The VPN tab turns the firewall into a way into the private network from your own devices, over WireGuard or Tailscale. Use it to reach private workloads, such as a database or an admin panel, without exposing them to the internet.
Turning on either one adds two default firewall rules so the VPN and the private network can reach each other.
WireGuard
Select Turn on WireGuard. The firewall generates its keys and picks an
address range (by default 10.99.0.0/24), and shows its endpoint, which is
the firewall's public address on UDP 51820.
Add a device
- Select Add device and give it a Name, such as
Laptop. - The firewall generates the device's keys and assigns it the next free address.
- Select Config to download a ready-to-use
.conffile.
Import that file into the WireGuard app on your computer or phone and connect. It already carries the firewall's public key and endpoint, the device's address, and routes for every private network the firewall serves, so once connected you can reach those networks directly. A firewall holds up to about 250 devices before its range is full.
Keep the config file safe
The .conf file contains the device's private key. Anyone who has it can join
your network as that device. Remove a device from the list to cut it off.
Tailscale
If you already run a tailnet, connect the firewall to it instead:
- Create an auth key in your Tailscale admin console.
- On the VPN tab, paste it into Auth key, optionally set a Hostname, and leave Advertise this firewall's private networks as subnet routes on.
- Select Connect.
With subnet routes advertised, every device in your tailnet can reach the firewall's private networks through it.
Approve the routes in Tailscale
Advertised subnet routes still need approving in your tailnet's admin console before your other devices will use them. The firewall advertises them; your tailnet decides whether to accept them.