Why default gateways kill remote access, what actually keeps your stream direct, and how to stop fighting routing tables
Ready to route outbound traffic through a tunnel without breaking Plex remote access?
You spend an entire Saturday afternoon setting up an encrypted tunnel on your firewall. You configure OpenVPN or WireGuard on pfSense, define an alias for your media stack or your private LAN, assign the interface, and build an outbound NAT rule. Everything looks pristine until you check your Plex dashboard from your phone or open the web app from outside your house.
Suddenly, your server is marked as unreachable or stuck behind an indirect Plex Relay capped at 2 Mbps. Local smart TVs start complaining that the media server is remote rather than local. You toggle rules, flush states, and check firewall logs, wondering why a tunnel that works perfectly for web browsing manages to break your self-hosted media server every single time.
The issue is rarely your pfSense firewall rules or your media server settings. The real problem is how consumer VPNs interact with policy routing, incoming handshakes, and return paths.
Why Policy Routing Breaks Remote Access
When you set up policy-based routing in pfSense, the firewall evaluates rules from top to bottom. If a rule matches traffic leaving your media server or local subnet, pfSense overrides the default system routing table and forces the gateway to be your VPN tunnel interface instead of your native WAN.
That works exactly as intended for outbound downloads. The failure happens when a client outside your home tries to talk to your Plex server.
An incoming stream request arrives through your real ISP WAN IP on port 32400. pfSense accepts the packet and delivers it to your Plex server on the local subnet. But when Plex prepares the reply packet and sends it back to pfSense, the firewall checks its firewall rules. If your Plex host is caught in a blanket rule pointing to the VPN gateway, pfSense pushes the reply out through the VPN tunnel instead of the ISP WAN interface where the request came in.
The outside client sees a packet arriving from a completely unexpected VPN IP address instead of your home IP. The TCP handshake fails immediately due to asymmetric routing. Plex fallback mechanisms kick in, dropping the stream into an indirect relay via Plex servers, or it fails outright.
The Broadcast and Local Subnet Trap
Remote access is only half the headache. The other half happens inside your living room.
Plex clients discover servers on the local area network using GDM broadcast and multicast packets. When entire home subnets are forced through a VPN gateway without granular bypass rules, broadcast discovery breaks. Local smart TVs, Apple TVs, and game consoles suddenly treat your on-premise server as a remote entity. They attempt to hairpin through an external gateway, adding unnecessary latency and transcoding overhead to a movie sitting on a hard drive thirty feet away.
Fixing this inside pfSense requires strict rule ordering: local RFC 1918 traffic (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) must always be matched first and sent to the default LAN routing table, completely unhindered by any gateway override.
What You Actually Need from a VPN Provider
Most people searching for a VPN for pfSense start by looking at speed claims, server counts, or generic price promotions. None of those matter if the network architecture itself works against split tunneling.
To run a stable home lab behind pfSense while hosting Plex, a VPN provider must fulfill three specific technical criteria:
First, clean and deterministic port forwarding. If you choose to route your media box entirely through the tunnel, your VPN must provide a public-facing incoming port that forwards directly to your tunnel interface. Without this, inbound direct connections are impossible over the VPN.
Second, a persistent or static outbound IP option. When a provider rotates external IP addresses dynamically every few hours or days, Plex.tv gets confused by rapid DNS and IP churn. This triggers intermittent connection loss for remote family members and forces constant reconnection handshakes.
Third, native FreeBSD support and documented WireGuard or OpenVPN credentials. Commercial VPNs often push proprietary desktop applications with automated split-tunneling switches. On pfSense, those desktop apps are useless. You need raw configuration profiles, clean cryptographic keys, explicit handshake endpoints, and clear guidance on interface assignment without opaque scripts.
Where ONLYDOGSVPN Fits In
This is where ONLYDOGSVPN enters the conversation. Unlike mainstream consumer services that optimize strictly for mobile streaming unblocking, ONLYDOGSVPN provides raw configuration files specifically structured for FreeBSD and Linux router deployments.
If you are running pfSense, ONLYDOGSVPN gives you granular OpenVPN and WireGuard configurations with dedicated IP allocations and transparent port mapping options. Because the provider allows static outbound endpoints, your pfSense policy-based routing rules remain rock-solid: you can route arbitrary host aliases through the tunnel while binding dedicated ports that keep your external services reachable.
Their technical documentation explicitly covers policy routing scenarios on hardware firewalls, making it significantly easier to isolate specific IP aliases, configure Outbound NAT (Hybrid mode), and prevent gateway failover loops without guessing gateway monitor IPs.
Who Should Use This and Who Should Skip
ONLYDOGSVPN is built for home lab hobbyists, network administrators, and self-hosters who understand firewall states, NAT tables, and gateway aliases. If you want full control over your gateway routing tables and require reliable dedicated IPs that do not flag automated security checks, it is an exceptionally good fit.
However, you should skip this if you are looking for a simple one-click desktop app to unblock foreign streaming catalogs on an iPad. If you do not intend to configure pfSense interfaces, virtual IPs, or firewall rules manually, paying for router-grade infrastructure is an unnecessary expense.
How to Properly Structure Your Rules
If you decide to set up your tunnel, keep your pfSense rule hierarchy strictly separated:
1. Local Traffic Rule: At the very top of your LAN interface rules, create a pass rule with Destination set to an alias containing all private IP ranges (192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12). Leave the Gateway setting on "Default". This ensures local Plex traffic never hits the tunnel.
1. Plex Remote Direct Rule: If your Plex server runs on a machine that does not need its outbound web traffic masked, simply exclude the server host IP from the VPN alias entirely.
1. VPN Gateway Rule: Below the local bypass rules, place your policy routing rule matching your protected host alias, setting the Gateway explicitly to the VPN interface gateway.
1. Hybrid Outbound NAT: Under Firewall > NAT > Outbound, switch to Hybrid Outbound NAT and ensure an explicit mapping exists for your protected subnet exiting the VPN interface.
By structuring the firewall correctly and pairing it with a VPN service that supports static endpoints and transparent routing, you eliminate asymmetric reply drops entirely. Your private outbound traffic stays enclosed inside the encrypted tunnel, while your Plex library remains instantly accessible, in original 4K quality, from anywhere in the world.