OPNsense, and FreeBSD more generally, are community supported and built from the Tailscale client code (which is open source). However some of us do run OPNsense ourselves, including me.
The instructions set up tailscale for just the OPNsense host, so you can (for example) remotely connect to its web UI. If you’re expecting OPNsense to route from your LAN to the tailscale network, that can be done but requires an additional option when bringing the network up: https://tailscale.com/kb/1019/subnets
You’ll need to accept the subnet routes in https://login.tailscale.com/admin/machines before they will work. If everything is configured correctly you’ll see a “Subnets” badge on the machine. A screenshot from my admin panel is attached.
One note, however: Subnet Routing isn’t a feature in the free Solo plan. https://tailscale.com/pricing/
(I pay for the Connectivity plan for my personal Tailscale use.)
One thing that strikes me, is that Subnet routing is not part of the free plan ?
Is this new ?
I can’t recall to have seen that, and honestly, i have been using it, on my plan.
I just installed Tailscale on OPNsense and just with the defaults that showed up (the guide doesn’t show how to configure the rest , ex: dhcp, etc…) I never get an IP. But in my TS portal I do see OPNsense there with an IP. But I still can not access devices directly.
Tailscale interfaces don’t use DHCP to configure themselves, running “service tailscaled start” followed by “tailscale up” is sufficient. You should see an IP address in ifconfig:
root@OPNsense:~ # ifconfig tailscale0
tailscale0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1280
options=80000
inet 100.64.1.1 → 100.64.1.1 netmask 0xffffffff
inet6 fd7a:115c:a1e0:ab12:4843:cd96:6240:0101 prefixlen 48
groups: tun
nd6 options=103<PERFORMNUD,ACCEPT_RTADV,NO_DAD>
Opened by PID 31526
so i had to stop the tailscaled service and restart it. Now ifconfig hows the 100.67.223.113 IP that the admin console shows. I can ping out to the test site 100.101.102.103 and other devices from opnsense but can not ping the opnsense from any other devices.
@tappis
Did you ever find the solution to this? I have the exact same symptoms but despite hours of reading am still unable to reach the OPNsense GUI from other devices on the same Tailnet.
@ColeTrain
You seem to indicate you didn’t have a default rule for the Tailscale interface - I believe I have implemented this but still unable to reach the OPNsense GUI.