pfSense » pfSense Plus

On pfSense Plus 26.07, Tailscale starts successfully and accepted
subnet routes are installed through tailscale0. However, tailscale0
is only a member of the "tun" group and is not a member of the
"Tailscale" interface group.

This prevents firewall and outbound NAT rules using the Tailscale
interface group from matching.

ifconfig tailscale0 | grep groups
groups: tun

An outbound NAT rule compiles successfully:

nat on Tailscale inet from 10.21.1.0/24 to 10.23.1.0/24
-> <PFSENSE_TAILSCALE_IP>

However, the state leaves tailscale0 untranslated:

tailscale0 tcp 10.21.1.11 -> 10.23.1.10:443 SYN_SENT:CLOSED

Manually running:

ifconfig tailscale0 group Tailscale

immediately fixes the problem. New states are translated and establish:

tailscale0 tcp 100.77.152.102 (10.21.1.11)
-> 10.23.1.10:443 ESTABLISHED:ESTABLISHED

The package startup code appears intended to add this group membership,
but it is missing at runtime. This may be a startup timing issue or may
occur when tailscale0 is recreated after the package startup hook runs.