diff --git a/net/tinc/src/opnsense/mvc/app/controllers/OPNsense/Tinc/forms/dialogHost.xml b/net/tinc/src/opnsense/mvc/app/controllers/OPNsense/Tinc/forms/dialogHost.xml
index 91e55e420..9e991a432 100644
--- a/net/tinc/src/opnsense/mvc/app/controllers/OPNsense/Tinc/forms/dialogHost.xml
+++ b/net/tinc/src/opnsense/mvc/app/controllers/OPNsense/Tinc/forms/dialogHost.xml
@@ -35,6 +35,16 @@
         <type>textbox</type>
         <help>Public key for this host in the network</help>
     </field>
+    <field>
+      <id>host.cipher</id>
+      <label>Cipher</label>
+      <type>dropdown</type>
+      <help> The symmetric cipher algorithm used to encrypt UDP packets.
+             Any cipher supported by LibreSSL or OpenSSL is recognised.
+             Furthermore, specifying "none" will turn off packet encryption.
+             It is best to use only those ciphers which support CBC mode
+      </help>
+    </field>
     <field>
         <id>host.connectTo</id>
         <label>Connect To</label>
diff --git a/net/tinc/src/opnsense/mvc/app/controllers/OPNsense/Tinc/forms/dialogNetwork.xml b/net/tinc/src/opnsense/mvc/app/controllers/OPNsense/Tinc/forms/dialogNetwork.xml
index 026fdb993..e43e7ffea 100644
--- a/net/tinc/src/opnsense/mvc/app/controllers/OPNsense/Tinc/forms/dialogNetwork.xml
+++ b/net/tinc/src/opnsense/mvc/app/controllers/OPNsense/Tinc/forms/dialogNetwork.xml
@@ -17,6 +17,16 @@
         <type>text</type>
         <help>This machines internal address to use and network mask for the whole network</help>
     </field>
+    <field>
+      <id>network.cipher</id>
+      <label>Cipher</label>
+      <type>dropdown</type>
+      <help> The symmetric cipher algorithm used to encrypt UDP packets.
+             Any cipher supported by LibreSSL or OpenSSL is recognised.
+             Furthermore, specifying "none" will turn off packet encryption.
+             It is best to use only those ciphers which support CBC mode
+      </help>
+    </field>
     <field>
         <id>network.debuglevel</id>
         <label>Debug</label>
diff --git a/net/tinc/src/opnsense/mvc/app/models/OPNsense/Tinc/Tinc.xml b/net/tinc/src/opnsense/mvc/app/models/OPNsense/Tinc/Tinc.xml
index 5cc67df01..07b09ad3c 100644
--- a/net/tinc/src/opnsense/mvc/app/models/OPNsense/Tinc/Tinc.xml
+++ b/net/tinc/src/opnsense/mvc/app/models/OPNsense/Tinc/Tinc.xml
@@ -42,6 +42,14 @@
                 <pubkey type="TextField">
                     <Required>Y</Required>
                 </pubkey>
+                <cipher type="JsonKeyValueStoreField">
+                    <Required>Y</Required>
+                    <Multiple>N</Multiple>
+                    <ConfigdPopulateAct>tinc list ciphers</ConfigdPopulateAct>
+                    <ConfigdPopulateTTL>1</ConfigdPopulateTTL>
+                    <SourceFile>/tmp/tinc_current_cipher_options.index</SourceFile>
+                    <default>blowfish</default>
+                </cipher>
                 <enabled type="BooleanField">
                     <default>1</default>
                     <Required>Y</Required>
@@ -93,6 +101,14 @@
                 <pubkey type="TextField">
                     <Required>Y</Required>
                 </pubkey>
+                <cipher type="JsonKeyValueStoreField">
+                    <Required>Y</Required>
+                    <Multiple>N</Multiple>
+                    <ConfigdPopulateAct>tinc list ciphers</ConfigdPopulateAct>
+                    <ConfigdPopulateTTL>1</ConfigdPopulateTTL>
+                    <SourceFile>/tmp/tinc_current_cipher_options.index</SourceFile>
+                    <default>blowfish</default>
+                </cipher>
