VPN

NET-02 // VPN

omfreebdy supports two VPN options: WireGuard (built into the FreeBSD kernel) and Tailscale (mesh VPN with zero-config networking). The vpn-setup helper handles installation and management for both.

vpn-setup

vpn-setup is the unified entry point for VPN management. Run it with no arguments to see status of all configured VPNs.

# Show WireGuard + Tailscale status
vpn-setup status

Tailscale

Tailscale builds a mesh VPN on top of WireGuard. Every device on your Tailscale network gets a stable IP, and connections are peer-to-peer when possible. No port forwarding or config files required.

Install and connect

On a standard omfreebdy install Tailscale ships preinstalled and tailscaled is enabled and started automatically — so you usually only need to log in with tailscale up. The steps below cover manual / non-default installs.

# Install via vpn-setup
vpn-setup tailscale install

# Or manually:
pkg install tailscale
sysrc tailscaled_enable=YES
service tailscaled start

After install, authenticate with your Tailscale account:

# Opens a browser link for authentication
vpn-setup tailscale up

# Or directly:
tailscale up

tailscale up prints a URL. Open it in a browser to authorize the device on your Tailscale network.

Status and management

# Show connected peers
tailscale status

# Disconnect (keeps daemon running)
vpn-setup tailscale down

# Reconnect
vpn-setup tailscale up

Waybar indicator

The status bar shows a VPN icon (between Bluetooth and Ethernet) reflecting the Tailscale connection:

󰦝 green — connected (tooltip shows your tailnet name, IP, online peer count, and exit node if set)
󰦞 yellow — installed but disconnected or not logged in
󰦞 dim — Tailscale not installed / daemon not running

Click the icon to toggle the connection — when disconnected it opens a terminal running tailscale up so the login/auth URL is visible. Right-click shows full vpn-setup status.

Status and management

Installs the tailscale package via pkg
Enables tailscaled at boot via sysrc
Starts the tailscaled service

WireGuard

WireGuard runs as a kernel module (if_wg) on FreeBSD. It is fast, minimal, and uses short static config files.

Install

# Install via vpn-setup
vpn-setup wireguard install

# Or manually:
pkg install wireguard-tools wireguard-kmod
kldload if_wg
sysrc kld_list+=" if_wg"

Configure

WireGuard configs live in /usr/local/etc/wireguard/. Copy your config file (from your VPN provider, self-hosted server, or wg genkey setup) into place:

sudo cp your-config.conf /usr/local/etc/wireguard/wg0.conf

A minimal wg0.conf looks like:

[Interface]
PrivateKey = <your-private-key>
Address = 10.0.0.2/24

[Peer]
PublicKey = <server-public-key>
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0

Connect and disconnect

# Bring up the tunnel
vpn-setup wireguard up wg0

# Tear down the tunnel
vpn-setup wireguard down wg0

# Check tunnel status
vpn-setup wireguard status

wg0 is the default interface name. If your config file is named differently (e.g., office.conf), pass that name instead: vpn-setup wireguard up office.

Troubleshooting

Tailscale daemon not running

service tailscaled status
# If stopped:
service tailscaled start

WireGuard kernel module not loaded

kldstat | grep if_wg
# If missing:
sudo kldload if_wg

Ensure kld_list in /etc/rc.conf includes if_wg so it loads at boot.

No connectivity after WireGuard up

Check that your config has the correct Endpoint, keys, and AllowedIPs. Verify with sudo wg show wg0.

Tailscale can’t reach peers

Run tailscale ping <peer-ip> to diagnose. If using a firewall, ensure UDP port 41641 is open for direct connections. Tailscale falls back to relay (DERP) servers if direct connections fail, so connectivity should still work — just slower.