Tailscale, Magic DNS, pfsense and kubernetes oh my!

Here is the eco system.

I have a kubernetes cluster provisioned in xcp-ng. I have a tailscale pod running that advertises the kubernetes subnet and also accepts routes. The subnet is I have tailscale setup to dns cluster.local to (internal kubernetes dns server)

I have pfsense on a totally separate machine and have installed tailscale package in pfsense and also advertises the private network of the machines and vms on and accepts routes. I have tailscale setup to dns mydomain.local to (ip of pfsense and dns resolver)

The physical machines pfsense, xcp, nfs AND vms are all on the subnet

I have tailscale on my home pc out side of the physical network described above

So what is going on?

  • CAN dig loki.monitor.svc.cluster.local @ (tailscale resolver) I get the correct ip returned.

  • CAN dig loki.monitor.svc.cluster.local from home (outside of pfsense firewall) with no problems.

  • CANNOT dig from a vm using dig loki.monitor.svc.cluster.local this fails to resolve an ip. I find a server and the resolving server returns an empty record.

  • CANNOT dig loki.monitor.svc.cluster.local @ (pfsene) I get an empty record, no ip returned.

  • CANNOT dig loki.monitor.svc.cluster.local @' (kubernetes resolver) I get reply from unexpected source:, expected`

What have I done to try to make this work?

  • allow udp 41641 on wan interface to any and all.
  • Enable the UPnP service and Allow NAT-PMP Port Mapping
  • allow all and any on the tailscale interface
  • setup a domain over ride, cluster.local →

I have exhausted my ideas. Would love to make this work so any ideas no matter how “out there” are greatly welcomed and hoped for. Thanks for taking the time to read.


I don’t use Kuberneties but If pfsense is not responding with the proper DNS entry then you don’t have pfsense DNS setup properly.