How to update to the latest Tailscale version?
-
I'm on 25.11.1.
I updated to 1.94.1_2 via SSH on pfSense, and there were no problems after the update.
service tailscaled stop && tailscale logoutfetch https://pkg.freebsd.org/FreeBSD:16:amd64/latest/All/tailscale-1.94.1_2.pkg || exit 1 && IGNORE_OSVERSION=yes pkg-static add -f tailscale-1.94.1_2.pkg && rm -f tailscale-1.94.1_2.pkg && sysrc tailscaled_enable=“YES” && service tailscaled start && tailscale up && tailscale version && tailscale status -
@CarlMRoss Cool! Strange somehow, that some people had to recreate API key and other not...
-
@TommyMoo said in How to update to the latest Tailscale version?:
@CarlMRoss Cool! Strange somehow, that some people had to recreate API key and other not...
I have at least figured out why mine got annoyed and the key got invalidated. I had been assuming that the uninstall script for the PfSense package for Tailscale (pfsense-pkg-tailscale) would automatically stop the daemon. This is correct, however the way it seems to do it corrupts the configuration somehow (my guess would be the state table getting corrupted but I do not know for certain.)
If I first disable Tailscale in VPN > Tailscale then go and uninstall, update, and reinstall, I can re-enable it the same way I disabled and be perfectly fine. Last time my install corrupted was just over a month ago and I run expiry timers longer than I probably should so the key should not have gone invalid especially since the device is tagged instead of user-authenticated.
Also, @smurph82: your instructions are impeccable but I should note that they will not work for people who use tags on their PfSense node. I have mine tagged because I do not need any of the features that require user auth for Tailscale on PfSense and the act of applying tags to the device strips user auth away.
-
@veddy254 You are correct about the tags. For tags, again I don't use them but you can adjust for your use case would be something like this
tailscale up --force-reauth --accept-routes --advertise-exit-node --advertise-routes=<MY_SUBNET>/24 --advertise-tags=tag:pfsense,tag:serverYo would need to adjust the subnet and tags to your configuration.
-
@veddy254 Nice, you found out why you needed to renew API Key, well done!
-
CAUTION
I had the following error message after upgrading and restarting the daemon. This time I simply typed "tailscale login" and pasted the authentication URL into a browser to re-authenticate. I did not need to generate a new key.
# Health check: # - You are logged out. The last login error was: invalid key: API key does not existUpdated CE 2.8.1 to 1.96.4
pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.96.4.pkg -
Upgraded pfSense to version 26.03 - Tailscale Package version 0.1.9_2 - Package Dependencies: tailscale-1.94.1. Afterward, I only had to restart Tailscale and re-advertise routes. The Tailscale version remained the same as before the pfSense upgrade, 1.94.1_2.
Updated to 1.96.4; no errors.
After the updates, I always have to restart Tailscale and re-advertise routes. -
@elvisimprsntr I had to re-authenticate after the last update (to version 1.94.1_2) and every time the service restarted while on that update but I stopped the tailscale service and logged out of it as described by @CarlMRoss above (service tailscaled stop && tailscale logout) before this update and I didn't have to log back in manually after the update to 1.96.4.
I think the theory up-thread that one of the updates may have corrupted the saved login credentials when done on a running tailscale service may be correct. I'll just keep this extra step as part of the procedure since it seems to have fixed the issue for me.
-
I stopped using the logout command in the last update; as far as I could tell, it does nothing after 'service tailscaled stop'.
At the end of last year, I decided to do a clean restart and, afterward, apply all Tailscale updates and settings changes via SSH. I uninstalled the tailscale package, then deleted all leftover tailscale files and settings. After that, I reinstalled the package and then updated Tailscale via SSH from Freshports. Since then, no errors, no need to generate new keys or re-authenticate.
I always need to re-advertise routes after every update and after the rare pfSense reboot. I have searched for a solution, but none of the suggestions have seemed worth pursuing.
-
tailscale logout is not required to prevent the corruption event. The only thing that is absolutely required is to manually stop the tailscale service, whether by disabling Tailscale in the VPN menu of the Web Configurator or by command-line as @CarlMRoss alluded to. I just tested this myself as my pfSense box was still running 1.94.1 and had no issues.
-
New Tailscale pricing. Positive changes overall
https://tailscale.com/blog/pricing-v4
+Unlimited devices, up to 6 users
-3 ACL groups, 50 tagged resources
?1000 (Temporary) ephemeral resources
-
No login or authentication issues this time.
Updated CE 2.8.1 to 1.96.4_1
pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/quarterly/All/tailscale-1.96.4_1.pkg -
@elvisimprsntr said in How to update to the latest Tailscale version?:
No login or authentication issues this time.
Wasn't the case for me. Even though I stopped the Tailscale service before updating, I still had to reauthenticate using the existing key. Thankfully it didn't take much time to fix thanks to the discussion here.
It's weird that it's so unpredictable though.
-
Updated to version 1.96.4_1, no issues, no errors.
System: pfSense+ 26.03, Tailscale Package 0.1.9_2, Package Dependencies: tailscale-1.94.1, Freshports-tailscaled version 1.96.4_1
I’ve seen unpredictable behavior since I started doing FreshPorts updates on pfSense+ 24.x. What has worked better for me is stopping the service before the update and restarting it afterward. After reboots, I’ve sometimes had to run some version of service tailscaled stop, service tailscaled start, and tailscale up to get things stable again.
-
said in How to update to the latest Tailscale version?:
Updated to version 1.96.4_1, no issues, no errors.
Updated to version 1.96.4_2
service tailscaled stopfetch https://pkg.freebsd.org/FreeBSD:16:amd64/latest/All/tailscale-1.96.4_2.pkg || exit 1 && pkg-static add -f tailscale-1.96.4_2.pkg && rm -f tailscale-1.96.4_2.pkg && service tailscaled startAfter upgrading pfSense+ to 26.03, I added advertised routes in the Tailscale web GUI, and there have been no issues with Tailscale updates or pfSense reboots since then.
-
Updated CE 2.8.1 to 1.98.2
pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/quarterly/All/tailscale-1.98.2.pkg -
Updated CE 2.8.1 to 1.98.3
pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.98.3.pkg -
Updated CE 2.8.1 to 1.98.4
pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.98.4.pkg -
Updated CE 2.8.1 to 1.98.5_1
pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.98.5_1.pkg