                 <connectTo type="BooleanField">
                     <default>1</default>
                     <Required>Y</Required>
diff --git a/net/tinc/src/opnsense/scripts/OPNsense/Tinc/lib/objects.py b/net/tinc/src/opnsense/scripts/OPNsense/Tinc/lib/objects.py
index b2b8f37ef..956586c92 100644
--- a/net/tinc/src/opnsense/scripts/OPNsense/Tinc/lib/objects.py
+++ b/net/tinc/src/opnsense/scripts/OPNsense/Tinc/lib/objects.py
@@ -109,6 +109,7 @@ class Host(NetwConfObject):
         self._connectTo = "0"
         self._payload['subnet'] = None
         self._payload['pubkey'] = None
+        self._payload['cipher'] = None
 
     def connect_to_this_host(self):
         if self.is_valid() and self._connectTo == "1":
@@ -123,6 +124,7 @@ class Host(NetwConfObject):
         result = list()
         result.append('Address=%(address)s'%self._payload)
         result.append('Subnet=%(subnet)s'%self._payload)
+        result.append('Cipher=%(cipher)s'%self._payload)
         result.append(self._payload['pubkey'])
         return '\n'.join(result)
 
diff --git a/net/tinc/src/opnsense/scripts/OPNsense/Tinc/list_ciphers.py b/net/tinc/src/opnsense/scripts/OPNsense/Tinc/list_ciphers.py
new file mode 100755
index 000000000..b5755afc4
--- /dev/null
+++ b/net/tinc/src/opnsense/scripts/OPNsense/Tinc/list_ciphers.py
@@ -0,0 +1,50 @@
+#!/usr/local/bin/python2.7
+
+"""
+    Copyright (c) 2016 Deciso B.V. - Ad Schellevis
+    All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+
+    1. Redistributions of source code must retain the above copyright notice,
+     this list of conditions and the following disclaimer.
+
+    2. Redistributions in binary form must reproduce the above copyright
+     notice, this list of conditions and the following disclaimer in the
+     documentation and/or other materials provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+
+    --------------------------------------------------------------------------------------
+    list ciphers
+"""
+from subprocess import Popen, PIPE
+import ujson
+
+response = dict()
+
+p = Popen(['/usr/bin/openssl','enc', '-help'],stdin=PIPE, stdout=PIPE, stderr=PIPE, bufsize=-1)
+output, error = p.communicate()
+cipher_section = False
+for line in error.split('\n'):
+    if line.find('Cipher Types') == 0:
+        cipher_section = True
+        continue
+    if cipher_section:
+        for item in line.split():
+            if len(item) > 1:
+                response[item[1:]] = item[1:]
+
+response["none"] = "None"
+# output generated keys
+print (ujson.dumps(response))
diff --git a/net/tinc/src/opnsense/service/templates/OPNsense/Tinc/tinc_deploy.xml b/net/tinc/src/opnsense/service/templates/OPNsense/Tinc/tinc_deploy.xml
index f51b424d6..d2a1a1050 100644
--- a/net/tinc/src/opnsense/service/templates/OPNsense/Tinc/tinc_deploy.xml
+++ b/net/tinc/src/opnsense/service/templates/OPNsense/Tinc/tinc_deploy.xml
@@ -17,6 +17,7 @@
                 <address>{{network.extaddress}}</address>
                 <subnet>{{network.subnet}}</subnet>
                 <pubkey><![CDATA[{{network.pubkey}}]]></pubkey>
+                <cipher>{{network.cipher}}</cipher>
                 <connectto>0</connectto>
             </host>
 {%       for host in helpers.toList('OPNsense.Tinc.hosts.host', 'hostname') %}
@@ -27,6 +28,7 @@
                 <address>{{host.extaddress}}</address>
                 <subnet>{{host.subnet}}</subnet>
                 <pubkey><![CDATA[{{host.pubkey}}]]></pubkey>
+                <cipher>{{host.cipher}}</cipher>
                 <connectto>{{host.connectTo}}</connectto>
             </host>
 {%          endif %}