Can pfSense route to a Tailscale subnet without NAT?

jonsed

This post is deleted!

jonsed

Not had any response to this so thought I'd try and describe the scenario more succinctly.

Home network: 2 VLANs, 10.0.1.0/24 and 10.0.2.0/24; pfSense configured as per Christian McDonald's video.

10.0.3.0/24 subnet in Azure containing a VM; I start Tailscale with:

--accept-routes --advertise-routes=10.0.3.0/24 --snat-subnet-routes=false

After accepting both routes in the Tailscale portal, all three (V)LANs can ping each other.

However, the Azure VM sees all the traffic as coming from the pfSense Tailscale IP, because of the NAT rules.

Is it possible to route to the 10.0.3.0/24 subnet without NAT'ing? I'd like the Azure subnet to "appear" as another local VNET.

I don't need NAT rules from 10.0.1.0 to 10.0.2.0, for instance - can I do without NAT going from 10.0.1.0 to 10.0.3.0?

Tailscale docs suggest "--snat-subnet-routes=false" is needed, but it's not supported in pfSense.

I've tried setting "Do not Nat" on the Outbound NAT rules - if I do that, Azure VM can see the IPs of the requests from the local lans, but the responses don't make it back to the clients so DNS doesn't work. I'm not sure how to diagnose where they're getting lost.

Is there a way I've not thought of?

Cheers.

cyrus104

@jonsed, very sorry I can not help with this but I'm running into the exact same issue. I would also like to get to the Tailscale 100. addresses from machines behind my pfsense router, pfsense can get to them from a shell just fine but none of the edge clients.

Good luck.