Help debugging a multi-VPN setup

  • Hello, all,

    I'm trying to fix a semi-complex (at least as far as my knowledge goes) Open VPN setup on my end.

    First, I'm running a site-to-site setup of my parents' and my network to make things easy to work with when they need assistance. I can get this running, for the most part. I run the VPN server on my pfsense box then have the little one at my parents' that runs a client that connects. I have this working pretty well as I said, the problem comes though when I try to get the next part going.

    Second, I want to run a PIA VPN because, frankly, I don't trust Comcast. I want most of the devices going through this except for things like the Rokus around the house. Again, following the instructions, I can get this going and a connection setup. However, I only want certain devices to use this. To accomplish this, I set up an alias called SECURE with all the static IPs that I have pfSense assign based on MAC addresses. I want to pass all SECURE traffic through the PIAVPN interface (set this up too, same as the S2SVPN, which gives me 4 interfaces: LAN, WAN, S2SVPN, and PIAVPN). BUT the problem is I am apparently not routing traffic correctly. Things like Netflix say I'm behind a proxy unless I turn off OpenVPN. So, where all do I need to set what? I have rules in floating currently (drop all NO_WAN_EGRESS), in OUTBOUND, in NAT, etc. I can gather them all, but I think it may be best for someone with more knowledge to start pointing me in the right direction because I believe I have a lot of redundancy that is hurting me.


  • First, I don't think you need floating rules (most people don't) so I would get rid of those for now as they can certainly cause issues.  I have 5 OpenVPN clients and an ovpn server set up on my pfSense at home, with some pretty detailed policy routes + outbound NAT, and no floating rules needed.

    Netflix blocks most VPNs nowadays and it's whack-a-mole.  I don't know exactly what the latest advice is on that because I use Netflix without VPN and it works fine but you may need to find a different VPN provider to make that work if you absolutely must route Netflix via VPN.  That isn't a pfSense issue.

    It sounds like you've done the right things for the most part, the alias, the policy-based routing rules etc. Aside from Netflix, what exactly is not working? If you need the devices in the "SECURE" IP alias group to also talk to your parents house, then you probably need the rule that sends traffic there to be ABOVE whatever generic VPN routing rule you have.

  • LAYER 8 Netgate

    You have two basic choices:

    Enable Don't Pull Routes on the client connection and policy route certain traffic out the VPN.

    Leave Don't Pull Routes checked and policy route the exceptional traffic (like your Roku devices) out the WAN_GW directly.

  • First, thank you to both of you. I had given up hope of getting a reply and thus hadn't checked.

    @luckman212, my goal is NOT to use the secure VPN for Roku. Ideally my traffic all goes out the normal WAN. The exceptions are that traffic to and from SECURE goes out ONLY on the secure VPN and traffic that is not SECURE but tries to go to the parent's LAN goes out that VPN. The fact that Netflix is giving me problems means I'm sending traffic out the wrong way, I just don't know how to fix it or where to start.  :( Currently I have removed all of the SECURE VPN stuff and things are working as expected. How do I add my SECURE VPN back in without breaking everything?

    @Derelict, I'm afraid I don't follow. Could you elaborate some?

    Thank you both!

  • LAYER 8 Netgate

  • @Derelict, that's extremely similar to what I did with my privacy VPN connection. After that, I created an interface for that connection and I tried to route all SECURE traffic through it.

  • LAYER 8 Netgate

    And what?

  • Take a look at this document. It describes almost exactly what you want.

  • LAYER 8 Netgate

    I just perused that. It looks pretty solid. I like tag/match instead of Skip Rules when Gateway is Down but other than that…

  • Give a newbie a hand please  :) Tag/match should be done by floating rules in this context I suppose ?

  • LAYER 8 Netgate

  • Sty make sure you don't have "redirect-gateway def1" in your advanced configuration for the PIA VPN.  That will override all of your policy based routing and send all traffic through the VPN by setting your default gateway to the VPN.