{"slug":"pfsense-settings-to-enable-direct-connections","title":"pfSense settings to enable direct connections","tags":["tailscale"],"agent_summary":"Last validated: Feb 2, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# pfSense settings to enable direct connections\r\n\r\nLast validated: Feb 2, 2026\r\n\r\n[pfSense](https://pfsense.org/) is an open source router and firewall platform\r\nbuilt using FreeBSD. Tailscale clients behind a pfSense firewall can benefit\r\nfrom a settings change.\r\n\r\nTailscale can also be run directly on these routers, by using a plugin for pfSense.\r\n\r\n## [Direct Connections for LAN Clients](https://tailscale.com/docs/integrations/firewalls/pfsense\\#direct-connections-for-lan-clients)\r\n\r\nAs a router/firewall, pfSense may also be providing internet connectivity for LAN\r\ndevices which themselves have a Tailscale client installed. The NAT implementation\r\nin pfSense is an\r\n[Endpoint-Dependent Mapping, or \"hard\" NAT](https://tailscale.com/blog/how-nat-traversal-works),\r\nwhich means that LAN devices have difficulty making direct connections and often resort to\r\n[DERP Relays](https://tailscale.com/docs/reference/derp-servers).\r\n\r\nThere are a few options in which pfSense can enable devices on the LAN to make direct\r\nconnections to remote Tailscale nodes. Static NAT port mapping and NAT-PMP.\r\n\r\n## [Static NAT port mapping](https://tailscale.com/docs/integrations/firewalls/pfsense\\#static-nat-port-mapping)\r\n\r\nAs of [pfSense+ 25.11](https://docs.netgate.com/pfsense/en/latest/releases/25-11.html#endpoint-independent-port-restricted-cone-outbound-nat) and expected in the upcoming pfSense Community Edition 2.9.0, pfSense includes partial experimental support for [\"Port Restricted Cone\" endpoint-independent outbound NAT](https://docs.netgate.com/pfsense/en/latest/nat/outbound.html#nat-eiprc) (EIM-NAT).\r\n\r\nThese \"Port Restricted Cone\" NAT mappings can replace the `randomizeClientPort` suggestion for earlier versions.\r\n\r\nBy default, pfSense software rewrites the source port on all outgoing connections to enhance\r\nsecurity and prevent direct exposure of internal port numbers.\r\n\r\nStatic port mapping in pfSense involves creating a fixed association between a specific external\r\nport number and an internal IP address and port, allowing incoming traffic to be directed to the\r\ncorrect destination within the local network.\r\n\r\nLocate the **Firewall > NAT**, **Outbound** tab. Select **Hybrid Outbound NAT rule generation**.\r\nSelect **Save**. Select **↑ Add** to create a new NAT rule to the top of the list.\r\n\r\nConfigure the rule as shown below: **IPv4+IPv6**, for Protocol **UDP**, source address **Any**.\r\nCheck **Static Port** in the **Translation** section of the page.\r\n\r\n![Example Static NAT port mapping configuration in Firewall : NAT : Outbound](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fstatic-port-mapping.a651eb0f.png&w=1200&q=75)\r\n\r\nSelect **Save**. Select **Apply Changes**.\r\n\r\nIn your ACLs, set [randomizeClientPort](https://tailscale.com/docs/reference/syntax/policy-file#network-policy-options).\r\n\r\n```json\r\n{\r\n  // Other configurations\r\n  \"randomizeClientPort\": true\r\n}\r\n```\r\n\r\n## [NAT-PMP](https://tailscale.com/docs/integrations/firewalls/pfsense\\#nat-pmp)\r\n\r\nNAT-PMP is a protocol by which LAN clients can ask the firewall to temporarily create\r\nport mappings.\r\n\r\nEnable the UPnP service and **Allow NAT-PMP Port Mapping** in\r\n**Services** \\> **UPnP & NAT-PMP**. Only NAT-PMP is needed for Tailscale's\r\nuse, but enabling UPnP can be helpful for other applications like gaming consoles.\r\n\r\n![Enabling Allow NAT-PMP Port Mapping in Services : UPnP & NAT-PMP : Settings](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fupnp-settings.dbfb7981.jpg&w=1200&q=75)\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"<h1>pfSense settings to enable direct connections</h1>\n<p>Last validated: Feb 2, 2026</p>\n<p><a href=\"https://pfsense.org/\">pfSense</a> is an open source router and firewall platform\r\nbuilt using FreeBSD. Tailscale clients behind a pfSense firewall can benefit\r\nfrom a settings change.