tailscale / tailscale/tailscale
Relay Connections to (some) Subnet Routers with pfSense package
- Dominant language
- Go
- Stars
- 36.5k
- Forks
- 3.2k
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 132
Description
### What is the issue?
When using subnet routers, which advertise the public IP they connect to the internet with, and is the target for Tailscale direct connections (this is a bigger issue with IPv6, of course as the internet facing IPs and the "local" IPs you are trying to reach are the same), the client will not connect directly under no circumstances, contrary to all other clients (like macOS, iOS, Linux, etc.).
I can see why it's possibly failing to connect as it's seeing the route going to the `tailscale0` interface for a route it's not actually connected behind the scenes, but it's the same configuration on all devices as far as I can tell. Even those with userspace networking. And those work.
### Steps to reproduce
_Using IPv4 for brevity and clarity, works the same with IPv6 only, or both IPv4 and IPv6_
1. Have a subnet router on your Tailnet, which advertises _all_ of its public IPs (e.g. if its IPv4 is `192.0.2.10`, and it's advertising either `192.0.2.10/32` or a superset).
2. Setup a Tailscale client on pfSense using the recently released package, which accepts routes other nodes advertise.
3. Try and reach any IP advertised (or the Tailnet IPs) of the remote node, it will work, but only via a relay.
4. Disable the routes of the remote node, even in the Web GUI, and the connection goes to direct. Re-enable them and it goes instantly to relay. Enabling IPv4 or IPv6 by themselves moves the connection to the other IP.
### Are there any recent changes that introduced the issue?
_No response_
### OS
Other
### OS version
pfSense+ 22.05
### Tailscale version
1.26.2
### Bug report
BUG-65d1ecbc8bd3069c89e105a38b63e1fc7dcd7812bfa1d8c959e43e6f91cdd6d8-20220723134030Z-8dbc2d0016a7395d
Contributor guide
Assessment
This issue has not been assessed yet.