Opnsense on Sysadmin Tales

Routing to Tailscale clients from a local network with OPNSense

Sat, 15 Aug 2026 16:45:12 -0400

Overview

Effectively, what we’re trying to accomplish here today is the opposite of a Tailscale Subnet Router.

As in, allowing clients on our local network to talk to devices via their Tailscale subnet IP addresses.

When I started looking into how to do this, I could not find a complete guide on the topic.

I’ll do my best to do this start to finish so that anyone else can follow along with me.

Prerequisites

You already have an OPNSense gateway setup and enabled as a Subnet Router on your Tailnet.
You’ll also need to have approved the subnets that you told the Subnet Router to advertise in your admin console.

Recommendations

Create an alias for the Tailscale subnet range so you can avoid typing it in 10x times.

Firewall > Aliases

Explanation

Tailscale Subnet Routers by default use SNAT (Source NAT).

This means that packets sent from your Tailscale devices to the Subnet Router will go through Network Address Translation on their way to the local subnets you’ve advertised.

So, any devices inside your LAN by default will only ever see the IP address of your OPNSense gateway - they will not see the IP addresses of the individual Tailscale clients. This is the first thing that we will need to disable.

Once we have this disabled, we’ll need to configure both a static route as well as firewall rules to allow the traffic to pass.

Step by step

Log into your OPNSense router and navigate to VPN > Tailscale > Settings. You’ll need to toggle on “Advanced Mode”. Check the box for “Disable SNAT”.
Now, what we need to do is create a static route - but before we can do that, we need to take care of some other items:
1. Add the Tailscale interface by going to Interfaces > Assignments. Click on the + button and add the Tailscale interface from the dropdown. Don’t forget to enable the interface - by default it will be added in a disabled state.
2. Create a new gateway - System > Gateways > Configuration. The interface should be “Tailscale”. Gateway name is technically arbitrary, but for the sake of simplicity I’ve also called it “Tailscale”. Make sure you disable gateway monitoring.
3. Now that we’ve done this, we can finally define our static route (System > Routes > Configuration). The Tailscale subnet is 100.64.0.0/10:
Now that we have the routing taken care of, we need to create some firewall rules to allow the traffic to pass. You’ll need to create at minimum 2 rules on the OPNSense side (Firewall > Rules):
1. On your LAN interface, define a rule that allows communication from your LAN to your Tailnet. For example -
```
Interface: LAN (Or whatever yours is called)
Action: Pass
Source: LAN network
Destination: 100.64.0.0/10
```
2. On your Tailscale interface, define the inverse:
```
Interface: Tailscale
Action: Pass
Source: 100.64.0.0/10
Destination: LAN network
```
Rule 1 may not be needed if you have the default “Allow All” rule in your configuration on the LAN interface. I do not, so I needed to allow that traffic.

Feel free to restrict this traffic however you would like. Personally, I only allow through a few kinds of traffic - DNS, HTTP/HTTPS, and ICMP echo-request / echo-reply.
You’ll also need to go into your Tailscale ACL controls and allow access there from your local subnets.
Any device that you wish to reach via this connection needs to have the --accept-routes option enabled when you run tailscale up. The device you’re trying to access needs to have a route to get back to your LAN subnet, after all.

--accept-routes is enabled by default on MacOS and Windows, but disabled by default on Linux. Once enabled, the device should be reachable from any device on your LAN.

You may also want to configure MSS clamping to avoid unnecessary IP fragmentation. Under Firewall > Settings > Normalization, click the + to add a new rule:

Interface: Select your assigned Tailscale interface.
Direction: Any
Max MSS: 1240 (for standard Tailscale 1280 MTU) or 1380 (if your Tailnet uses 1420 MTU).
Description: Clamp MSS for Tailscale traffic.

I highly recommend thinking carefully about your firewall rules and Tailscale ACLs, and what you allow to connect to what.

Now that I’ve gotten this working I’ll be spending some time narrowing my LAN to Tailnet access ACL down to specific tags. But that’s a whole other post.

Exit Node

If, like me, you are also using your home OPNSense gateway as a Tailscale Exit Node, you’ll quickly realize that this process broke it.

The fix is simple, we need to add an Outbound NAT rule to replace the missing SNAT on the Tailscale service.

Go to Firewall > NAT > Outbound.

Your Outbound NAT mode must be set to “Hybrid” or “Manual”. If you don’t know what this means, set it to “Hybrid”.

Configure a rule that looks like this:

Interface: WAN
Source address: 100.64.0.0/10
Destination address: any
Translation target: Interface address

Setting up OpnSense as an AirVPN client

Tue, 03 Dec 2024 22:41:53 -0500

I recently set up my OpnSense firewall at home with a connection to AirVPN using Wireguard.

It was a bit more complicated than when I did it for Mullvad last year, so I figured I’d document it here for anyone who finds this useful.

1. Device Creation

Log into your AirVPN account and navigate to the client area. Click on Manage Devices. You can either edit the existing “default” device or create a new one. Either way, I recommend editing the name of the device so that you know what it is, 6 months down the line. I called mine “Opnsense”.

While you’re here, I recommend opening up a Notepad or equivalent and copying and pasting the public key that’s on this page. We’ll need it later.

