VPN#

Four jobs. Which one you want depends on what is at the other end.

Guide	Use it when
A WireGuard tunnel for a laptop	One person needs to reach the network from anywhere
WireGuard between two sites	Two routers you control, both able to run WireGuard
An IPsec tunnel to a third-party device	The far end is somebody else's, and IPsec is what they support
Join a tailnet from the router	You already use Tailscale, and want the LAN reachable from it without a client on each machine

What is here, and what is not#

WireGuard is a feature module: the kernel implementation is always present, and the Wheelhouse page appears once it is installed from the app catalogue. Tunnels and peers are native configuration under interfaces wireguard.

IPsec is native vpn ipsec, and the page shows declared peers beside strongSwan's live security associations.

OpenVPN is the exception:

Tailscale is a catalogue app, not a native feature, and it earns its place on a router as a subnet router.

The firewall half#

Every tunnel needs two firewall decisions, and neither is made for you:

The listener. WireGuard's UDP port, or IPsec's UDP 500 and 4500, arriving on the uplink and addressed to the router — an input rule.
What the tunnel may reach. Traffic arriving on the tunnel interface and going somewhere else — a forward rule.

A default-drop ruleset that admits what you meant has both shapes.

Checked against ui/src/pages/WireGuard.tsx · ui/src/pages/Ipsec.tsx · ui/src/pages/Openvpn.tsx · agent/catalog.json