Not understanding Tailscale VPN lockdown

Hey folks,
Help me understand something here about Tailscale on pfSense.
Tailscale is a painless way of setting up a site2site VPN or having remote access back to the homelab but the one thing I’m not understanding is how do you set up firewall rules in this set up?

As an example, i came up with a network diagram that outlines what I’m trying to understand. I have two sites 1. California and 2. New York.
The pfsense firewalls will control access to each site through firewall rules on the LAN side. Easy to understand.
The remote access user on the other hand cant be controlled by pfSense as far as i know. The default policy is permit any/any. Is creating JSON rules in the tailscale portal the only way to control where Remote Access employees can go? Feels extremely limited in this setup.

Yes, you create the rules in the Tailscale web interface.

1 Like