Issues with IPSec when Tailscale package is installed and enabled

[barnettd]

I have a few locations with site to site IPsec tunnels that have been working with no issue. Tailscale was installed on both devices recently to test out different remote access methods. I noticed that after authenticating and enabling tailscale, the IPsec status page fails to load, as well as having issues with specific tunnels going offline, yet others seemed unaffected.

While troubleshooting, I observed the the unaffected tunnel was using an IP address for the remote peer, while the other tunnel with problems was using FQDN for the remote peer. Disabling tailscale allowed the problem tunnel to immediately connect, as well as the ipsec status page to load correctly. Further troublshooting found that disabling "Accept DNS" in the Tailscale settings also appeared to resolve the issue.

Has anyone experienced this? I might be missing something, but I can't think of a reason why I would even need the tailscale DNS on the firewall itself.

[keyser]

@barnettd Tailscale DNS is for your firewalls capability to resolve all client names on your tailnet. It rather usefull in many scenarios ;-)

But several misconfigurations can happen that can cause issues with both tailnet DNS and real net DNS resolution.
Depending on your pfsense config I found the best way to handle “both” DNS scenarios is to make sure your pfSense boks either only uses remote internet DNS (NOT 100.100.100.100), of if you are using forwarder/resolver, then configure them to resolve/forward like you usually would, and then make a conditional forward for your tailnet DNS name (tailxxxxxxx.ts.net -> 100.100.100.100).
If alle your LAN hosts is published and use the tailnet through pfSense that config will make them able to resolve tailclients as well.