</p>\n<p>Tailscale can also be run directly on these routers, by using a plugin for pfSense.</p>\n<h2><a href=\"https://tailscale.com/docs/integrations/firewalls/pfsense#direct-connections-for-lan-clients\">Direct Connections for LAN Clients</a></h2>\n<p>As a router/firewall, pfSense may also be providing internet connectivity for LAN\r\ndevices which themselves have a Tailscale client installed. The NAT implementation\r\nin pfSense is an\r\n<a href=\"https://tailscale.com/blog/how-nat-traversal-works\">Endpoint-Dependent Mapping, or \"hard\" NAT</a>,\r\nwhich means that LAN devices have difficulty making direct connections and often resort to\r\n<a href=\"https://tailscale.com/docs/reference/derp-servers\">DERP Relays</a>.</p>\n<p>There are a few options in which pfSense can enable devices on the LAN to make direct\r\nconnections to remote Tailscale nodes. Static NAT port mapping and NAT-PMP.</p>\n<h2><a href=\"https://tailscale.com/docs/integrations/firewalls/pfsense#static-nat-port-mapping\">Static NAT port mapping</a></h2>\n<p>As of <a href=\"https://docs.netgate.com/pfsense/en/latest/releases/25-11.html#endpoint-independent-port-restricted-cone-outbound-nat\">pfSense+ 25.11</a> and expected in the upcoming pfSense Community Edition 2.9.0, pfSense includes partial experimental support for <a href=\"https://docs.netgate.com/pfsense/en/latest/nat/outbound.html#nat-eiprc\">\"Port Restricted Cone\" endpoint-independent outbound NAT</a> (EIM-NAT).</p>\n<p>These \"Port Restricted Cone\" NAT mappings can replace the <code>randomizeClientPort</code> suggestion for earlier versions.</p>\n<p>By default, pfSense software rewrites the source port on all outgoing connections to enhance\r\nsecurity and prevent direct exposure of internal port numbers.</p>\n<p>Static port mapping in pfSense involves creating a fixed association between a specific external\r\nport number and an internal IP address and port, allowing incoming traffic to be directed to the\r\ncorrect destination within the local network.</p>\n<p>Locate the <strong>Firewall > NAT</strong>, <strong>Outbound</strong> tab. Select <strong>Hybrid Outbound NAT rule generation</strong>.\r\nSelect <strong>Save</strong>. Select <strong>↑ Add</strong> to create a new NAT rule to the top of the list.</p>\n<p>Configure the rule as shown below: <strong>IPv4+IPv6</strong>, for Protocol <strong>UDP</strong>, source address <strong>Any</strong>.\r\nCheck <strong>Static Port</strong> in the <strong>Translation</strong> section of the page.</p>\n<p><img src=\"https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fstatic-port-mapping.a651eb0f.png&#x26;w=1200&#x26;q=75\" alt=\"Example Static NAT port mapping configuration in Firewall : NAT : Outbound\"></p>\n<p>Select <strong>Save</strong>. Select <strong>Apply Changes</strong>.</p>\n<p>In your ACLs, set <a href=\"https://tailscale.com/docs/reference/syntax/policy-file#network-policy-options\">randomizeClientPort</a>.</p>\n<pre><code class=\"language-json\">{\r\n  // Other configurations\r\n  \"randomizeClientPort\": true\r\n}\n</code></pre>\n<h2><a href=\"https://tailscale.com/docs/integrations/firewalls/pfsense#nat-pmp\">NAT-PMP</a></h2>\n<p>NAT-PMP is a protocol by which LAN clients can ask the firewall to temporarily create\r\nport mappings.</p>\n<p>Enable the UPnP service and <strong>Allow NAT-PMP Port Mapping</strong> in\r\n<strong>Services</strong> > <strong>UPnP &#x26; NAT-PMP</strong>. Only NAT-PMP is needed for Tailscale's\r\nuse, but enabling UPnP can be helpful for other applications like gaming consoles.</p>\n<p><img src=\"https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fupnp-settings.dbfb7981.jpg&#x26;w=1200&#x26;q=75\" alt=\"Enabling Allow NAT-PMP Port Mapping in Services : UPnP &#x26; NAT-PMP : Settings\"></p>\n<p><img src=\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\" alt=\"Project Logo\"></p>\n<p>Ask AI</p>\n<p>reCAPTCHA</p>\n<p>Recaptcha requires verification.</p>\n<p>protected by <strong>reCAPTCHA</strong></p>\n"}