Freshports

pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.98.5_1.pkg

Changelog

Freshports

pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.98.4.pkg

Changelog

Freshports

pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.98.3.pkg

Changelog

Freshports

pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/quarterly/All/tailscale-1.98.2.pkg

Changelog

Updated to version 1.96.4_1, no issues, no errors.

Updated to version 1.96.4_2

service tailscaled stop

fetch https://pkg.freebsd.org/FreeBSD:16:amd64/latest/All/tailscale-1.96.4_2.pkg || exit 1 && pkg-static add -f tailscale-1.96.4_2.pkg && rm -f tailscale-1.96.4_2.pkg && service tailscaled start

After upgrading pfSense+ to 26.03, I added advertised routes in the Tailscale web GUI, and there have been no issues with Tailscale updates or pfSense reboots since then.

Updated to version 1.96.4_1, no issues, no errors.

System: pfSense+ 26.03, Tailscale Package 0.1.9_2, Package Dependencies: tailscale-1.94.1, Freshports-tailscaled version 1.96.4_1

I’ve seen unpredictable behavior since I started doing FreshPorts updates on pfSense+ 24.x. What has worked better for me is stopping the service before the update and restarting it afterward. After reboots, I’ve sometimes had to run some version of service tailscaled stop, service tailscaled start, and tailscale up to get things stable again.

No login or authentication issues this time.

Wasn't the case for me. Even though I stopped the Tailscale service before updating, I still had to reauthenticate using the existing key. Thankfully it didn't take much time to fix thanks to the discussion here.

It's weird that it's so unpredictable though.

Updated CE 2.8.1 to 1.96.4_1

Freshports

pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/quarterly/All/tailscale-1.96.4_1.pkg

Changelog

https://tailscale.com/blog/pricing-v4

+Unlimited devices, up to 6 users
-3 ACL groups, 50 tagged resources
?1000 (Temporary) ephemeral resources

tailscale logout is not required to prevent the corruption event. The only thing that is absolutely required is to manually stop the tailscale service, whether by disabling Tailscale in the VPN menu of the Web Configurator or by command-line as @CarlMRoss alluded to. I just tested this myself as my pfSense box was still running 1.94.1 and had no issues.

I stopped using the logout command in the last update; as far as I could tell, it does nothing after 'service tailscaled stop'.

At the end of last year, I decided to do a clean restart and, afterward, apply all Tailscale updates and settings changes via SSH. I uninstalled the tailscale package, then deleted all leftover tailscale files and settings. After that, I reinstalled the package and then updated Tailscale via SSH from Freshports. Since then, no errors, no need to generate new keys or re-authenticate.

I always need to re-advertise routes after every update and after the rare pfSense reboot. I have searched for a solution, but none of the suggestions have seemed worth pursuing.

I think the theory up-thread that one of the updates may have corrupted the saved login credentials when done on a running tailscale service may be correct. I'll just keep this extra step as part of the procedure since it seems to have fixed the issue for me.

Upgraded pfSense to version 26.03 - Tailscale Package version 0.1.9_2 - Package Dependencies: tailscale-1.94.1. Afterward, I only had to restart Tailscale and re-advertise routes. The Tailscale version remained the same as before the pfSense upgrade, 1.94.1_2.

Updated to 1.96.4; no errors.
After the updates, I always have to restart Tailscale and re-advertise routes.

I had the following error message after upgrading and restarting the daemon. This time I simply typed "tailscale login" and pasted the authentication URL into a browser to re-authenticate. I did not need to generate a new key.

# Health check:
#     - You are logged out. The last login error was: invalid key: API key does not exist

Updated CE 2.8.1 to 1.96.4

Freshports

pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.96.4.pkg

Changelog

tailscale up --force-reauth --accept-routes --advertise-exit-node --advertise-routes=<MY_SUBNET>/24 --advertise-tags=tag:pfsense,tag:server

Yo would need to adjust the subnet and tags to your configuration.

@CarlMRoss Cool! Strange somehow, that some people had to recreate API key and other not...

I have at least figured out why mine got annoyed and the key got invalidated. I had been assuming that the uninstall script for the PfSense package for Tailscale (pfsense-pkg-tailscale) would automatically stop the daemon. This is correct, however the way it seems to do it corrupts the configuration somehow (my guess would be the state table getting corrupted but I do not know for certain.)

If I first disable Tailscale in VPN > Tailscale then go and uninstall, update, and reinstall, I can re-enable it the same way I disabled and be perfectly fine. Last time my install corrupted was just over a month ago and I run expiry timers longer than I probably should so the key should not have gone invalid especially since the device is tagged instead of user-authenticated.

Also, @smurph82: your instructions are impeccable but I should note that they will not work for people who use tags on their PfSense node. I have mine tagged because I do not need any of the features that require user auth for Tailscale on PfSense and the act of applying tags to the device strips user auth away.

I'm on 25.11.1.

I updated to 1.94.1_2 via SSH on pfSense, and there were no problems after the update.

service tailscaled stop && tailscale logout 

fetch https://pkg.freebsd.org/FreeBSD:16:amd64/latest/All/tailscale-1.94.1_2.pkg || exit 1 && IGNORE_OSVERSION=yes pkg-static add -f tailscale-1.94.1_2.pkg && rm -f tailscale-1.94.1_2.pkg && sysrc tailscaled_enable=“YES” && service tailscaled start && tailscale up && tailscale version && tailscale status

updated in terminal of pfsense with command:

sudo pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.94.1_2.pkg

I had NO PROBLEM, all went well, Ive not been forced to create new API Key

Thanks for keeping us up to date to those, who contribute with Updates of Tailscale and informing our community

You can try to run it from the command in Diagnostics > Command Prompt but I always use ssh in to run commands.

Steps.
ssh into your pfsense.

ssh root@YOUR_IP -p YOUR_PORT

Then choose option 8 for the shell.

Once in the pfsense shell. I ran this

tailscale up --force-reauth 

Since I have my pfsense as an exit node and it also advertises routes. pfsense suggested I run this instead.

tailscale up --force-reauth --accept-routes --advertise-exit-node --advertise-routes=<MY_SUBNET>/24

This will then show you a Url that you copy and paste from your shell in your wed browser. It will then take you to Tailscale where you sign into your account and re-auth your pfsense. This will not change you Tail net Ip of the pfsense.

Again this does not persist after a reboot of the gateway or restarting the Tailscale, but I also don't do that often.

CAUTION

I had the following error message after upgrading and restarting the daemon. I had to logout and clean, then generate a new key

# Health check:
#     - You are logged out. The last login error was: invalid key: API key does not exist

Updated CE 2.8.1 to 1.94.1_2

Freshports

pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.94.1_2.pkg

Changelog

I had that when I went to install 1.94.1_1, not realizing I'd already installed that update. For some reason even though key expiry was disabled, it deauth'd the node. All I had to do was generate a new key on the backend, plug that into PfSense and reset the IP address and tags on the device within the tailnet. A note that if anyone does what I did and changes the IP address for pfsense from the admin page, you'll have to manually restart the daemon else it won't be responsive when targeting the new IP.

I had the following error message after upgrading and restarting the daemon. I had to logout and clean, then generate a new key

# Health check:
#     - You are logged out. The last login error was: invalid key: API key does not exist

Updated CE 2.8.1 to 1.94.1_2

Freshports

pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.94.1_2.pkg

Changelog

Tailscale
pkg add -f https://pkg.freebsd.org/FreeBSD:16:amd64/latest/All/tailscale-1.94.1_1.pkg

https://www.freshports.org/security/tailscale/