diff --git a/ext/installfiles/linux/zerotier-containerized/Dockerfile b/ext/installfiles/linux/zerotier-containerized/Dockerfile
index f0386c800..b6d122a0e 100644
--- a/ext/installfiles/linux/zerotier-containerized/Dockerfile
+++ b/ext/installfiles/linux/zerotier-containerized/Dockerfile
@@ -5,7 +5,7 @@ FROM debian:buster-slim as builder
 ## Supports x86_64, x86, arm, and arm64
 
 RUN apt-get update && apt-get install -y curl gnupg
-RUN apt-key adv --keyserver ha.pool.sks-keyservers.net --recv-keys 0x1657198823e52a61  && \
+RUN apt-key adv --keyserver pgp.mit.edu --recv-keys 0x1657198823e52a61  && \
     echo "deb http://download.zerotier.com/debian/buster buster main" > /etc/apt/sources.list.d/zerotier.list
 RUN apt-get update && apt-get install -y zerotier-one=1.8.4
 COPY ext/installfiles/linux/zerotier-containerized/main.sh /var/lib/zerotier-one/main.sh
diff --git a/ext/libnatpmp/getgateway.c b/ext/libnatpmp/getgateway.c
index f743a0894..0f06e1dc2 100644
--- a/ext/libnatpmp/getgateway.c
+++ b/ext/libnatpmp/getgateway.c
@@ -271,7 +271,9 @@ int getdefaultgateway(in_addr_t *addr)
   rtm.rtm_addrs = rtm_addrs;
 
   so_dst.sa_family = AF_INET;
+  so_dst.sa_len = sizeof(struct sockaddr);
   so_mask.sa_family = AF_INET;
+  so_mask.sa_len = sizeof(struct sockaddr);
 
   NEXTADDR(RTA_DST, so_dst);
   NEXTADDR(RTA_NETMASK, so_mask);
diff --git a/make-bsd.mk b/make-bsd.mk
index 06c188090..637f80d68 100644
--- a/make-bsd.mk
+++ b/make-bsd.mk
@@ -7,6 +7,29 @@ LIBS=
 include objects.mk
 ONE_OBJS+=osdep/BSDEthernetTap.o ext/http-parser/http_parser.o
 
+ifeq ($(OSTYPE),FreeBSD)
+	# Auto-detect miniupnpc and nat-pmp as well and use ports libs if present,
+	# otherwise build into binary as done on Mac and Windows.
+	INCLUDES+=-I/usr/local/include
+	LIBS+=-L/usr/local/lib
+	ONE_OBJS+=osdep/PortMapper.o
+	override DEFS+=-DZT_USE_MINIUPNPC
+	MINIUPNPC_IS_NEW_ENOUGH=$(shell grep -sqr '.*define.*MINIUPNPC_VERSION.*"2..*"' /usr/local/include/miniupnpc/miniupnpc.h && echo 1)
+	ifeq ($(MINIUPNPC_IS_NEW_ENOUGH),1)
+		LIBS+=-lminiupnpc
+		override DEFS+=-DZT_USE_SYSTEM_MINIUPNPC
+	else
+		override DEFS+=-DMINIUPNP_STATICLIB -DMINIUPNPC_SET_SOCKET_TIMEOUT -DMINIUPNPC_GET_SRC_ADDR -D_BSD_SOURCE -D_DEFAULT_SOURCE -DOS_STRING=\"FreeBSD/$(shell uname -r)\" -DMINIUPNPC_VERSION_STRING=\"2.0\" -DUPNP_VERSION_STRING=\"UPnP/1.1\" -DENABLE_STRNATPMPERR
+		ONE_OBJS+=ext/miniupnpc/connecthostport.o ext/miniupnpc/igd_desc_parse.o ext/miniupnpc/minisoap.o ext/miniupnpc/minissdpc.o ext/miniupnpc/miniupnpc.o ext/miniupnpc/miniwget.o ext/miniupnpc/minixml.o ext/miniupnpc/portlistingparse.o ext/miniupnpc/receivedata.o ext/miniupnpc/upnpcommands.o ext/miniupnpc/upnpdev.o ext/miniupnpc/upnperrors.o ext/miniupnpc/upnpreplyparse.o
+	endif
+	ifeq ($(wildcard /usr/local/include/natpmp.h),)
+		ONE_OBJS+=ext/libnatpmp/natpmp.o ext/libnatpmp/getgateway.o
+	else
+		LIBS+=-lnatpmp
+		override DEFS+=-DZT_USE_SYSTEM_NATPMP
+	endif
+endif
+
 # Build with address sanitization library for advanced debugging (clang)
 ifeq ($(ZT_SANITIZE),1)
 	SANFLAGS+=-fsanitize=address -DASAN_OPTIONS=symbolize=1