Why do I need TS installed on pfsense router?

chudak

@johnpoz said in Why do I need TS installed on pfsense router?:

@chudak I have TS setup with pfsense, but other then testing that it works I would normally just access via openvpn.

I am not aware of any security concerns with TS at this time.. What do you mean how would I enable it - I walk through the TS gui on pfsense, it was pretty straight forward..

When hit TS pfsense IP the UI page does not start

Maybe there is a setting somewhere ‍️ ?

johnpoz

@chudak let me test from my phone on cell with tailscale - brb.

johnpoz

@chudak ok back - I had some issues with pfblocker doh list blocking my access to the TS site.. anywho.. Got that sorted, and then could enable routes and exit node stuff again on TS site, seems when got disconnected while back for expired keys when I brought it back up it looked like new device which didn't have routes enabled, or exit node.

So got that sorted then was able to access my pfsense web gui from phone on cell, connected to TS just using the lan IP of my pfsense 192.168.9.253 and my gui port

chudak

@johnpoz
In my case I am trying to use TS IP: 100.xx.yy.35 and I can't either from my net of outside

johnpoz

@chudak why would you use that? But I just tried that.. And worked after it complained about the cert.

BTW there really no point to hiding the TS Ips - they are all in the cgnat space.. If your not connected to ts they sure would not route.. And pretty sure they don't allow people on different TS networks that have been setup to see each other - unless they have some way to allow for that..

michmoor

@johnpoz What theme is that?

johnpoz

@michmoor theme where on pfsense screenshot from phone? I am using default pfsense theme

michmoor

@johnpozah ok. Looks different to me

johnpoz

@michmoor maybe browser setting on my phone? Just using firefox on an iphone.. I think I set it to dark or something - not a big browser on my phone guy anyway.. I mean I look up stuff like anyone and go to the site.. But not a big just surfing about to stuff so have not spent any time trying to make it look pretty or anything ;) heheh

chudak

@johnpoz

I see

tailscale0	Default deny rule IPv4 (1000000103)

Blocking access to my router via TS
I have no WF rules on tailscale0 interface

Puzzled

I do see WG port open.

Do I need to open port for TS too?

johnpoz

@chudak you mean on this interface you have no rules?

chudak

@johnpoz said in Why do I need TS installed on pfsense router?:

@chudak you mean on this interface you have no rules?

I do not.

What’s interesting that except opening pfsense UI everything else is working fine ‍️

PS: WG interface also has none

johnpoz

@chudak so you can get to your other devices though pfsense TS connection.. Or do the clients have their own TS connections?

I could try removing that rule and see if I can still get to the web gui.. There for sure some hits on it - but not very much.. but then all I did was open the webgui page, I didn't log in or anything.

I will set that rule to log as well to see what it actually allows.

chudak

@johnpoz said in Why do I need TS installed on pfsense router?:

@chudak so you can get to your other devices though pfsense TS connection.. Or do the clients have their own TS connections?

Both work fine

BTW I trued adding this rule and it didn't make any difference

johnpoz

@chudak that rule is what seems to allow it - here I set it to log, and made a connection via my phone and you can see it showing a state

Did you try just access say your webgui on your pfsense lan IP?

chudak

@johnpoz said in Why do I need TS installed on pfsense router?:

@chudak that rule is what seems to allow it - here I set it to log, and made a connection via my phone and you can see it showing a state

Did you try just access say your webgui on your pfsense lan IP?

I can access via LAN IP

Added this rule and see what you see:

So it passed, buy still no UI

So I am suspecting it's something else on pfsense level

chudak

@johnpoz said in Why do I need TS installed on pfsense router?:

@chudak that rule is what seems to allow it - here I set it to log, and made a connection via my phone and you can see it showing a state

Did you try just access say your webgui on your pfsense lan IP?

Did you set up any of these?

https://tailscale.com/kb/1146/pfsense/?q=pfsen
https://tailscale.com/kb/1181/firewalls
https://tailscale.com/kb/1082/firewall-ports

In addition to the standard TS install?

johnpoz

@chudak those are all about clients behind pfsense making their own TS connections, I have none of those.. I allowed the 41641 port to my wan that is it..

chudak

@johnpoz said in Why do I need TS installed on pfsense router?:

@chudak those are all about clients behind pfsense making their own TS connections, I have none of those.. I allowed the 41641 port to my wan that is it..

TCP/UDP on 41641 on WAN?

chudak

@johnpoz

Finally made it work :)

It does require TS port to be open on WAN + All all traffic on talescale interface

The confusion was that TS has to be restarted in order to show the difference

Thx @johnpoz