Tailscale on OPNsense

So i have installed Tailscal on my OPNsense box, as described here : Setting up Tailscale on OPNsense - Tailscale

I get an ip, but i have a hard time, getting anything to work.
Can anybody tell, when other steps they did, to make it usable in this setup ?


OPNsense, and FreeBSD more generally, are community supported and built from the Tailscale client code (which is open source). However some of us do run OPNsense ourselves, including me.

The instructions set up tailscale for just the OPNsense host, so you can (for example) remotely connect to its web UI. If you’re expecting OPNsense to route from your LAN to the tailscale network, that can be done but requires an additional option when bringing the network up: https://tailscale.com/kb/1019/subnets

You’ll need to accept the subnet routes in https://login.tailscale.com/admin/machines before they will work. If everything is configured correctly you’ll see a “Subnets” badge on the machine. A screenshot from my admin panel is attached.

One note, however: Subnet Routing isn’t a feature in the free Solo plan. https://tailscale.com/pricing/
(I pay for the Connectivity plan for my personal Tailscale use.)

Sent from Front

Thanks for your answer.

One thing that strikes me, is that Subnet routing is not part of the free plan ?
Is this new ?
I can’t recall to have seen that, and honestly, i have been using it, on my plan.



The subnet routing feature is not disabled in any tier, and we encourage people to try it to make sure it will meet their needs.

Sent from Front

I just installed Tailscale on OPNsense and just with the defaults that showed up (the guide doesn’t show how to configure the rest , ex: dhcp, etc…) I never get an IP. But in my TS portal I do see OPNsense there with an IP. But I still can not access devices directly.

Tailscale interfaces don’t use DHCP to configure themselves, running “service tailscaled start” followed by “tailscale up” is sufficient. You should see an IP address in ifconfig:

root@OPNsense:~ # ifconfig tailscale0
tailscale0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1280
inet netmask 0xffffffff
inet6 fd7a:115c:a1e0:ab12:4843:cd96:6240:0101 prefixlen 48
groups: tun
Opened by PID 31526

Sent from Front

so i had to stop the tailscaled service and restart it. Now ifconfig hows the IP that the admin console shows. I can ping out to the test site and other devices from opnsense but can not ping the opnsense from any other devices.

Ignore my last email I did not have a default rule for the tailscale interface. working fine now! Thank you!

Do you happen to remember how you did it ? :smiley: Same problem here.

Or if anyone else can guide me to do the necessary stuff in CLI. My issues:

  • Opnsense in VM can ping other VMs
  • Other VMs can’t ping opnsense or access gui
  • Tailscale machine list shows connection to the opnsense VM.

thank you. your mistake helped me, that was my mistake!

Did you ever find the solution to this? I have the exact same symptoms but despite hours of reading am still unable to reach the OPNsense GUI from other devices on the same Tailnet.

You seem to indicate you didn’t have a default rule for the Tailscale interface - I believe I have implemented this but still unable to reach the OPNsense GUI.

Any suggestions welcome.

Has anyone figured out what to do in addition to setting up the Tailscale addon? I have the same problem. Set up Tailscale on OPNsense following the guide and it shows connected on the Tailscale webpage but I cannot ping the IP address or connect to the OPNsense GUI.

Just figured I’d reply to this post as I’m having a hard time understanding getting Tailscale to work with OPNsense, and the documentation on the website sends you for a loop without any clear instructions. I’ve got Tailscale running, without subnets or advertising as an exit node yet as I wanted to figure out the basics. I went ahead and created an interface for Tailscale and have the IPv4 Configuration Type as static with the IP being the IP reported in the dashboard and when I execute ifconfig. It’s in IP/32 CIDR.

Where I’m completely lost is what I’m supposed to setup NAT wise as when I go to Firewall > NAT > Outbound and create new, I’m not entirely sure what to put and I definitely don’t see anything about NAT-PMP and don’t want to enable UPnP on my router. However, since installing Tailscale on the router, I’ve begun noticing connectivity issues as highlighted in the documentation, but when you click the links they just send you around in a circle.

I wish Tailscale was officially supported in OPNsense like it is in pfSense, doesn’t make any sense why not. However, it has led me looking into ZeroTier as an alternative since it has a native integration. Any advice on how I can get OPNsense/my Tailscale network to “work” better/smoother again would be greatly appreciated!