In my previous post, I mentioned that have a remote portal machine in my friend’s house where I use RustDesk to access into.
However, in some use case, like access LAN resources and managing online services across multiple devices, the best practice is not using a remote desktop tool but having a VPN tunnel.
Old Stories
In the very early days, I used to use Hamachi to play LAN games like Counter Strike, Warcraft 3 and Minecraft with my internet friends. After I started doing homelab, I have used ZeroTier for quite a while before Tailscale came out.
In many cases, Syncthing (before was Resilio) would do the job for file sharing and RustDesk (before was AnyDesk) for remote control. But still way limited comparing to use VPN gateway which is quite difficult to have and secure for a homelab environment. This dilemma ends when Tailscale comes in.
I have been running a dedicated Tailscale router for a couple of weeks. It runs well at beginning but became unstable recently. So I decided to upgrade its hardware by getting a soft router.
Because of Tailscale/Wireguard uses AES-NI acceleration for its encryption, a relatively recent Intel x86 CPU is more preferable than ARM or any router processors.
I still remember my very first routerOS/pfSense soft router had a D525, which was the most capable Atom processor with DDR2 RAM. After that one died, I replaced it with a J1900 machine, that was the most popular low-power CPU with DDR3 RAM (I also added another with D2550 later on). This time, I bought a J4125 machine with DDR4 RAM.
But why am I so emphasized on the RAM generations? Because of the god damn price surge made DDR5 so expensive and many N100 mini PCs requires DDR5 RAMs!
Even there are some N100/N150/N97/G7505 models run with DDR4, the price went up more than I’m happy to pay. At the time of speculative bubble, I only buy things good enough for my use case, so I’ve chose J4125 rather than N5105 since everything is overpriced.
This specific model that I bought comes with multiple Ethernet port (though I need only 2 ports) Intel I210, this is the most reliable 1000Mbps NIC for soft routers (unlike those crappy 2.5 GbE NICs like I225/226 either have driver or firmware issues). I210 is able to plug and play on Linux/BSD based OSes, so I don’t need to tweak drivers like other Intel or the notorious Realtek/Ralink cards.
OPNsense (not working)
Download vga version of OPNsense, verify the image and write it to USB drive via balenaEtcher or dd.
Boot it from the soft router, log in with installer:opnsense to start installation.
Use ZFS and Strip for the storage option and install it on my 30GB mSATA drive.
After the system boots, login, reassign the interfaces and Set interface IP address to fit my local networking topology.
By now, it should be able to function as a normal firewall/router to access the Internet and web GUI without any issue. Do a update via OPNsense web GUI > System > Firmware > Updates
Thanks to the community plugin support, I can search & install os-tailscale via OPNsense web GUI > System > Firmware > Plugins > view community plugins
When it installed, refresh the page and go to VPN > Tailscale > Settings, check Enabled and Apply.
Go to Tailscale > Status, use the AuthURL to login Tailscale via another network/device if needed.
However, the plugin web GUI page was very limited, so does guides and resources. I couldn’t make it to use my Exit Node whether through GUI or CLI. Although I still believe it is possible to do but I need to set it up sooner than later, so I gave it up.
pfSense (semi working)
OPNsense is absolutely a better alternative for my taste but currently with lesser support than pfSense.
For example, mullvad vpn only got tutorials for pfSense and Openwrt. Also, Tailscale plugin in pfSense is more polished than OPNsense perhaps due to the community size.
For the sake of netgate’s dictatorship, we still have to install pfSense from version 2.7.2 like last time
Login with admin:pfsense and go through the setup wizard
In the end of the wizard, it may show Unable to check for updates due to pfSense-repoc: no pfSense packages installed. Do not change the Branch from 2.7.2 in Update Settings
To fix it, access the 8) Shell via the machine or SSH, then run
#certctl rehash, and install package management tool as prompted
pkg bootstrap -f
#update repo
pkg-static -d update
pkg-static update -f
#this one line script may work: certctl rehash pkg-static update -f pkg-static install -fy pkg pfSense-repo pfSense-upgrade
#If the webui doesn't show upgrade button, use the cli command: pfSense-upgrade
#https://docs.netgate.com/pfsense/en/latest/troubleshooting/upgrades.html
Now, refresh the System - Update page, it should be able to check update without error and saying it is up-to-date.
Change the Branch from 2.7.2 to 2.8.1, and check update again to trigger the upgrade button.
when the system is really up-to-date (2.8.1), install all needed packages from package manager, make a backup backup.xml file.
