{"slug":"using-opnsense-with-tailscale","title":"Using OPNsense with Tailscale","tags":["tailscale","setup"],"agent_summary":"Last validated: Dec 4, 2025","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Using OPNsense with Tailscale\r\n\r\nLast validated: Dec 4, 2025\r\n\r\n[OPNsense](https://opnsense.org/) is an open source router and firewall platform built using FreeBSD. Tailscale can be installed on an OPNsense platform, joining it to your WireGuard-based mesh network.\r\n\r\nOPNsense is a community supported platform for Tailscale.\r\n\r\nAs of OPNsense v24.711, an `os-tailscale` plugin is available. This plugin does not require the following command-line steps.\r\n\r\n## [Installation](https://tailscale.com/docs/install/opnsense\\#installation)\r\n\r\nConnect to the console of OPNsense using SSH or another preferred method. Select option `8) Shell` and ensure you are the root user.\r\n\r\nFirst we must download the ports tree. More information about this can be found in the OPNsense [documentation](https://docs.opnsense.org/manual/software_included.html), and the FreeBSD ports [documentation](https://docs.freebsd.org/en/books/handbook/ports).\r\n\r\n```shell\r\n# opnsense-code ports\r\nUpdating OPNsense repository catalogue...\r\n...\r\nCloning into '/usr/ports'...\r\n...\r\nYour branch is up to date with 'origin/master'.\r\n```\r\n\r\nMake sure to run `opnsense-code ports` again even if you have done so previously, to update the ports tree to current versions. The version of Tailscale in the FreeBSD ports is periodically updated for new releases. More information on updates can be found below.\r\n\r\nOnce the ports tree is downloaded, execute the following steps as root to install Tailscale.\r\n\r\n```shell\r\n# cd /usr/ports/security/tailscale\r\n# make install\r\n```\r\n\r\nOnce installed, start and enable the `tailscaled` daemon and verify that Tailscale is working properly with `tailscale version`.\r\n\r\n```shell\r\n# service tailscaled enable\r\n# service tailscaled start\r\n# tailscale version\r\nroot@opnsense:~ # tailscale version\r\n1.56.1\r\n go version: go1.21.5\r\n```\r\n\r\n## [Connect](https://tailscale.com/docs/install/opnsense\\#connect)\r\n\r\nTo add the OPNsense machine as a node in your tailnet run the following command as root:\r\n\r\n```shell\r\n# tailscale up\r\nTo authenticate, visit:\r\n https://tailscale.com/a/abc123abc123\r\n```\r\n\r\nYou'll be asked to authenticate to Tailscale in your browser. This is an appropriate time to specify other useful options such as [subnet-routes](https://tailscale.com/docs/features/subnet-routers), [exit nodes](https://tailscale.com/docs/features/exit-nodes), and so on.\r\n\r\nOnce started, Tailscale should appear in the list of interfaces in the OPNsense UI. It can be used in firewall rules and other OPNsense functions.\r\n\r\n![The OPNsense UI with the TLSCL interface enabled.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fopnsense.928c5a17.png&w=1200&q=75)\r\n\r\n## [Update Tailscale](https://tailscale.com/docs/install/opnsense\\#update-tailscale)\r\n\r\nTo update Tailscale perform the following steps as the root user:\r\n\r\n```shell\r\n# opnsense-code ports\r\n# cd /usr/ports/security/tailscale\r\n# make deinstall\r\n# make clean\r\n# make install\r\n# service tailscaled restart\r\n```\r\n\r\nThis might take a few minutes depending on the strength of the CPU in use. Verify Tailscale updated using `tailscale version`. Sometimes it is necessary to restart the tailscaled service with `service tailscaled restart`.