I'm having some trouble getting OpenVPN working on my pfSense box. The issue is quite strange to me.

When I have the OpenVPN turned on, only my router is able to connect to the Internet. From the router I can use ping, links, etc., and connections work exactly as expected - through the VPN, with the IP address assigned by my VPN provider (Proxy.sh, incidentally).

However, none of the clients on the local network can connect to the Internet. I get timeouts when using ping or a web browser. I can ping my router, and the IP address of the gateway.

When I switch the default gateway from the VPN to my ISP's gateway, all works exactly as expected.

Here the routing table (netstat -r) when in VPN mode, and a key for it:

Destination     Gateway     Flags   Refs    Use  Mtu     Netif   Expire       10.XX.X.53  UGS     0       122  1500    ovpnc1  =>
default         10.XX.X.53  UGS     0       235  1500    ovpnc1         10.XX.X.53  UGHS    0       82   1500    ovpnc1   
10.XX.X.1/32  UGS     0       0    1500    ovpnc1   
10.XX.X.53      link#12     UH      0       0    1500    ovpnc1   
10.XX.X.54      link#12     UHS     0       0    16384   lo0  
ZZ.XX.XXX.0/20  link#1      U       0       83   1500    re0  
ZZ.XX.XXX.XXX   link#1      UHS     0       0    16384   lo0       link#9      UH      0       12   16384   lo0  UGS     0       123  1500    ovpnc1  link#11     U       0       1434 1500    ue0     link#11     UHS     0       0    16384   lo0  
Y.Y.Y.Y/32      ZZ.XX.XXX.1 UGS     0       249  1500    re0 

IP addresses

  • 10.XX.X.53/54 - My DHCP-assigned IP address/pair from the VPN provider
  • ZZ.XX.XXX.XXX - My external IP assigned by my ISP
  • Y.Y.Y.Y - The external IP assigned by the VPN provider


  • ovpnc1 - My VPN client interface
  • re0 - My LAN interface
  • ue0 - My WAN interface

This looks essentially what I would expect it to be. The default route is through the VPN provider. The VPN address is routed through the ISP-assigned IP address. I am not sure what would be wrong here.

So figuring this was a firewall issue, I basically tried enabling all in/out traffic. This did not seem to remedy the problem.

Also figuring it could possibly be some client networking issue, I restarted the clients on the LAN. This did not help.

I also ran route flush and reset the routes manually.

So I am a bit stumped, and would be very grateful for any thoughts on what the problem might be.


Normally, you must provide an instruction to forward IPv4 traffic from the LAN to the new interface which the VPN provides, be it tun0 or tap0.

I am way too rusty with pf to try and suggest how to do it. With iptables you would use this command:

 iptables --table nat --append POSTROUTING --out-interface tap0/tun0 -j MASQUERADE

I hope this will provide a push in the right direction, even though this is not a solution.

  • Thanks for the comment. These are my thoughts exactly, but alas trying manual NAT rules has not yet alleviated the problem. I appreciate the suggestion though. – Brian M. Hunt Oct 30 '13 at 11:56

To resolve this I had to go to:

pfSense -> Firewall -> NAT -> Outbound -> Manual Outbound NAT rule generation (AON - Advanced Outbound NAT)

From there I had to move all the OPT1 mappings to the top (i.e. above the WAN mappings).

Note as well that:

  1. in the firewall rules I had to set an rule for all incoming traffic on the LAN subnet to have it use the Proxy-Gateway. Looks like this in the rule list of pfSense:
IPv4 TCP LAN net * * 80 (HTTP) ProxySHGW none "LAN Subnet to Proxy.sh gateway"
  1. I kept the default gateway as the WAN, but had to add the ProxySHGW gateway used by the above rule.

I hope that helps someone else along the way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.