Project

General

Profile

Actions
Copy link

Bug #17034

open

Tailscale package does not add tailscale0 to Tailscale interface group

Added by Jerry Poole 2 days ago. Updated about 19 hours ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
VPN (Multiple Types)
Target version:
-
Start date:
Due date:
% Done:

0%

Estimated time:
Release Notes:
Default
Affected Plus Version:
26.07
Affected Architecture:

Description

On pfSense Plus 26.07, Tailscale starts successfully and accepted
subnet routes are installed through tailscale0. However, tailscale0
is only a member of the "tun" group and is not a member of the
"Tailscale" interface group.

This prevents firewall and outbound NAT rules using the Tailscale
interface group from matching.

ifconfig tailscale0 | grep groups
groups: tun

An outbound NAT rule compiles successfully:

nat on Tailscale inet from 10.21.1.0/24 to 10.23.1.0/24
-> <PFSENSE_TAILSCALE_IP>

However, the state leaves tailscale0 untranslated:

tailscale0 tcp 10.21.1.11 -> 10.23.1.10:443 SYN_SENT:CLOSED

Manually running:

ifconfig tailscale0 group Tailscale

immediately fixes the problem. New states are translated and establish:

tailscale0 tcp 100.77.152.102 (10.21.1.11)
-> 10.23.1.10:443 ESTABLISHED:ESTABLISHED

The package startup code appears intended to add this group membership,
but it is missing at runtime. This may be a startup timing issue or may
occur when tailscale0 is recreated after the package startup hook runs.

Actions
Copy link
 #1

Updated by → luckman212 about 19 hours ago

I'm hitting this too, but hadn't realized it until I looked at my logs:

# grep 'tailscale0 does not have interface group set' /var/log/system.log
<13>1 2026-08-15T15:10:01.057491-04:00 r1.lan tailscaled 24021 - - tailscale0 does not have interface group set
<13>1 2026-08-15T15:15:00.043996-04:00 r1.lan tailscaled 41538 - - tailscale0 does not have interface group set
<13>1 2026-08-15T20:15:00.041474-04:00 r1.lan tailscaled 37756 - - tailscale0 does not have interface group set
<13>1 2026-08-18T08:30:00.038498-04:00 r1.lan tailscaled 65194 - - tailscale0 does not have interface group set

Don't think it's a new bug in 26.07, this issue was definitely occurring on my systems as far back as April, because I had already picked up on it as a bug and added it to my catch-all Tailscale fixer-upper script tscheck.sh (GitHub: tscheck.sh) which I have scheduled to run every 5 minutes via Cron.

Actions
Copy link

Also available in: Atom