Load Balancing Across Multiple OpenVPN Clients Causes Intermittent Internet Loss

PnetG

Hi Community,

I am experiencing a persistent issue with load balancing across multiple OpenVPN clients on pfSense 26.x. When I enable load balancing, internet access becomes intermittent for multiple PCs on my LAN, requiring an ipconfig /renew to restore connectivity temporarily. The failover gateway group works perfectly, but the load balanced group is unstable.

My Environment:

pfSense Version: 26.x (Plus/CE)
WAN: PPPoE with MTU 1492.
VPN Clients: 3+ OpenVPN clients configured successfully. Each client works individually without issue.
MTU/MSS Fix: I have already applied the standard PPPoE fix: OpenVPN DCO interface MTU=1400/MSS=1360, and Advanced Config tun-mtu=1500/mssfix=1360. This resolved speed issues when using a single VPN.
Gateway Groups:
- VPN_Failover (Tier 1: VPN1, Tier 2: VPN2, Tier 3: VPN3, etc.) - STABLE
- VPN_Balance (Tier 1: VPN1+VPN2, round-robin) - UNSTABLE
LAN Firewall Rules:
- Rule 1: Pass, Source: LAN net, Gateway: VPN_Failover (Enabled)
- Rule 2: Pass, Source: LAN net, Gateway: VPN_Balance (Enabled)
- Rule 3: Pass, Source: LAN net, Gateway: WAN (Enabled)
- Default allow rule is disabled.

My Issues:
When I disable Rule 1 (VPN_Failover) and Rule 2 (VPN_Balance) becomes active, internet access is fast but unstable. After 5-10 minutes of use, multiple PCs will lose internet access simultaneously. Pinging the gateway (pfSense LAN IP) fails. Running ipconfig /renew on the affected PCs restores connectivity for a short time, but the issue repeats. The failover group does not exhibit this behavior.

My Troubleshooting:

Confirmed the issue is not related to the DHCP service (tested with both Kea and ISC dhcpd with no change in behavior).
Tried state handling options on the load balance rule (sloppy state, Disable reply-to, State Timeout 300s). This did not solve the problem.
Confirmed rule order is correct (active rules above disabled ones).
The issue occurs even with a simple two-client load balance (VPN1+VPN2).

My Thoughts:
I believe the issue is related to asymmetric routing. When the load balancer switches paths for a device's connection, pfSense's state table may become corrupted because return packets arrive via a different VPN tunnel than they left on. This seems to break the connection tracking, leading to the symptoms described.

My Question:
Has anyone successfully implemented stable load balancing across multiple OpenVPN clients on pfSense 26.x? Is there a specific setting or configuration I am missing to make the state table tolerant of these path changes? Is this a known limitation with consumer-grade OpenVPN providers?

Any ideas or guidance would be greatly appreciated. Thank you!

q54e3w

@PnetG
Try enabling sticky connections. Might help
Also potentially VPN address and NAT related. What are the interface and gateway addresses?

PnetG

@q54e3w Your suggestion was correct. The issue was the sticky connections timeout. I set the "Source tracking timeout" back to the default of 0 seconds. Load balancing is now stable. will monitor for the next 24hours, hopefully this is working. Appreciate your help!