tailscale OPNsense

How to Install Tailscale on OPNsense

Learn how to install Tailscale on OPNsense firewall in a few easy steps. Follow this guide to create a secure, WireGuard-based mesh network using OPNsense.


  1. Log in to OPNsense and activate SSH and root login and password login.

    echo 'PermitRootLogin yes' >> /etc/ssh/sshd_config
    service sshd restart
    # Set root password
  2. Increase the disk size of OPNsense to at least 12 GB to avoid DiskPressure and Evicted Pods issues.

    df -h
    # If the usage is high, add more space to the disk
    # For example, to add 10 GB of space:
    gpart add -s 10G -t freebsd-ufs da0
    growfs /dev/da0p2
  3. Update OPNsense to the latest version by going into the default menu via console or SSH and selecting 12. You might need to do this a few times to get to the final version.

    opnsense-update -T opnsense-devel

When asked for updating to a major version, do not select 'y' as this will only cause a minor update. Type in the version number instead (it will be shown in the shell).

  1. Additionally, enable Swap.

    mdconfig -a -t swap -s 4g
    swapon /dev/md0
  2. Follow the tutorial: WireGuard mesh network using OPNsense. You can use the following command to set it up in one step (adjust IP range to your exposed IP range):

    cd /usr/ports/security/tailscale
    make install clean
    service tailscaled enable
    service tailscaled start
    tailscale up --advertise-routes=

Note: If you still encounter problems regarding missing swap, you can shut down the k3OS VM and temporarily increase the CPU and memory of OPNsense.

Want to Learn More?

Discover guides on Unified Namespace, IT/OT architecture, and essential tools. Start your journey with the United Manufacturing Hub today!

Explore Content Get in Touch