VPN#
Five jobs. Which one you want depends on what is at the other end.
| Guide | Use it when |
|---|---|
| A WireGuard tunnel for a laptop | One person needs to reach the network from anywhere |
| WireGuard between two sites | Two routers you control, both able to run WireGuard |
| An IPsec tunnel to a third-party device | The far end is somebody else's, and IPsec is what they support |
| An OpenVPN server for remote devices | The devices already have an OpenVPN client, or you want certificates one authority issues and can revoke |
| Join a tailnet from the router | You already use Tailscale, and want the LAN reachable from it without a client on each machine |
What each VPN page does#
WireGuard — Protect → WireGuard — adds and changes tunnels and peers. The agent generates a tunnel's keys, and Add device sets up a phone or a laptop in one step: its keys, its address, and a configuration shown once as a QR code and a file. The page shows each peer's last handshake and traffic as the router reports them. WireGuard is a feature module: the kernel implementation is always present, and the page appears once the module is switched on in Apps or a tunnel exists. WireGuard.
IPsec — Protect → IPsec — adds and changes site-to-site peers: the networks on each side, a pre-shared key or certificates, and the IKE and ESP groups, beside strongSwan's live security associations. IPsec.
OpenVPN — Protect → OpenVPN — adds a server, a client or one end of a site-to-site tunnel with the certificates and keys it needs, and changes any of them afterwards. A server's clients are added, revoked and given their configuration files from its settings. OpenVPN.
Tailscale is a catalogue app, not a native feature. On a router it is used as a subnet router.
The firewall half#
Every tunnel needs two firewall decisions:
- The listener. WireGuard's UDP port, OpenVPN's, or IPsec's UDP 500 and 4500 and ESP, arriving on the uplink and addressed to the router — an input rule.
- What the tunnel may reach. Traffic arriving on the tunnel and going somewhere else — a forward rule.
The WireGuard and OpenVPN pages handle the first: adding a tunnel or an instance offers Allow the listen port through the firewall, on by default, and a tunnel whose port the input firewall drops says so, with the rule a click away. The rule goes after the input chain's accept rules and before the first rule that does anything else, and is added only when the port would otherwise be dropped.
The second is yours to decide on the Firewall page, because what a tunnel should reach is a policy, not a default. Adding a WireGuard device says when the forward firewall would drop its traffic. A default-drop ruleset that admits what you meant has both shapes.