How to update to the latest Tailscale version?
-
@elvisimprsntr Thanks!
You've become my source of knowledge of when a new version of Tailscale is finally available for pfsense :-) -
Updated CE 2.8.1 to 1.92.5_1
pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.92.5_1.pkg -
Updated CE 2.8.1 to 1.94.1
pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.94.1.pkg -
Updated CE 2.8.1 to 1.94.1_1
pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.94.1_1.pkg -
Updated 25.11.1-RELEASE (amd64)
Tailscale
pkg add -f https://pkg.freebsd.org/FreeBSD:16:amd64/latest/All/tailscale-1.94.1_1.pkghttps://www.freshports.org/security/tailscale/
-
CAUTION
I had the following error message after upgrading and restarting the daemon. I had to logout and clean, then generate a new key
# Health check: # - You are logged out. The last login error was: invalid key: API key does not existUpdated CE 2.8.1 to 1.94.1_2
pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.94.1_2.pkg -
@elvisimprsntr said in How to update to the latest Tailscale version?:
CAUTION
I had the following error message after upgrading and restarting the daemon. I had to logout and clean, then generate a new key
# Health check: # - You are logged out. The last login error was: invalid key: API key does not existUpdated CE 2.8.1 to 1.94.1_2
pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.94.1_2.pkgI had that when I went to install 1.94.1_1, not realizing I'd already installed that update. For some reason even though key expiry was disabled, it deauth'd the node. All I had to do was generate a new key on the backend, plug that into PfSense and reset the IP address and tags on the device within the tailnet. A note that if anyone does what I did and changes the IP address for pfsense from the admin page, you'll have to manually restart the daemon else it won't be responsive when targeting the new IP.
-
Yes. getting a new Api key will work, and doing so will change the Tailscale ip. There is another workaround that works but you might have to perform it everytime you reboot or restart Tailscale.
You can try to run it from the command in Diagnostics > Command Prompt but I always use ssh in to run commands.
Steps.
ssh into your pfsense.ssh root@YOUR_IP -p YOUR_PORTThen choose option 8 for the shell.
Once in the pfsense shell. I ran this
tailscale up --force-reauthSince I have my pfsense as an exit node and it also advertises routes. pfsense suggested I run this instead.
tailscale up --force-reauth --accept-routes --advertise-exit-node --advertise-routes=<MY_SUBNET>/24This will then show you a Url that you copy and paste from your shell in your wed browser. It will then take you to Tailscale where you sign into your account and re-auth your pfsense. This will not change you Tail net Ip of the pfsense.
Again this does not persist after a reboot of the gateway or restarting the Tailscale, but I also don't do that often.
-
Hello everybody, Im on CE 2.8.1
updated in terminal of pfsense with command:
sudo pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.94.1_2.pkg
I had NO PROBLEM, all went well, Ive not been forced to create new API Key
Thanks for keeping us up to date to those, who contribute with Updates of Tailscale and informing our community
-
I'm on 25.11.1.
I updated to 1.94.1_2 via SSH on pfSense, and there were no problems after the update.
service tailscaled stop && tailscale logoutfetch https://pkg.freebsd.org/FreeBSD:16:amd64/latest/All/tailscale-1.94.1_2.pkg || exit 1 && IGNORE_OSVERSION=yes pkg-static add -f tailscale-1.94.1_2.pkg && rm -f tailscale-1.94.1_2.pkg && sysrc tailscaled_enable=“YES” && service tailscaled start && tailscale up && tailscale version && tailscale status -
@CarlMRoss Cool! Strange somehow, that some people had to recreate API key and other not...
-
@TommyMoo said in How to update to the latest Tailscale version?:
@CarlMRoss Cool! Strange somehow, that some people had to recreate API key and other not...
I have at least figured out why mine got annoyed and the key got invalidated. I had been assuming that the uninstall script for the PfSense package for Tailscale (pfsense-pkg-tailscale) would automatically stop the daemon. This is correct, however the way it seems to do it corrupts the configuration somehow (my guess would be the state table getting corrupted but I do not know for certain.)
If I first disable Tailscale in VPN > Tailscale then go and uninstall, update, and reinstall, I can re-enable it the same way I disabled and be perfectly fine. Last time my install corrupted was just over a month ago and I run expiry timers longer than I probably should so the key should not have gone invalid especially since the device is tagged instead of user-authenticated.
Also, @smurph82: your instructions are impeccable but I should note that they will not work for people who use tags on their PfSense node. I have mine tagged because I do not need any of the features that require user auth for Tailscale on PfSense and the act of applying tags to the device strips user auth away.
-
@veddy254 You are correct about the tags. For tags, again I don't use them but you can adjust for your use case would be something like this
tailscale up --force-reauth --accept-routes --advertise-exit-node --advertise-routes=<MY_SUBNET>/24 --advertise-tags=tag:pfsense,tag:serverYo would need to adjust the subnet and tags to your configuration.
-
@veddy254 Nice, you found out why you needed to renew API Key, well done!
-
CAUTION
I had the following error message after upgrading and restarting the daemon. This time I simply typed "tailscale login" and pasted the authentication URL into a browser to re-authenticate. I did not need to generate a new key.
# Health check: # - You are logged out. The last login error was: invalid key: API key does not existUpdated CE 2.8.1 to 1.96.4
pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/latest/All/tailscale-1.96.4.pkg -
Upgraded pfSense to version 26.03 - Tailscale Package version 0.1.9_2 - Package Dependencies: tailscale-1.94.1. Afterward, I only had to restart Tailscale and re-advertise routes. The Tailscale version remained the same as before the pfSense upgrade, 1.94.1_2.
Updated to 1.96.4; no errors.
After the updates, I always have to restart Tailscale and re-advertise routes. -
@elvisimprsntr I had to re-authenticate after the last update (to version 1.94.1_2) and every time the service restarted while on that update but I stopped the tailscale service and logged out of it as described by @CarlMRoss above (service tailscaled stop && tailscale logout) before this update and I didn't have to log back in manually after the update to 1.96.4.
I think the theory up-thread that one of the updates may have corrupted the saved login credentials when done on a running tailscale service may be correct. I'll just keep this extra step as part of the procedure since it seems to have fixed the issue for me.
-
I stopped using the logout command in the last update; as far as I could tell, it does nothing after 'service tailscaled stop'.
At the end of last year, I decided to do a clean restart and, afterward, apply all Tailscale updates and settings changes via SSH. I uninstalled the tailscale package, then deleted all leftover tailscale files and settings. After that, I reinstalled the package and then updated Tailscale via SSH from Freshports. Since then, no errors, no need to generate new keys or re-authenticate.
I always need to re-advertise routes after every update and after the rare pfSense reboot. I have searched for a solution, but none of the suggestions have seemed worth pursuing.
-
tailscale logout is not required to prevent the corruption event. The only thing that is absolutely required is to manually stop the tailscale service, whether by disabling Tailscale in the VPN menu of the Web Configurator or by command-line as @CarlMRoss alluded to. I just tested this myself as my pfSense box was still running 1.94.1 and had no issues.
-
New Tailscale pricing. Positive changes overall
https://tailscale.com/blog/pricing-v4
+Unlimited devices, up to 6 users
-3 ACL groups, 50 tagged resources
?1000 (Temporary) ephemeral resources
