Wireguard gained popularity as more people learned about its advantages over openvpn. Now tailscale is gaining popularity as people discover the advantages it offers on top of wireguard.

Firewalla needs to recognize this evolution. Tailscale isn't replacing wireguard's underlying technology; it's making it dramatically easier to use. Automatic device discovery, NAT traversal, connectivity behind CGNAT, centralized access controls, and the ability to securely connect devices across multiple locations without port forwarding are compelling improvements.

I own a firewalla Gold and initially appreciated its native wireguard implementation. However I've recently started using tailscale to connect to a few off-site servers, and the difference in convenience is substantial. I now have multiple VPN environments, each serving a different purpose, when ideally they could be consolidated.

What makes this particularly relevant to firewalla is that tailscale solves connectivity problems, while firewalla specializes in network security. These technologies should complement one another.

Yes, tailscale can already run in docker on firewalla, but that comes with significant limitations. Depending on the networking configuration firewalla may not be able to distinguish individual tailscale clients, monitor their traffic separately, or apply its normal device-specific policies.

That's a substantial compromise. One of firewalla's biggest selling points is its ability to identify, monitor, and protect individual devices. I shouldn't have to sacrifice those capabilities to use a more convenient VPN solution.

What I'd like to see from native integration is:

• Individual device visibility: Tailscale clients appearing as identifiable devices within firewalla, with individual traffic histories, security alerts, and firewall rules.
• Subnet routing: Secure access to home networks and VLANs without installing tailscale on every device.
• Exit node functionality: The ability to route internet traffic through firewalla while retaining its security protections and monitoring.
• Proper DNS and firewall integration: Tailscale traffic participating in firewalla's existing security architecture rather than requiring custom routing and NAT workarounds.
• Native management: Configuration, updates, monitoring, and recovery handled directly through firewalla rather than community-maintained docker containers and scripts.

I recognize that properly integrating individual tailscale device identities into firewalla's monitoring and firewall systems is considerably more complicated than simply installing tailscale. Source NAT, routing, and device attribution would need to be addressed. But that's also precisely why native support would be valuable and why people would be willing to pay $$$ for hardware (and now software!)

I'd be perfectly happy with a phased implementation, starting with officially supported subnet routing and exit-node functionality, followed by deeper integration with firewalla's device management and security features.

There's also a broader reason I think firewalla should prioritize this.

Wireguard became popular because it improved on openvpn. Tailscale is becoming popular because it makes wireguard easier and more practical for everyday use. Firewalla was right to embrace wireguard, and I think embracing tailscale is the logical next step.

Tailscale already has excellent access controls but those aren't a substitute for firewalla's network monitoring, device management, and security capabilities. Combining the two would offer something neither product provides independently.

Ultimately, I don't want firewalla to simply run tailscale. I would like firewalla to secure tailscale connections with the same level of visibility and control it provides for its native wireguard clients.

That would be a meaningful competitive advantage, and a compelling reason for existing tailscale users to choose firewalla over other routers.

The most important difference

Traditional wireguard assumes you can establish a network path between peers.

Tailscale actively works to establish that path for you.

That's a substantial advantage when you have no control over one or both networks.