Regression #14987
closed
``Interface Address`` is no longer an option for outbound NAT targets
Added by Danilo Zrenjanin about 1 year ago.
Updated 11 months ago.
Affected Architecture:
All
Description
After upgrading to version 23.09, the option to choose a Tailscale address when defining an outbound NAT rule on the Tailscale interface is no longer available.
Steps to reproduce.
1.) Define Tailscale setup and confirm that it is active under Status/Tailscale
2.) Navigate to Firewall/NAT/Outbound and define a new mapping using the Tailscale interface.
3.) Click on the Translation - Address drop-down menu.
4.) Notice that there is no option for a Tailscale address to choose.
Files
Can confirm this,
tested on
23.09-RELEASE (amd64)
built on Tue Oct 31 22:56:00 MSK 2023
FreeBSD 14.0-CURREN
Tested
23.09-RELEASE (amd64)
built on Tue Oct 31 22:56:00 MSK 2023
FreeBSD 14.0-CURRENT
If I assign Tailscale interface, in this case it is presented
I've just tested and confirmed on 23.05.1 that there was no need to assign the Tailscale interface to have it in the list of available interfaces in the Outbound NAT rules.
Assigning a Tailscale interface in pfSense is wrong.
Is there a workaround until this gets fixed?
I second this issue. Is there a workaround.
If you are using tailscale to set a Site2Site VPN then traffic leaving the tailscale interface to a remote network learned within the tailnet must be sourced using the Tailscale interface.
Danilo - Are you saying that outbound SNAT rules are done automatically now?
UPDATE:
I see the Tailscale interface has now been added back in 23.09.1
Please update the ticket to let us know if this is resolved permanently
I am running 23.09.1. The Tailscale address is still missing from the pull-down menu in the translation section. In the setup video by Christian McDonald it says to not assign tailscale0 to an interface. Previously it appeared the "Tailscale address" selection was available in the outbound NAT rule creation without assigning the interface.
I have mine setup per the Tailscale website instructions, but it is basically making all UDP traffic have static NAT. I would rather have only Tailscale traffic be handled with static NAT.
I've tested on 23.09.1. Indeed, there is no Tailscale address from the drop-down menu in the translation section.
As a workaround, you can define an IP Alis VIP using localhost as the Parent interface and the Tailscale address of that node for IP.
In the outbound NAT rule, the VIP address defined in the previous step will be available in the drop-down menu.
Once the outbound NAT rule is configured on both sides, the traffic flows as intended in both directions.
- Project changed from pfSense Packages to pfSense
- Subject changed from Tailscale Address option is missing in Translation Address section under Firewall/NAT/Outbound to ``Interface Address`` is no longer an option for outbound NAT targets
- Category changed from Tailscale to Rules / NAT
- Status changed from Confirmed to Not a Bug
- Assignee deleted (
Christian McDonald)
- Affected Version set to 2.7.2
- Release Notes set to Default
- Affected Architecture All added
The "Interface Address" selection is no longer available due to general changes to the outbound NAT pages which bring similar features as other parts of the firewall. For example:
- Expose
<interface> subnets aliases in source/destination
- Expose
<interface group> networks aliases in source/destination
- Alias popup preview on the
NAT Address field
- Better error handling on rules to avoid filter reload failures
With other VPN types such as OpenVPN, IPsec, or WireGuard, the option isn't needed or simply doesn't apply. However, Tailscale is an edge case that indeed benefits from having the "Interface Address" option given that it cannot have an interface assignment. In this case, the address should be entered by selecting Network or Alias. If there's a use-case that necessitates frequently changing the interface address, an option for this edge case could be considered.
Does this cause issues with layer 2 experimental rules? They are MAC address or interface based.
Also available in: Atom
PDF
Updated by 
Updated by 
Updated by 
Updated by 
Updated by 
Updated by 
Updated by 
