tailscale / tailscale/tailscale

Relay Connections to (some) Subnet Routers with pfSense package

Open
#5,157 6 comments 0 reactions 0 assignees View on GitHub
bug L1 Very few P1 Nuisance T3 Performance/Debugging
Dominant language
Go
Stars
36.5k
Forks
3.2k
Avg merge
1d 23h
Merged PRs (30d)
132

Description

### What is the issue?

When using subnet routers, which advertise the public IP they connect to the internet with, and is the target for Tailscale direct connections (this is a bigger issue with IPv6, of course as the internet facing IPs and the "local" IPs you are trying to reach are the same), the client will not connect directly under no circumstances, contrary to all other clients (like macOS, iOS, Linux, etc.).

I can see why it's possibly failing to connect as it's seeing the route going to the `tailscale0` interface for a route it's not actually connected behind the scenes, but it's the same configuration on all devices as far as I can tell. Even those with userspace networking. And those work.

### Steps to reproduce

_Using IPv4 for brevity and clarity, works the same with IPv6 only, or both IPv4 and IPv6_

1. Have a subnet router on your Tailnet, which advertises _all_ of its public IPs (e.g. if its IPv4 is `192.0.2.10`, and it's advertising either `192.0.2.10/32` or a superset).
2. Setup a Tailscale client on pfSense using the recently released package, which accepts routes other nodes advertise.
3. Try and reach any IP advertised (or the Tailnet IPs) of the remote node, it will work, but only via a relay.
4. Disable the routes of the remote node, even in the Web GUI, and the connection goes to direct. Re-enable them and it goes instantly to relay. Enabling IPv4 or IPv6 by themselves moves the connection to the other IP.

### Are there any recent changes that introduced the issue?

_No response_

### OS

Other

### OS version

pfSense+ 22.05

### Tailscale version

1.26.2

### Bug report

BUG-65d1ecbc8bd3069c89e105a38b63e1fc7dcd7812bfa1d8c959e43e6f91cdd6d8-20220723134030Z-8dbc2d0016a7395d

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.