\r\n\r\n## [Direct Connections for LAN Clients](https://tailscale.com/docs/install/opnsense\\#direct-connections-for-lan-clients)\r\n\r\nAs a router/firewall, OPNsense may also be providing internet connectivity for LAN devices which themselves have a Tailscale client installed. The NAT implementation in OPNsense is an [Endpoint-Dependent Mapping, or \"hard\" NAT](https://tailscale.com/blog/how-nat-traversal-works), which means that LAN devices have difficulty making direct connections and often resort to [DERP Relays](https://tailscale.com/docs/reference/derp-servers).\r\n\r\nThere are a few options in which OPNsense can enable devices on the LAN to make direct connections to remote Tailscale nodes. Static NAT port mapping and NAT-PMP.\r\n\r\n## [Static NAT port mapping](https://tailscale.com/docs/install/opnsense\\#static-nat-port-mapping)\r\n\r\nBy default, OPNsense software rewrites the source port on all outgoing connections to enhance security and prevent direct exposure of internal port numbers.\r\n\r\nStatic port mapping in OPNsense involves creating a fixed association between a specific external port number and an internal IP address and port, allowing incoming traffic to be directed to the correct destination within the local network.\r\n\r\nGo to **Firewall > NAT**, **Outbound** tab. Select **Hybrid Outbound NAT rule generation**. Select **Save**. Select **↑ Add** to create a new NAT rule to the top of the list.\r\n\r\nConfigure the rule to match UDP traffic as shown below. Note, for each rule, select the appropriate **Address Family** (IP version), **IPv4** for one and **IPv6** for the other.\r\n\r\n![Example Static NAT port mapping configuration in Firewall : NAT : Outbound](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fstatic-port-mapping.ce3201c0.png&w=1200&q=75)\r\n\r\nCheck **Static Port** in the **Translation** section of the page. Select **Save**. Select **Apply Changes**.\r\n\r\nIn your ACLs, set [randomizeClientPort](https://tailscale.com/docs/reference/syntax/policy-file#network-policy-options).\r\n\r\n```json\r\n{\r\n // Other configurations\r\n \"randomizeClientPort\": true\r\n}\r\n```\r\n\r\nFrom the command line, use `tailscale ping node` to verify the connection path between two nodes. Also useful in this scenario is `tailscale netcheck`.\r\n\r\n## [NAT-PMP](https://tailscale.com/docs/install/opnsense\\#nat-pmp)\r\n\r\nNAT-PMP is a protocol by which LAN clients can ask the firewall to temporarily create port mappings.\r\n\r\nEnable the UPnP service and **Allow NAT-PMP Port Mapping** in **Services** \\> **Universal Plug and Play**. Only NAT-PMP is needed for Tailscale's use, but enabling UPnP can be helpful for other applications like gaming consoles.\r\n\r\n![Enabling Allow NAT-PMP Port Mapping in Services : Universal Plug and Play : Settings](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fupnp-settings.0b41260e.jpg&w=1200&q=75)\r\n\r\n## [Further reading](https://tailscale.com/docs/install/opnsense\\#further-reading)\r\n\r\nSetting up [subnet routing](https://tailscale.com/docs/features/subnet-routers) or acting as an [exit node](https://tailscale.com/docs/features/exit-nodes) may be of interest for a router using OPNsense.\r\n\r\n## [Special thanks](https://tailscale.com/docs/install/opnsense\\#special-thanks)\r\n\r\nSpecial thanks to GitHub user [@newmy-de](https://github.com/newmy-de) who helped us provide these installation instructions.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Using OPNsense with Tailscale

