Project

General

Profile

Actions
Copy link

Bug #16342

open

Incorrect behavior of logout button in Tailscale

Added by aleksei prokofiev 3 months ago. Updated 3 days ago.

Status:
Confirmed
Priority:
Normal
Assignee:
Christian McDonald
Category:
Tailscale
Target version:
-
Start date:
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Affected Version:
Affected Plus Version:
24.11
Affected Architecture:
All

Description

Tailscale after press "Logout and Clean" button and then try to start connection again, it will produce error in the status that aut-key no valid
In the Tailscale admin panel in the server it will consider this connection as from different instance.
So if I switch to the reused key, yach time I do logout and connect again it will create a new instance in admin panel in Tailscale server.
Tested on 24.11 and 25.07-RC
Tailscale 1.76.1 and 1.82.5

Files

Download all files
image007.png (96.3 KB) image007.png aleksei prokofiev, 07/30/2025 04:00 PM
clipboard-202508171546-08dro.png (42.4 KB) clipboard-202508171546-08dro.png Jordan G, 08/17/2025 08:46 PM
clipboard-202508240807-tn3md.png (7.36 KB) clipboard-202508240807-tn3md.png aleksei prokofiev, 08/24/2025 05:07 AM
Actions
Copy link
 #1

Updated by aleksei prokofiev 3 months ago

Also, if change working key to different, save changes and then put working key back it won't connect and key will be no valid.

Actions
Copy link
 #2

Updated by dylan mendez 3 months ago

  • Status changed from New to Confirmed

Can confirm this issue in latest pfSense development versions

Actions
Copy link
 #3

Updated by Per Otto Opstad 3 months ago

This issue is not limited to clicking the log out button in Tailscale.
In my case, I’m experiencing the same problem without ever logging out manually.

It seems to occur when the firewall is rebooted. Upon reboot, the Tailscale key appears to become corrupted or invalid.
My suspicion is that the problem is related to how the key is stored and later retrieved — possibly resulting in a faulty or incomplete key during the fetch process.

Actions
Copy link
 #4

Updated by Christian McDonald 3 months ago

I'm seeing different behavior here.

When using a reusable preauth key, if I click `Logout and Clean`, the local Tailscale instance logs out and clears the local state cache. However, if I restart Tailscale with the same preauth key, Tailscale reauthenticates and creates a new machine node in the Admin Panel. This is expected behavior.

What else am I missing here?

I'm not seeing this:

it will produce error in the status that aut-key no valid

Actions
Copy link
 #5

Updated by Jordan G 2 months ago

I believe since the log out and clean button is on the authentication page, the expectation is that the pre-auth key would potentially be cleared. even if you just enter a random string and save it, it doesn't clear with the log out and clean button.

Actions
Copy link
 #6

Updated by aleksei prokofiev 2 months ago

Retested on 25.07.1
stepes:
1. Create key in admin panel
2. Setup Tailscale on pfSense using this key and connect instance
3. Change key in pfSense to any wrong key or random number and save
4. Put correct key back and save
5. You can't connect any more with this key

If you use a Reusable key and try to provided these steps, so each time when you put back correct key it will create new instance in admin panel.

Actions
Copy link
 #7

Updated by Jordan G 2 months ago

confirmed above behavior with 25.07.1 and tailscale 0.1.8

Actions
Copy link
 #8

Updated by Christian McDonald 2 months ago

aleksei prokofiev wrote in #note-6:

Retested on 25.07.1
stepes:
1. Create key in admin panel
2. Setup Tailscale on pfSense using this key and connect instance
3. Change key in pfSense to any wrong key or random number and save
4. Put correct key back and save
5. You can't connect any more with this key

If you use a Reusable key and try to provided these steps, so each time when you put back correct key it will create new instance in admin panel.

Thanks for the repro steps. I will try again

Actions
Copy link
 #9

Updated by Roger Winfield 3 days ago

Per Otto Opstad wrote in #note-3:

This issue is not limited to clicking the log out button in Tailscale.
In my case, I’m experiencing the same problem without ever logging out manually.

It seems to occur when the firewall is rebooted. Upon reboot, the Tailscale key appears to become corrupted or invalid.
My suspicion is that the problem is related to how the key is stored and later retrieved — possibly resulting in a faulty or incomplete key during the fetch process.

I have the same reboot issue on 25.07.1 SG4200. After a normal reboot the following status:

Tailscale Status (/usr/local/bin/tailscale status)
  1. Health check:
  2. - You are logged out. The last login error was: invalid key: API key does not exist.

Any help or suggestions would be greatly appreciated.

Actions
Copy link
 #10

Updated by Per Otto Opstad 3 days ago

Yes, i can confirm this is an issue on the latest public build 25.07.1.
Developers, please take another look. I can give you access to my fw for further testing.
This is for my company a big issue since i have all my customer managed using tailscale.
If a fw is restarted i loose management to the firewall.

Roger Winfield wrote in #note-9:

Per Otto Opstad wrote in #note-3:

This issue is not limited to clicking the log out button in Tailscale.
In my case, I’m experiencing the same problem without ever logging out manually.

It seems to occur when the firewall is rebooted. Upon reboot, the Tailscale key appears to become corrupted or invalid.
My suspicion is that the problem is related to how the key is stored and later retrieved — possibly resulting in a faulty or incomplete key during the fetch process.

I have the same reboot issue on 25.07.1 SG4200. After a normal reboot the following status:

Tailscale Status (/usr/local/bin/tailscale status)
  1. Health check:
  2. - You are logged out. The last login error was: invalid key: API key does not exist.

Any help or suggestions would be greatly appreciated.

Actions
Copy link

Also available in: Atom PDF