)
:D
Sorry for the late response, I was working on my truck and didnt realize the time lol.
No worries.
I have my local subnets set as a CIDR range. So youd put 10.0.0.0/24, 10.0.100.0/24, etc. Depending on the actual subnet IP's.
I tried this, but it makes the ip list wierd and i think this broke the rest of the setup.
I have gotten the URL_Bypass rule to work, somewhat. By setting the gateway to WAN. I included www.ipmonkey.com to check if the connection was going around my VPN and it seems to do so, but one webpage I included (a local broadcasting company, who has geolock on some of their videos) still says I'm not in the approved country and therefore denied to watch the video.
You've got the rule set up correctly, but you might have the rule order wrong then. Since its first match, youd want the rule for bypass above the rule for the VPNGG that you have.After I made the LOCAL subnet and new WAN GG it pushes me over VPN.
Edit:
A good way to test the URL bypass is to add any of the "Whats my ip address" websites to the bypass group. That way you can debug the routing/firewall rules quickly by just going to a website and seeing which IP shows up.This I did, and it now shows my VPN IP.
So I reverted back to a backup of a clean simple install with WLAN so I could get everything set up as you have, but it doesn't seem to be working quite right. I have tried to comment above on what I've found.
Sorry for the short reply, but I only got 2 hours of tinkering done and am now off to bed. can of course elaborate on it tomorrow if you need more info.
I have attached photos of what I made.
On the Local subnet i put in 192.168.1.1-192.168.1.245 /24 (as an example), but instead of listing every ip ending with 1 to 245 it makes these jumps as you see on the picture and also it sets the subnet, this also applies to the WLAN.![FW Rules Lan.JPG](/public/imported_attachments/1/FW Rules Lan.JPG)
![FW Rules Lan.JPG_thumb](/public/imported_attachments/1/FW Rules Lan.JPG_thumb)
![FW Rules OpenVPN.JPG](/public/imported_attachments/1/FW Rules OpenVPN.JPG)
![FW Rules OpenVPN.JPG_thumb](/public/imported_attachments/1/FW Rules OpenVPN.JPG_thumb)
![Gateway Groups.JPG](/public/imported_attachments/1/Gateway Groups.JPG)
![Gateway Groups.JPG_thumb](/public/imported_attachments/1/Gateway Groups.JPG_thumb)
![FW Aliases.JPG](/public/imported_attachments/1/FW Aliases.JPG)
![FW Aliases.JPG_thumb](/public/imported_attachments/1/FW Aliases.JPG_thumb) -
your Internet_GG group is the PIA VPN gateways. so youre routing all traffic through the VPN, and nothing is bypassing it.
On your openvpn interface, youll want a rule to allow all traffic and dont set a gateway. this will allow traffic headed to local subnets to be routed correctly.
I figured id offer a remote screen share session over skype or something else. I'll be able to see the config live and fix any issues you have. The only thing I'd ask is since we'd be troubleshooting over voice and screen share that you post screenshots of what we had to do so there's something in the forums for other users to view in case they're in a similar situation.
-
I figured id offer a remote screen share session over skype or something else. I'll be able to see the config live and fix any issues you have. The only thing I'd ask is since we'd be troubleshooting over voice and screen share that you post screenshots of what we had to do so there's something in the forums for other users to view in case they're in a similar situation.
That is very generous of you and I will gladly accept your offter! I will definitely post screenshots of the whole setup when we're done.
my time zone is GMT+1 so right now its 7 am, I'm leaving for university in 5 mins and will be back in roughly 6½ hours. at 1.30 pm If you at any time after that point have time please reply and we will set something up.If there is any program you prefer we use, we use that program. I have only used Teamviewer before.