Frequently Asked Questions
Can't find your answer? Reach out to contact support
No matching questions found.
What is TLSOps Home?
TLSOps Home is a self-hosted network gateway appliance that runs on your own hardware — a spare Linux machine, a Raspberry Pi, or a bridged VM. It gives you per-device VPN routing, network-wide DNS ad-blocking and content filtering, and a built-in WireGuard server for remote access — all managed from a web dashboard.
Do I need special hardware?
No special hardware is required, but the host must run a supported OS. Official releases support Ubuntu 22.04 and 24.04+, Debian 12 and Debian 13+, on x86_64 or aarch64 — bare-metal, a Proxmox VM in bridged mode, or similar. The host must be LAN-reachable with its own IPv4 address and not hidden behind an isolated NAT hypervisor network.
Does TLSOps replace my router?
No. Your router still handles the WAN uplink and typically Wi-Fi and DHCP. TLSOps sits between your router and your clients as the LAN default gateway. For full routing and VPN enforcement your router must hand out the TLSOps machine as the default gateway for each device. It can also run in DNS-only mode, where it filters DNS without handling all client traffic.
Can remote devices use the same filtering and routing rules as home devices?
Yes, if the WireGuard profile is linked to a known device. TLSOps includes a built-in WireGuard server for phones and laptops connecting back from outside the home. Unlinked profiles appear as separate entries in Devices and Telemetry and follow the global policy until you link them. Linked profiles stay associated with the selected device, so the same device identity and per-device filtering and routing rules carry over on and off the home network. Client profiles are issued from the VPN Server tab in the dashboard.
Which VPN providers and protocols work with TLSOps?
TLSOps is WireGuard-only. Any provider that can export a standard WireGuard configuration works, including providers such as Mullvad, IVPN, Proton VPN, Surfshark, AzireVPN, or your own self-hosted WireGuard peer. OpenVPN and other proprietary VPN protocols are not supported.
What does a remote WireGuard device need to connect from outside the home?
TLSOps does not auto-detect whether inbound WireGuard will work from your network. For remote access, the appliance needs either a direct public IP or a router rule that forwards the chosen UDP port to the TLSOps machine. If your ISP uses CGNAT, direct inbound WireGuard may not work at all without an additional relay or VPS. If remote profiles cannot connect, verify the public IP, router forwarding, local firewall rules, and CGNAT status first.
How do I activate my license?
You can choose a plan in two places: (A) Immediately after creating the admin account on a fresh install, the dashboard opens the Activation screen and requires you to choose how TLSOps should run. Enter a license key and click Activate License for paid access, or click Continue in Free Mode to persist the Free plan. (B) On an already-running appliance that is already in Free mode, open Settings, then use the Access & License card to enter your key and click Activate. The appliance switches into paid access as soon as the key is validated, then refreshes the detailed plan limits and feature availability in the background as current entitlements arrive.
Do backups require a paid license?
Backup export does require an active paid license on that appliance. Restore from an existing backup is still available regardless of license state, including recovery onto a new machine. For hardware migration, the recommended path is to restore the backup on first boot of the new appliance, which re-binds the license automatically as part of the restore.
What happens during an appliance update?
Updates are installed from Settings under Appliance Updates. TLSOps downloads the published bundle, verifies its signature, installs it in place, and then restarts appliance services automatically. DNS, VPN, and dashboard access drop briefly while services restart, then the dashboard reloads once healthy. Your configuration is preserved across updates, the license is re-validated on startup, cached license state covers temporary licensing-server outages for up to 5 days, and if an update fails mid-install the previous version remains running.
What does the Free plan include?
The Free plan includes 1 imported VPN tunnel, 5 domain routes, 1 per-device default route assignment, and 1 hour of telemetry history once the appliance has refreshed its current entitlements. Immediately after switching to Free or during a temporary Free fallback, telemetry can briefly appear unavailable until that refresh completes. It is free forever with no card required. WireGuard server profiles and App presets are not included on the Free plan.
What do the paid plans add?