\n

Last validated: Dec 4, 2025

\n

OPNsense is an open source router and firewall platform built using FreeBSD. Tailscale can be installed on an OPNsense platform, joining it to your WireGuard-based mesh network.

\n

OPNsense is a community supported platform for Tailscale.

\n

As of OPNsense v24.711, an os-tailscale plugin is available. This plugin does not require the following command-line steps.

\n

Installation

\n

Connect to the console of OPNsense using SSH or another preferred method. Select option 8) Shell and ensure you are the root user.

\n

First we must download the ports tree. More information about this can be found in the OPNsense documentation, and the FreeBSD ports documentation.

\n
# opnsense-code ports\r\nUpdating OPNsense repository catalogue...\r\n...\r\nCloning into '/usr/ports'...\r\n...\r\nYour branch is up to date with 'origin/master'.\n
\n

Make sure to run opnsense-code ports again even if you have done so previously, to update the ports tree to current versions. The version of Tailscale in the FreeBSD ports is periodically updated for new releases. More information on updates can be found below.

\n

Once the ports tree is downloaded, execute the following steps as root to install Tailscale.

\n
# cd /usr/ports/security/tailscale\r\n# make install\n
\n

Once installed, start and enable the tailscaled daemon and verify that Tailscale is working properly with tailscale version.

\n
# service tailscaled enable\r\n# service tailscaled start\r\n# tailscale version\r\nroot@opnsense:~ # tailscale version\r\n1.56.1\r\n  go version: go1.21.5\n
\n

Connect

\n

To add the OPNsense machine as a node in your tailnet run the following command as root:

\n
# tailscale up\r\nTo authenticate, visit:\r\n    https://tailscale.com/a/abc123abc123\n
\n

You'll be asked to authenticate to Tailscale in your browser. This is an appropriate time to specify other useful options such as subnet-routes, exit nodes, and so on.

\n

Once started, Tailscale should appear in the list of interfaces in the OPNsense UI. It can be used in firewall rules and other OPNsense functions.

\n

\"The

\n

Update Tailscale

\n

To update Tailscale perform the following steps as the root user:

\n
# opnsense-code ports\r\n# cd /usr/ports/security/tailscale\r\n# make deinstall\r\n# make clean\r\n# make install\r\n# service tailscaled restart\n
\n

This might take a few minutes depending on the strength of the CPU in use. Verify Tailscale updated using tailscale version. Sometimes it is necessary to restart the tailscaled service with service tailscaled restart.

\n

Direct Connections for LAN Clients

\n

As a router/firewall, OPNsense may also be providing internet connectivity for LAN devices which themselves have a Tailscale client installed. The NAT implementation in OPNsense is an Endpoint-Dependent Mapping, or \"hard\" NAT, which means that LAN devices have difficulty making direct connections and often resort to DERP Relays.

\n

There are a few options in which OPNsense can enable devices on the LAN to make direct connections to remote Tailscale nodes. Static NAT port mapping and NAT-PMP.

\n

Static NAT port mapping

\n

By default, OPNsense software rewrites the source port on all outgoing connections to enhance security and prevent direct exposure of internal port numbers.

\n

Static port mapping in OPNsense involves creating a fixed association between a specific external port number and an internal IP address and port, allowing incoming traffic to be directed to the correct destination within the local network.

\n

Go to Firewall > NAT, Outbound tab. Select Hybrid Outbound NAT rule generation. Select Save. Select ↑ Add to create a new NAT rule to the top of the list.

\n

Configure the rule to match UDP traffic as shown below. Note, for each rule, select the appropriate Address Family (IP version), IPv4 for one and IPv6 for the other.

\n

\"Example

\n

Check Static Port in the Translation section of the page. Select Save. Select Apply Changes.

\n

In your ACLs, set randomizeClientPort.

\n
{\r\n  // Other configurations\r\n  \"randomizeClientPort\": true\r\n}\n
\n

From the command line, use tailscale ping node to verify the connection path between two nodes. Also useful in this scenario is tailscale netcheck.

\n

NAT-PMP

\n

NAT-PMP is a protocol by which LAN clients can ask the firewall to temporarily create port mappings.

\n

Enable the UPnP service and Allow NAT-PMP Port Mapping in Services > Universal Plug and Play. Only NAT-PMP is needed for Tailscale's use, but enabling UPnP can be helpful for other applications like gaming consoles.

\n

\"Enabling

\n

Further reading

\n

Setting up subnet routing or acting as an exit node may be of interest for a router using OPNsense.

\n

Special thanks

\n

Special thanks to GitHub user @newmy-de who helped us provide these installation instructions.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}