Pfsense and tailscale

Networking & Firewalls
1

One of my few remaining pfsense (2.9.0 CE) boxes was upgraded recently

I have various NAT outbound mappings set to several other remote tailscale subnets so you can seemlessly access any host on any tailscale subnet from the LAN Net

Since updating I’m having to run “service tailscaled restart” as a cron job every few hours, as the service just stop routing even though all connections are showing ok in the plugin status page

Any one having the same problem, should I upgrade to opnsense?

PS just saw this at redmine … Bug #17075: Tailscale: tailscale0 loses "Tailscale" interface group after reboot, silently breaking rules - pfSense Packages - pfSense bugtracker

2

I mean, lots of users are moving off of pfsense for a variety of reasons. Opnsense is a good alternative.

3

I have not had any issues since updating but I was having an issue a while back with services sometimes stopping and not restarting. I addressed it with the service watchdog package. Its been rock solid for me.

4

One other thought, you can always set up a backup subnet router as well. I have done that on a small NUC device here in my home lab.

5

Wasn’t aware of that package, although I think in this case it’s not a service crashing issue

The forum link referenced in the redline link has a proposed patch, I’ll keep an eye on the redline page see what netgates reply is when it comes

6

It’s just the sheer convenience of being able to access any remote endpoint from ANY client on the LAN net when it’s running on the firewall

With a separate subnet router probably have to create persistence routes to achieve the same on every LAN client

Must make sure keep LAN net secure…. With great power comes great responsibility (from the book of Trump) :grinning_face:

7

It’s just inertia with these last few. Bit like I know I should move away from tailscale to NetBird because I can host it myself as tailscale can “do a “Broadcom” anytime…. But tailscale just works, just like pfsense, it’s pretty stable like opnsense

8

(FYI: netgate have posted a manual patch at redmine, fixes it fully)

9

Netscape posted a bunch of patches for the CE edition today (yesterday?) through the package manager. When I updated the package manager page, I was offered a new patch manager, which had 8-10 or so patches, including one for tailscale.

10

Wasn’t aware of that, I’ll remove the manual patch and do an update

Thnx

PS Easy to forget how ingrained tailscale has become in a lot of workflows, until something like this happens