Select System - Advanced - Miscellaneous - Cryptographic Hardware - AES-NI, then follow the steps as in Flemming’s guide
Search and install tailscale via System - Package Manager
Refresh the page, go to VPN - Tailscale - Authentication - Pre-authentication Key, paste the key string and save it
Go through Settings - Enable Tailscale - Save, then run following command in SSH/Shell or Diagnostics - Command Prompt to let pfSense use an Exit Node
tailscale set --exit-node=100.xxx.xx.xx
tailscale up --reset --exit-node 100.xxx.xx.xx
Go to Interfaces - Assignments - + Add - tailscale0 - Save, then OPT1 - Enable interface - Save
At the same page, also set IPv4 Configuration Type to Static IPv4 and set the local tailscale IP as IPv4 Address and Save
Open the click here link under Add a new gateway, put the exit node IP into + Add - Gateway IPv4,
Check Disable Gateway Monitoring and Gateway Monitoring Action, click Display Advanced - Use non-local gateway through interface specific route
Go back to the tailscale0/OPT1 interfaces pages, select the gateway just created for IPv4 Upstream gateway, Save and Apply
Then follow the mullvad wireguard guide setting up the firewall rules for a leak proof router level VPN
Go to Firewall → NAT → Outbound.
Select Manual Outbound NAT rule generation.
Click on 💾 Save and then click on ✔ Apply Changes.
Locate your current NAT rule that contains 192.168.x.0/24 by default. (Auto created rule - LAN to WAN).
Click on the pencil button to edit that rule and change the Interface from WAN to OPT1.
Click on 💾 Save and then click on ✔ Apply Changes.
Go to Firewall → Rules → LAN.
Click on the pencil button next to the rule with the description "Default allow LAN to any".
Click on the button Display Advanced.
Gateway: select "tailscale_gw - 10.xx.xx.xx".
Click on 💾 Save and then click on ✔ Apply Changes.
Click Save when done, and check if the public IP address has changed as expected. Everything works quite well until a router reboot…
Unfortunately, the tailscale0/OPT1 interface disappears on every reboot which triggers interface mismatch and a troublesome auto reassign.
This is caused by poor support of tailscale by pfSense. There are multiple threads reporting/patching bugs related to this issue in netgate forums, but has not being solved yet. So I need to fallback to Openwrt X86, which works on my hard router.
Openwrt (work like a charm)
To install Openwrt x86, this guide is not suitable for me because I don’t have a mSATA adapter for operating my hard drive externally.
Boot into a handy LiveUSB of choice, and download the latest image
wget https://downloads.openwrt.org/releases/25.12.5/targets/x86/64/openwrt-25.12.5-x86-64-generic-ext4-combined-efi.img.gz
sha256sum openwrt-25.12.5-x86-64-generic-ext4-combined-efi.img.gz
c8ee59ce7b0f635a6b50c1b7307b07ee7785214a6faf2af42280dd4ef4310290
Extract the image and flash it on to the hard drive sdX, then reboot the system into the fresh installed Openwrt
lsblk -f
gzip -d openwrt-25.12.5-x86-64-generic-ext4-combined-efi.img.gz
sudo dd if=openwrt-25.12.5-x86-64-generic-ext4-combined-efi.img of=/dev/sdX
reboot
Try to connect the correct cable to the correct port. By default, my router’s eth0 is LAN and eth1 is WAN
Hit Enter key when boot process shows something like eth0 NIC Link is Up to access the console
Make sure the internet is accessible by ping, login Openwrt via console or SSH (need to enable through web GUI first) ssh [email protected] and run
apk update
apk add parted losetup resize2fs
parted -l -s
parted -f -s /dev/sda resizepart 2 100%
reboot
#continue after reboot
losetup /dev/loop0 /dev/sda2 2> /dev/null
resize2fs -f /dev/loop0
reboot
Search and install luci-app-tailscale-community via System - Software - Update lists... - Install...
Go to Services - Tailscale - Account Settings, put https://controlplane.tailscale.com as Custom Login Server and th Auth Key, then Save & Apply
Wait for a moment, it will show Service is Running.
Go to General Settings, select the desired Exit Node and click Auto Configure Firewall, then Save & Apply
To make it leak proof, go to Network - Firewall - Zones - lan - Edit - Allow forward to destination zones - remove wan, also check IPv4 Masquerading for lan zone then Save & Apply and reboot the router (very important to make things work)
After rebooting, check the public IP. Now it shows from the remote network location as my desired Exit Node.
To monitor the status, plugins like luci-app-statistics and collectd-mod-thermal need to be installed, then go to Statistics - Setup - General plugins - Thermal - Save & Apply
Now, at the Graphs page, I’m able to see the historical changes of my CPU temperature. On average use, it runs around 42C which is pretty good for a passive thermal system, thanks to its aluminum chassis which is in fact a thick and heavy heatsink. Download some ISO images at full speed to see test out impact (not so much for me) on the system status.
AES-NI support should be enabled out-of-the-box for Openwrt, and the connection is very stable. It looks like this CPU is a little bit over kill for my use case, since I don’t have a lot of devices running through the Tailscale tunnel with high volume of traffic.
But since the storage costs more than CPUs, this J4125 machine is at the sweet spot between N3160 and N5105, for its superior temperature.
So what about my previous hard router? I’ll be uninstalling Tailscale and make it as an AP with a built-in 4 port switch next to the new soft router.