pfSense » pfSense Packages

I marked this as "Very High" because if a user is remotely connected to their system through tailscale, a reboot would totally lock them out since this bug prevents the service from reconnecting to the tailnet. It is only repairable on the local network or console.

Package Versions
Name	Version	Comment
pfSense-pkg-Tailscale	0.1.8	pfSense package Tailscale
tailscale	1.80.0	Mesh VPN that makes it easy to connect your devices
pfsense	2.8.1-RELEASE	Community Edition

What works:
On a new install of the package, with a non-reusable auth key and the machine set to never expire (both recommended by the package itself), tailscale connects perfectly. Restarting the package also reconnects fine, as long as a reboot has not yet occurred.

What doesn't work:
If the system reboots, it attempts to run

tailscale up

with the --auth-key flag still set. This throws an error

invalid key: API key does not exist

because the key is non-reusable.

Current workaround:
After boot completes and tailscale fails to connect, clear the flags and then bring the tailscale port back up with the flags needed via shell command

/usr/local/bin/tailscale up --reset --advertise-exit-node --advertise-routes=192.168.0.0/24,192.168.20.0/24,192.168.1.0/24 --accept-dns=false

.

Of course each user's flags will vary, those are just mine.

Proposed fix:
Add a checkbox that allows users to mark it as a non-reusable key. Marking it as such would then remove the

--auth-key

flag on future

tailescale up

commands run by the package.