Connecting pfSense to Multiple OpenVPN Client Instances Creates Traceroute Drops

pfBlense

I have connected my pfSense box to two OpenVPN Servers. I route specific LAN IPs through specific OpenVPN servers. However, when I connect pfSense to both OpenVPN Servers, computers/devices routing through any of the OpenVPN servers would drop packets or services do not work or http requests would hang for a bit. Here is an example of traceroute/pings under both circumstances:

Single Connection to OpenVPN Server - Traceroute from LAN-Client IP


 1  10.8.0.1 (10.8.0.1)  87.403 ms  86.146 ms  85.895 ms
 2  192.168.1.254 (192.168.1.254)  86.942 ms  86.806 ms  86.677 ms
 3  99._._.2 (99._._.2)  107.517 ms  107.918 ms  108.015 ms
 4  75.20.1.0 (75.20.1.0)  214.566 ms  108.796 ms  107.975 ms
 5  12.83.38.145 (12.83.38.145)  113.240 ms
    12.83.38.129 (12.83.38.129)  110.231 ms
    12.83.38.145 (12.83.38.145)  311.703 ms
 6  cr1.la2ca.ip.att.net (12.123.132.129)  204.962 ms  202.887 ms  108.571 ms
 7  * * *
 8  209.85.240.225 (209.85.240.225)  141.705 ms
    64.233.174.100 (64.233.174.100)  197.027 ms
    209.85.242.23 (209.85.242.23)  274.355 ms
 9  google-public-dns-a.google.com (8.8.8.8)  135.617 ms  168.050 ms  109.055 ms

Two Connections to OpenVPN Server - Traceroute from LAN-Client IP


 1  * 10.8.0.1 (10.8.0.1)  86.313 ms *
 2  * * 192.168.1.254 (192.168.1.254)  90.782 ms
 3  * 99._._.2 (99._._.2)  110.192 ms *
 4  * 75.20.1.0 (75.20.1.0)  135.562 ms *
 5  * * 12.83.38.129 (12.83.38.129)  292.533 ms
 6  * * cr1.la2ca.ip.att.net (12.123.132.129)  126.212 ms
 7  * * *
 8  * * *
 9  * * google-public-dns-a.google.com (8.8.8.8)  121.876 ms

Single Connection to OpenVPN - 100 Pings to 8.8.8.8 from LAN-Client IP


--- 8.8.8.8 ping statistics ---
100 packets transmitted, 100 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 106.729/158.429/540.726/78.707 ms

Two Connections to OpenVPN - 100 Pings to 8.8.8.8 from

Initial Attempt

--- 8.8.8.8 ping statistics ---
100 packets transmitted, 0 packets received, 100.0% packet loss

Second Attempt

--- 8.8.8.8 ping statistics ---
100 packets transmitted, 99 packets received, 1.0% packet loss
round-trip min/avg/max/stddev = 107.028/128.548/270.874/37.246 ms

Two Connections to OpenVPN Server - Traceroute from pfSense Box


 1  10.8.0.1 (10.8.0.1)  82.837 ms  82.702 ms  83.306 ms
 2  192.168.1.254 (192.168.1.254)  188.795 ms  83.066 ms  83.194 ms
 3  99._._.2 (99._._.2)  105.057 ms  104.097 ms  104.683 ms
 4  75.20.1.0 (75.20.1.0)  107.061 ms  104.000 ms  105.557 ms
 5  12.83.38.145 (12.83.38.145)  210.801 ms
    12.83.38.129 (12.83.38.129)  216.573 ms
    12.83.38.145 (12.83.38.145)  207.713 ms
 6  cr1.la2ca.ip.att.net (12.123.132.129)  164.689 ms  196.122 ms  105.273 ms
 7  * * *
 8  209.85.240.225 (209.85.240.225)  105.919 ms
    209.85.242.21 (209.85.242.21)  128.159 ms  207.973 ms
 9  google-public-dns-a.google.com (8.8.8.8)  105.925 ms  106.250 ms  211.623 ms

As you can see the traceroute from pfSense itself is fine when the pfSense box is connected to both OpenVPN servers. So it seems to have to do with something on the routing/ipTables end of things. Somehow when pfSense is connected to both OpenVPN servers packets start getting lost or something. The routing/ipTables works fine when only connected to one OpenVPN server so I'm thinking my NAT and Firewall rules are fine. But here they are for your reference.

![Screen Shot 2015-05-09 at 12.10.13 PM.png](/public/imported_attachments/1/Screen Shot 2015-05-09 at 12.10.13 PM.png)
![Screen Shot 2015-05-09 at 12.10.13 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2015-05-09 at 12.10.13 PM.png_thumb)
![Screen Shot 2015-05-09 at 12.09.40 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2015-05-09 at 12.09.40 PM.png_thumb)
![Screen Shot 2015-05-09 at 12.09.40 PM.png](/public/imported_attachments/1/Screen Shot 2015-05-09 at 12.09.40 PM.png)

pfBlense

Update

So I just systematically went through my setup point by point. Here is what went wrong:

Under Interfaces –> (assign) the network port was wrongly assigned to one of the OpenVPN interfaces.

Under Firewall –> Rules --> LAN my redirect rule for one of the OpenVPN interfaces didn't have the right Gateway.

Both of these should have pointed to the OpenVPN connection in question. But my Interface pointed to an extra ethernet port which is not connected and my firewall was going through my "default" WAN interface.

I think what threw me off was that the connection sort of worked when they both were connected and completely worked when only one was connected. So I didn't immediately expect an Interface issue although the Rules I picked up on pretty quick. Anyway… Hope this will help someone in the future. It was a minor issue but took me hours of headache.