pfSense (OpenVPN Setup)

This guide explains how to configure a router running pfSense with Private Internet Access (PIA) OpenVPN configuration files. 

Note: These steps are written for pfSense CE 2.8.1. Some labels may differ slightly on older pfSense versions. 

Jump To:

Step 1: Download the OpenVPN Configuration Files

  1. Log into your PIA account.

PIA login screen.

  1. Go to Downloads.

PIA account interface showing the "Downloads" option highlighted.

  1. Scroll down to the OpenVPN configuration files and download the one that best fits your needs. (You can find more about PIA’s OpenVPN configuration files here).

PIA Downloads section showing the "OpenVPN Configurations" section highlighted.

  1. Once downloaded, extract the downloaded archive.

Linux desktop showing the "Extract" options for an archive.

Step 2: Import the PIA Certificate Authority

The certificate authority file authenticates your connection to PIA's servers. To import it:

  1. Log into the pfSense web interface.
  2. Go to System > Certificates > CAs.
  3. Click Add.
  4. In Descriptive name, enter a name for the certificate authority, such as PIA.2048 or PIA.4096.
  5. Set Method to Import an Existing Certificate Authority.
  6. Open the PIA certificate authority file that matches your chosen configuration. You will find it in the openvpn folder extracted from the archive you downloaded earlier. In this example, the file is named ca.rsa.2048.crt.

OVPN folder showing the certificate authority file highlighted.

  1. Open the certificate file in a text editor and copy the full contents, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.

Certificate authority OVPN file showing the certificate text.

  1. Paste the certificate into Certificate Data.
  2. Click Save.

Step 3: Configure the OpenVPN Client

For this step, use the data from one of the .ovpn configuration files in the OpenVPN folder where you found the certificate file. This guide uses the us_california.ovpn configuration.

  1. Open an ovpn configuration file.

California server OVPN configuration showing the configuration details.

  1. Note the details you will need for the steps below.

California server OVPN configuration showing the configuration details.
 Then, in your pfSense router interface:

  1. Go to VPN > OpenVPN > Clients.
  2. Click Add.
  3. Configure the following settings:
  • Server Mode: Peer to Peer (SSL/TLS)
  • Device mode: tun – Layer 3 Tunnel Mode
  • Interface: WAN
  • Protocol: match the proto line in your .ovpn file (UDP on IPv4 only or TCP on IPv4 only)
  • Local port: leave blank
  • Server host or address: Enter the hostname from the remote line in your .ovpn file (for example, us-california.privacy.network)
  • Server port: Enter the port from the same remote line (for example, 1198)
  • Proxy host or address: Leave blank
  • Proxy port: Leave blank
  • Proxy Authentication: None
  • Description: Enter a name for this connection, such as “PIA California.”
  1. Under User Authentication Settings: 
  • Username: Enter your PIA username (format: p1234567)
  • Password: Enter your PIA password
  1. Under Cryptographic Settings: 
  • Use a TLS key: Uncheck this.
  • Peer Certificate Authority: Select the certificate you imported in Step 2.
  • Data Encryption Algorithms: Select the available AES-GCM options, such as AES-256-GCM and AES-128-GCM.
  • Fallback Data Encryption Algorithm: Select AES-128-CBC.
  • Auth Digest Algorithm: Match the auth line in your .ovpn file (for example, SHA1).
  • Compression: Disable compression.
  1. In the Clients tab, check the following two options:
  • Don’t Pull Routes
  • Pull DNS
  1. In Custom options, paste the following:

persist-key

persist-tun

remote-cert-tls server

reneg-sec 0

auth-retry interact

  1. Set Gateway Creation to IPv4 only.
  1. Click Save.

Step 4: Assign the OpenVPN Interface

  1. Go to System > Routing and set the default gateway to your WAN gateway.
  2. Go to Interfaces > Assignments.
  3. In Available network ports, select the OpenVPN client interface for your PIA connection.
  4. Click Add.
  5. Click on the newly created OPT interface to open it.
  6. Check Enable.
  7. In Description, enter “PIA_VPN.”
  8. Click Save > Apply Changes.
  9. Go back to VPN > OpenVPN > Clients, open the PIA client entry, and click Save without making any changes. This refreshes the OpenVPN configuration after assigning the interface.

Step 5: Configure Outbound NAT

  1. Go to Firewall > NAT > Outbound.
  2. Select Manual Outbound NAT rule generation and click Save.
  3. Click Add to create a new rule and configure the following:
  • Interface: Select the PIA_VPN interface you created in Step 4.
  • Address Family: IPv4
  • Protocol: Any
  • Source: LAN net
  • Destination: Any
  • Translation / target: Interface address
  • Description: NAT LAN through PIA VPN
  1. Click Save > Apply Changes.
  2. Make sure this rule appears above any broader matching NAT rules.

Step 6: Route LAN Traffic Through the VPN

First, configure pfSense to skip policy-routing rules when their selected gateway goes down:

  1. Go to System > Advanced > Miscellaneous.
  2. Enable Do not create rules when gateway is down.
  3. Click Save.

Next, create the VPN routing rule:

  1. Go to Firewall > Rules > LAN.
  2. Click Add to create a new rule above the default LAN rule.
  3. Configure the following settings:
  • Action: Pass
  • Interface: LAN
  • Address Family: IPv4
  • Protocol: Any
  • Source: LAN net
  • Destination: Any
  1. Click Display Advanced and set Gateway to the PIA OpenVPN gateway.
  2. In Description, enter “Route LAN through PIA VPN.”
  3. Click Save > Apply Changes.

Then, add a fallback block rule directly below the VPN routing rule and above the default LAN rule:

  • Action: Block
  • Interface: LAN
  • Address Family: IPv4
  • Protocol: Any
  • Source: LAN net
  • Destination: Any
  • Description: Block LAN traffic if PIA VPN is unavailable

Click Save > Apply Changes. This rule order prevents LAN traffic from falling back to the WAN connection if the PIA gateway goes down.

Note: This guide routes IPv4 traffic through the VPN. If IPv6 is enabled on your network, IPv6 traffic may use your regular connection unless you disable IPv6 or configure IPv6 routing separately.

Step 7: Confirm the VPN Connection

  1. Go to Status > OpenVPN and confirm that the PIA client shows as connected.
  2. From a device connected to your LAN, visit an IP-checking page such as PIA’s What’s My IP Address and confirm that the public IP address matches your selected PIA server location.

Related articles