Send everything your TVs and streaming boxes do through a WireGuard VPN tunnel, with a second VPN as backup and your normal internet line as the last resort, so the TVs never go offline. This guide follows the setup of a home network: three TVs (a Sony TV, a Samsung TV and an Nvidia Shield) at 192.168.2.60–.69, NordVPN as the first tunnel, IPVanish as the backup, and the internet line (Ziply) last.
At a glance:
| Step | Where | What |
|---|---|---|
| 1 | Network › DHCP server, Firewall › Aliases & objects | A fixed address for each TV, and one group for all of them |
| 2 | VPN › WireGuard | The VPN tunnels on (a client tunnel per VPN server) |
| 3 | Firewall › NAT › Source NAT | Outbound NAT through each tunnel |
| 4 | Network › Policy routing › Gateway groups | The order: VPN 1, VPN 2, then the internet line |
| 5 | Network › Policy routing › Policy routes | All TV traffic to the group, as the first route |
| 6 | Review and commit | Commit, and clear the TVs' old connections |
| 7 | Firewall › NAT translations, Monitoring › Traffic verification | Check that the TVs really use the tunnel |
The firewall recognises the TVs by their addresses. Give each TV a DHCP reservation (Network › DHCP server › Reservations: its MAC address and a fixed address such as .60, .61, .62). Then, in Firewall › Aliases & objects, make one address object for all of them, for example StreamingTV = 192.168.2.60/30, 192.168.2.64/30, 192.168.2.68/31 (the range .60–.69). Every device you add later in that range is covered.
VPN › WireGuard: each VPN server is one tunnel in the Client role (import the provider's WireGuard file with Import configuration, or enter the key, address and server). Zone WAN. Tick Enabled on each tunnel you want to use, give it a description, and Save to pending changes.
After the commit, Tunnel status shows each tunnel online with a recent handshake. A tunnel that stays offline with never as the last handshake and 0 B received is refused by the VPN server: its key or file is out of date. Download a new WireGuard file from your VPN account and import it again.
Two tunnels with the same address: some providers (NordVPN) give every client the same tunnel address (10.5.0.2). Turn on only one such tunnel at a time, or give each the address with /32.
Traffic that leaves through a tunnel must carry the tunnel's own address, or the VPN server drops it. Firewall › NAT › Source NAT › Add source NAT for each tunnel: type Masquerade, out interface the tunnel (wg0, wg2), sources any. A configuration imported from pfSense often has outbound NAT only for the internet line: add the tunnels.
Network › Policy routing › Gateway groups › Add gateway group (or edit the existing one, here TV_VPN):
The list shows each member's state; the active one carries the traffic.
A VPN account allows one connected tunnel per key at a time. If two tunnels of the same account are connected together (two NordVPN servers in one group, or the same tunnels on both firewalls of a failover pair), the provider keeps dropping one of them: the tunnels go up and down, pings are lost, and the group switches back and forth. Fastest and Load balance keep every member connected, so do not use them for tunnels of one account.
From 1.1.30, tick Connect only the active tunnel (failover mode): only the tunnel that carries the traffic is connected; the others stay configured but idle (no handshake, no keepalive, no pings) until they are needed. When the active tunnel fails, the next one is woken and must answer (a handshake within 10 seconds and 2 pings) before it carries the traffic; a tunnel whose key the provider no longer accepts is marked failed and skipped. Return to the first tunnel: Never stays on the tunnel that works; Periodically tests tier 1 again (with the same provider key this interrupts the traffic for a few seconds).
One tunnel per provider account (the next release): the limit is one connection per account, so a group with NordVPN 1-5 and IPVanish 1-5 may keep one tunnel of each provider connected. In the group editor, Connected tunnels offers Keep every tunnel connected, One tunnel per provider account and Only the active tunnel (the setting above, one connection in total). With One tunnel per provider account the first working NordVPN tunnel carries the traffic and the first working IPVanish tunnel is ready (connected and pinged, standing by); the other tunnels are on standby (idle). When the NordVPN tunnel fails, the IPVanish tunnel carries the traffic in the same second while NordVPN 2 connects in the background; once NordVPN 2 answers, the traffic goes back to it, because NordVPN comes first in your order (untick Go back to the earlier tunnel once it is connected to stay on IPVanish until it fails). Give the tunnels of each provider the same Account; the VPN wizard fills it in and chooses this mode when the tunnels belong to two or more accounts.
In a failover pair, the standby firewall keeps all its provider tunnels idle from 1.1.30: only the active firewall connects to the provider.
Policy routes › Add policy route: from LAN, source StreamingTV, destination any, Send via gateway group TV_VPN. Move it to #1 with the arrows: policy routes are checked top to bottom and the first match decides, so a route further up (for example "Google & YouTube via another group") would otherwise take the TVs' YouTube elsewhere.
One exit per TV. Turn off separate routes that send only part of the TVs' traffic (for example only Netflix) through another tunnel. A streaming service that sees one TV come from two different addresses at once is more likely to show a VPN or proxy error. Also check that the TVs have no IPv6 route to the internet outside the tunnel: a TV that reaches the service over IPv6 from your home address while its IPv4 comes from the VPN gives the VPN away. (In the example the internet line has no IPv6, so there is no leak.)
Review and commit, with Clear old connections the change affects ticked (from 1.1.29), then Commit.
Why clearing matters: a route change only applies to new connections. A connection that was open before keeps its old path, because its address translation is fixed at its first packet: after the change, its packets would go into the tunnel with the internet line's address, and the VPN server drops them. The TV then hangs until the app gives up. Clearing ends those connections at once; the TV opens new ones, which use the tunnel. A playing video rebuffers once.
The same happens at a failover of the group and at a schedule that starts blocking, and when you isolate a device: from 1.1.29 Korthveil clears the affected connections in those cases by itself. By hand, each policy route and gateway group has Clear connections.
Firewall › NAT translations, filtered by a TV's address: the translated source must be the tunnel's address (10.5.0.2 for NordVPN), not your internet address.
From 1.1.29, Monitoring › Traffic verification shows the same for every route and NAT rule at once: per connection what the configuration expects (rule, NAT, route, tunnel) and what really happens, with mismatches in red and Clear mismatching next to them.
The pictures are from the home rack firewall korthmain, 2 November 2026. Addresses of the internet line are not shown.