Project

General

Profile

Actions
Copy link

Regression #14987

closed

``Interface Address`` is no longer an option for outbound NAT targets

Added by Danilo Zrenjanin 6 months ago. Updated 4 months ago.

Status:
Not a Bug
Priority:
Normal
Assignee:
-
Category:
Rules / NAT
Target version:
-
Start date:
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Default
Affected Version:
2.7.2
Affected Architecture:
All

Description

After upgrading to version 23.09, the option to choose a Tailscale address when defining an outbound NAT rule on the Tailscale interface is no longer available.

Steps to reproduce.
1.) Define Tailscale setup and confirm that it is active under Status/Tailscale
2.) Navigate to Firewall/NAT/Outbound and define a new mapping using the Tailscale interface.
3.) Click on the Translation - Address drop-down menu.
4.) Notice that there is no option for a Tailscale address to choose.

Files

Download all files
clipboard-202311150941-pz0q7.png (38.2 KB) clipboard-202311150941-pz0q7.png Danilo Zrenjanin, 11/15/2023 08:41 AM
clipboard-202311151300-hsm4m.png (68.9 KB) clipboard-202311151300-hsm4m.png Lev Prokofev, 11/15/2023 09:00 AM
clipboard-202311151456-gyk8a.png (30.9 KB) clipboard-202311151456-gyk8a.png aleksei prokofiev, 11/15/2023 11:56 AM
clipboard-202311151456-da78t.png (4.79 KB) clipboard-202311151456-da78t.png aleksei prokofiev, 11/15/2023 11:56 AM
clipboard-202311151458-eunfa.png (27.4 KB) clipboard-202311151458-eunfa.png aleksei prokofiev, 11/15/2023 11:58 AM
clipboard-202311151458-tggqd.png (23.5 KB) clipboard-202311151458-tggqd.png aleksei prokofiev, 11/15/2023 11:58 AM
clipboard-202312150919-hksmq.png (66.4 KB) clipboard-202312150919-hksmq.png Alias VIP Danilo Zrenjanin, 12/15/2023 08:19 AM
clipboard-202312150922-4btvs.png (116 KB) clipboard-202312150922-4btvs.png Translation Address using Alias VIP Danilo Zrenjanin, 12/15/2023 08:22 AM
clipboard-202312150928-9zksy.png (168 KB) clipboard-202312150928-9zksy.png Outbound NAT rule Danilo Zrenjanin, 12/15/2023 08:28 AM
Actions
Copy link
 #1

Updated by Lev Prokofev 6 months ago

Can confirm this,

tested on

23.09-RELEASE (amd64)
built on Tue Oct 31 22:56:00 MSK 2023
FreeBSD 14.0-CURREN

Actions
Copy link
 #2

Updated by aleksei prokofiev 6 months ago

Tested
23.09-RELEASE (amd64)
built on Tue Oct 31 22:56:00 MSK 2023
FreeBSD 14.0-CURRENT

If I assign Tailscale interface, in this case it is presented

Actions
Copy link
 #3

Updated by Danilo Zrenjanin 5 months ago

I've just tested and confirmed on 23.05.1 that there was no need to assign the Tailscale interface to have it in the list of available interfaces in the Outbound NAT rules.

Assigning a Tailscale interface in pfSense is wrong.

Actions
Copy link
 #4

Updated by Chad Wagner 5 months ago

Is there a workaround until this gets fixed?

Actions
Copy link
 #5

Updated by Mike Moore 5 months ago

I second this issue. Is there a workaround.
If you are using tailscale to set a Site2Site VPN then traffic leaving the tailscale interface to a remote network learned within the tailnet must be sourced using the Tailscale interface.

Danilo - Are you saying that outbound SNAT rules are done automatically now?

Actions
Copy link
 #6

Updated by Mike Moore 5 months ago

UPDATE:
I see the Tailscale interface has now been added back in 23.09.1

Please update the ticket to let us know if this is resolved permanently

Actions
Copy link
 #7

Updated by Chad Wagner 5 months ago

I am running 23.09.1. The Tailscale address is still missing from the pull-down menu in the translation section. In the setup video by Christian McDonald it says to not assign tailscale0 to an interface. Previously it appeared the "Tailscale address" selection was available in the outbound NAT rule creation without assigning the interface.

I have mine setup per the Tailscale website instructions, but it is basically making all UDP traffic have static NAT. I would rather have only Tailscale traffic be handled with static NAT.

Actions
Copy link
 #8

Updated by Danilo Zrenjanin 5 months ago

I've tested on 23.09.1. Indeed, there is no Tailscale address from the drop-down menu in the translation section.

As a workaround, you can define an IP Alis VIP using localhost as the Parent interface and the Tailscale address of that node for IP.

Alias VIP

In the outbound NAT rule, the VIP address defined in the previous step will be available in the drop-down menu.

Translation Address using Alias VIP

Once the outbound NAT rule is configured on both sides, the traffic flows as intended in both directions.
Outbound NAT rule

Actions
Copy link
 #9

Updated by Marcos M 5 months ago

  • Project changed from pfSense Packages to pfSense
  • Subject changed from Tailscale Address option is missing in Translation Address section under Firewall/NAT/Outbound to ``Interface Address`` is no longer an option for outbound NAT targets
  • Category changed from Tailscale to Rules / NAT
  • Status changed from Confirmed to Not a Bug
  • Assignee deleted (Christian McDonald)
  • Affected Version set to 2.7.2
  • Release Notes set to Default
  • Affected Architecture All added
The "Interface Address" selection is no longer available due to general changes to the outbound NAT pages which bring similar features as other parts of the firewall. For example:
  • Expose <interface> subnets aliases in source/destination
  • Expose <interface group> networks aliases in source/destination
  • Alias popup preview on the NAT Address field
  • Better error handling on rules to avoid filter reload failures

With other VPN types such as OpenVPN, IPsec, or WireGuard, the option isn't needed or simply doesn't apply. However, Tailscale is an edge case that indeed benefits from having the "Interface Address" option given that it cannot have an interface assignment. In this case, the address should be entered by selecting Network or Alias. If there's a use-case that necessitates frequently changing the interface address, an option for this edge case could be considered.

Actions
Copy link
 #10

Updated by Jonathan Lee 4 months ago

Does this cause issues with layer 2 experimental rules? They are MAC address or interface based.

Actions
Copy link

Also available in: Atom PDF