Everything that joins the Wi-Fi korthveil goes out through NordVPN. When NordVPN stops answering, it switches to IPVanish. When both are down, it is blocked (the kill switch): nothing leaves through your normal internet line. One wizard does it, and it can also send chosen devices, people connecting in over WireGuard, or only certain sites through the VPN.

What you need:

• A WireGuard configuration for this firewall from each provider (Step 1).
• The Wi-Fi access point set up (guide Set up Wi-Fi, NAC, IPS, and WAF, Steps 3 to 6), with zone WIFI and DHCP.
• About ten minutes.

The screenshots come from a test firewall whose LAN zone is lan. On the GMKtec test firewall the Wi-Fi zone is WIFI.

Step 1: A WireGuard file from each provider

Make a new configuration for this firewall at each provider. Never reuse one from another router or your phone: a WireGuard key used on two devices makes both drop their connection.

Each file looks like this; the keys are yours alone:

[Interface]
PrivateKey = (your key)
Address = 10.5.0.2/32
DNS = 103.86.96.100

[Peer]
PublicKey = (the server's key)
AllowedIPs = 0.0.0.0/0
Endpoint = us1234.nordvpn.com:51820

Keep the files safe, like passwords.

Step 2: A password on the Wi-Fi

Go to Network › Interfaces, zones & routes and click the pencil on the Wi-Fi interface (wlp3s0):

Click Save to pending changes. With WPA2/WPA3-Enterprise instead (a certificate per device, guide NAC and Enterprise Wi-Fi), everything below works the same.

Step 3: The wizard, providers

Open System › Wizards › VPN provider with failover.

For each provider:

1. Type a short Name: nord, then ipvanish. The tunnel becomes wgnord, wgipvanish.
2. Paste the file into Configuration, or choose it (a screenshot of a QR code works too).
3. Click Check.

Korthveil reads the file, shows ready, and hides the private key on screen. Health check via the provider's DNS is the DNS server from the file. It is reached only through the tunnel, so it shows whether the whole path works.

Zone for the provider tunnels: providers. It is kept apart from the zone that remote VPN users arrive in, so rules can tell them apart.

Already imported a provider on VPN › WireGuard? Tick it under Provider tunnels already on this firewall instead of pasting it again.

Step 4: Failover

Failover or load balance: How the providers share the traffic chooses between Failover: one at a time, in order (above) and Load balance: all at once. With load balance every provider that answers carries a share, and one device stays on one provider for each site, so sites keep seeing the same address. A provider that stops answering is left out until it answers again; with none, the kill switch blocks. Weights (for example NordVPN 2, IPVanish 1) are set later on Network › Policy routing › Gateway groups. IPv6 through WireGuard tunnels without a gateway uses one provider at a time.

Step 5: Who uses the VPN

Choose any of:

• Whole networks: tick WIFI for everything on the Wi-Fi korthveil. This is the setting for the test firewall.
• Chosen devices: the list shows the DHCP server's clients by name, address, and MAC. Tick the ones that should use the VPN. With Keep their addresses on, each gets a DHCP reservation, so its address (and the VPN) stays with it.
• More addresses: devices not in the list, for example 192.168.2.16 or 192.168.2.80-192.168.2.89.
• People connecting in over WireGuard: tick the WireGuard server (for example wg0) and the remote devices' internet traffic goes out through the providers too.

Adding people who connect in: use Wizards › Remote-access VPN, or VPN › WireGuard › Remote devices › Add device. Each device gets its own configuration file and a QR code: open the WireGuard app on the phone, tap +, Scan from QR code, and it is connected. Choose all their internet traffic (full tunnel) there, so it reaches the providers.

Step 6: What goes through it

Leave Only these sites empty to send all their internet traffic through the VPN. Or list host names and networks, such as discord.com or 157.240.0.0/16, to send only those. Host names follow DNS changes on their own.

Traffic between your own networks (Wi-Fi to LAN, for example) never goes through the provider.

Step 7: Review and apply

The review lists, in words, everything the wizard adds:

• the tunnels and the gateway group;
• policy routes for the networks, devices, and remote users;
• a rule that allows this traffic into the providers' zone;
• source NAT on each tunnel;
• DHCP reservations.

Configuration changes and Network actions show the exact lines.

Click Apply, then Keep these settings within five minutes. Without that, the firewall goes back by itself (safety rollback).

Step 8: Check it

1. Join the Wi-Fi korthveil with the passphrase from Step 2.
2. Open an IP check site (for example the provider's own "what is my IP" page). It shows NordVPN's server and location, not your internet provider.
3. Watch the providers: in Network › Policy routing › Gateway groups, wgnord is up and active, wgipvanish up.
4. Check the path: Firewall › Policy lookup: a phone's address on the Wi-Fi to any internet address says sends it via gateway group VPN_ONLY: the first healthy of wgnord, wgipvanish, else dropped (kill switch).

Test the failover: on VPN › WireGuard, untick Enabled on wgnord and commit. Within about 15 seconds IPVanish is active and the IP check shows IPVanish. Turn wgnord back on: NordVPN takes over again. Downloads that were running stop and start again on the new path.

Test the kill switch: turn both tunnels off. Web pages stop loading, and nothing leaves through your normal internet line. Turn them back on.

Change it later

Everything the wizard made can be changed on its own page:

In any rule or policy route, Add object… also lists the DHCP clients by name.

Troubleshooting

More: the guide VPN failover with a kill switch, and moving pfSense rules to Korthveil explains gateway groups and policy routes in depth. adr/0067 and adr/0069 describe the design.