2. Generate Wireguard configuration file

Next, head back to the client area and head into the Config Generator.

For OS, you’ll want to choose “Router”. You’ll also want to decide which device (if you have more than one) that this configuration will apply to.

Pick the “Wireguard” protocol.

Pick a server as well - I picked Switzerland.

Once you’re done, click the Generate button at the bottom of the page. This will download a Wireguard configuration file - save this, we’ll need it in a moment.

3. Create Wireguard tunnel in Opnsense.

Next, we’ll be heading into Opnsense. Log in and navigate to the VPN section. Under Wireguard, create a peer.

Name: AirVPN 
Public Key: you can get this from the wireguard configuration file you downloaded in step 2.
Pre-Shared Key: you can get this from the wireguard configuration file you
downloaded in Step 2. 
Allowed IPs: 0.0.0.0/0 
Endpoint Address: Get this from the config file as well.
Endpoint port: Get this from the config file as well. It's usually 1637.
Keepalive Interval: You can either set this to 15 or leave it blank.

Save, and next we’ll head over to Instances. Configure a new instance with the following options:

Make sure you enable advanced features.

Name: AirVPNLocal
Public Key: Here you'll want to put the public key we got in step 1. This is the public key of OPNSENSE.
Private Key: Grab this from the config file. It will be under the Interface section.
Tunnel address: Set this to the /32 address that was in the config file. It will be something in the 10.128.0.0/10 range.
Peer: Select the AirVPN peer we created earlier.
MTU: 1320
Disable Routes: Checked

Make sure you have Disable Routes checked, it’s important.

Hit Save. Don’t forget to check the box to enable Wireguard, and hit apply at the bottom of the page.

Once done, head over to the “Status” page - the tunnel should show a status of “Up” now, but we’ve still got some work to do before we can use it.

4. Create an interface.

Head over to Interfaces > Assignments.

Under “Assign a new interface”, pick the Wireguard device we just created. If it’s your first one, it’ll be wg0.

Click on the interface, Enable it. I also recommend giving it a descriptive name. Mine is called “airvpn_wg”.

5. Create a gateway.

Next we have to create a gateway for AirVPN clients to use.

Head over to System > Gateways > Configuration.

Create a new gateway and give it a descriptive name. I called mine AIRVPN_GW.

Here are the other settings you’ll need to configure on this gateway.

Interface: airvpn_wg
Address family: IPv4
IP Address: 10.128.0.1
Far Gateway: checked
Disable Gateway Monitoring: checked.

Click Save, and then Apply.

6. Create Outbound NAT rule.

Most Wireguard VPN providers will require you to configure outbound NAT, and AirVPN is no exception.

Go to Firewall > NAT > Outbound and add a rule.

Configure only the following settings and leave everything else default.

Interface: airvpn_wg
Source Address: LAN net (or whatever you're using.)
Description: Outbound NAT for AirVPN

7. Configure Policy Routing

How we’re going to accomplish this is we’re going to create an alias for the devices we want to route out over the VPN tunnel.

Call it VPN_Required or whatever you like.

Once you’ve created the alias, navigate to Firewall > Rules > Your network.

Create a pass rule with the following settings defined:

Interface: LAN
Protocol: Any
Source: VPN_Required
Destination: Any
Gateway: AIRVPN_GW
Advanced features:
  Set local tag: vpntraffic

Next head to Rules > Floating and define a Block rule.

Interface: Your WAN interface
Source: Any
Protocol: Any
Destination: Any
Advanced features:
  Match local tag: vpntraffic

This block rule will serve as a “kill switch” preventing our VPN traffic from leaking if the tunnel goes down for some reason.

8. Test It

I recommend testing the connection at this point. Add your current device’s IP address to the alias you’re using for policy routing for testing purposes.

Go to sites like https://ipleak.net/ and make sure that everything is reported correctly. Make sure you don’t have any DNS leaks, either - it should show DNS servers in the same region as the AirVPN server that you chose.

9. Bonus Points - Port Forwarding

If you have a need for port forwarding, AirVPN supports up to 5 ports per account.

Head on back to the Client Area on their website and click on Ports.

If you’re forwarding ports for a protocol like Bittorrent, you’ll need to use the :1 pool of addresses.

I suggest using AirVPN’s tool on the same page to find a free port in that range.

Once you’ve determined which port to use, configure it for yourself. Configure which device it’s for, set the protocol to TCP+UDP.

I recommend using ipv4 only.

On Opnsense, configure a rule on the airvpn_wg interface. (Firewall > Rules > airvpn_wg)

Action: Pass
Protocol: TCP/UDP
Destination: The IP address of your box of Linux ISOs.
Port: the port you defined in AirVPN.
Reply-To: AIRVPN_GW

You’ll also want to configure a port forward under NAT > Port Forward.

Interface: airvpn_wg
Protocol: TCP/UDP
Destination: airvpn_wg address
Destination port range: the port you defined in AirVPN.
Redirect target IP: The IP address of your box of Linux ISOs.
Redirect target port: the port you defined in AirVPN.

Now, in your Bittorrent client, make sure you turn off port randomization, and set the port to the same one.

You may also have to allow that port through the system firewall, if there is one.

If you’re running something like Transmission in Docker, don’t forget to publish the port in your docker compose.