pfSense » pfSense Packages

I'm hitting this too, but hadn't realized it until I looked at my logs:

# grep 'tailscale0 does not have interface group set' /var/log/system.log
<13>1 2026-08-15T15:10:01.057491-04:00 r1.lan tailscaled 24021 - - tailscale0 does not have interface group set
<13>1 2026-08-15T15:15:00.043996-04:00 r1.lan tailscaled 41538 - - tailscale0 does not have interface group set
<13>1 2026-08-15T20:15:00.041474-04:00 r1.lan tailscaled 37756 - - tailscale0 does not have interface group set
<13>1 2026-08-18T08:30:00.038498-04:00 r1.lan tailscaled 65194 - - tailscale0 does not have interface group set

Don't think it's a new bug in 26.07, this issue was definitely occurring on my systems as far back as April, because I had already picked up on it as a bug and added it to my catch-all Tailscale fixer-upper script tscheck.sh (GitHub: tscheck.sh) which I have scheduled to run every 5 minutes via Cron.

I have this issue as well after updating to 26.07. My pfSense box stays connected to Tailscale showing "Connected" via https://console.tailscale.com/admin/machines, however traffic can no longer route from LAN networks outbound to the tailscale interface.

In this state system logs show:

Aug 21 02:15:17     kernel         tailscale0: link state changed to DOWN
Aug 21 02:15:18     kernel         tun0: link state changed to UP
Aug 21 02:15:18     kernel         tun0: changing name to 'tailscale0'

Restarting the tailscale service allows outbound traffic to route again and system logs show:

Aug 21 22:15:40     php-fpm     8782     NOTICE The command '/usr/local/etc/rc.d/pfsense_tailscaled stop' returned exit code '1', the output was 'Stopping tailscaled. Waiting for PIDS: 56985.'
Aug 21 22:15:40     kernel         tailscale0: link state changed to DOWN
Aug 21 22:15:40     tailscale     74121     Waiting for device tailscale0
Aug 21 22:15:40     kernel         tun0: link state changed to UP
Aug 21 22:15:40     kernel         tun0: changing name to 'tailscale0'
Aug 21 22:15:41     tailscale     76241     Found device tailscale0
Aug 21 22:15:41     tailscale     77371     Added tailscale0 to interface group Tailscale
Aug 21 22:15:41     tailscale     77783     Bringing up tailscale0 with --auth-key=tskey-auth-XXXXXXXXXXXXXXXXXX --login-server=https://controlplane.tailscale.com --advertise-exit-node --accept-routes=false --accept-dns=false --advertise-routes=192.168.XX.0/24,192.168.XX.0/24,192.168.XX.0/24

I added the following command to a Cron job running every 1 minute; tailscale outbound traffic has worked every since.

/sbin/ifconfig tailscale0 2>/dev/null | /usr/bin/grep -q Tailscale || /sbin/ifconfig tailscale0 group Tailscale >/dev/null 2>&1

Also, I created a pfsense alias, "PFSENSE_TAILSCALE_TP" and used it for the NAT translation address in the Tailscale NAT Outbound rule. Set the alias to your tailscale ip address.

Paste this single command into Diagnostics → Command Prompt → Execute Shell Command to determine if tailcale0 is in the group and it will provide you with your tailscaleip as well as the pfsense alias address for further diagonstics.

/bin/sh -c 'echo "Current Tailscale IP:"; /usr/local/bin/tailscale ip -4; echo "PFSENSE_TAILSCALE_IP alias:"; /sbin/pfctl -t PFSENSE_TAILSCALE_IP -T show; echo "tailscale0 interface groups:"; /sbin/ifconfig tailscale0 | /usr/bin/grep groups'

Disabling Tailscale auto-updates with tailscale set --auto-update=false fixed this for me.
The auto-update mechanism recreates the interface for some reason, and after it is recreated it is no longer a member of the Tailscale group.
See https://github.com/tailscale/tailscale/issues/18136.

That looks promising. I've not tested this myself but here's a patch to try (set strip count to 4 when adding it with the System Patches package). ShowHide

diff --git a/security/pfSense-pkg-Tailscale/files/usr/local/etc/rc.d/pfsense_tailscaled b/security/pfSense-pkg-Tailscale/files/usr/local/etc/rc.d/pfsense_tailscaled
index a6f043cfaab8..c9f45eaf13ab 100755
--- a/security/pfSense-pkg-Tailscale/files/usr/local/etc/rc.d/pfsense_tailscaled
+++ b/security/pfSense-pkg-Tailscale/files/usr/local/etc/rc.d/pfsense_tailscaled
@@ -74,6 +74,9 @@ pfsense_tailscaled_up_flags="${pfsense_tailscaled_up_flags} --advertise-routes=$
 #    pfsense_tailscaled_up_flags="${pfsense_tailscaled_up_flags} --snat-subnet-routes=false" 
 #fi

+# Always disable automatic package updates.
+pfsense_tailscaled_set_flags="--auto-update=false" 
+
 extra_commands="clean" 

 start_cmd="${name}_start" 
@@ -133,10 +136,20 @@ pfsense_tailscaled_clean() {
     /bin/rm -f ${tailscaled_state_dir}/${tailscaled_state_file} >/dev/null 2>&1
 }

+# set tailscale runtime options
+tailscale_set() {
+    logger -s -t tailscale "Setting runtime options for ${tailscale_tun_dev} with ${pfsense_tailscaled_set_flags}" 
+    ${tailscale_bin} set ${pfsense_tailscaled_set_flags} || {
+        logger -s -t "Unable to set runtime options for ${tailscale_tun_dev}." 
+    }
+}
+
 # bring up tailscale using the generated up flags from the configuration
 tailscale_up() {
     logger -s -t tailscale "Bringing up ${tailscale_tun_dev} with ${pfsense_tailscaled_up_flags}" 
-    ${tailscale_bin} up ${pfsense_tailscaled_up_flags} || {
+    ${tailscale_bin} up ${pfsense_tailscaled_up_flags} && {
+        tailscale_set
+    } || {
         logger -s -t "Unable to bring up ${tailscale_tun_dev}. Check authentication." 
     }
 }

Marcos M wrote in #note-5:

That looks promising. I've not tested this myself but here's a patch to try (set strip count to 4 when adding it with the System Patches package). {{collapse
[...]
}}

I installed this using System Patches then restarted Tailscale, and have not had issues with losing tailscale routing since.

I haven't had the issue either since installing the patch.

Is this supposed to show up in System Patches?

Also I saw a new Tailscale pkg this morning: v0.1.10 - do we still need this patch with that version of the pkg installed?

The patch is in the new version.