Send chosen devices and sites through NordVPN, fall back to IPVanish when NordVPN fails, and never leak outside the VPN when both are down. Then bring over a pfSense setup: aliases, schedules, LAN rules, and gateway groups. The screenshots are from a test firewall with two WireGuard provider tunnels, wgnord and wgipv.

How pfSense maps to Korthveil:

Every change goes into pending changes until you Commit. Commit with Safety rollback on: if a change cuts you off, it undoes itself after five minutes.

Step 1: The provider tunnels

Each firewall needs its own WireGuard configuration from each provider. Do not copy the private keys from pfSense; a key used by two devices drops both connections.

• NordVPN: NordVPN's dashboard › Manual setup gives a NordLynx (WireGuard) configuration.
• IPVanish: the WireGuard configuration generator in your IPVanish account.

Go to VPN › WireGuard › Import configuration and paste or upload the .conf file (a QR code image works too).

Korthveil detects a client tunnel. Check these settings:

Tunnel status at the bottom shows each provider online after its first handshake.

Step 2: Aliases (address and service objects)

Open Firewall › Aliases and recreate the pfSense aliases with the same names. Each entry can be:

• an address (192.168.2.11);
• a CIDR network (10.0.0.0/8, fd00::/64);
• a range (192.168.2.80-192.168.2.89);
• a host name (discord.com).

Host names are kept as fqdn:discord.com. The firewall resolves them for IPv4 and IPv6 and follows their DNS TTL (checked again between 30 seconds and an hour), so changes need no commit. Like pfSense, wildcards (*.discord.com) are not supported; list each name.

Networks written with host bits set, such as pfSense's 192.168.2.61/30, are accepted and match the whole network (192.168.2.60/30), with a hint.

Port aliases become service objects. A port alias used with TCP/UDP becomes two objects and a group:

• STUN_Ports_TCP and STUN_Ports_UDP, with ports 3478, 3479, 5349, 19302-19309 (pfSense's 19302:19309 is written with a dash);
• STUN_Ports, a group of both.

Left out on purpose: pfBlockerNG's own tables (pfB_…). Use the DNS filter add-in or an IP list there instead.

Step 3: Schedules

Firewall › Schedules › Add schedule:

• Phones_YouTube: every day, 21:00 to 00:00. An end before the start runs past midnight; 00:00 means until midnight.
• Block_Youtube: every day, 21:00 to 23:00.

Korthveil schedules are weekly. pfSense's month ranges for Block_Youtube (March, April) become a daily window; turn the rule on and off for the months you want.

Step 4: Gateway groups (the failover)

Open Network › Policy routing, then Gateway groups › Add gateway group.

The monitor is pinged through the member's tunnel, so it tests the whole path to the internet, not just the handshake.

The four groups of the pfSense setup:

The panel shows each member live: up with its round-trip time, down, and which one is active.

Step 5: Policy routes (pfSense's pass rules with a gateway)

In pfSense, a pass rule with a gateway allows the traffic and chooses its path. Korthveil keeps these apart: policy routes choose the path, and rules allow it (Step 6). Policy routes are checked top to bottom, and the first match decides.

Add policy route, then Send via: A gateway group (failover):

Each has From zones: the LAN zone (on the Wi-Fi test network, WIFI).

"Not" (invert match): pfSense's ! RFC_1918 is the Not check box under Destination: every destination except the private networks, so Transmission still reaches the LAN directly.

Step 6: Rules and NAT

Firewall › Rules, from the LAN zone to the WAN zone, in this order:

The existing allow rule from the LAN to the WAN stays below them.

Allow into the tunnels: traffic a policy route sends into wgnord or wgipv leaves through the vpn zone. Add LAN to VPN tunnels: from the LAN zone to vpn, any, Allow. pfSense passes it with the same LAN rule; Korthveil checks it as going to the tunnel's zone.

NAT: in Firewall › NAT › Add source NAT, one per tunnel, so the LAN's private addresses leave as the tunnel's address:

• Name: Internet via wgnord; Out interface: wgnord; Type: Masquerade; Family: IPv4 + IPv6.
• The same for wgipv.

Not carried over, on purpose:

Step 7: Commit and check

Commit with a note such as VPN failover and pfSense rules. Then confirm the commit (the banner at the top).

Check the path of a connection: Firewall › Policy lookup. A Google address from a LAN device shows sends it via gateway group APPL_VPN: the first healthy of wgnord, wgipv, else the normal routes.

Watch a failover: when NordVPN stops answering, within about 15 seconds:

• NordVPN shows down and IPVanish becomes active;
• NORD_ONLY has no active member, so its traffic is blocked;
• new connections take the new path.

When NordVPN answers again, it takes over as tier 1.

Existing connections keep their path until they end. A download running through NordVPN when it fails stops, and starts again through IPVanish.

Troubleshooting

More: adr/0067 (gateway groups) and adr/0068 (invert match and source ports) describe the design.