Starter raises limits to 3 VPN tunnels, 3 WireGuard server profiles, 20 domain routes, 3 per-device default routes, 2 app presets, 2 tunnel groups, 24 hours of telemetry, and 1 hardware reset per month. Pro raises limits to 10 VPN tunnels, 10 WireGuard server profiles, 60 domain routes, 10 per-device default routes, 10 app presets, 10 tunnel groups, 7 days of telemetry, and 3 hardware resets per month. Ultimate removes the published count limits for VPN tunnels, WireGuard server profiles, domain routes, per-device default routes, app presets, tunnel groups, and hardware resets, and includes 30 days of telemetry history.
Do I need a payment method to try TLSOps?
No. The Free plan requires no billing setup. After first login, TLSOps still requires you to choose how it should run: click Continue in Free Mode on the Activation screen to persist Free access, or enter a license key for a paid plan. If you later want to upgrade from Free, open Settings and use the Access & License card to activate your key there.
What happens if my license expires or cannot be refreshed?
After a successful validation, TLSOps caches the license locally. If the licensing server is temporarily unreachable, the appliance continues at the activated plan level for up to 5 days. If the license cannot be refreshed after that window, TLSOps falls back to Free plan limits until connectivity is restored and the license is re-validated — your network stays up throughout.
My devices cannot reach the internet after installing TLSOps.
The most common cause is port 53 being occupied by systemd-resolved or another local DNS service. Check with: sudo ss -lntu | grep :53. If systemd-resolved is listed, disable it and restart TLSOps. See the Troubleshooting doc for the exact commands.
Routing and VPN policy seem to have no effect on my devices.
Per-device routing only works when client devices route their traffic through TLSOps as the default gateway. If you only pointed DNS at TLSOps (DNS-only mode), content filtering applies but routing policy does not. Change your DHCP server to hand out the TLSOps machine as the default gateway to enable full enforcement.
Why did my tunnel group stay on the current tunnel even though another one measured faster?
A faster single throughput sample does not force an immediate switch. Tunnel groups rank challengers by score, require repeated evaluation wins before changing the selector, and run throughput checks less often than lightweight health probes. If the active tunnel becomes unhealthy, TLSOps can switch immediately to the top-scoring challenger. With interruption disabled, existing sessions stay on the old tunnel and only new connections use the newly selected member.
Content filtering is not working on a specific device.
Check that the device is using TLSOps as its DNS server. TLSOps already enforces encrypted-DNS guard rules for common bypass paths, including rejecting UDP 443 and TCP or UDP 853. If a specific app is pinned to a known HTTPS resolver domain, add or verify a DNS rewrite for that resolver domain if needed. Then verify the right policy controls in the dashboard: global Blocklists and global Blocked Domains apply network-wide. For device-specific rules, make sure that device's override is enabled if you expect a separate policy, DNS Filtering is turned on for the device, and the device's Blocked Services and Blocked Domains settings match what you intend.
Why did TLSOps create a new device or stop applying rules to the old one?
TLSOps treats the MAC address as the durable identity for a device because IP addresses can change over time. If a phone, laptop, or other client starts using a different MAC address — for example because private or randomized Wi-Fi addresses are enabled — TLSOps will treat it as a different device and the old per-device rules stay attached to the previous identity. If you want one stable device identity, keep the client on a consistent MAC address for your home network. When adding a device manually, include the MAC address when you know it to help keep that identity stable.
Why am I still at the device policy limit or unable to remove a manual device?
A device with saved custom settings still counts toward the per-device policy limit until you reset it back to the default policy. That includes custom routes, saved device overrides, and per-device rule state. In the Devices view, use Reset Settings first to clear that custom state and free the slot. Offline manual devices can also stay non-removable until those saved settings are reset, after which you can remove the manual entry normally.
Can I move my license to a different machine?
Yes. The recommended approach is to export a backup from the current appliance (Settings → Backup & Restore card → Export configuration), install TLSOps on the new machine, and on first boot choose Restore from Backup before creating an admin account. This migrates all settings and re-binds the license to the new hardware in one step. If you did not follow the backup path and the new machine reports a hardware binding mismatch, contact support with your license details to clear the binding.