VPN on Dad's a Nerd!

Tailscale vs. WireGuard on pfSense: Which Should You Run?

Wed, 12 Aug 2026 19:12:37 -0400

Short answer: run WireGuard on pfSense if you can open a UDP port, and add Tailscale if you’re behind CGNAT or need to hand access to people who won’t edit a config file. The encryption is identical — Tailscale is WireGuard with a control plane on top. The deciding factor on pfSense is that FreeBSD can’t run Tailscale’s kernel mode, so subnet routing and exit nodes go through a userspace stack, which changes how packets are forwarded and makes exit node duty noticeably slow.

Multi-Site VPN on pfSense: Connect Multiple Locations with WireGuard (No Vendor Fees)

Tue, 11 Aug 2026 16:11:27 -0400

Connects multiple pfSense-routed locations into one routed, dual-stack (IPv4 + IPv6) network using WireGuard — a self-hosted multi-site VPN on pfSense in a hub-and-spoke topology. No NAT, no per-site static IP requirement, no recurring vendor fee.

Terminology note: the underlying technique here is a site-to-site VPN — a permanent, routed tunnel connecting two networks. “Multi-site” just means using that same technique more than once: a hub site runs a separate site-to-site tunnel to each additional location. Two sites is the base case (one tunnel, one peer on each end); three or more is that same setup repeated, with the hub acting as the common point. Nothing about the core configuration changes as sites are added — Step 2 through Step 5 are simply repeated per additional spoke.

pfSense WireGuard IPv6 Setup: Full Tunnel and Split Tunnel Guide

Mon, 10 Aug 2026 21:08:26 -0400

Setting up a home WireGuard VPN on pfSense gets you your own private, self-hosted VPN — no subscription, no third-party logging policy to trust, just your own router. This guide walks through a complete pfSense WireGuard setup with IPv6 covering both major connection modes (full tunnel and split tunnel), dual-stack IPv4 and IPv6 addressing, a stable hostname via Cloudflare Dynamic DNS, and the firewall/NAT rules that actually make traffic pass — not just handshake.